Jos nyt vaikka menisi oikein. Tässä tämä.
Logfile of HijackThis v1.99.0
Scan saved at 22:29:22, on 21.1.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINNT\system32\internat.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\HJT\HijackThis.exe
C:\WINNT\system32\NOTEPAD.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\Hotbar\bin\4.4.6.0\WeatherOnTray.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [DeluxeCD] C:\WINNT\System32\cdplayer.exe -tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.windowsecurity.com/trojanscan/TDECntrl.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28177.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/bingame/feed/default/SproutLauncher.cab
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9.5/ticker.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/isan/default/popcaploader_v6.cab
O16 - DPF: {EDFCDAF5-95D9-40E9-BBE6-10C33190C3EF} (cGameControl Class) - http://zone.msn.com/bingame/rmcb/default/RumbleCube.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab28177.cab
O23 - Service: Hälytys - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Sovellusten hallinta - Unknown - C:\WINNT\system32\services.exe
O23 - Service: avast! iAVS4 Control Service - Unknown - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: Tietokoneiden selaus - Unknown - C:\WINNT\System32\services.exe
O23 - Service: DHCP-asiakas - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINNT\System32\dmadmin.exe
O23 - Service: Loogisen levyn hallinta - Unknown - C:\WINNT\System32\services.exe
O23 - Service: DNS-asiakas - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Tapahtumaloki - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Faksipalvelu - Unknown - C:\WINNT\system32\faxsvc.exe
O23 - Service: Palvelin - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Työasema - Unknown - C:\WINNT\System32\services.exe
O23 - Service: TCP/IP NetBIOS Helper -palvelu - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Viestinvälitys - Unknown - C:\WINNT\System32\services.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINNT\System32\mnmsrvc.exe
O23 - Service: Verkon DDE - Unknown - C:\WINNT\system32\netdde.exe
O23 - Service: Verkon DDE DSDM - Unknown - C:\WINNT\system32\netdde.exe
O23 - Service: Verkkokirjautuminen - Unknown - C:\WINNT\System32\lsass.exe
O23 - Service: NT LM -suojaustuen toimittaja - Unknown - C:\WINNT\System32\lsass.exe
O23 - Service: Plug and Play - Unknown - C:\WINNT\system32\services.exe
O23 - Service: IP-suojauskäytäntöagentti - Unknown - C:\WINNT\System32\lsass.exe
O23 - Service: Suojattu tallennuspaikka - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Käyttöoikeustilien hallinta - Unknown - C:\WINNT\system32\lsass.exe
O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINNT\System32\SCardSvr.exe
O23 - Service: Älykortti - Unknown - C:\WINNT\System32\SCardSvr.exe
O23 - Service: Tehtävien ajoitus - Unknown - C:\WINNT\system32\MSTask.exe
O23 - Service: RunAs-palvelu - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINNT\system32\smlogsvc.exe
O23 - Service: Telnet - Unknown - C:\WINNT\system32\tlntsvr.exe
O23 - Service: Tiedostolinkkijäljityksen asiakas - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Toimintojen hallinta - Unknown - C:\WINNT\System32\UtilMan.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Time - Unknown - C:\WINNT\System32\services.exe
O23 - Service: WMI-palvelu (Windows Management Instrumentation) - Unknown - C:\WINNT\System32\WBEM\WinMgmt.exe
O23 - Service: WM -instrumenttien ohjainlaajennukset - Unknown - C:\WINNT\system32\Services.exe
Logfile of HijackThis v1.99.0
Scan saved at 22:29:22, on 21.1.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINNT\system32\internat.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\HJT\HijackThis.exe
C:\WINNT\system32\NOTEPAD.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\Hotbar\bin\4.4.6.0\WeatherOnTray.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [DeluxeCD] C:\WINNT\System32\cdplayer.exe -tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.windowsecurity.com/trojanscan/TDECntrl.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28177.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/bingame/feed/default/SproutLauncher.cab
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9.5/ticker.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/isan/default/popcaploader_v6.cab
O16 - DPF: {EDFCDAF5-95D9-40E9-BBE6-10C33190C3EF} (cGameControl Class) - http://zone.msn.com/bingame/rmcb/default/RumbleCube.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab28177.cab
O23 - Service: Hälytys - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Sovellusten hallinta - Unknown - C:\WINNT\system32\services.exe
O23 - Service: avast! iAVS4 Control Service - Unknown - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: Tietokoneiden selaus - Unknown - C:\WINNT\System32\services.exe
O23 - Service: DHCP-asiakas - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINNT\System32\dmadmin.exe
O23 - Service: Loogisen levyn hallinta - Unknown - C:\WINNT\System32\services.exe
O23 - Service: DNS-asiakas - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Tapahtumaloki - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Faksipalvelu - Unknown - C:\WINNT\system32\faxsvc.exe
O23 - Service: Palvelin - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Työasema - Unknown - C:\WINNT\System32\services.exe
O23 - Service: TCP/IP NetBIOS Helper -palvelu - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Viestinvälitys - Unknown - C:\WINNT\System32\services.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINNT\System32\mnmsrvc.exe
O23 - Service: Verkon DDE - Unknown - C:\WINNT\system32\netdde.exe
O23 - Service: Verkon DDE DSDM - Unknown - C:\WINNT\system32\netdde.exe
O23 - Service: Verkkokirjautuminen - Unknown - C:\WINNT\System32\lsass.exe
O23 - Service: NT LM -suojaustuen toimittaja - Unknown - C:\WINNT\System32\lsass.exe
O23 - Service: Plug and Play - Unknown - C:\WINNT\system32\services.exe
O23 - Service: IP-suojauskäytäntöagentti - Unknown - C:\WINNT\System32\lsass.exe
O23 - Service: Suojattu tallennuspaikka - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Käyttöoikeustilien hallinta - Unknown - C:\WINNT\system32\lsass.exe
O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINNT\System32\SCardSvr.exe
O23 - Service: Älykortti - Unknown - C:\WINNT\System32\SCardSvr.exe
O23 - Service: Tehtävien ajoitus - Unknown - C:\WINNT\system32\MSTask.exe
O23 - Service: RunAs-palvelu - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINNT\system32\smlogsvc.exe
O23 - Service: Telnet - Unknown - C:\WINNT\system32\tlntsvr.exe
O23 - Service: Tiedostolinkkijäljityksen asiakas - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Toimintojen hallinta - Unknown - C:\WINNT\System32\UtilMan.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Time - Unknown - C:\WINNT\System32\services.exe
O23 - Service: WMI-palvelu (Windows Management Instrumentation) - Unknown - C:\WINNT\System32\WBEM\WinMgmt.exe
O23 - Service: WM -instrumenttien ohjainlaajennukset - Unknown - C:\WINNT\system32\Services.exe
Vastaukset 4
Vanhimmat
katsoa ( internat.exe, WeatherOnTray.exe )
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\Hotbar\bin\4.4.6.0\WeatherOnTray.exe
tällä
http://virusscan.jotti.dhs.org/
Jos tuollaista esiintyy " babes in bikinis with large breasts " niin jälkimmäisen voi FIX:sata
Sulje selain ja muut ikkunat ennen FIX:sta
uusi Logi tästä
virusscan.jotti mukaan
Onkohan tämä nyt ihan se mitä tarkoitit..
Service load:
0% 100%
File: hijackthis.log
Status:
OK
Packers detected:
None
AntiVir
No viruses found (0.15 seconds taken)
Avast
No viruses found (1.51 seconds taken)
BitDefender
No viruses found (0.37 seconds taken)
ClamAV
No viruses found (0.37 seconds taken)
Dr.Web
No viruses found (0.53 seconds taken)
F-Prot Antivirus
No viruses found (0.07 seconds taken)
Kaspersky Anti-Virus
No viruses found (0.64 seconds taken)
mks_vir
No viruses found (0.20 seconds taken)
NOD32
No viruses found (0.37 seconds taken)
Norman Virus Control
No viruses found (0.14 seconds taken)
Statistics
Last piece of malware found was probably unknown NewHeur_PE in servers.exe, detected by:
Scanner Malware name Time taken
AntiVir X 0.19 seconds
Avast X 1.51 seconds
BitDefender Backdoor.Prorat.Q 1.22 seconds
ClamAV X 0.42 seconds
Dr.Web BackDoor.ProRat.19 0.78 seconds
F-Prot Antivirus X 0.16 seconds
Kaspersky Anti-Virus Backdoor.Win32.Prorat.19.k 3.17 seconds
mks_vir Win32.4 0.22 seconds
NOD32 probably unknown NewHeur_PE 1.30 seconds
Norman Virus Control X 7.18 seconds
sekä tässä tämä uusi log
Logfile of HijackThis v1.99.0
Scan saved at 23:32:54, on 21.1.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINNT\system32\internat.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\HJT\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [DeluxeCD] C:\WINNT\System32\cdplayer.exe -tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.windowsecurity.com/trojanscan/TDECntrl.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28177.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/bingame/feed/default/SproutLauncher.cab
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9.5/ticker.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/isan/default/popcaploader_v6.cab
O16 - DPF: {EDFCDAF5-95D9-40E9-BBE6-10C33190C3EF} (cGameControl Class) - http://zone.msn.com/bingame/rmcb/default/RumbleCube.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab28177.cab
O23 - Service: Hälytys - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Sovellusten hallinta - Unknown - C:\WINNT\system32\services.exe
O23 - Service: avast! iAVS4 Control Service - Unknown - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: Tietokoneiden selaus - Unknown - C:\WINNT\System32\services.exe
O23 - Service: DHCP-asiakas - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINNT\System32\dmadmin.exe
O23 - Service: Loogisen levyn hallinta - Unknown - C:\WINNT\System32\services.exe
O23 - Service: DNS-asiakas - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Tapahtumaloki - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Faksipalvelu - Unknown - C:\WINNT\system32\faxsvc.exe
O23 - Service: Palvelin - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Työasema - Unknown - C:\WINNT\System32\services.exe
O23 - Service: TCP/IP NetBIOS Helper -palvelu - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Viestinvälitys - Unknown - C:\WINNT\System32\services.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINNT\System32\mnmsrvc.exe
O23 - Service: Verkon DDE - Unknown - C:\WINNT\system32\netdde.exe
O23 - Service: Verkon DDE DSDM - Unknown - C:\WINNT\system32\netdde.exe
O23 - Service: Verkkokirjautuminen - Unknown - C:\WINNT\System32\lsass.exe
O23 - Service: NT LM -suojaustuen toimittaja - Unknown - C:\WINNT\System32\lsass.exe
O23 - Service: Plug and Play - Unknown - C:\WINNT\system32\services.exe
O23 - Service: IP-suojauskäytäntöagentti - Unknown - C:\WINNT\System32\lsass.exe
O23 - Service: Suojattu tallennuspaikka - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Käyttöoikeustilien hallinta - Unknown - C:\WINNT\system32\lsass.exe
O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINNT\System32\SCardSvr.exe
O23 - Service: Älykortti - Unknown - C:\WINNT\System32\SCardSvr.exe
O23 - Service: Tehtävien ajoitus - Unknown - C:\WINNT\system32\MSTask.exe
O23 - Service: RunAs-palvelu - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINNT\system32\smlogsvc.exe
O23 - Service: Telnet - Unknown - C:\WINNT\system32\tlntsvr.exe
O23 - Service: Tiedostolinkkijäljityksen asiakas - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Toimintojen hallinta - Unknown - C:\WINNT\System32\UtilMan.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Time - Unknown - C:\WINNT\System32\services.exe
O23 - Service: WMI-palvelu (Windows Management Instrumentation) - Unknown - C:\WINNT\System32\WBEM\WinMgmt.exe
O23 - Service: WM -instrumenttien ohjainlaajennukset - Unknown - C:\WINNT\system32\Services.exe
hakea ja scannata koneesi
http://www.spychecker.com/program/counterspy.html
FIX:saa tuo scannauksen jäkeen, jos ei poistu jo sitä ennen
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
uusi logi
Tässä tämä uusi. Onko kaikki jo ok?
Logfile of HijackThis v1.99.0
Scan saved at 13:45:14, on 24.1.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Sunbelt Software\CounterSpy Client\sunasDTServ.exe
C:\Program Files\Sunbelt Software\CounterSpy Client\sunasServ.exe
C:\WINNT\system32\internat.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [DeluxeCD] C:\WINNT\System32\cdplayer.exe -tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [sunasDTServ] C:\Program Files\Sunbelt Software\CounterSpy Client\sunasDTServ.exe
O4 - HKLM\..\Run: [sunasServ] C:\Program Files\Sunbelt Software\CounterSpy Client\sunasServ.exe
O4 - HKLM\..\RunOnce: [CounterSpyCleaner] C:\Program Files\Sunbelt Software\CounterSpy Client\sunASCleaner.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.windowsecurity.com/trojanscan/TDECntrl.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28177.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/bingame/feed/default/SproutLauncher.cab
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9.5/ticker.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/isan/default/popcaploader_v6.cab
O16 - DPF: {EDFCDAF5-95D9-40E9-BBE6-10C33190C3EF} (cGameControl Class) - http://zone.msn.com/bingame/rmcb/default/RumbleCube.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab28177.cab
O23 - Service: Hälytys - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Sovellusten hallinta - Unknown - C:\WINNT\system32\services.exe
O23 - Service: avast! iAVS4 Control Service - Unknown - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: Tietokoneiden selaus - Unknown - C:\WINNT\System32\services.exe
O23 - Service: DHCP-asiakas - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINNT\System32\dmadmin.exe
O23 - Service: Loogisen levyn hallinta - Unknown - C:\WINNT\System32\services.exe
O23 - Service: DNS-asiakas - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Tapahtumaloki - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Faksipalvelu - Unknown - C:\WINNT\system32\faxsvc.exe
O23 - Service: Palvelin - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Työasema - Unknown - C:\WINNT\System32\services.exe
O23 - Service: TCP/IP NetBIOS Helper -palvelu - Unknown - C:\WINNT\System32\services.exe
O23 - Service: Viestinvälitys - Unknown - C:\WINNT\System32\services.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINNT\System32\mnmsrvc.exe
O23 - Service: Verkon DDE - Unknown - C:\WINNT\system32\netdde.exe
O23 - Service: Verkon DDE DSDM - Unknown - C:\WINNT\system32\netdde.exe
O23 - Service: Verkkokirjautuminen - Unknown - C:\WINNT\System32\lsass.exe
O23 - Service: NT LM -suojaustuen toimittaja - Unknown - C:\WINNT\System32\lsass.exe
O23 - Service: Plug and Play - Unknown - C:\WINNT\system32\services.exe
O23 - Service: IP-suojauskäytäntöagentti - Unknown - C:\WINNT\System32\lsass.exe
O23 - Service: Suojattu tallennuspaikka - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Käyttöoikeustilien hallinta - Unknown - C:\WINNT\system32\lsass.exe
O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINNT\System32\SCardSvr.exe
O23 - Service: Älykortti - Unknown - C:\WINNT\System32\SCardSvr.exe
O23 - Service: Tehtävien ajoitus - Unknown - C:\WINNT\system32\MSTask.exe
O23 - Service: RunAs-palvelu - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINNT\system32\smlogsvc.exe
O23 - Service: Telnet - Unknown - C:\WINNT\system32\tlntsvr.exe
O23 - Service: Tiedostolinkkijäljityksen asiakas - Unknown - C:\WINNT\system32\services.exe
O23 - Service: Toimintojen hallinta - Unknown - C:\WINNT\System32\UtilMan.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Time - Unknown - C:\WINNT\System32\services.exe
O23 - Service: WMI-palvelu (Windows Management Instrumentation) - Unknown - C:\WINNT\System32\WBEM\WinMgmt.exe
O23 - Service: WM -instrumenttien ohjainlaajennukset - Unknown - C:\WINNT\system32\Services.exe