Win32:Trojan-gen - en vaan saa putsattua

Discussion in 'Virukset ja haittaohjelmat' started by manymoves, Jul 17, 2008.

Page 1 of 2
  1. manymoves

    manymoves Member

    Joined:
    Apr 5, 2006
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    16
    Moi!

    Mun koneelle pääsi ilmeisesti jonkin msg-linkin kautta ainakin Win32:Trojan-gen -virus ja mitä ilmeisemmin muitakin troijalaisia. Avast ilmoittelee jatkuvasti tästä viruksesta eri lokaatioissa koneella. Olen yrittänyt poistaa sen Avastilla, mutta se ilmeisesti pystyy jotenkin uusimaan itsensä aina, kun käynnistän koneen. Muutaman päivän jo tapellut tämän ongelman kanssa enkä vaan pääse näistä viruksista eroon. Luin jostain SDFix.zip -ohjelman lataamisesta koneelle ja sitä kautta pyrkiä hoitamaan ongelmat pois, mutta kun yritän ladata tuota ohjelmaa ihmisten antamista linkeistä ilmoittaa Avast ohjelman sisältävän viruksen ja katkaisee lataamisen. Eli siitä ei ole mulle apua.

    Joten lopulta tuli mieleen kääntyä teidän puoleen ja toivoa, että joku keksisi jonkin ratkaisun tähän hätään.

    HJT-logi, kun sitä varmaankin kaipaillaan:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:50:48, on 18.7.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\SysMonitor.exe
    C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
    C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\WINDOWS\eHome\ehSched.exe
    c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\HPZipm12.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Opera\Opera.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
    C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ycomp/defaults/sp/*http://uk.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fi.intl.acer.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O1 - Hosts: 108.112.42.206 ad.doubleclick.net
    O1 - Hosts: 184.169.44.29 upgrade.bitdefender.com
    O1 - Hosts: 106.62.59.13 report.bitdefender.com
    O1 - Hosts: 178.95.95.213 ad.fastclick.net
    O1 - Hosts: 107.116.117.138 ads.fastclick.net
    O1 - Hosts: 174.15.27.94 ar.atwola.com
    O1 - Hosts: 115.27.183.221 atdmt.com
    O1 - Hosts: 183.97.110.57 avp.ch
    O1 - Hosts: 114.153.7.176 avp.com
    O1 - Hosts: 179.51.181.210 avp.ru
    O1 - Hosts: 108.15.197.227 awaps.net
    O1 - Hosts: 180.66.164.240 banner.fastclick.net
    O1 - Hosts: 112.56.109.230 banners.fastclick.net
    O1 - Hosts: 177.137.61.67 ca.com
    O1 - Hosts: 111.18.29.102 www.ca.com
    O1 - Hosts: 180.140.140.115 click.atdmt.com
    O1 - Hosts: 104.148.31.185 clicks.atdmt.com
    O1 - Hosts: 100.96.64.129 dispatch.mcafee.com
    O1 - Hosts: 183.2.101.136 download.mcafee.com
    O1 - Hosts: 104.210.98.148 download.microsoft.com
    O1 - Hosts: 181.159.189.68 downloads.microsoft.com
    O1 - Hosts: 112.218.150.78 downloads-eu1.kaspersky-labs.com
    O1 - Hosts: 181.65.170.225 downloads-eu2.kaspersky-labs.com
    O1 - Hosts: 115.202.138.212 downloads-eu3.kaspersky-labs.com
    O1 - Hosts: 185.37.50.218 downloads-us1.kaspersky-labs.com
    O1 - Hosts: 109.114.81.80 downloads-us2.kaspersky-labs.com
    O1 - Hosts: 180.183.191.200 downloads-us3.kaspersky-labs.com
    O1 - Hosts: 111.63.81.72 downloads1.kaspersky-labs.com
    O1 - Hosts: 187.45.123.197 downloads2.kaspersky-labs.com
    O1 - Hosts: 102.48.18.192 downloads3.kaspersky-labs.com
    O1 - Hosts: 180.188.144.114 downloads4.kaspersky-labs.com
    O1 - Hosts: 111.57.62.146 engine.awaps.net
    O1 - Hosts: 179.113.96.3 f-secure.com
    O1 - Hosts: 100.178.73.135 fastclick.net
    O1 - Hosts: 182.38.71.88 ftp.avp.ch
    O1 - Hosts: 107.152.141.111 ftp.downloads2.kaspersky-labs.com
    O1 - Hosts: 186.39.46.12 ftp.f-secure.com
    O1 - Hosts: 106.65.181.226 ftp.kasperskylab.ru
    O1 - Hosts: 174.100.75.218 ftp.sophos.com
    O1 - Hosts: 111.138.97.30 go.microsoft.com
    O1 - Hosts: 174.194.28.31 ids.kaspersky-labs.com
    O1 - Hosts: 110.101.147.64 kaspersky-labs.com
    O1 - Hosts: 182.218.134.18 kaspersky.com
    O1 - Hosts: 115.84.151.31 mast.mcafee.com
    O1 - Hosts: 185.0.220.131 mcafee.com
    O1 - Hosts: 109.92.142.185 media.fastclick.net
    O1 - Hosts: 176.171.191.233 msdn.microsoft.com
    O1 - Hosts: 103.113.37.211 my-etrust.com
    O1 - Hosts: 180.172.202.29 nai.com
    O1 - Hosts: 115.89.143.98 networkassociates.com
    O1 - Hosts: 174.46.37.27 office.microsoft.com
    O1 - Hosts: 109.188.51.100 phx.corporate-ir.net
    O1 - Hosts: 185.45.204.116 rads.mcafee.com
    O1 - Hosts: 109.120.41.223 secure.nai.com
    O1 - Hosts: 183.50.26.181 sophos.com
    O1 - Hosts: 109.170.21.186 spd.atdmt.com
    O1 - Hosts: 187.58.188.136 support.microsoft.com
    O1 - Hosts: 176.188.88.223 trendmicro.com
    O1 - Hosts: 108.110.33.59 updates1.kaspersky-labs.com
    O1 - Hosts: 183.59.213.85 updates2.kaspersky-labs.com
    O1 - Hosts: 100.8.14.248 updates3.kaspersky-labs.com
    O1 - Hosts: 177.203.115.101 updates4.kaspersky-labs.com
    O1 - Hosts: 115.99.75.57 updates5.kaspersky-labs.com
    O1 - Hosts: 177.164.21.164 us.mcafee.com
    O1 - Hosts: 104.191.68.232 vil.nai.com
    O1 - Hosts: 178.104.12.229 viruslist.com
    O1 - Hosts: 115.45.29.170 viruslist.ru
    O1 - Hosts: 180.17.225.124 windowsupdate.microsoft.com
    O1 - Hosts: 101.14.104.106 www.avp.ch
    O1 - Hosts: 187.220.183.234 www.avp.com
    O1 - Hosts: 106.32.32.175 www.avp.ru
    O1 - Hosts: 186.54.74.45 www.awaps.net
    O1 - Hosts: 101.143.19.123 www.ca.com
    O1 - Hosts: 174.32.86.13 www.f-secure.com
    O1 - Hosts: 105.116.161.207 www.fastclick.net
    O1 - Hosts: 181.161.67.179 www.grisoft.com
    O1 - Hosts: 112.172.26.189 www.kaspersky-labs.com
    O1 - Hosts: 184.209.149.39 www.kaspersky.com
    O1 - Hosts: 101.182.189.240 www.kaspersky.ru
    O1 - Hosts: 173.37.26.35 www.mcafee.com
    O1 - Hosts: 112.46.139.229 www.my-etrust.com
    O1 - Hosts: 178.225.214.176 www.nai.com
    O1 - Hosts: 108.150.114.26 www.networkassociates.com
    O1 - Hosts: 178.182.181.42 www.sophos.com
    O1 - Hosts: 185.128.102.236 www.trendmicro.com
    O1 - Hosts: 106.65.196.108 www.viruslist.com
    O1 - Hosts: 179.223.125.67 www.viruslist.ru
    O1 - Hosts: 103.38.35.138 www3.ca.com
    O1 - Hosts: 175.24.52.173 avp.ch
    O1 - Hosts: 112.167.176.41 avp.com
    O1 - Hosts: 181.132.72.29 avp.ru
    O1 - Hosts: 108.51.94.92 awaps.net
    O1 - Hosts: 184.196.64.44 f-secure.com
    O1 - Hosts: 102.35.134.158 fastclick.net
    O1 - Hosts: 175.33.199.87 grisoft.com
    O1 - Hosts: 105.9.199.125 kaspersky-labs.com
    O1 - Hosts: 175.26.38.236 kaspersky.com
    O1 - Hosts: 113.214.19.103 kaspersky.ru
    O1 - Hosts: 181.92.116.12 mcafee.com
    O1 - Hosts: 110.211.91.110 my-etrust.com
    O1 - Hosts: 185.156.136.247 nai.com
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: wssclient - {8D99D2A3-317C-4929-8A5D-21140259D93A} - c:\PROGRA~1\wss.dll (file missing)
    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
    O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Acer Empowering Technology.lnk = ?
    O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
    O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 13692 bytes
     
    manymoves, Jul 17, 2008
    #1
  2. manymoves

    manymoves Member

    Joined:
    Apr 5, 2006
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    16
    HJT muuten ilmoitti heti ensitöikseen, että "You have a particularly large amount of hijacked domains.]/i]"... Ei näytä hyvältä.
     
    manymoves, Jul 17, 2008
    #2
  3. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Herranen aika sentään...

    Fixaa seuraavat rivit HJT:llä

    O1 - Hosts: 108.112.42.206 ad.doubleclick.net
    O1 - Hosts: 184.169.44.29 upgrade.bitdefender.com
    O1 - Hosts: 106.62.59.13 report.bitdefender.com
    O1 - Hosts: 178.95.95.213 ad.fastclick.net
    O1 - Hosts: 107.116.117.138 ads.fastclick.net
    O1 - Hosts: 174.15.27.94 ar.atwola.com
    O1 - Hosts: 115.27.183.221 atdmt.com
    O1 - Hosts: 183.97.110.57 avp.ch
    O1 - Hosts: 114.153.7.176 avp.com
    O1 - Hosts: 179.51.181.210 avp.ru
    O1 - Hosts: 108.15.197.227 awaps.net
    O1 - Hosts: 180.66.164.240 banner.fastclick.net
    O1 - Hosts: 112.56.109.230 banners.fastclick.net
    O1 - Hosts: 177.137.61.67 ca.com
    O1 - Hosts: 111.18.29.102 www.ca.com
    O1 - Hosts: 180.140.140.115 click.atdmt.com
    O1 - Hosts: 104.148.31.185 clicks.atdmt.com
    O1 - Hosts: 100.96.64.129 dispatch.mcafee.com
    O1 - Hosts: 183.2.101.136 download.mcafee.com
    O1 - Hosts: 104.210.98.148 download.microsoft.com
    O1 - Hosts: 181.159.189.68 downloads.microsoft.com
    O1 - Hosts: 112.218.150.78 downloads-eu1.kaspersky-labs.com
    O1 - Hosts: 181.65.170.225 downloads-eu2.kaspersky-labs.com
    O1 - Hosts: 115.202.138.212 downloads-eu3.kaspersky-labs.com
    O1 - Hosts: 185.37.50.218 downloads-us1.kaspersky-labs.com
    O1 - Hosts: 109.114.81.80 downloads-us2.kaspersky-labs.com
    O1 - Hosts: 180.183.191.200 downloads-us3.kaspersky-labs.com
    O1 - Hosts: 111.63.81.72 downloads1.kaspersky-labs.com
    O1 - Hosts: 187.45.123.197 downloads2.kaspersky-labs.com
    O1 - Hosts: 102.48.18.192 downloads3.kaspersky-labs.com
    O1 - Hosts: 180.188.144.114 downloads4.kaspersky-labs.com
    O1 - Hosts: 111.57.62.146 engine.awaps.net
    O1 - Hosts: 179.113.96.3 f-secure.com
    O1 - Hosts: 100.178.73.135 fastclick.net
    O1 - Hosts: 182.38.71.88 ftp.avp.ch
    O1 - Hosts: 107.152.141.111 ftp.downloads2.kaspersky-labs.com
    O1 - Hosts: 186.39.46.12 ftp.f-secure.com
    O1 - Hosts: 106.65.181.226 ftp.kasperskylab.ru
    O1 - Hosts: 174.100.75.218 ftp.sophos.com
    O1 - Hosts: 111.138.97.30 go.microsoft.com
    O1 - Hosts: 174.194.28.31 ids.kaspersky-labs.com
    O1 - Hosts: 110.101.147.64 kaspersky-labs.com
    O1 - Hosts: 182.218.134.18 kaspersky.com
    O1 - Hosts: 115.84.151.31 mast.mcafee.com
    O1 - Hosts: 185.0.220.131 mcafee.com
    O1 - Hosts: 109.92.142.185 media.fastclick.net
    O1 - Hosts: 176.171.191.233 msdn.microsoft.com
    O1 - Hosts: 103.113.37.211 my-etrust.com
    O1 - Hosts: 180.172.202.29 nai.com
    O1 - Hosts: 115.89.143.98 networkassociates.com
    O1 - Hosts: 174.46.37.27 office.microsoft.com
    O1 - Hosts: 109.188.51.100 phx.corporate-ir.net
    O1 - Hosts: 185.45.204.116 rads.mcafee.com
    O1 - Hosts: 109.120.41.223 secure.nai.com
    O1 - Hosts: 183.50.26.181 sophos.com
    O1 - Hosts: 109.170.21.186 spd.atdmt.com
    O1 - Hosts: 187.58.188.136 support.microsoft.com
    O1 - Hosts: 176.188.88.223 trendmicro.com
    O1 - Hosts: 108.110.33.59 updates1.kaspersky-labs.com
    O1 - Hosts: 183.59.213.85 updates2.kaspersky-labs.com
    O1 - Hosts: 100.8.14.248 updates3.kaspersky-labs.com
    O1 - Hosts: 177.203.115.101 updates4.kaspersky-labs.com
    O1 - Hosts: 115.99.75.57 updates5.kaspersky-labs.com
    O1 - Hosts: 177.164.21.164 us.mcafee.com
    O1 - Hosts: 104.191.68.232 vil.nai.com
    O1 - Hosts: 178.104.12.229 viruslist.com
    O1 - Hosts: 115.45.29.170 viruslist.ru
    O1 - Hosts: 180.17.225.124 windowsupdate.microsoft.com
    O1 - Hosts: 101.14.104.106 www.avp.ch
    O1 - Hosts: 187.220.183.234 www.avp.com
    O1 - Hosts: 106.32.32.175 www.avp.ru
    O1 - Hosts: 186.54.74.45 www.awaps.net
    O1 - Hosts: 101.143.19.123 www.ca.com
    O1 - Hosts: 174.32.86.13 www.f-secure.com
    O1 - Hosts: 105.116.161.207 www.fastclick.net
    O1 - Hosts: 181.161.67.179 www.grisoft.com
    O1 - Hosts: 112.172.26.189 www.kaspersky-labs.com
    O1 - Hosts: 184.209.149.39 www.kaspersky.com
    O1 - Hosts: 101.182.189.240 www.kaspersky.ru
    O1 - Hosts: 173.37.26.35 www.mcafee.com
    O1 - Hosts: 112.46.139.229 www.my-etrust.com
    O1 - Hosts: 178.225.214.176 www.nai.com
    O1 - Hosts: 108.150.114.26 www.networkassociates.com
    O1 - Hosts: 178.182.181.42 www.sophos.com
    O1 - Hosts: 185.128.102.236 www.trendmicro.com
    O1 - Hosts: 106.65.196.108 www.viruslist.com
    O1 - Hosts: 179.223.125.67 www.viruslist.ru
    O1 - Hosts: 103.38.35.138 www3.ca.com
    O1 - Hosts: 175.24.52.173 avp.ch
    O1 - Hosts: 112.167.176.41 avp.com
    O1 - Hosts: 181.132.72.29 avp.ru
    O1 - Hosts: 108.51.94.92 awaps.net
    O1 - Hosts: 184.196.64.44 f-secure.com
    O1 - Hosts: 102.35.134.158 fastclick.net
    O1 - Hosts: 175.33.199.87 grisoft.com
    O1 - Hosts: 105.9.199.125 kaspersky-labs.com
    O1 - Hosts: 175.26.38.236 kaspersky.com
    O1 - Hosts: 113.214.19.103 kaspersky.ru
    O1 - Hosts: 181.92.116.12 mcafee.com
    O1 - Hosts: 110.211.91.110 my-etrust.com
    O1 - Hosts: 185.156.136.247 nai.com

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    * Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    * Lopuksi varmistu, että seuraavat on valittu: Päivitä Malwarebytes' Anti-Malware ja Käynnistä Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Lopeta.
    * Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    * Kun ohjelma on latautunut, valitse Suorita täysi tarkistus ja klikkaa Tarkista.
    * Kun skanni on valmis, klikkaa OK ja sitten Näytä tulokset nähdäksesi tulokset.
    * Varmistu, että kaikki on merkitty ja klikkaa Poista valitut.
    * Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös
    täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    * Lähetä lokin sisältö seuraavassa viestissäsi + uusi hjt-loki.

    Lähetä myös alla olevan HOSTS tiedoston sisältö
    C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS
    avaa HOSTS notepadilla ja Copy & Pastee sisältö tänne.
     
    Last edited: Jul 18, 2008
    yaht, Jul 18, 2008
    #3
  4. manymoves

    manymoves Member

    Joined:
    Apr 5, 2006
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    16
    No niin, kiitoksia vinkeistä! Niitä noudattamalla ollaan nyt tässä pisteessä:



    HOSTS-tiedoston sisältö:


    # Copyright (c) 1993-1999 Microsoft Corp.
    #
    # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
    #
    # This file contains the mappings of IP addresses to host names. Each
    # entry should be kept on an individual line. The IP address should
    # be placed in the first column followed by the corresponding host name.
    # The IP address and the host name should be separated by at least one
    # space.
    #
    # Additionally, comments (such as these) may be inserted on individual
    # lines or following the machine name denoted by a '#' symbol.
    #
    # For example:
    #
    # 102.54.94.97 rhino.acme.com # source server
    # 38.25.63.10 x.acme.com # x client host

    127.0.0.1 localhost
    113.44.133.254 networkassociates.com
    178.106.76.170 sophos.com
    178.73.132.50 trendmicro.com
    104.152.134.206 viruslist.com
    174.25.193.182 viruslist.ru
    100.58.33.218 www3.ca.com
    102.158.3.18 akamai.net
    179.147.199.183 www.antivir.de
    105.108.119.104 antivir.de
    181.87.27.164 drweb.com
    110.60.112.152 www.drweb.com
    173.72.89.247 drweb.ru
    111.44.59.160 www.ravantivirus.com
    177.51.6.174 ravantivirus.com
    105.20.84.201 bitdefender.com
    184.57.115.18 www.bitdefender.com
    111.9.106.84 www.clamav.net
    179.134.219.18 clamav.net
    113.105.150.225 pandasoftware.com
    184.14.192.135 www.pandasoftware.com
    104.26.34.150 ftpav.ca.com
    178.40.61.175 upgrade.bitdefender.com
    104.145.107.4 www.bitdefender.ru
    186.223.18.161 bitdefender.ru
    100.125.216.116 open.by
    175.210.118.4 vba32.de
    106.43.202.48 www.open.by
    187.158.9.42 lavasoft.com
    176.168.161.132 rs01.avast.com
    113.196.23.53 sm01.avast.com
    173.85.201.82 rs02.avast.com
    100.83.75.234 sm02.avast.com
    178.94.124.98 rs03.avast.com
    115.115.189.31 sm03.avast.com
    179.82.30.213 rs04.avast.com
    108.6.5.208 sm04.avast.com
    184.166.75.163 rs05.avast.com
    109.98.190.168 sm05.avast.com
    185.166.221.212 rs06.avast.com
    101.71.169.118 sm06.avast.com
    183.68.192.179 rs07.avast.com
    113.156.186.65 sm07.avast.com
    173.216.20.157 rs08.avast.com
    115.25.97.195 sm08.avast.com
    185.172.91.117 rs09.avast.com
    103.56.26.4 sm09.avast.com
    187.21.191.24 rs10.avast.com
    106.135.126.37 sm10.avast.com
    186.92.191.182 rs11.avast.com
    101.151.218.40 sm11.avast.com
    182.12.173.157 rs12.avast.com
    102.44.86.6 sm12.avast.com
    187.177.109.41 rs13.avast.com
    100.135.39.7 sm13.avast.com
    183.4.26.28 rs14.avast.com
    109.152.56.132 sm14.avast.com
    174.22.52.47 rs15.avast.com
    112.44.76.101 sm15.avast.com
    176.24.2.108 rs16.avast.com
    104.88.100.68 sm16.avast.com
    175.209.96.55 rs17.avast.com
    108.136.54.58 sm17.avast.com
    182.81.75.62 rs18.avast.com
    100.132.172.31 sm18.avast.com
    183.224.68.115 rs19.avast.com
    103.144.191.113 sm19.avast.com
    184.193.195.14 rs20.avast.com
    103.69.72.110 sm20.avast.com
    176.169.145.194 rs21.avast.com
    105.200.223.248 sm21.avast.com
    176.72.49.72 rs22.avast.com
    105.200.136.24 sm22.avast.com
    184.106.33.253 rs23.avast.com
    112.106.95.4 sm23.avast.com
    176.15.175.146 rs24.avast.com
    115.172.124.52 sm24.avast.com
    174.173.108.253 rs25.avast.com
    111.199.132.183 sm25.avast.com
    181.141.199.236 rs26.avast.com
    108.110.4.67 sm26.avast.com
    187.38.57.188 rs27.avast.com
    110.153.170.218 sm27.avast.com
    184.120.97.180 rs28.avast.com
    104.221.204.97 sm28.avast.com
    184.87.84.126 rs29.avast.com
    113.158.156.12 sm29.avast.com
    175.137.116.58 rs30.avast.com
    106.89.171.42 sm30.avast.com
    181.63.155.14 downloadhosting.core.ignum.cz
    108.171.61.165 download25.avast.com
    180.78.122.242 www.avast.com
    105.94.46.61 avast.com
    177.128.188.27 avira.com
    104.119.33.105 www.avira.com
    100.89.152.164 zak.avira.com
    183.81.157.57 downloads.avira.com
    101.219.196.161 www.clamwin.com
    177.93.131.172 clamwin.com
    113.178.206.30 213.219.245.4
    178.169.49.160 files.referats.net
    104.83.9.105 database.clamav.net
    173.153.208.24 213.248.60.121
    101.135.166.191 gin.ba.euroweb.sk
    187.98.219.21 www2.eset.com
    106.190.161.183 esetsoftware.com
    176.66.89.23 msk4.drweb.com
    101.69.45.112 drweb.com
    173.95.15.84 www.drweb.com
    112.24.167.210 62.146.66.181
    104.147.137.57 www.hbedv.com
    174.131.68.125 hbedv.com
    106.3.47.173 www.hacksoft.com.pe
    177.137.173.100 ikarus-software.at
    114.219.187.247 download.ikarus.at
    178.202.68.47 193.69.114.12
    100.9.1.202 niutwo.norman.no
    183.208.148.247 www.anti-virus.by
    109.60.43.169 anti-virus.by
    185.112.35.70 www.vba32.de
    108.83.215.209 ftpav.ca.com

     
    manymoves, Jul 18, 2008
    #4
  5. manymoves

    manymoves Member

    Joined:
    Apr 5, 2006
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    16
    HJT-logi (joka muuten ilmoitti taas ton saman, että on erityisen paljon kaapattuja domaineja):


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:40:55, on 18.7.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\SysMonitor.exe
    C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
    C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\a-squared Free\a2service.exe
    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\HPZipm12.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Opera\Opera.exe
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ycomp/defaults/sp/*http://uk.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fi.intl.acer.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O1 - Hosts: 113.44.133.254 networkassociates.com
    O1 - Hosts: 178.106.76.170 sophos.com
    O1 - Hosts: 178.73.132.50 trendmicro.com
    O1 - Hosts: 104.152.134.206 viruslist.com
    O1 - Hosts: 174.25.193.182 viruslist.ru
    O1 - Hosts: 100.58.33.218 www3.ca.com
    O1 - Hosts: 102.158.3.18 akamai.net
    O1 - Hosts: 179.147.199.183 www.antivir.de
    O1 - Hosts: 105.108.119.104 antivir.de
    O1 - Hosts: 181.87.27.164 drweb.com
    O1 - Hosts: 110.60.112.152 www.drweb.com
    O1 - Hosts: 173.72.89.247 drweb.ru
    O1 - Hosts: 111.44.59.160 www.ravantivirus.com
    O1 - Hosts: 177.51.6.174 ravantivirus.com
    O1 - Hosts: 105.20.84.201 bitdefender.com
    O1 - Hosts: 184.57.115.18 www.bitdefender.com
    O1 - Hosts: 111.9.106.84 www.clamav.net
    O1 - Hosts: 179.134.219.18 clamav.net
    O1 - Hosts: 113.105.150.225 pandasoftware.com
    O1 - Hosts: 184.14.192.135 www.pandasoftware.com
    O1 - Hosts: 104.26.34.150 ftpav.ca.com
    O1 - Hosts: 178.40.61.175 upgrade.bitdefender.com
    O1 - Hosts: 104.145.107.4 www.bitdefender.ru
    O1 - Hosts: 186.223.18.161 bitdefender.ru
    O1 - Hosts: 100.125.216.116 open.by
    O1 - Hosts: 175.210.118.4 vba32.de
    O1 - Hosts: 106.43.202.48 www.open.by
    O1 - Hosts: 187.158.9.42 lavasoft.com
    O1 - Hosts: 176.168.161.132 rs01.avast.com
    O1 - Hosts: 113.196.23.53 sm01.avast.com
    O1 - Hosts: 173.85.201.82 rs02.avast.com
    O1 - Hosts: 100.83.75.234 sm02.avast.com
    O1 - Hosts: 178.94.124.98 rs03.avast.com
    O1 - Hosts: 115.115.189.31 sm03.avast.com
    O1 - Hosts: 179.82.30.213 rs04.avast.com
    O1 - Hosts: 108.6.5.208 sm04.avast.com
    O1 - Hosts: 184.166.75.163 rs05.avast.com
    O1 - Hosts: 109.98.190.168 sm05.avast.com
    O1 - Hosts: 185.166.221.212 rs06.avast.com
    O1 - Hosts: 101.71.169.118 sm06.avast.com
    O1 - Hosts: 183.68.192.179 rs07.avast.com
    O1 - Hosts: 113.156.186.65 sm07.avast.com
    O1 - Hosts: 173.216.20.157 rs08.avast.com
    O1 - Hosts: 115.25.97.195 sm08.avast.com
    O1 - Hosts: 185.172.91.117 rs09.avast.com
    O1 - Hosts: 103.56.26.4 sm09.avast.com
    O1 - Hosts: 187.21.191.24 rs10.avast.com
    O1 - Hosts: 106.135.126.37 sm10.avast.com
    O1 - Hosts: 186.92.191.182 rs11.avast.com
    O1 - Hosts: 101.151.218.40 sm11.avast.com
    O1 - Hosts: 182.12.173.157 rs12.avast.com
    O1 - Hosts: 102.44.86.6 sm12.avast.com
    O1 - Hosts: 187.177.109.41 rs13.avast.com
    O1 - Hosts: 100.135.39.7 sm13.avast.com
    O1 - Hosts: 183.4.26.28 rs14.avast.com
    O1 - Hosts: 109.152.56.132 sm14.avast.com
    O1 - Hosts: 174.22.52.47 rs15.avast.com
    O1 - Hosts: 112.44.76.101 sm15.avast.com
    O1 - Hosts: 176.24.2.108 rs16.avast.com
    O1 - Hosts: 104.88.100.68 sm16.avast.com
    O1 - Hosts: 175.209.96.55 rs17.avast.com
    O1 - Hosts: 108.136.54.58 sm17.avast.com
    O1 - Hosts: 182.81.75.62 rs18.avast.com
    O1 - Hosts: 100.132.172.31 sm18.avast.com
    O1 - Hosts: 183.224.68.115 rs19.avast.com
    O1 - Hosts: 103.144.191.113 sm19.avast.com
    O1 - Hosts: 184.193.195.14 rs20.avast.com
    O1 - Hosts: 103.69.72.110 sm20.avast.com
    O1 - Hosts: 176.169.145.194 rs21.avast.com
    O1 - Hosts: 105.200.223.248 sm21.avast.com
    O1 - Hosts: 176.72.49.72 rs22.avast.com
    O1 - Hosts: 105.200.136.24 sm22.avast.com
    O1 - Hosts: 184.106.33.253 rs23.avast.com
    O1 - Hosts: 112.106.95.4 sm23.avast.com
    O1 - Hosts: 176.15.175.146 rs24.avast.com
    O1 - Hosts: 115.172.124.52 sm24.avast.com
    O1 - Hosts: 174.173.108.253 rs25.avast.com
    O1 - Hosts: 111.199.132.183 sm25.avast.com
    O1 - Hosts: 181.141.199.236 rs26.avast.com
    O1 - Hosts: 108.110.4.67 sm26.avast.com
    O1 - Hosts: 187.38.57.188 rs27.avast.com
    O1 - Hosts: 110.153.170.218 sm27.avast.com
    O1 - Hosts: 184.120.97.180 rs28.avast.com
    O1 - Hosts: 104.221.204.97 sm28.avast.com
    O1 - Hosts: 184.87.84.126 rs29.avast.com
    O1 - Hosts: 113.158.156.12 sm29.avast.com
    O1 - Hosts: 175.137.116.58 rs30.avast.com
    O1 - Hosts: 106.89.171.42 sm30.avast.com
    O1 - Hosts: 181.63.155.14 downloadhosting.core.ignum.cz
    O1 - Hosts: 108.171.61.165 download25.avast.com
    O1 - Hosts: 180.78.122.242 www.avast.com
    O1 - Hosts: 105.94.46.61 avast.com
    O1 - Hosts: 177.128.188.27 avira.com
    O1 - Hosts: 104.119.33.105 www.avira.com
    O1 - Hosts: 100.89.152.164 zak.avira.com
    O1 - Hosts: 183.81.157.57 downloads.avira.com
    O1 - Hosts: 101.219.196.161 www.clamwin.com
    O1 - Hosts: 177.93.131.172 clamwin.com
    O1 - Hosts: 113.178.206.30 213.219.245.4
    O1 - Hosts: 178.169.49.160 files.referats.net
    O1 - Hosts: 104.83.9.105 database.clamav.net
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: wssclient - {8D99D2A3-317C-4929-8A5D-21140259D93A} - c:\PROGRA~1\wss.dll (file missing)
    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
    O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Acer Empowering Technology.lnk = ?
    O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
    O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 13518 bytes
     
    manymoves, Jul 18, 2008
    #5
  6. manymoves

    manymoves Member

    Joined:
    Apr 5, 2006
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    16
    Ja tässä vielä Malware-logi (G-asema on mun kameran muistikortti jonne näköjään myös oli eksynyt virus):



    Malwarebytes' Anti-Malware 1.20
    Tietokantaversio: 964
    Windows 5.1.2600 Service Pack 2

    19:35:53 18.7.2008
    mbam-log-7-18-2008 (19-35-53).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|)
    Tarkistetut kohteet: 123940
    Kulunut aika: 1 hour(s), 0 minute(s), 50 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 1
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 1

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    G:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
     
    manymoves, Jul 18, 2008
    #6
  7. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Jep eivät lähteneet ajetaan nyt vaikka combofixi.

    1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä:
    Combofix.exe
    Combofix.exe

    Avaa Combofix.exe ja seuraa näyttöön tulevia ohjeita

    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
    Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.

    Tyhjennä roskakori ja käynnistä koneesi uudelleen.

    Postita tänne seuraavat lokit:
    * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
    * (C:\ComboFix.txt) raportti
    *

    Sitten toinen ohjelma

    Lataa alla olevasta linkistä.
    http://www.funkytoad.com/download/HostsXpert.zip

    Pura esim C:/host
    Aja HostsXpert.exe puretusta kansiosta
    Paina Make Hosts Writable?
    Paina Restore Microsoft's Hosts File sitten ok
    nyt voit sammuttaa ohjelman.
     
    Last edited: Jul 19, 2008
    yaht, Jul 19, 2008
    #7
  8. manymoves

    manymoves Member

    Joined:
    Apr 5, 2006
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    16
    Uutta HJT-logia tässä (nyt ei muuten enää ilmoitellut kaapatuista domaineista):



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:41:43, on 19.7.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\SysMonitor.exe
    C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
    C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\a-squared Free\a2service.exe
    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\HPZipm12.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Opera\Opera.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
    O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Acer Empowering Technology.lnk = ?
    O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
    O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 8987 bytes
     
    manymoves, Jul 19, 2008
    #8
  9. manymoves

    manymoves Member

    Joined:
    Apr 5, 2006
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    16
    Ja Combofix-logi:



    ComboFix 08-07-18.5 - E K 2008-07-19 19:23:29.1 - NTFSx86
    Running from: C:\Documents and Settings\E K\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2008-06-19 to 2008-07-19 )))))))))))))))))))))))))))))))
    .

    2008-07-18 18:32 . 2008-07-18 18:32 <KANSIO> d-------- C:\Documents and Settings\E K\Application Data\Malwarebytes
    2008-07-18 18:31 . 2008-07-18 18:32 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-07-18 18:31 . 2008-07-18 18:31 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-07-18 18:31 . 2008-07-18 18:31 1,774,048 --a------ C:\Program Files\mbam-setup.exe
    2008-07-18 18:31 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-07-18 18:31 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-07-18 05:14 . 2008-07-18 06:41 <KANSIO> d-------- C:\Program Files\a-squared Free
    2008-07-18 05:13 . 2008-07-18 05:13 <KANSIO> d-------- C:\Program Files\CCleaner
    2008-07-18 05:12 . 2008-07-18 05:12 <KANSIO> d-------- C:\Program Files\ccleaner_2.09.600
    2008-07-18 05:10 . 2008-07-18 05:11 2,884,274 --a------ C:\Program Files\ccleaner_2.09.600.zip
    2008-07-18 05:08 . 2008-07-18 05:12 28,511,688 --a------ C:\Program Files\a2FreeSetup_v3.5.0.25.exe
    2008-07-18 04:49 . 2008-07-18 04:49 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-07-18 04:49 . 2008-07-18 04:49 <KANSIO> d-------- C:\Program Files\hijackthis_v2.0.2
    2008-07-18 04:49 . 2008-07-18 04:49 499,568 --a------ C:\Program Files\hijackthis_v2.0.2.zip
    2008-07-18 04:37 . 2008-07-18 04:37 1,077,632 --a------ C:\Program Files\RegCureSetup_1501_RW.exe
    2008-07-18 03:35 . 2008-07-18 03:35 394,928 --a------ C:\Program Files\spywarefighter.exe
    2008-07-17 02:26 . 2008-07-17 02:26 <KANSIO> d-------- C:\Program Files\Alwil Software
    2008-07-17 02:24 . 2008-05-19 23:22 23,047,784 --a------ C:\Program Files\setupeng.exe
    2008-07-02 20:39 . 2008-07-16 03:12 <KANSIO> d-------- C:\Program Files\PeerGuardian2
    2008-07-02 20:38 . 2008-07-02 20:38 882,489 --a------ C:\Program Files\pg2-050918-nt.exe
    2008-07-02 20:33 . 2008-07-02 20:33 1,119,484 --a------ C:\Program Files\pg2-050918-x64.exe
    2008-06-25 05:35 . 2008-07-14 03:06 318,904 --a------ C:\Program Files\wmpfirefoxplugin.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-07-19 01:38 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-07-18 02:08 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-07-17 00:24 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-07-17 00:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-07-16 23:22 --------- d-----w C:\Program Files\Symantec
    2008-07-15 21:15 --------- d-----w C:\Documents and Settings\E K\Application Data\uTorrent
    2008-07-14 21:37 --------- d-----w C:\Program Files\DC++
    2008-07-14 18:37 120 ----a-w C:\drmHeader.bin
    2008-07-13 18:31 --------- d-----w C:\Program Files\Winamp
    2008-07-11 22:23 --------- d-----w C:\Program Files\Soulseek
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-06-17 12:33 --------- d-----w C:\Program Files\Last.fm
    2008-06-15 12:46 1,495,112 ----a-w C:\Program Files\install_flash_player.exe
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
    2008-06-07 18:40 --------- d-----w C:\Program Files\DVDVideoSoft
    2008-06-07 18:40 --------- d-----w C:\Program Files\Common Files\DVDVideoSoft
    2008-06-07 18:39 5,858,085 ----a-w C:\Program Files\FreeYouTubeToMP3Converter.exe
    2008-05-07 04:55 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-04-21 06:56 666,624 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-03-28 04:14 1,435,224 ----a-w C:\Program Files\TMPGEnc-2.524.63.181-Free.zip
    2008-02-28 15:22 13,325,832 ----a-w C:\Program Files\RealPlayer11GOLD.exe
    2008-02-10 17:15 31,768,752 ----a-w C:\Program Files\avg75free_516a1225.exe
    2008-02-01 21:47 22,766,896 ----a-w C:\Program Files\QuickTime740Installer.exe
    2007-11-21 20:36 2,889,848 ----a-w C:\Program Files\TvantsSetup for Myp2p.eu.EXE
    2007-11-21 16:35 1,283,624 ----a-w C:\Program Files\octosetup_v_l_odd.exe
    2007-09-08 14:13 2,246,355 ----a-w C:\Program Files\SopCast%201.1.2%20by%20Myp2p.eu.zip
    2007-09-01 20:20 888 ----a-w C:\Program Files\cross.gif
    2007-08-29 21:53 280,227 ----a-w C:\Program Files\FreeMPC.jar
    2007-08-27 15:20 842,672 ----a-w C:\Program Files\slsk156c.exe
    2007-08-04 22:38 3,178,368 ----a-w C:\Program Files\FastlabPhotoService.ENG.exe
    2007-07-24 16:07 5,272,405 ----a-w C:\Program Files\avi-mpeg-converter.exe
    2007-07-24 15:57 1,026,026 ----a-w C:\Program Files\VirtualDub-1.6.19.zip
    2007-06-13 14:57 2,528,098 ----a-w C:\Program Files\emule048a.exe
    2007-06-03 23:48 4,850,920 -c--a-w C:\Program Files\aawsepersonal.exe
    2007-06-03 23:47 922,985 ----a-w C:\Program Files\internet-eraser-setup.exe
    2007-05-06 20:51 2,037,802 -c--a-w C:\Program Files\privacy-eraser-pro-setup.exe
    2007-04-16 09:46 4,129,768 -c--a-w C:\Program Files\DCPlusPlus-0.699.exe
    2007-04-15 20:49 9,228,440 -c--a-w C:\Program Files\spf.exe
    2007-03-14 20:57 17,840,496 -c--a-w C:\Program Files\Install_Messenger.exe
    2007-03-14 20:50 415,784 -c--a-w C:\Program Files\msgr8us.exe
    2007-02-15 17:52 3,782,589 -c--a-w C:\Program Files\LastFM_Win_1.1.3.0.exe
    2007-02-09 00:09 3,499,729 -c--a-w C:\Program Files\ffdshow_rev610_20061201_clsid.exe
    2007-02-06 14:56 14,705,768 -c--a-w C:\Program Files\DivXInstaller.exe
    2007-02-04 23:23 9,453,630 -c--a-w C:\Program Files\vlc-0.8.6a-win32.exe
    2007-01-29 15:59 23,717,831 -c--a-w C:\Program Files\ACDSee.v9.0.Photo.Manager.Incl.Keygen-SSG.rar
    2007-01-29 00:21 1,035,282 -c--a-w C:\Program Files\wrar362.exe
    2007-01-22 18:23 6,806,473 -c--a-w C:\Program Files\CeltxSetup-fi.exe
    2007-01-17 19:40 5,971,432 -c--a-w C:\Program Files\Firefox Setup 2.0.0.1.exe
    2007-01-17 16:13 645,670 -c--a-w C:\Program Files\uTorrent-1.6-install.exe
    2007-01-17 12:57 41,702,735 -c--a-w C:\Program Files\CMS5_PCAPP_LB_5_10_38.exe
    2007-01-17 12:21 29,257,979 -c--a-w C:\Program Files\CMS5_MTP_PCAPP_LB_5_00_36.exe
    2007-01-16 22:11 2,434,406 -c--a-w C:\Program Files\cdex_170b2_enu.exe
    2007-01-16 17:18 6,441,056 -c--a-w C:\Program Files\Opera_9.10_International_Setup.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 23:00 15360]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 13:55 5674352]
    "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-06-12 15:32 700416]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LaunchApp"="Alaunch" [X]
    "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 15:01 67584]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-12 01:19 7626752]
    "ntiMUI"="c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 17:15 45056]
    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 23:00 208952]
    "IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-10 23:00 44032]
    "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 23:00 59392]
    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 23:00 455168]
    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 23:00 455168]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-07-12 01:19 86016]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 14:03 36975]
    "Acer Empowering Technology Monitor"="C:\WINDOWS\system32\SysMonitor.exe" [2006-04-18 20:54 49152]
    "eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 16:00 345088]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 03:41 49152]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2003-12-13 03:50 33792]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
    "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40 2577632]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 16:27 385024]
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-28 18:23 185896]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 02:19 79224]
    "nwiz"="nwiz.exe" [2006-07-12 01:19 1519616 C:\WINDOWS\system32\nwiz.exe]
    "RTHDCPL"="RTHDCPL.EXE" [2006-06-01 03:48 16208384 C:\WINDOWS\RTHDCPL.exe]
    "SkyTel"="SkyTel.EXE" [2006-05-16 05:04 2879488 C:\WINDOWS\SkyTel.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 23:00 15360]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Acer Empowering Technology.lnk - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2007-01-15 16:14:48 45056]
    Acer WLAN 11g USB Dongle.lnk - C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 20:25:14 745472]
    Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-12-06 21:14:38 113664]
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 05:21:22 288472]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 23:05:56 65588]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
    "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.avis"= ff_acm.acm
    "VIDC.ACDV"= ACDV.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SLUNotify]
    @="Service"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\uTorrent\\utorrent.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\MSN Messenger\\livecall.exe"=

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 06:29]
    S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2005-10-28 11:38]

    *Newly Created Service* - CATCHME
    *Newly Created Service* - PROCEXP90
    .
    - - - - ORPHANS REMOVED - - - -

    HKLM-Run-Device Detector - DevDetect.exe


    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-07-19 19:26:00
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\vsdatant]
    "ImagePath"=""
    .
    Completion time: 2008-07-19 19:27:55
    ComboFix-quarantined-files.txt 2008-07-19 16:27:43

    Pre-Run: 1,564,061,696 bytes free
    Post-Run: 1,550,626,816 tavua vapaana

    174 --- E O F --- 2008-07-10 22:36:42
     
    manymoves, Jul 19, 2008
    #9
  10. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Hyvältä näyttää.

    Fixaa seuraava rivi hijackthis:llä

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

    ******************************************
    Kirjoita windowsin käynnistävalikon suorita-kenttään ComboFix.exe /u paina OK
    ***************************************************************************

    Javan päivitys ja välimuistin tyhjennys:

    1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
    2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
    Niissä pitäisi olla seuraava kuva vieressä:[​IMG]

    3. Valitse kaikki entiset Java versiosi ja valitse Poista.
    4. Asenna uusin Java päivitys seuraavasta linkistä..
    5. Käynnistä kone uudelleen asennuksen jälkeen:

    http://java.sun.com/javase/downloads/index.jsp

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6 Update 7

    Paina Download

    Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

    7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

    8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

    *Applications and Applets

    *Trace and Log Files

    Ja paina OK -nappia

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.

    10. Klikkaa OK jättääksesi Java asetusikkunasi.
     
    yaht, Jul 19, 2008
    #10
  11. manymoves

    manymoves Member

    Joined:
    Apr 5, 2006
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    16
    Niin, ja toi HostsXpert ei muuten antanut mulle tollaista vaihtoehtoa kuin "Make Hosts Writable?", joten painoin suoraan "Restore Microsoft's Hosts File".


    Nyt HOSTS- file näyttää tältä:

    # Copyright © 1993-1999 Microsoft Corp.
    #
    # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
    #
    # This file contains the mappings of IP addresses to host names. Each
    # entry should be kept on an individual line. The IP address should
    # be placed in the first column followed by the corresponding host name.
    # The IP address and the host name should be separated by at least one
    # space.
    #
    # Additionally, comments (such as these) may be inserted on individual
    # lines or following the machine name denoted by a "#" symbol.
    #
    # For example:
    #
    # 102.54.94.97 rhino.acme.com # source server
    # 38.25.63.10 x.acme.com # x client host
    #
    127.0.0.1 localhost

     
    manymoves, Jul 19, 2008
    #11
  12. manymoves

    manymoves Member

    Joined:
    Apr 5, 2006
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    16
    Jep, koitan noita uusia ohjeita, hetki.......
     
    manymoves, Jul 19, 2008
    #12
  13. manymoves

    manymoves Member

    Joined:
    Apr 5, 2006
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    16
    Eli asensin ton Javan ja säädin sen disk spacen noin puoleenväliin (n. 500mb). Onkohan vieläkin vähän turhan suuri?



    Ja uusi HJT-logi tässä:


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:20:12, on 19.7.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\SysMonitor.exe
    C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
    C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\a-squared Free\a2service.exe
    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\HPZipm12.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Opera\Opera.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
    O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Acer Empowering Technology.lnk = ?
    O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
    O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 9227 bytes
     
    manymoves, Jul 19, 2008
    #13
  14. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Ihan sopiva se on :D

    Siivotaan vielä loput roskat pois.

    Lataa CCleaner tästä

    - Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
    - Asennuksen jälkeen aukaise CCleaner.
    - Valitse vasemmalta pystyrivistä Options.
    - Valitse viereisestä pystyrivistä Settings.
    - Language kohtaan valitse Suomi.

    - Käynnistä CCleaner.
    - Valitse Valinnat.
    - Paina Lisäasetukset.
    - Ota ruksi pois kohdasta "Poista vain yli 48 tuntia vanhat tiedostot Windowsin tilapäiskansioista".

    Puhdistaja

    - Valitse vasemmalta pystyrivistä Puhdistaja.
    - Paina alhaalta Tutki.
    Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
    - Kun tutkiminen on valmis, paina Aja CCleaner.
    Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.

    Rekisterin virheiden korjaus

    - Valitse vasemmalta pystyrivistä Rekisteri.
    - Paina alhaalta Etsi rekisterin virheitä.
    - Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
    - Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
    - Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
    - Saat vielä varmistus kysymyksen, paina Ok.
    - Kun virheet on korjattu, paina Sulje.

    Nyt voit suljea CCleanerin painamalla oikealta ylhäältä punaista rastia.
     
    yaht, Jul 19, 2008
    #14
  15. manymoves

    manymoves Member

    Joined:
    Apr 5, 2006
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    16
    Jep, eli tässäpä tää viimeinen HJT-logi:


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:28:20, on 19.7.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\SysMonitor.exe
    C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
    C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\a-squared Free\a2service.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\HPZipm12.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Opera\Opera.exe
    C:\Program Files\Winamp\winamp.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
    O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Acer Empowering Technology.lnk = ?
    O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
    O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 9243 bytes
     
    manymoves, Jul 19, 2008
    #15
  16. manymoves

    manymoves Member

    Joined:
    Apr 5, 2006
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    16
    Tuli mieleen, että syystä tai toisesta mun Sygaten palomuuri ilmoittelee vielä toisinaan tällasia juttuja:


    Application hijacking, incoming, remote host 88.221.82.250, local host 80.222.40.130, c:\program files\common files\lightscribe\lssrvc.exe

    Samaa varotusta tuli myös koskien tiedostoa c:\windows\system32\msiexec.exe


    Onkohan noista syytä huolestua?
     
    manymoves, Jul 19, 2008
    #16
  17. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Toinen on microsoftin omia juttuja ja toinen on kanssa ihan ok eli ei tarvi huolestua.

     
    yaht, Jul 19, 2008
    #17
  18. manymoves

    manymoves Member

    Joined:
    Apr 5, 2006
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    16
    Eli nyt näyttäisi kone olevan puhdas viruksista, vai?

    Jos näin on, niin kiitoksia todella paljon! Tää oli hieno homma.
     
    manymoves, Jul 20, 2008
    #18
  19. manymoves

    manymoves Member

    Joined:
    Apr 5, 2006
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    16
    Perkele. Avast näytti löytävän taas 2 uutta troijalaista koneelta. Uskomatonta. Sitkeitä ovat perkeleet, niin kuin Raptori asian ilmaisisi.
     
    manymoves, Jul 21, 2008
    #19
  20. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Hmm...

    Mistä päin konetta avast nuo löytää?
     
    yaht, Jul 21, 2008
    #20
Page 1 of 2

Share This Page