Logfile of HijackThis v1.99.1
Scan saved at 8:48:59, on 17.2.2005
Platform: Windows NT 4 SP6 (WinNT 4.00.1381)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\spoolss.exe
C:\WINNT\System32\cpqalert.exe
C:\WINNT\CPQDIAG\CPQDFWAG.EXE
C:\Ohjelmatiedostot\COMPAQ\CpqWebDMI\webdmi.EXE
C:\Ohjelmatiedostot\F-Secure\Anti-Virus\fsgk32st.exe
C:\Ohjelmatiedostot\F-Secure\Anti-Virus\FSGK32.EXE
C:\WINNT\system32\RpcSs.exe
C:\Ohjelmatiedostot\F-Secure\Anti-Virus\fssm32.exe
C:\WINNT\system32\tapisrv.exe
C:\OHJELM~1\IBM\CLIENT~1\cwbbs.exe
C:\OHJELM~1\IBM\CLIENT~1\cwbntred.exe
C:\WINNT\System32\nddeagnt.exe
C:\WINNT\system32\rasman.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\Explorer.exe
C:\Ohjelmatiedostot\IBM\Client Access\CWBPROVD.EXE
c:\dmi\win32\bin\Win32sl.exe
C:\WINNT\System32\esserver.exe
C:\Ohjelmatiedostot\F-Secure\Common\FSMA32.EXE
C:\WINNT\System32\SysTray.Exe
C:\WINNT\System32\CHKADMIN.EXE
C:\WINNT\System32\loadwc.exe
C:\Ohjelmatiedostot\IBM\Client Access\cwbuitsk.exe
C:\Ohjelmatiedostot\IBM\Client Access\CWBSVD.EXE
c:\winnt\system32\pstores.exe
C:\Ohjelmatiedostot\F-Secure\Common\FSM32.EXE
C:\Ohjelmatiedostot\F-Secure\Common\FSMB32.EXE
C:\WINNT\System32\SENS.EXE
C:\WINNT\loadqm.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\cpqdmi.exe
C:\Ohjelmatiedostot\F-Secure\Common\FCH32.EXE
C:\Ohjelmatiedostot\F-Secure\Common\FAMEH32.EXE
C:\Ohjelmatiedostot\Microsoft Office\Office\OSA.EXE
C:\Ohjelmatiedostot\Microsoft Office\Office\FINDFAST.EXE
C:\Ohjelmatiedostot\WinZip\WZQKPICK.EXE
C:\Ohjelmatiedostot\F-Secure\Common\FNRB32.EXE
C:\Ohjelmatiedostot\F-Secure\Common\FIH32.EXE
C:\Ohjelmatiedostot\F-Secure\Anti-Virus\fsav32.exe
C:\Ohjelmatiedostot\Microsoft Office\Office\EXCEL.EXE
C:\Ohjelmatiedostot\Outlook Express\msimn.exe
C:\WINNT\System32\ddhelp.exe
C:\Ohjelmatiedostot\IBM\Client Access\Emulator\pcsws.exe
C:\OHJELM~1\IBM\CLIENT~1\Emulator\PCSCM.EXE
C:\Ohjelmatiedostot\IBM\Client Access\CWBCSD.EXE
C:\OHJELM~1\IBM\CLIENT~1\Emulator\pcsws.exe
C:\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\TEMP\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\TEMP\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F2 - REG:system.ini: UserInit=C:\OHJELM~1\IBM\CLIENT~1\cwbbs.exe,C:\OHJELM~1\IBM\CLIENT~1\cwbntred.exe,C:\OHJELM~1\IBM\CLIENT~1\cwbprovd.exe,userinit,nddeagnt.exe
O1 - Hosts: 195.156.106.134 FIIMATRA
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\above\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ShprRprts - {2A8A997F-BB9F-48F6-AA2B-2762D50F9289} - C:\Ohjelmatiedostot\ShopperReports\Bin\1.0.0.1\SmrtShpr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Ohjelmatiedostot\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {79239431-8004-11D9-A49F-0001C6AF882F} - C:\WINNT\System32\jmbi.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [CHKADMIN] CHKADMIN.EXE
O4 - HKLM\..\Run: [BrowserWebCheck] loadwc.exe
O4 - HKLM\..\Run: [Client Access Service] "C:\Ohjelmatiedostot\IBM\Client Access\CwbSvStr.Exe"
O4 - HKLM\..\Run: [Client Access Taskbar] "C:\Ohjelmatiedostot\IBM\Client Access\cwbuitsk.exe"
O4 - HKLM\..\Run: [Client Access API Daemon] "C:\Ohjelmatiedostot\IBM\Client Access\cwbappcd.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Ohjelmatiedostot\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Ohjelmatiedostot\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [hpsjbmgr] C:\Ohjelmatiedostot\Hewlett-Packard\Precisionscan Pro 3.1\hpsjbmgr.exe
O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /logon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Ohjelmatiedostot\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\TEMP\se.dll,DllInstall
O4 - HKCU\..\Run: [msnmsgr] "C:\Ohjelmatiedostot\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Officen käynnistys.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office Pikahaku.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Ohjelmatiedostot\WinZip\WZQKPICK.EXE
O13 - WWW. Prefix: http://
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/2.0.0.33/player.virtools.com/downloads/player/Install2.0/Installer.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 195.156.106.135
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 195.156.106.135
O18 - Filter: text/html - {AC9C4E10-80AA-11D9-A4A1-00018861B3F1} - C:\WINNT\System32\jmbi.dll
O18 - Filter: text/plain - {AC9C4E10-80AA-11D9-A4A1-00018861B3F1} - C:\WINNT\System32\jmbi.dll
O23 - Service: Compaq Local Alerter (CPQALERT) - Compaq Computer Corporation - C:\WINNT\System32\cpqalert.exe
O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) - Unknown owner - C:\WINNT\CPQDIAG\CPQDFWAG.EXE
O23 - Service: CPQDMI - Compaq Computer Corporation - C:\WINNT\System32\cpqdmi.exe
O23 - Service: Compaq DMI Web Agent (CpqWebDmi) - Compaq Computer Corporation - C:\Ohjelmatiedostot\COMPAQ\CpqWebDMI\webdmi.EXE
O23 - Service: Client Accessin Etäkomentopalvelu (Cwbrxd) - IBM Corporation - C:\WINNT\CWBRXD.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Ohjelmatiedostot\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Ohjelmatiedostot\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Ohjelmatiedostot\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Ohjelmatiedostot\F-Secure\Common\FSMA32.EXE
O23 - Service: Win32sl - Intel - c:\dmi\win32\bin\Win32sl.exe
Scan saved at 8:48:59, on 17.2.2005
Platform: Windows NT 4 SP6 (WinNT 4.00.1381)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\spoolss.exe
C:\WINNT\System32\cpqalert.exe
C:\WINNT\CPQDIAG\CPQDFWAG.EXE
C:\Ohjelmatiedostot\COMPAQ\CpqWebDMI\webdmi.EXE
C:\Ohjelmatiedostot\F-Secure\Anti-Virus\fsgk32st.exe
C:\Ohjelmatiedostot\F-Secure\Anti-Virus\FSGK32.EXE
C:\WINNT\system32\RpcSs.exe
C:\Ohjelmatiedostot\F-Secure\Anti-Virus\fssm32.exe
C:\WINNT\system32\tapisrv.exe
C:\OHJELM~1\IBM\CLIENT~1\cwbbs.exe
C:\OHJELM~1\IBM\CLIENT~1\cwbntred.exe
C:\WINNT\System32\nddeagnt.exe
C:\WINNT\system32\rasman.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\Explorer.exe
C:\Ohjelmatiedostot\IBM\Client Access\CWBPROVD.EXE
c:\dmi\win32\bin\Win32sl.exe
C:\WINNT\System32\esserver.exe
C:\Ohjelmatiedostot\F-Secure\Common\FSMA32.EXE
C:\WINNT\System32\SysTray.Exe
C:\WINNT\System32\CHKADMIN.EXE
C:\WINNT\System32\loadwc.exe
C:\Ohjelmatiedostot\IBM\Client Access\cwbuitsk.exe
C:\Ohjelmatiedostot\IBM\Client Access\CWBSVD.EXE
c:\winnt\system32\pstores.exe
C:\Ohjelmatiedostot\F-Secure\Common\FSM32.EXE
C:\Ohjelmatiedostot\F-Secure\Common\FSMB32.EXE
C:\WINNT\System32\SENS.EXE
C:\WINNT\loadqm.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\cpqdmi.exe
C:\Ohjelmatiedostot\F-Secure\Common\FCH32.EXE
C:\Ohjelmatiedostot\F-Secure\Common\FAMEH32.EXE
C:\Ohjelmatiedostot\Microsoft Office\Office\OSA.EXE
C:\Ohjelmatiedostot\Microsoft Office\Office\FINDFAST.EXE
C:\Ohjelmatiedostot\WinZip\WZQKPICK.EXE
C:\Ohjelmatiedostot\F-Secure\Common\FNRB32.EXE
C:\Ohjelmatiedostot\F-Secure\Common\FIH32.EXE
C:\Ohjelmatiedostot\F-Secure\Anti-Virus\fsav32.exe
C:\Ohjelmatiedostot\Microsoft Office\Office\EXCEL.EXE
C:\Ohjelmatiedostot\Outlook Express\msimn.exe
C:\WINNT\System32\ddhelp.exe
C:\Ohjelmatiedostot\IBM\Client Access\Emulator\pcsws.exe
C:\OHJELM~1\IBM\CLIENT~1\Emulator\PCSCM.EXE
C:\Ohjelmatiedostot\IBM\Client Access\CWBCSD.EXE
C:\OHJELM~1\IBM\CLIENT~1\Emulator\pcsws.exe
C:\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\TEMP\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\TEMP\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F2 - REG:system.ini: UserInit=C:\OHJELM~1\IBM\CLIENT~1\cwbbs.exe,C:\OHJELM~1\IBM\CLIENT~1\cwbntred.exe,C:\OHJELM~1\IBM\CLIENT~1\cwbprovd.exe,userinit,nddeagnt.exe
O1 - Hosts: 195.156.106.134 FIIMATRA
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\above\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ShprRprts - {2A8A997F-BB9F-48F6-AA2B-2762D50F9289} - C:\Ohjelmatiedostot\ShopperReports\Bin\1.0.0.1\SmrtShpr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Ohjelmatiedostot\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {79239431-8004-11D9-A49F-0001C6AF882F} - C:\WINNT\System32\jmbi.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [CHKADMIN] CHKADMIN.EXE
O4 - HKLM\..\Run: [BrowserWebCheck] loadwc.exe
O4 - HKLM\..\Run: [Client Access Service] "C:\Ohjelmatiedostot\IBM\Client Access\CwbSvStr.Exe"
O4 - HKLM\..\Run: [Client Access Taskbar] "C:\Ohjelmatiedostot\IBM\Client Access\cwbuitsk.exe"
O4 - HKLM\..\Run: [Client Access API Daemon] "C:\Ohjelmatiedostot\IBM\Client Access\cwbappcd.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Ohjelmatiedostot\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Ohjelmatiedostot\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [hpsjbmgr] C:\Ohjelmatiedostot\Hewlett-Packard\Precisionscan Pro 3.1\hpsjbmgr.exe
O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /logon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Ohjelmatiedostot\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\TEMP\se.dll,DllInstall
O4 - HKCU\..\Run: [msnmsgr] "C:\Ohjelmatiedostot\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Officen käynnistys.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office Pikahaku.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Ohjelmatiedostot\WinZip\WZQKPICK.EXE
O13 - WWW. Prefix: http://
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/2.0.0.33/player.virtools.com/downloads/player/Install2.0/Installer.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 195.156.106.135
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 195.156.106.135
O18 - Filter: text/html - {AC9C4E10-80AA-11D9-A4A1-00018861B3F1} - C:\WINNT\System32\jmbi.dll
O18 - Filter: text/plain - {AC9C4E10-80AA-11D9-A4A1-00018861B3F1} - C:\WINNT\System32\jmbi.dll
O23 - Service: Compaq Local Alerter (CPQALERT) - Compaq Computer Corporation - C:\WINNT\System32\cpqalert.exe
O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) - Unknown owner - C:\WINNT\CPQDIAG\CPQDFWAG.EXE
O23 - Service: CPQDMI - Compaq Computer Corporation - C:\WINNT\System32\cpqdmi.exe
O23 - Service: Compaq DMI Web Agent (CpqWebDmi) - Compaq Computer Corporation - C:\Ohjelmatiedostot\COMPAQ\CpqWebDMI\webdmi.EXE
O23 - Service: Client Accessin Etäkomentopalvelu (Cwbrxd) - IBM Corporation - C:\WINNT\CWBRXD.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Ohjelmatiedostot\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Ohjelmatiedostot\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Ohjelmatiedostot\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Ohjelmatiedostot\F-Secure\Common\FSMA32.EXE
O23 - Service: Win32sl - Intel - c:\dmi\win32\bin\Win32sl.exe
Vastaukset 2
Vanhimmat
Pistä se HijackThis.exe omaan kansioon ennenku jatkat eteenpäin.
Poista Lisää/Poista paneelista jos näkyy
ShopperReports
Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina FIX checked
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\TEMP\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\TEMP\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: ShprRprts - {2A8A997F-BB9F-48F6-AA2B-2762D50F9289} - C:\Ohjelmatiedostot\ShopperReports\Bin\1.0.0.1\SmrtShpr.dll
O2 - BHO: (no name) - {79239431-8004-11D9-A49F-0001C6AF882F} - C:\WINNT\System32\jmbi.dll
O4 - HKLM\..\Run: [sp] rundll32 C:\TEMP\se.dll,DllInstall
O13 - WWW. Prefix: http://
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/2.0.0.33/player.virtools.com/downloads/player/Install2.0/Installer.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O18 - Filter: text/html - {AC9C4E10-80AA-11D9-A4A1-00018861B3F1} - C:\WINNT\System32\jmbi.dll
O18 - Filter: text/plain - {AC9C4E10-80AA-11D9-A4A1-00018861B3F1} - C:\WINNT\System32\jmbi.dll
Käynnistä sitte vikasietotilassa etsi ja poista jos löytyy
jmbi.dll
C:\Ohjelmatiedostot\ShopperReports\< kansio
C:\TEMP\se.dll,DllInstall
- tuolta pois se.dll
Käynnistä normaalisti ja uus logi.
pitkällisen taistelun ja taivuttelun jälkeen....iso kiitos ja kumarrus!!