...minulle, miksi en saa työpöydän alanurkkaan ilmestyvää Desktop Search- lappua katoamaan! Ei Hijactilla, ei millään Spy- tai Adware- poisto-ohjelmalla.
Ilmeisesti paska sijaitsee paikassa WINDOWS\ISRVS\SYSUPD.DLL, koska joka kerran, kun otan Desktop Searchin pois päältä, jolloin se kyllä katoaa seuraavaan koneen käynnistykseen saakka, F- Secure ilmoittaa: Vahingollinen koodi löytynyt yllä mainitsemastani tiedostosta.
Trojan DownloaderWin32.leser.a.
Elikkä hevonenhan se siellä ketkuilee...
Pistän oheen login, jossa Securen ilmoittama tiedosto näkyy.
Sanokaa ihmeessä, jos tiedätte,mitkä voin tuosta listasta poistaa.
(Jos sitten suostuvat millään konstilla poistumaan...)
Etukäteiskiitoksin,
monin...
--------------------
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\hushware.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\hushware.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\popupblocker.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\popupblocker.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\virushunter.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\virushunter.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\spywareavenger.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\spywareavenger.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\usaplatinum.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\usaplatinum.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\mfiltis.dll
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\mfiltis.dll
2004/12/31 15:33:23 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html\CLSID
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\desktop.exe
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\desktop.exe
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\msdbhk.dll
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\msdbhk.dll
2004/12/31 15:33:23 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\isearch.xpi
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\isearch.xpi
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\ffisearch.exe
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\ffisearch.exe
2004/12/31 15:33:23 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ffis
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\sysupd.dll
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\sysupd.dll
2004/12/31 15:33:24 WRITE_ACCESS \??\C:\WINDOWS\isrvs\delprot.sys
2004/12/31 15:33:24 WRITE_ACCESS \??\C:\WINDOWS\isrvs\delprot.sys
2004/12/31 15:33:24 WRITE_ACCESS \??\C:\WINDOWS\isrvs\edmond.exe
2004/12/31 15:33:24 WRITE_ACCESS \??\C:\WINDOWS\isrvs\edmond.exe
2004/12/31 15:33:24 WRITE_ACCESS \??\C:\WINDOWS\delprot.ini
2004/12/31 15:33:24 WRITE_ACCESS \??\C:\WINDOWS\delprot.ini
2005/01/12 06:15:22 WRITE \Device\HarddiskVolume1\WINDOWS\Temp\AVP288.tmp
2005/01/14 10:06:29 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/14 11:12:01 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/14 11:28:32 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/14 11:59:38 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/16 15:06:52 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/16 15:08:05 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/16 15:08:05 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/16 15:45:00 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/16 15:46:13 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/16 15:46:13 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/16 15:49:17 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/16 15:49:55 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/16 16:05:20 WRITE_ACCESS \??\C:
2005/01/17 08:29:36 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/17 08:30:51 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/17 08:30:51 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/17 10:21:01 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/17 11:51:32 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/18 13:38:58 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/18 13:38:58 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ffis
2005/01/18 13:38:58 DELETEKEY \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html
Ilmeisesti paska sijaitsee paikassa WINDOWS\ISRVS\SYSUPD.DLL, koska joka kerran, kun otan Desktop Searchin pois päältä, jolloin se kyllä katoaa seuraavaan koneen käynnistykseen saakka, F- Secure ilmoittaa: Vahingollinen koodi löytynyt yllä mainitsemastani tiedostosta.
Trojan DownloaderWin32.leser.a.
Elikkä hevonenhan se siellä ketkuilee...
Pistän oheen login, jossa Securen ilmoittama tiedosto näkyy.
Sanokaa ihmeessä, jos tiedätte,mitkä voin tuosta listasta poistaa.
(Jos sitten suostuvat millään konstilla poistumaan...)
Etukäteiskiitoksin,
monin...
--------------------
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\hushware.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\hushware.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\popupblocker.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\popupblocker.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\virushunter.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\virushunter.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\spywareavenger.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\spywareavenger.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\usaplatinum.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\icons\usaplatinum.ico
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\mfiltis.dll
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\mfiltis.dll
2004/12/31 15:33:23 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html\CLSID
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\desktop.exe
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\desktop.exe
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\msdbhk.dll
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\msdbhk.dll
2004/12/31 15:33:23 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\isearch.xpi
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\isearch.xpi
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\ffisearch.exe
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\ffisearch.exe
2004/12/31 15:33:23 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ffis
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\sysupd.dll
2004/12/31 15:33:23 WRITE_ACCESS \??\C:\WINDOWS\isrvs\sysupd.dll
2004/12/31 15:33:24 WRITE_ACCESS \??\C:\WINDOWS\isrvs\delprot.sys
2004/12/31 15:33:24 WRITE_ACCESS \??\C:\WINDOWS\isrvs\delprot.sys
2004/12/31 15:33:24 WRITE_ACCESS \??\C:\WINDOWS\isrvs\edmond.exe
2004/12/31 15:33:24 WRITE_ACCESS \??\C:\WINDOWS\isrvs\edmond.exe
2004/12/31 15:33:24 WRITE_ACCESS \??\C:\WINDOWS\delprot.ini
2004/12/31 15:33:24 WRITE_ACCESS \??\C:\WINDOWS\delprot.ini
2005/01/12 06:15:22 WRITE \Device\HarddiskVolume1\WINDOWS\Temp\AVP288.tmp
2005/01/14 10:06:29 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/14 11:12:01 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/14 11:28:32 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/14 11:59:38 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/16 15:06:52 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/16 15:08:05 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/16 15:08:05 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/16 15:45:00 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/16 15:46:13 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/16 15:46:13 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/16 15:49:17 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/16 15:49:55 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/16 16:05:20 WRITE_ACCESS \??\C:
2005/01/17 08:29:36 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/17 08:30:51 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/17 08:30:51 DELETE \Device\HarddiskVolume1\WINDOWS\isrvs\icons\virushunter.ico
2005/01/17 10:21:01 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/17 11:51:32 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/18 13:38:58 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
2005/01/18 13:38:58 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ffis
2005/01/18 13:38:58 DELETEKEY \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html
Vastaukset 4
Vanhimmat
Pistä Hijack logi.
Kiitos taas etukäteen!
-------------------------
Logfile of HijackThis v1.99.0
Scan saved at 11:55:11, on 21.1.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\fswsclds.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\BackWeb-4476822.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\mapiicon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\AAAAAAAAAAAAAAAAAA\SpySub.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hijacthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.soneraplaza.fi/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Plaza Oy
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Profiles\default\6ojwgc2j.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [ADSL_A2] A2Installed
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: A-Link ADSL Diagnostic Tools.LNK = C:\WINDOWS\system32\mapiicon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Kalenterin muistutukset.lnk = ?
O4 - Global Startup: SpySubtract.lnk = C:\AAAAAAAAAAAAAAAAAA\SpySub.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/CursorManiaInitialSetup1.0.0.6.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.johannrain-softwareentwicklung.de/scan/Msie/bitdefender.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O23 - Service: F-Secure Internet Security 2004 - Unknown - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - Unknown - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - Unknown - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\fswsclds.exe
O23 - Service: hpdj - HP - C:\DOCUME~1\JRJEST~1\LOCALS~1\Temp\hpdj.exe
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe
-----------------------
Mikä lienee haittana?
Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina FIX checked
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/CursorManiaInitialSetup1.0.0.6.cab
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
Käynnistä sitte vikasietotilassa etsi ja poista
C:\WINDOWS\isrvs\
- poista isrvs kansio
Käynnistä normaalisti ja uus logi.
...ehkä pelkästään sekin, että poistat rekisteristä nuo logissa näkyvät merkinnät:
2005/01/18 13:38:58 DELETEVALUE \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Search
Eli otat Käynnistä-valikko -> Suorita -> kirjoita REGEDIT ja paina Enter ja menet noihin hakemistoihin. Pöpö on kirjoittanut Windowsin rekisteriin kamaa, jolloin se käynnistyy joka koneen käynnistyksen yhteydessä uudestaan. Kun olet poistanut nuo rekisterimerkinnät, poista sen jälkeen se vahingollinen .DLL -tiedosto. Voit tämän jälkeen vielä ajaa virustorjunnat sun muut, jos ne vielä löytävät jotain.