Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    Ongelma

    Mikäköhän tässä mahtaa olla vikana??


    Logfile of HijackThis v1.99.0
    Scan saved at 18:14:25, on 18.2.2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
    C:\Norman\bin\ZANDA.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe
    C:\Norman\bin\ZLH.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    C:\ATI-CPanel\atiptaxx.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe
    C:\Norman\Nvc\BIN\NIP.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\NORMAN\Nvc\BIN\nipsvc.exe
    C:\NORMAN\Nvc\BIN\nvcoas.exe
    C:\Norman\bin\NJEEVES.EXE
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\Nvc\bin\cclaw.exe
    C:\WINDOWS\System32\connmie.exe
    C:\WINDOWS\System32\truettf.exe
    C:\WINDOWS\System32\dxconf.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\HJT2\HijackThis2.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://clearsurfing.net/srch.php?qq=%s
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
    O2 - BHO: Name - {9FEF02A7-2793-4B08-ABAB-7C0C22089DB4} - C:\WINDOWS\System32\msjnl.dll (file missing)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: FreshBar - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - C:\WINDOWS\System32\iecustom32.dll
    O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe"
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = ?
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by2fd.bay2.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103996560625
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{67D507B5-1DD3-4FB5-8C13-4610D3B12D2F}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9BD4D94E-7B48-4A4D-92E5-92A3DBB196D4}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{A6C05EFD-9802-4D27-903E-1D5B17B77C0A}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{CBE5DA09-5240-4EBF-B5F1-3E1FCC493747}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CS1\Services\Tcpip\..\{67D507B5-1DD3-4FB5-8C13-4610D3B12D2F}: NameServer = 69.50.188.180,195.225.176.31
    O23 - Service: *windows update - Unknown - C:\WINDOWS\System32\wxmvt.exe (file missing)
    O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
    O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
    O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
    O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
    O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
    O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
    O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
    O23 - Service: Norman API-hooking helper - Unknown - C:\NORMAN\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown - C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown - C:\Norman\bin\ZANDA.EXE
    O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
    O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
    O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
    O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
    O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe
    36950
    Äänestä

    Muut lukivat myös

    Vastaukset 36

    Vanhimmat

    Nuo ehkä jotain uusia örkkejä

    C:\WINDOWS\System32\connmie.exe
    C:\WINDOWS\System32\truettf.exe
    C:\WINDOWS\System32\dxconf.exe

    Scannaa ne yksitellen tuolla

    http://virusscan.jotti.org/

    Ilmota tulokset.

    Äänestä

    • Service load: 0% 100%

      File: connmie.exe
      Status: INFECTED/MALWARE (Note: only non-destructive malware has been found. Considering the non-destructive nature of samples like these - although they can be a pain in the ass -, results will not be stored in the database.)
      Packers detected: UPX

      AntiVir No viruses found (0.37 seconds taken)
      Avast No viruses found (1.53 seconds taken)
      AVG Antivirus No viruses found (0.39 seconds taken)
      BitDefender No viruses found (0.49 seconds taken)
      ClamAV No viruses found (0.58 seconds taken)
      Dr.Web not a virus Adware.FindSpy (0.86 seconds taken)
      F-Prot Antivirus No viruses found (0.09 seconds taken)
      Fortinet No viruses found (0.41 seconds taken)
      Kaspersky Anti-Virus not-a-virus:AdWare.FindSpy.a (1.00 seconds taken)
      mks_vir Trojan.Downloader.Sapox (0.22 seconds taken)
      NOD32 No viruses found (0.51 seconds taken)
      Norman Virus Control No viruses found (0.58 seconds taken)

      Statistics
      Last piece of malware found was Trojan.Agent.Bd in Gunbound_Aimbot.rar, detected by:

      Scanner Malware name Time taken
      AntiVir TR/Agent.BD 0.81 seconds
      Avast Win32:Trojan-gen. {Other} 3.03 seconds
      AVG Antivirus Agent.E 0.78 seconds
      BitDefender Trojan.Agent.BD 0.94 seconds
      ClamAV X 1.18 seconds
      Dr.Web Trojan.DragonBot 1.66 seconds
      F-Prot Antivirus X 0.26 seconds
      Fortinet W32/Agent.BD-tr 0.45 seconds
      Kaspersky Anti-Virus Trojan.Win32.Agent.bd 1.02 seconds
      mks_vir Trojan.Agent.Bd 0.23 seconds
      NOD32 X 5.91 seconds
      Norman Virus Control X 0.18 seconds





      Service load: 0% 100%

      File: truettf.exe
      Status: INFECTED/MALWARE (Note: only non-destructive malware has been found. Considering the non-destructive nature of samples like these - although they can be a pain in the ass -, results will not be stored in the database.)
      Packers detected: UPX

      AntiVir TR/Spy.Jepan (0.37 seconds taken)
      Avast No viruses found (1.53 seconds taken)
      AVG Antivirus No viruses found (0.38 seconds taken)
      BitDefender No viruses found (0.48 seconds taken)
      ClamAV No viruses found (0.60 seconds taken)
      Dr.Web Trojan.Click.209 (0.86 seconds taken)
      F-Prot Antivirus No viruses found (0.27 seconds taken)
      Fortinet W32/Adclicker.BW-tr (0.36 seconds taken)
      Kaspersky Anti-Virus not-a-virus:AdWare.Msnagent.a (1.01 seconds taken)
      mks_vir No viruses found (0.41 seconds taken)
      NOD32 No viruses found (0.56 seconds taken)
      Norman Virus Control No viruses found (6.42 seconds taken)

      Statistics
      Last piece of malware found was Trojan.Agent.Bd in Gunbound_Aimbot.rar, detected by:

      Scanner Malware name Time taken
      AntiVir TR/Agent.BD 0.81 seconds
      Avast Win32:Trojan-gen. {Other} 3.03 seconds
      AVG Antivirus Agent.E 0.78 seconds
      BitDefender Trojan.Agent.BD 0.94 seconds
      ClamAV X 1.18 seconds
      Dr.Web Trojan.DragonBot 1.66 seconds
      F-Prot Antivirus X 0.26 seconds
      Fortinet W32/Agent.BD-tr 0.45 seconds
      Kaspersky Anti-Virus Trojan.Win32.Agent.bd 1.02 seconds
      mks_vir Trojan.Agent.Bd 0.23 seconds
      NOD32 X 5.91 seconds
      Norman Virus Control X 0.18 seconds






      Service load: 0% 100%

      File: dxconf.exe
      Status: INFECTED/MALWARE (Note: only non-destructive malware has been found. Considering the non-destructive nature of samples like these - although they can be a pain in the ass -, results will not be stored in the database.)
      Packers detected: UPX

      AntiVir No viruses found (0.36 seconds taken)
      Avast No viruses found (1.52 seconds taken)
      AVG Antivirus No viruses found (1.26 seconds taken)
      BitDefender No viruses found (0.83 seconds taken)
      ClamAV No viruses found (1.13 seconds taken)
      Dr.Web Trojan.Click.239 (1.59 seconds taken)
      F-Prot Antivirus No viruses found (0.15 seconds taken)
      Fortinet No viruses found (0.54 seconds taken)
      Kaspersky Anti-Virus not-a-virus:AdWare.FindSpy.a (1.46 seconds taken)
      mks_vir No viruses found (0.48 seconds taken)
      NOD32 No viruses found (0.98 seconds taken)
      Norman Virus Control No viruses found (1.43 seconds taken)

      Statistics
      Last piece of malware found was Trojan.Agent.Bd in Gunbound_Aimbot.rar, detected by:

      Scanner Malware name Time taken
      AntiVir TR/Agent.BD 0.81 seconds
      Avast Win32:Trojan-gen. {Other} 3.03 seconds
      AVG Antivirus Agent.E 0.78 seconds
      BitDefender Trojan.Agent.BD 0.94 seconds
      ClamAV X 1.18 seconds
      Dr.Web Trojan.DragonBot 1.66 seconds
      F-Prot Antivirus X 0.26 seconds
      Fortinet W32/Agent.BD-tr 0.45 seconds
      Kaspersky Anti-Virus Trojan.Win32.Agent.bd 1.02 seconds
      mks_vir Trojan.Agent.Bd 0.23 seconds
      NOD32 X 5.91 seconds
      Norman Virus Control X 0.18 seconds

      Äänestä

    Poista Lisää/Poista paneelista jos näkyy

    FreshBar

    Sammuta nuo processit

    C:\WINDOWS\System32\connmie.exe
    C:\WINDOWS\System32\truettf.exe
    C:\WINDOWS\System32\dxconf.exe

    Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina FIX checked

    R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://clearsurfing.net/srch.php?qq=%s
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
    O2 - BHO: Name - {9FEF02A7-2793-4B08-ABAB-7C0C22089DB4} - C:\WINDOWS\System32\msjnl.dll (file missing)
    O3 - Toolbar: FreshBar - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - C:\WINDOWS\System32\iecustom32.dll
    O17 - HKLM\System\CCS\Services\Tcpip\..\{67D507B5-1DD3-4FB5-8C13-4610D3B12D2F}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9BD4D94E-7B48-4A4D-92E5-92A3DBB196D4}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{A6C05EFD-9802-4D27-903E-1D5B17B77C0A}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{CBE5DA09-5240-4EBF-B5F1-3E1FCC493747}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CS1\Services\Tcpip\..\{67D507B5-1DD3-4FB5-8C13-4610D3B12D2F}: NameServer = 69.50.188.180,195.225.176.31
    O23 - Service: *windows update - Unknown - C:\WINDOWS\System32\wxmvt.exe (file missing)


    Käynnistä sitte vikasietotilassa etsi ja poista jos löytyy

    iecustom32.dll
    connmie.exe
    truettf.exe
    dxconf.exe

    Käynnistä normaalisti ja uus logi.

    Äänestä

    • Ei löytynyt FreshBaria, eikä noita voinut sammuttaa ku ei niitä löytynyt sieltä.



      Logfile of HijackThis v1.99.0
      Scan saved at 19:30:22, on 18.2.2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe
      C:\Norman\bin\ZLH.EXE
      C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
      C:\ATI-CPanel\atiptaxx.exe
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
      C:\Norman\bin\ZANDA.EXE
      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      C:\WINDOWS\System32\wdfmgr.exe
      C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      C:\NORMAN\Nvc\BIN\nipsvc.exe
      C:\Norman\bin\NJEEVES.EXE
      C:\NORMAN\Nvc\BIN\nvcoas.exe
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\Norman\Nvc\bin\cclaw.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\HJT2\HijackThis2.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe"
      O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
      O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
      O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
      O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe" -lang 1033
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - Global Startup: Adobe Gamma Loader.lnk = ?
      O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by2fd.bay2.hotmail.msn.com/resources/MsnPUpld.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103996560625
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O23 - Service: *windows update - Unknown - C:\WINDOWS\System32\wxmvt.exe (file missing)
      O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
      O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
      O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
      O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
      O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
      O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
      O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
      O23 - Service: Norman API-hooking helper - Unknown - C:\NORMAN\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown - C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown - C:\Norman\bin\ZANDA.EXE
      O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
      O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
      O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
      O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
      O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
      O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
      O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

      Äänestä

    • Prio kirjoitti:

      Ei löytynyt FreshBaria, eikä noita voinut sammuttaa ku ei niitä löytynyt sieltä.



      Logfile of HijackThis v1.99.0
      Scan saved at 19:30:22, on 18.2.2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe
      C:\Norman\bin\ZLH.EXE
      C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
      C:\ATI-CPanel\atiptaxx.exe
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
      C:\Norman\bin\ZANDA.EXE
      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      C:\WINDOWS\System32\wdfmgr.exe
      C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      C:\NORMAN\Nvc\BIN\nipsvc.exe
      C:\Norman\bin\NJEEVES.EXE
      C:\NORMAN\Nvc\BIN\nvcoas.exe
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\Norman\Nvc\bin\cclaw.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\HJT2\HijackThis2.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe"
      O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
      O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
      O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
      O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe" -lang 1033
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - Global Startup: Adobe Gamma Loader.lnk = ?
      O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by2fd.bay2.hotmail.msn.com/resources/MsnPUpld.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103996560625
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O23 - Service: *windows update - Unknown - C:\WINDOWS\System32\wxmvt.exe (file missing)
      O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
      O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
      O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
      O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
      O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
      O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
      O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
      O23 - Service: Norman API-hooking helper - Unknown - C:\NORMAN\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown - C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown - C:\Norman\bin\ZANDA.EXE
      O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
      O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
      O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
      O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
      O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
      O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
      O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

      > eikä noita voinut sammuttaa ku ei niitä löytynyt sieltä <

      Saikko poistettua ne vikasietotilassa?

      Merkkaa ja FIX:saa tuo

      O23 - Service: *windows update - Unknown - C:\WINDOWS\System32\wxmvt.exe (file missing)


      Jos ite tai joku muu on ton määritelly,niin sen olla muuten merkka se myös

      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

      Äänestä

    • Juu kirjoitti:

      > eikä noita voinut sammuttaa ku ei niitä löytynyt sieltä <

      Saikko poistettua ne vikasietotilassa?

      Merkkaa ja FIX:saa tuo

      O23 - Service: *windows update - Unknown - C:\WINDOWS\System32\wxmvt.exe (file missing)


      Jos ite tai joku muu on ton määritelly,niin sen olla muuten merkka se myös

      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

      Sai poistettua vikasietotilassa, nyt FIXasin vielä nuo kaksi kohtaa, tossa logi nyt

      Logfile of HijackThis v1.99.0
      Scan saved at 20:04:27, on 18.2.2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe
      C:\Norman\bin\ZLH.EXE
      C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
      C:\ATI-CPanel\atiptaxx.exe
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
      C:\Norman\bin\ZANDA.EXE
      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      C:\WINDOWS\System32\wdfmgr.exe
      C:\Norman\bin\NJEEVES.EXE
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      C:\NORMAN\Nvc\BIN\nipsvc.exe
      C:\NORMAN\Nvc\BIN\nvcoas.exe
      C:\Norman\Nvc\bin\cclaw.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\HJT2\HijackThis2.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe"
      O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
      O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
      O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
      O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe" -lang 1033
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - Global Startup: Adobe Gamma Loader.lnk = ?
      O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by2fd.bay2.hotmail.msn.com/resources/MsnPUpld.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103996560625
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
      O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
      O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
      O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
      O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
      O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
      O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
      O23 - Service: Norman API-hooking helper - Unknown - C:\NORMAN\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown - C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown - C:\Norman\bin\ZANDA.EXE
      O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
      O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
      O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
      O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
      O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
      O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
      O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

      Äänestä

    • Prio kirjoitti:

      Sai poistettua vikasietotilassa, nyt FIXasin vielä nuo kaksi kohtaa, tossa logi nyt

      Logfile of HijackThis v1.99.0
      Scan saved at 20:04:27, on 18.2.2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe
      C:\Norman\bin\ZLH.EXE
      C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
      C:\ATI-CPanel\atiptaxx.exe
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
      C:\Norman\bin\ZANDA.EXE
      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      C:\WINDOWS\System32\wdfmgr.exe
      C:\Norman\bin\NJEEVES.EXE
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      C:\NORMAN\Nvc\BIN\nipsvc.exe
      C:\NORMAN\Nvc\BIN\nvcoas.exe
      C:\Norman\Nvc\bin\cclaw.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\HJT2\HijackThis2.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe"
      O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
      O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
      O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
      O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe" -lang 1033
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - Global Startup: Adobe Gamma Loader.lnk = ?
      O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by2fd.bay2.hotmail.msn.com/resources/MsnPUpld.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103996560625
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
      O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
      O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
      O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
      O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
      O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
      O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
      O23 - Service: Norman API-hooking helper - Unknown - C:\NORMAN\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown - C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown - C:\Norman\bin\ZANDA.EXE
      O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
      O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
      O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
      O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
      O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
      O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
      O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

      Logi on nyt kunnossa,mutta scannaa vielä kone tolla.
      Siellä voi olla vielä poistettavaa

      http://koti.mbnet.fi/pattaya1/escanmwav.htm

      Äänestä

    • Juu kirjoitti:

      Logi on nyt kunnossa,mutta scannaa vielä kone tolla.
      Siellä voi olla vielä poistettavaa

      http://koti.mbnet.fi/pattaya1/escanmwav.htm

      Tällaisia löytyi tällä laitteella, mitenkäs näitä poistetaan tai jotain:



      File C:\WINDOWS\System32\wscxt.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\WINDOWS\System32\wstcl.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\WINDOWS\System32\hdhrm.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\WINDOWS\System32\nlsfuncs.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\System32\openconf.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\System32\sethcd.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\WINDOWS\System32\smbdins.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\System32\tsmsetup.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\System32\unlodctl.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\System32\upncont.exe infected by "Trojan.Win32.StartPage.sl" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\wowdbe.exe infected by "Trojan-Dropper.Win32.Small.qt" Virus. Action Taken: File Deleted.
      File C:\dlltmp.exe infected by "Trojan.Win32.Bizten.gen" Virus. Action Taken: File Deleted.
      File C:\Program Files\Windows FormatAd\WinFormComm.dll tagged as not-a-virus:AdWare.WinAD.k. No Action Taken.
      File C:\sys1393.exe infected by "Trojan-Downloader.Win32.Agent.fs" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP77\A0579043.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP77\A0579059.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP77\A0579060.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP77\A0579061.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP78\A0580447.dll infected by "Trojan-Proxy.Win32.Webber.m" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP78\A0580449.dll infected by "Trojan-Proxy.Win32.Webber.m" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581734.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581771.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581788.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581804.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581817.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581830.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581843.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581858.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581871.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581884.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581897.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581910.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581923.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581936.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581949.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581962.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581975.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581988.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0582001.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0582010.dll infected by "Trojan.Win32.StartPage.sl" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0582012.exe infected by "Backdoor.Win32.Rbot.gn" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0582019.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0582041.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0582054.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP88\A0582068.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP88\A0582081.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP88\A0582094.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP88\A0582107.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582120.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582133.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582146.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582159.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582172.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582185.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582198.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582211.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582224.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582238.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582251.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582264.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582277.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582290.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582304.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582318.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582333.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582346.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582359.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582372.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582385.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582398.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582415.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582428.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582441.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582451.exe infected by "HackTool.Win32.Hidd.f" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582458.exe infected by "Trojan-Clicker.Win32.Agent.bu" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582552.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582553.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582555.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582618.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582619.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582620.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582665.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582666.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582667.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582670.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582671.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582672.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582673.exe infected by "Trojan.Win32.StartPage.sl" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582674.exe infected by "Trojan-Dropper.Win32.Small.qt" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582675.exe infected by "Trojan.Win32.Bizten.gen" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582676.exe infected by "Trojan-Downloader.Win32.Agent.fs" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1100.dll tagged as not-a-virus:AdWare.Gator.1101. No Action Taken.
      File C:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1100.dll tagged as not-a-virus:AdWare.Gator.1101. No Action Taken.
      File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8LOLMUKY\update[1].htm infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\WINDOWS\system32\nlsfuncs.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\system32\openconf.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\system32\sethcd.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\WINDOWS\system32\smbdins.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\system32\tsmsetup.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\system32\unlodctl.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\Temp\cvcevsybpta.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\WINDOWS\Temp\ilyqixmbagk.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\WINDOWS\Temp\wgwkcoyfay.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\WINDOWS\Temp\yrijdhlqc.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.

      Äänestä

    • Prio kirjoitti:

      Tällaisia löytyi tällä laitteella, mitenkäs näitä poistetaan tai jotain:



      File C:\WINDOWS\System32\wscxt.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\WINDOWS\System32\wstcl.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\WINDOWS\System32\hdhrm.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\WINDOWS\System32\nlsfuncs.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\System32\openconf.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\System32\sethcd.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\WINDOWS\System32\smbdins.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\System32\tsmsetup.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\System32\unlodctl.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\System32\upncont.exe infected by "Trojan.Win32.StartPage.sl" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\wowdbe.exe infected by "Trojan-Dropper.Win32.Small.qt" Virus. Action Taken: File Deleted.
      File C:\dlltmp.exe infected by "Trojan.Win32.Bizten.gen" Virus. Action Taken: File Deleted.
      File C:\Program Files\Windows FormatAd\WinFormComm.dll tagged as not-a-virus:AdWare.WinAD.k. No Action Taken.
      File C:\sys1393.exe infected by "Trojan-Downloader.Win32.Agent.fs" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP77\A0579043.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP77\A0579059.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP77\A0579060.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP77\A0579061.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP78\A0580447.dll infected by "Trojan-Proxy.Win32.Webber.m" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP78\A0580449.dll infected by "Trojan-Proxy.Win32.Webber.m" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581734.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581771.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581788.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581804.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581817.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581830.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581843.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581858.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581871.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581884.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581897.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581910.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581923.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581936.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581949.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581962.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581975.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0581988.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0582001.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0582010.dll infected by "Trojan.Win32.StartPage.sl" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0582012.exe infected by "Backdoor.Win32.Rbot.gn" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0582019.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0582041.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP87\A0582054.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP88\A0582068.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP88\A0582081.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP88\A0582094.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP88\A0582107.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582120.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582133.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582146.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582159.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582172.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582185.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582198.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582211.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582224.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582238.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582251.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582264.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582277.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582290.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582304.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582318.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582333.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582346.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582359.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582372.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582385.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582398.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP89\A0582415.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582428.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582441.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582451.exe infected by "HackTool.Win32.Hidd.f" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582458.exe infected by "Trojan-Clicker.Win32.Agent.bu" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582552.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582553.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582555.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582618.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582619.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582620.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582665.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582666.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582667.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582670.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582671.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582672.dll infected by "HackTool.Win32.Hidd.c" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582673.exe infected by "Trojan.Win32.StartPage.sl" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582674.exe infected by "Trojan-Dropper.Win32.Small.qt" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582675.exe infected by "Trojan.Win32.Bizten.gen" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP90\A0582676.exe infected by "Trojan-Downloader.Win32.Agent.fs" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1100.dll tagged as not-a-virus:AdWare.Gator.1101. No Action Taken.
      File C:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1100.dll tagged as not-a-virus:AdWare.Gator.1101. No Action Taken.
      File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8LOLMUKY\update[1].htm infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\WINDOWS\system32\nlsfuncs.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\system32\openconf.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\system32\sethcd.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\WINDOWS\system32\smbdins.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\system32\tsmsetup.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\system32\unlodctl.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\Temp\cvcevsybpta.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\WINDOWS\Temp\ilyqixmbagk.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\WINDOWS\Temp\wgwkcoyfay.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
      File C:\WINDOWS\Temp\yrijdhlqc.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.

      osan niistä löydöistä, kun otat systeemin palautustoiminnon pois päältä, sekä käynnistät koneen uudelleen
      OHJE tässä

      Windows XP:
      1. Valitse My Computer (klikkaa oikealla). ( OMA Tietokone )
      2. Valitse Properties.           ( Ominaisuudet )
      3. Valitse System Restore välilehti. ( Järjestelmän palautus )
      4. Valitse "Turn off System Restore".     ( Poista Palautus toiminto )
      5. Paina Apply.           ( Käytä )
      6. Paina OK.
      7. Käynnistä kone uudelleen

      Laita palautus takaisin päälle toistamalla äskeinen, mutta kohtaan 4 laitat sen palautuksen

      ETSI toiminnon avulla ne tiedostot, jotka ohjelma on nimennyt uudelleen == vaihtanut tiedostopäätteen ( File Renamed. )

      Esim. C:\WINDOWS\System32\wscxt.exe
      etsi > tiedosto wscxt.* ( * on tähti, tulee kerto-merkistä )löytää wscxt.???-nimetyn.
      OLE tarkkana ettet poista mitään muuta tiedostoa, kuin sen mitä etsit

      Käy samalla tavoin kaikki löydöt lävitse.

      NÄMÄ ohjelma on poistanut ( File Deleted. )

      Nämä voit myös poistaa ( tagged as not-a-virus:AdWare )

      Äänestä

    Mitäköhän vielä pitäis tehdä, tulee se "your computer might be at risk" tai joku semmonen jutska aina välillä. Poistelin äsken ton viimeisen ohjeen mukaan mut ei sieltä kovin paljoa voinut poistaa.
    Tossa logi:

    Logfile of HijackThis v1.99.0
    Scan saved at 17:45:56, on 23.2.2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe
    C:\Norman\bin\ZLH.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    C:\ATI-CPanel\atiptaxx.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
    C:\Norman\bin\ZANDA.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\Norman\Nvc\BIN\NIP.EXE
    C:\NORMAN\Nvc\BIN\nipsvc.exe
    C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\bin\NJEEVES.EXE
    C:\NORMAN\Nvc\BIN\nvcoas.exe
    C:\Norman\Nvc\bin\cclaw.exe
    C:\WINDOWS\System32\connmie.exe
    C:\WINDOWS\System32\truettf.exe
    C:\WINDOWS\System32\dxconf.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\HJT2\HijackThis2.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe"
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [*Microsoft Update] wstcl.exe
    O4 - HKLM\..\RunServices: [*Microsoft Update] wstcl.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [*Microsoft Update] wstcl.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = ?
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by2fd.bay2.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103996560625
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{67D507B5-1DD3-4FB5-8C13-4610D3B12D2F}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9BD4D94E-7B48-4A4D-92E5-92A3DBB196D4}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{A6C05EFD-9802-4D27-903E-1D5B17B77C0A}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{CBE5DA09-5240-4EBF-B5F1-3E1FCC493747}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CS1\Services\Tcpip\..\{67D507B5-1DD3-4FB5-8C13-4610D3B12D2F}: NameServer = 69.50.188.180,195.225.176.31
    O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
    O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
    O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
    O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
    O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
    O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
    O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
    O23 - Service: Norman API-hooking helper - Unknown - C:\NORMAN\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown - C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown - C:\Norman\bin\ZANDA.EXE
    O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
    O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
    O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
    O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
    O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

    Äänestä

    • Piilotiedostot näkyviin,ohje tuolla

      http://www.xtra.co.nz/help/0,,4155-1916458,00.html

      Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina FIX checked

      O4 - HKLM\..\Run: [*Microsoft Update] wstcl.exe
      O4 - HKLM\..\RunServices: [*Microsoft Update] wstcl.exe
      O4 - HKCU\..\Run: [*Microsoft Update] wstcl.exe
      O17 - HKLM\System\CCS\Services\Tcpip\..\{67D507B5-1DD3-4FB5-8C13-4610D3B12D2F}: NameServer = 69.50.188.180,195.225.176.31
      O17 - HKLM\System\CCS\Services\Tcpip\..\{9BD4D94E-7B48-4A4D-92E5-92A3DBB196D4}: NameServer = 69.50.188.180,195.225.176.31
      O17 - HKLM\System\CCS\Services\Tcpip\..\{A6C05EFD-9802-4D27-903E-1D5B17B77C0A}: NameServer = 69.50.188.180,195.225.176.31
      O17 - HKLM\System\CCS\Services\Tcpip\..\{CBE5DA09-5240-4EBF-B5F1-3E1FCC493747}: NameServer = 69.50.188.180,195.225.176.31
      O17 - HKLM\System\CS1\Services\Tcpip\..\{67D507B5-1DD3-4FB5-8C13-4610D3B12D2F}: NameServer = 69.50.188.180,195.225.176.31


      Käynnistä sitte vikasietotilassa etsi ja poista nuo

      wstcl.exe

      C:\WINDOWS\System32\connmie.exe
      C:\WINDOWS\System32\truettf.exe
      C:\WINDOWS\System32\dxconf.exe
      C:\WINDOWS\System32\nlsfuncs.exe
      C:\WINDOWS\System32\openconf.exe
      C:\WINDOWS\System32\sethcd.exe
      C:\WINDOWS\System32\smbdins.exe
      C:\WINDOWS\System32\tsmsetup.exe
      C:\WINDOWS\System32\unlodctl.exe

      C:\Program Files\Windows FormatAd\ < kansio

      Käynnistä sitte kone uudestaan ja scannaa uudestaan sillä escannilla,mutta muista päivittää se ensin.
      Ilmota tulokset,niin nähään joko ois puhasta.

      Äänestä

    • Juu kirjoitti:

      Piilotiedostot näkyviin,ohje tuolla

      http://www.xtra.co.nz/help/0,,4155-1916458,00.html

      Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina FIX checked

      O4 - HKLM\..\Run: [*Microsoft Update] wstcl.exe
      O4 - HKLM\..\RunServices: [*Microsoft Update] wstcl.exe
      O4 - HKCU\..\Run: [*Microsoft Update] wstcl.exe
      O17 - HKLM\System\CCS\Services\Tcpip\..\{67D507B5-1DD3-4FB5-8C13-4610D3B12D2F}: NameServer = 69.50.188.180,195.225.176.31
      O17 - HKLM\System\CCS\Services\Tcpip\..\{9BD4D94E-7B48-4A4D-92E5-92A3DBB196D4}: NameServer = 69.50.188.180,195.225.176.31
      O17 - HKLM\System\CCS\Services\Tcpip\..\{A6C05EFD-9802-4D27-903E-1D5B17B77C0A}: NameServer = 69.50.188.180,195.225.176.31
      O17 - HKLM\System\CCS\Services\Tcpip\..\{CBE5DA09-5240-4EBF-B5F1-3E1FCC493747}: NameServer = 69.50.188.180,195.225.176.31
      O17 - HKLM\System\CS1\Services\Tcpip\..\{67D507B5-1DD3-4FB5-8C13-4610D3B12D2F}: NameServer = 69.50.188.180,195.225.176.31


      Käynnistä sitte vikasietotilassa etsi ja poista nuo

      wstcl.exe

      C:\WINDOWS\System32\connmie.exe
      C:\WINDOWS\System32\truettf.exe
      C:\WINDOWS\System32\dxconf.exe
      C:\WINDOWS\System32\nlsfuncs.exe
      C:\WINDOWS\System32\openconf.exe
      C:\WINDOWS\System32\sethcd.exe
      C:\WINDOWS\System32\smbdins.exe
      C:\WINDOWS\System32\tsmsetup.exe
      C:\WINDOWS\System32\unlodctl.exe

      C:\Program Files\Windows FormatAd\ < kansio

      Käynnistä sitte kone uudestaan ja scannaa uudestaan sillä escannilla,mutta muista päivittää se ensin.
      Ilmota tulokset,niin nähään joko ois puhasta.

      Tossa escan lista ja alla vielä hjt:

      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc10.dll tagged as not-a-virus:AdWare.WinAD.k. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc24.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc25.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc26.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc4.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc5.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc6.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc7.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc8.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc9.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1100.dll tagged as not-a-virus:AdWare.Gator.1101. No Action Taken.
      File C:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1100.dll tagged as not-a-virus:AdWare.Gator.1101. No Action Taken.





      Logfile of HijackThis v1.99.0
      Scan saved at 19:52:46, on 23.2.2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
      C:\Norman\bin\ZANDA.EXE
      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      C:\WINDOWS\System32\wdfmgr.exe
      C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe
      C:\Norman\bin\ZLH.EXE
      C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
      C:\ATI-CPanel\atiptaxx.exe
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\NORMAN\Nvc\BIN\nvcoas.exe
      C:\NORMAN\Nvc\BIN\nipsvc.exe
      C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      C:\Norman\bin\NJEEVES.EXE
      C:\Norman\Nvc\bin\cclaw.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Scan\mwav.exe
      C:\Scan\mwav.exe
      C:\Kaspersky\mwavscan.com
      C:\Kaspersky\kavss.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\HJT2\HijackThis2.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe"
      O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
      O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
      O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
      O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe" -lang 1033
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - Global Startup: Adobe Gamma Loader.lnk = ?
      O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by2fd.bay2.hotmail.msn.com/resources/MsnPUpld.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103996560625
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
      O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
      O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
      O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
      O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
      O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
      O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
      O23 - Service: Norman API-hooking helper - Unknown - C:\NORMAN\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown - C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown - C:\Norman\bin\ZANDA.EXE
      O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
      O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
      O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
      O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
      O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
      O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
      O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

      Äänestä

    • Prio kirjoitti:

      Tossa escan lista ja alla vielä hjt:

      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc10.dll tagged as not-a-virus:AdWare.WinAD.k. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc24.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc25.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc26.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc4.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc5.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc6.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc7.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc8.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\RECYCLER\S-1-5-21-3795071625-1623521795-489868830-1005\Dc9.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1100.dll tagged as not-a-virus:AdWare.Gator.1101. No Action Taken.
      File C:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1100.dll tagged as not-a-virus:AdWare.Gator.1101. No Action Taken.





      Logfile of HijackThis v1.99.0
      Scan saved at 19:52:46, on 23.2.2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
      C:\Norman\bin\ZANDA.EXE
      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      C:\WINDOWS\System32\wdfmgr.exe
      C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe
      C:\Norman\bin\ZLH.EXE
      C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
      C:\ATI-CPanel\atiptaxx.exe
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\NORMAN\Nvc\BIN\nvcoas.exe
      C:\NORMAN\Nvc\BIN\nipsvc.exe
      C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      C:\Norman\bin\NJEEVES.EXE
      C:\Norman\Nvc\bin\cclaw.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Scan\mwav.exe
      C:\Scan\mwav.exe
      C:\Kaspersky\mwavscan.com
      C:\Kaspersky\kavss.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\HJT2\HijackThis2.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe"
      O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
      O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
      O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
      O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe" -lang 1033
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - Global Startup: Adobe Gamma Loader.lnk = ?
      O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by2fd.bay2.hotmail.msn.com/resources/MsnPUpld.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103996560625
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
      O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
      O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
      O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
      O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
      O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
      O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
      O23 - Service: Norman API-hooking helper - Unknown - C:\NORMAN\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown - C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown - C:\Norman\bin\ZANDA.EXE
      O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
      O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
      O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
      O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
      O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
      O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
      O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

      Nyt on logi kunnossa.

      Poista vielä nuo ja tyhjennä roskis

      C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1100.dll
      C:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1100.dll

      Äänestä

    • Juu kirjoitti:

      Nyt on logi kunnossa.

      Poista vielä nuo ja tyhjennä roskis

      C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1100.dll
      C:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1100.dll

      Ei löydy noita edellisiä ja tähän vieläkin pompsahtelee jotain outoja sivuja. Mitäköhän vielä vois tehdä??

      Äänestä

    • Prio kirjoitti:

      Ei löydy noita edellisiä ja tähän vieläkin pompsahtelee jotain outoja sivuja. Mitäköhän vielä vois tehdä??

      Kokeile syöttää nuo sinne Hijackin Delete a file on reboot kohtaan

      C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1100.dll

      C:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1100.dll


      Mitä sivuja ne on pistä pari osotetta.

      Äänestä

    • Juu kirjoitti:

      Kokeile syöttää nuo sinne Hijackin Delete a file on reboot kohtaan

      C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1100.dll

      C:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1100.dll


      Mitä sivuja ne on pistä pari osotetta.

      Ei oo nyt auennut sivuja, mut tonne suosikit- listaan tulee aika usein joku Links- kansio, tyhjä tosin.

      Äänestä

    • Juu kirjoitti:

      Kokeile syöttää nuo sinne Hijackin Delete a file on reboot kohtaan

      C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1100.dll

      C:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1100.dll


      Mitä sivuja ne on pistä pari osotetta.

      No nyt aukes http://datingwcats.com/search.php

      Äänestä

    • Prio kirjoitti:

      No nyt aukes http://datingwcats.com/search.php

      > mut tonne suosikit- listaan tulee aika usein joku Links- kansio, tyhjä tosin. <

      Mun mielestä normaalia,mullaki on siellä sama kansio.

      Muistakko jos löysit kaikki nuo ja sait poistettua ne

      C:\WINDOWS\System32\connmie.exe
      C:\WINDOWS\System32\truettf.exe
      C:\WINDOWS\System32\dxconf.exe
      C:\WINDOWS\System32\nlsfuncs.exe
      C:\WINDOWS\System32\openconf.exe
      C:\WINDOWS\System32\sethcd.exe
      C:\WINDOWS\System32\smbdins.exe
      C:\WINDOWS\System32\tsmsetup.exe
      C:\WINDOWS\System32\unlodctl.exe



      Ota tosta remv3.zip

      http://forums.skads.org/index.php?act=Attach&type=post&id=103

      Pura se omaan kansioon C:/lle
      Käynnistä sitte kone vikasietotilassa mee sinne kansioon ja tuplaklikkaa
      remv3.bat kohtaa ja anna sen scannata valmiiks.
      Käynnistä sitte kone normaalisti ja pistä se remv3.bat logi tänne

      Äänestä

    • Juu kirjoitti:

      > mut tonne suosikit- listaan tulee aika usein joku Links- kansio, tyhjä tosin. <

      Mun mielestä normaalia,mullaki on siellä sama kansio.

      Muistakko jos löysit kaikki nuo ja sait poistettua ne

      C:\WINDOWS\System32\connmie.exe
      C:\WINDOWS\System32\truettf.exe
      C:\WINDOWS\System32\dxconf.exe
      C:\WINDOWS\System32\nlsfuncs.exe
      C:\WINDOWS\System32\openconf.exe
      C:\WINDOWS\System32\sethcd.exe
      C:\WINDOWS\System32\smbdins.exe
      C:\WINDOWS\System32\tsmsetup.exe
      C:\WINDOWS\System32\unlodctl.exe



      Ota tosta remv3.zip

      http://forums.skads.org/index.php?act=Attach&type=post&id=103

      Pura se omaan kansioon C:/lle
      Käynnistä sitte kone vikasietotilassa mee sinne kansioon ja tuplaklikkaa
      remv3.bat kohtaa ja anna sen scannata valmiiks.
      Käynnistä sitte kone normaalisti ja pistä se remv3.bat logi tänne

      Noin puolet sai poistettua noista ja tossa ois logi


      Files Found.................
      ----------------------------------------

      Files Not deleted.................
      ----------------------------------------

      Merging registry entries
      -----------------------------------------------------------------
      The Registry Entries Found...
      -----------------------------------------------------------------


      Other bad files to be Manually deleted.. Please note that this might also list legit Files, be careful while deleting
      -----------------------------------------------------------------
      hdjtd.dll
      msi.dll
      Finished

      Äänestä

    • Juu kirjoitti:

      > mut tonne suosikit- listaan tulee aika usein joku Links- kansio, tyhjä tosin. <

      Mun mielestä normaalia,mullaki on siellä sama kansio.

      Muistakko jos löysit kaikki nuo ja sait poistettua ne

      C:\WINDOWS\System32\connmie.exe
      C:\WINDOWS\System32\truettf.exe
      C:\WINDOWS\System32\dxconf.exe
      C:\WINDOWS\System32\nlsfuncs.exe
      C:\WINDOWS\System32\openconf.exe
      C:\WINDOWS\System32\sethcd.exe
      C:\WINDOWS\System32\smbdins.exe
      C:\WINDOWS\System32\tsmsetup.exe
      C:\WINDOWS\System32\unlodctl.exe



      Ota tosta remv3.zip

      http://forums.skads.org/index.php?act=Attach&type=post&id=103

      Pura se omaan kansioon C:/lle
      Käynnistä sitte kone vikasietotilassa mee sinne kansioon ja tuplaklikkaa
      remv3.bat kohtaa ja anna sen scannata valmiiks.
      Käynnistä sitte kone normaalisti ja pistä se remv3.bat logi tänne

      Nyt aukes tällainen sivu http://www.jackandpoker.net/search.php

      Äänestä

    • Prio kirjoitti:

      Noin puolet sai poistettua noista ja tossa ois logi


      Files Found.................
      ----------------------------------------

      Files Not deleted.................
      ----------------------------------------

      Merging registry entries
      -----------------------------------------------------------------
      The Registry Entries Found...
      -----------------------------------------------------------------


      Other bad files to be Manually deleted.. Please note that this might also list legit Files, be careful while deleting
      -----------------------------------------------------------------
      hdjtd.dll
      msi.dll
      Finished

      > Noin puolet sai poistettua noista <

      No miten niille muille kävi.
      Eikö niitä löytynny vai eikö niitä voinnu poistaa.

      Scannaa tuo

      hdjtd.dll

      tuolla ja ilmoita tulos.

      http://virusscan.jotti.org/

      Äänestä

    • Juu kirjoitti:

      > Noin puolet sai poistettua noista <

      No miten niille muille kävi.
      Eikö niitä löytynny vai eikö niitä voinnu poistaa.

      Scannaa tuo

      hdjtd.dll

      tuolla ja ilmoita tulos.

      http://virusscan.jotti.org/

      Niitä ei löytynyt. Se ei scannannut tota vaán tuli teksti "The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file". Nyt muuten tuli suosikit kansioon n.10 outoa sivua

      Äänestä

    • Prio kirjoitti:

      Niitä ei löytynyt. Se ei scannannut tota vaán tuli teksti "The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file". Nyt muuten tuli suosikit kansioon n.10 outoa sivua

      Koitas ettiä vielä kerran ja piilotiedostot näkyvillä.
      Poista samalla tuo

      hdjtd.dll

      Äänestä

    Ei löytynyt sitä hdjtd.dll eikä näitä:
    C:\WINDOWS\System32\nlsfuncs.exe
    C:\WINDOWS\System32\openconf.exe
    C:\WINDOWS\System32\sethcd.exe
    C:\WINDOWS\System32\smbdins.exe
    C:\WINDOWS\System32\tsmsetup.exe
    C:\WINDOWS\System32\unlodctl.exe

    Ne kolme muuta löytyi ja poistettiin

    Äänestä

    • Sulje virus-sieppari Messenger sekä Netmeeting ja kokeilet puhdistaa sen jälkeen koneesi.

      Äänestä

    • tätä kirjoitti:

      Sulje virus-sieppari Messenger sekä Netmeeting ja kokeilet puhdistaa sen jälkeen koneesi.

      Miten tapahtuu??

      Äänestä

    • No kumma jos niitä ei löytynny.
      Ainaki se scanneri näytti löytävän ne.
      Päivitä se scanneri ja aja sillä vielä kerran.

      Äänestä

    • Juu kirjoitti:

      No kumma jos niitä ei löytynny.
      Ainaki se scanneri näytti löytävän ne.
      Päivitä se scanneri ja aja sillä vielä kerran.

      Tällä scannerillako piti ajaa:

      File C:\HJT2\backups\backup-20050202-232241-698.dll infected by "Trojan-Downloader.Win32.Murlo.c" Virus. Action Taken: File Deleted.
      File C:\mommafuck.exe tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.
      File C:\sd3hesa.exe tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000007.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000017.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000018.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000019.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000024.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000047.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000077.dll tagged as not-a-virus:AdWare.WinAD.k. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000078.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000079.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000080.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000087.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000088.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000089.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000090.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000091.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000092.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000119.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000133.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000148.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000165.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000181.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000200.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000227.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000243.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000244.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000245.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000253.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000266.dll infected by "Trojan-Downloader.Win32.Murlo.c" Virus. Action Taken: File Deleted.
      File C:\test.exe tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.
      File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8LOLMUKY\UndergroundCorpSoftwareDownloads[1].exe tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.
      File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CXOQL5M9\dl[1].htm tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.
      File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\ZX1LG6IH\Xsteel_downloader[1].exe tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.

      Äänestä

    • Prio kirjoitti:

      Tällä scannerillako piti ajaa:

      File C:\HJT2\backups\backup-20050202-232241-698.dll infected by "Trojan-Downloader.Win32.Murlo.c" Virus. Action Taken: File Deleted.
      File C:\mommafuck.exe tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.
      File C:\sd3hesa.exe tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000007.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000017.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000018.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000019.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000024.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000047.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000077.dll tagged as not-a-virus:AdWare.WinAD.k. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000078.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000079.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000080.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000087.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000088.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000089.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000090.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000091.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000092.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000119.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP1\A0000133.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000148.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000165.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000181.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000200.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000227.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000243.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000244.exe tagged as not-a-virus:AdWare.Msnagent.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000245.exe tagged as not-a-virus:AdWare.FindSpy.a. No Action Taken.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000253.dll infected by "HackTool.Win32.Hidd.g" Virus. Action Taken: File Renamed.
      File C:\System Volume Information\_restore{6EA0F8BB-25C4-4932-B75D-370D4DA510A0}\RP2\A0000266.dll infected by "Trojan-Downloader.Win32.Murlo.c" Virus. Action Taken: File Deleted.
      File C:\test.exe tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.
      File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8LOLMUKY\UndergroundCorpSoftwareDownloads[1].exe tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.
      File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CXOQL5M9\dl[1].htm tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.
      File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\ZX1LG6IH\Xsteel_downloader[1].exe tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.

      Taas löyty örkkejä,jokohan pop-upit asettuu ku nuo poistetaan.

      Eli poista nuo piilotiedostot näkyvissä

      C:\mommafuck.exe
      C:\sd3hesa.exe
      C:\test.exe

      Ja tyhjennä nuo Tempit

      C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8LOLMUKY\UndergroundCorpSoftwareDownloads[1].exe tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.
      File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CXOQL5M9\dl[1].htm tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.
      File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\ZX1LG6IH\Xsteel_downloader[1].exe tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.


      Sitte sammuta System Restore (järjestelmänpalautustoiminto).
      Käynnistä sitte kone uudestaan ja pistä se System Restore takas päälle ja tee uus palautuspiste

      Äänestä

    • Juu kirjoitti:

      Taas löyty örkkejä,jokohan pop-upit asettuu ku nuo poistetaan.

      Eli poista nuo piilotiedostot näkyvissä

      C:\mommafuck.exe
      C:\sd3hesa.exe
      C:\test.exe

      Ja tyhjennä nuo Tempit

      C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8LOLMUKY\UndergroundCorpSoftwareDownloads[1].exe tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.
      File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CXOQL5M9\dl[1].htm tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.
      File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\ZX1LG6IH\Xsteel_downloader[1].exe tagged as not-a-virus:AdWare.WinAD.z. No Action Taken.


      Sitte sammuta System Restore (järjestelmänpalautustoiminto).
      Käynnistä sitte kone uudestaan ja pistä se System Restore takas päälle ja tee uus palautuspiste

      Poistin ne tiedostot, mut miten nuo tempit tyhjennetään. Poistin evästeet ja tiedostot Internet- asetuksista.

      "Sitte sammuta System Restore (järjestelmänpalautustoiminto).
      Käynnistä sitte kone uudestaan ja pistä se System Restore takas päälle ja tee uus palautuspiste "

      Laitoin ruksin siihen laatikkoon ja sitte apply ja sammutin koneen. Sitte otin ruksin pois ja taas apply. Meniköhän oikein??

      Äänestä

    • Prio kirjoitti:

      Poistin ne tiedostot, mut miten nuo tempit tyhjennetään. Poistin evästeet ja tiedostot Internet- asetuksista.

      "Sitte sammuta System Restore (järjestelmänpalautustoiminto).
      Käynnistä sitte kone uudestaan ja pistä se System Restore takas päälle ja tee uus palautuspiste "

      Laitoin ruksin siihen laatikkoon ja sitte apply ja sammutin koneen. Sitte otin ruksin pois ja taas apply. Meniköhän oikein??

      > Poistin ne tiedostot <

      No hyvä jos löyty ja lähti pois

      > Poistin evästeet ja tiedostot Internet- asetuksista. <

      Joo no sieltähän niitä poistetaan,mutta saattaa sinne kummisnii jäädä jotain.

      > Laitoin ruksin siihen laatikkoon ja sitte apply ja sammutin koneen. Sitte otin ruksin pois ja taas apply. Meniköhän oikein?? <

      Joo silleen se menee

      Eipä muuta ku kattele,jos ne pop-upit loppu.

      Äänestä

    • Juu kirjoitti:

      > Poistin ne tiedostot <

      No hyvä jos löyty ja lähti pois

      > Poistin evästeet ja tiedostot Internet- asetuksista. <

      Joo no sieltähän niitä poistetaan,mutta saattaa sinne kummisnii jäädä jotain.

      > Laitoin ruksin siihen laatikkoon ja sitte apply ja sammutin koneen. Sitte otin ruksin pois ja taas apply. Meniköhän oikein?? <

      Joo silleen se menee

      Eipä muuta ku kattele,jos ne pop-upit loppu.

      Ei loppunut vielä, ja suosikit kansio on taas täynnä jotain...

      Äänestä

    • Prio kirjoitti:

      Ei loppunut vielä, ja suosikit kansio on taas täynnä jotain...

      Heh...olipas sitkee tapaus.

      Koitetaan tota,ota tosta

      http://www.sysinternals.com/files/procexpnt.zip

      Pura se omaan kansioon ja sitte auki
      Sitte ylhäältä View ja kato että siellä on täpit näissä kohissa

      Show processes form all users.
      Show Lower Pane
      Lower Pane View DLL's

      Sitte siittä ikkunasta klikkaa Explorer.exe kohtaa
      Sitte ylhäältä File > Save As > ja säästät sen ja sitte pistä tänne se logi,niin katotaan jos siinä näky jotain.

      Äänestä

    • Juu kirjoitti:

      Heh...olipas sitkee tapaus.

      Koitetaan tota,ota tosta

      http://www.sysinternals.com/files/procexpnt.zip

      Pura se omaan kansioon ja sitte auki
      Sitte ylhäältä View ja kato että siellä on täpit näissä kohissa

      Show processes form all users.
      Show Lower Pane
      Lower Pane View DLL's

      Sitte siittä ikkunasta klikkaa Explorer.exe kohtaa
      Sitte ylhäältä File > Save As > ja säästät sen ja sitte pistä tänne se logi,niin katotaan jos siinä näky jotain.

      Process   PID   CPU   Description   Company Name
      System Idle Process   0   95      
      Interrupts   n/a      Hardware Interrupts   
      DPCs   n/a      Deferred Procedure Calls   
      System   4         
      smss.exe   568      Windows NT Session Manager   Microsoft Corporation
      csrss.exe   672      Client Server Runtime Process   Microsoft Corporation
      winlogon.exe   696      Windows NT -kirjaus   Microsoft Corporation
      services.exe   860      Palvelu- ja ohjainohjelma   Microsoft Corporation
      svchost.exe   1072      Generic Host Process for Win32 Services   Microsoft Corporation
      svchost.exe   1096      Generic Host Process for Win32 Services   Microsoft Corporation
      svchost.exe   1328      Generic Host Process for Win32 Services   Microsoft Corporation
      svchost.exe   1408      Generic Host Process for Win32 Services   Microsoft Corporation
      spoolsv.exe   1572      Spooler SubSystem App   Microsoft Corporation
      NPFSVICE.EXE   1696         
      Zanda.exe   1732         
      SMAgent.exe   1784      SoundMAX service agent component   Analog Devices, Inc.
      wdfmgr.exe   1848      Windows User Mode Driver Manager   Microsoft Corporation
      Nipsvc.exe   788         
      Njeeves.exe   912         
      Nvcsched.exe   1040      NVC Scheduler   Norman Data Defense Systems
      Nvcoas.exe   1272      NVC on-access virus scanner   Norman ASA
      lsass.exe   872      LSA Shell (Export Version)   Microsoft Corporation
      explorer.exe   1400      Resurssienhallinta   Microsoft Corporation
      CnxDslTb.exe   180      TaskBar Application   Conexant Systems Inc.
      Zlh.exe   168   2      
      Nip.exe   484         
      SMTray.exe   212      SoundMAX System Tray   Analog Devices, Inc.
      atiptaxx.exe   232      ATI Desktop Control Panel   ATI Technologies, Inc.
      WkUFind.exe   244      Microsoft® Works Update Detection   Microsoft® Corporation
      qttask.exe   256         Apple Computer, Inc.
      daemon.exe   276      Virtual DAEMON Manager   DAEMON'S HOME
      msmsgs.exe   324      Messenger   Microsoft Corporation
      ctfmon.exe   408      CTF Loader   Microsoft Corporation
      WinCinemaMgr.exe   560      WinCinema Manager   
      IEXPLORE.EXE   2696      Internet Explorer   Microsoft Corporation
      WinRAR.exe   2620         
      procexp.exe   2848   3   Sysinternals Process Explorer   Sysinternals
      CClaw.exe   640         
      connmie.exe   1028         
      truettf.exe   2076         
      dxconf.exe   2096         

      Process: explorer.exe Pid: 1400

      Name   Description   Company Name   Version
      activeds.dll   ADs Router Layer DLL   Microsoft Corporation   5.01.2600.0000
      adsldpc.dll   ADs LDAP Provider C DLL   Microsoft Corporation   5.01.2600.1106
      advapi32.dll   Windows 32 -pohjainen lisä-API   Microsoft Corporation   5.01.2600.1106
      apphelp.dll   Application Compatibility Client Library   Microsoft Corporation   5.01.2600.1106
      atl.dll   ATL Module for Windows NT (Unicode)   Microsoft Corporation   3.00.9435.0000
      batmeter.dll   Battery Meter Helper -kirjasto (DLL)   Microsoft Corporation   6.00.2600.0000
      browselc.dll   Liittymäselaimen käyttöliittymäkirjasto   Microsoft Corporation   6.00.2800.1106
      browseui.dll   Liittymäselaimen käyttöliittymäkirjasto   Microsoft Corporation   6.00.2800.1106
      cfgmgr32.dll   Configuration Manager Forwarder DLL   Microsoft Corporation   5.01.2600.0000
      clbcatq.dll      Microsoft Corporation   2001.12.4414.0042
      comctl32.dll   User Experience Controls Library   Microsoft Corporation   6.00.2800.1106
      comctl32.dll   Common Controls Library   Microsoft Corporation   5.82.2800.1106
      comres.dll      Microsoft Corporation   2001.12.4414.0042
      credui.dll   Credential Manager User Interface   Microsoft Corporation   5.01.2600.1106
      crypt32.dll   Crypto API32   Microsoft Corporation   5.131.2600.1123
      cscdll.dll   Offline-verkkoagentti   Microsoft Corporation   5.01.2600.0000
      cscui.dll   Asiakkaan puskurointiliittymä   Microsoft Corporation   5.01.2600.1106
      ctype.nls         
      davclnt.dll   Web DAV Client DLL   Microsoft Corporation   5.01.2600.0000
      drprov.dll   Microsoft Terminal Server Network Provider   Microsoft Corporation   5.01.2600.0000
      duser.dll   Windows DirectUser Engine   Microsoft Corporation   5.01.2600.1106
      explorer.exe   Resurssienhallinta   Microsoft Corporation   6.00.2800.1106
      fxsapi.dll   Microsoft Fax API Support DLL   Microsoft Corporation   5.02.1776.1023
      fxsst.dll   Faksipalvelu   Microsoft Corporation   5.02.1776.1023
      gdi32.dll   GDI Client DLL   Microsoft Corporation   5.01.2600.1106
      imagehlp.dll   Windows NT Image Helper   Microsoft Corporation   5.01.2600.1106
      index.dat         
      index.dat         
      index.dat         
      index.dat         
      iphlpapi.dll   IP Helper API   Microsoft Corporation   5.01.2600.0002
      kernel32.dll   Windows NT BASE APIn asiakas-DLL   Microsoft Corporation   5.01.2600.1106
      linkinfo.dll   Windows Volume Tracking   Microsoft Corporation   5.01.2600.0000
      locale.nls         
      midimap.dll   Microsoft MIDI-kartoitin   Microsoft Corporation   5.01.2600.0000
      mpr.dll   Monipalvelureititin-DLL   Microsoft Corporation   5.01.2600.0000
      msacm32.dll   Microsoft ACM Audio Filter   Microsoft Corporation   5.01.2600.0000
      msacm32.drv   Microsoft Sound Mapper   Microsoft Corporation   5.01.2600.0000
      msasn1.dll   ASN.1 Runtime APIs   Microsoft Corporation   5.01.2600.0000
      MSCTF.dll   MSCTF Server DLL   Microsoft Corporation   5.01.2600.1106
      msi.dll   Windows Installer   Microsoft Corporation   2.00.2600.1106
      msimg32.dll   GDIEXT Client DLL   Microsoft Corporation   5.01.2600.1106
      mstla.dll         
      msutb.dll   MSUTB Server DLL   Microsoft Corporation   5.01.2600.1106
      msvcrt.dll   Windows NT CRT DLL   Microsoft Corporation   7.00.2600.1106
      mydocs.dll   Omat tiedostot -kansion käyttöliittymä   Microsoft Corporation   6.00.2600.0000
      netapi32.dll   Net Win32 API DLL   Microsoft Corporation   5.01.2600.1106
      netrap.dll   Net Remote Admin Protocol DLL   Microsoft Corporation   5.01.2600.0000
      netshell.dll   Network Connections Shell   Microsoft Corporation   5.01.2600.1106
      netui0.dll   NT LM UI Common Code - GUI-luokat   Microsoft Corporation   5.01.2600.0000
      netui1.dll   NT LM UI Common Code - Networking classes   Microsoft Corporation   5.01.2600.0000
      Niphk.dll         
      ntdll.dll   NT Layer -kirjasto (DLL)   Microsoft Corporation   5.01.2600.1217
      ntlanman.dll   Microsoft® Lan Manager   Microsoft Corporation   5.01.2600.1106
      ntmarta.dll   Windows NT MARTA -toimittaja   Microsoft Corporation   5.01.2600.1106
      ntshrui.dll   Liittymälaajennus jakamista varten   Microsoft Corporation   5.01.2600.1106
      ole32.dll   Microsoft OLE Windowsia varten   Microsoft Corporation   5.01.2600.1263
      oleaut32.dll   Microsoft OLE 3.50 for Windows NT(TM) and Windows 95(TM) Operating Systems   Microsoft Corporation   3.50.5016.0000
      powrprof.dll   Power Profile Helper DLL   Microsoft Corporation   6.00.2600.0000
      printui.dll   Tulostuksen käyttöliittymä   Microsoft Corporation   5.01.2600.1106
      R000000000008.clb         
      rpcrt4.dll   Remote Procedure Call Runtime   Microsoft Corporation   5.01.2600.1254
      rsaenh.dll   Microsoft Base Cryptographic Provider   Microsoft Corporation   5.01.2600.1029
      samlib.dll   SAM Library DLL   Microsoft Corporation   5.01.2600.1106
      secur32.dll   Security Support Provider Interface   Microsoft Corporation   5.01.2600.1106
      setupapi.dll   Windows Setup API   Microsoft Corporation   5.01.2600.1106
      shdoclc.dll   Shell Doc -objekti ja Control-kirjasto   Microsoft Corporation   6.00.2600.0000
      shdocvw.dll   Shell Doc -objekti ja Control-kirjasto   Microsoft Corporation   6.00.2800.1203
      shell32.dll   Windows-käyttöliittymän yleinen DLL   Microsoft Corporation   6.00.2800.1233
      SHLWAPI.DLL   Shell Light-weight Utility Library   Microsoft Corporation   6.00.2800.1226
      sortkey.nls         
      sorttbls.nls         
      stobject.dll   Systray shell -palvelun objekti   Microsoft Corporation   5.01.2600.1106
      sxs.dll   Fusion 2.5   Microsoft Corporation   5.01.2600.1106
      Syncor11.dll   SynthCore R2.0 Midi Interface Driver   SoundMAX   0.01.0002.0003
      themeui.dll   Windows Theme API   Microsoft Corporation   6.00.2800.1106
      unicode.nls         
      urlmon.dll   OLE32-laajennukset Win32:ta varten   Microsoft Corporation   6.00.2800.1226
      user32.dll   Windows XP USER API Client DLL   Microsoft Corporation   5.01.2600.1106
      userenv.dll   Userenv   Microsoft Corporation   5.01.2600.1106
      uxtheme.dll   Microsoft UxTheme Library   Microsoft Corporation   6.00.2800.1106
      wdmaud.drv   WDM Audio driver mapper   Microsoft Corporation   5.01.2600.0000
      webcheck.dll   Web-sivuston valvonta   Microsoft Corporation   6.00.2800.1106
      version.dll   Version Checking and File Installation Libraries   Microsoft Corporation   5.01.2600.0000
      wininet.dll   Internet-laajennus Win32:ta varten   Microsoft Corporation   6.00.2800.1106
      winmm.dll   MCI API DLL   Microsoft Corporation   5.01.2600.1106
      winspool.drv   Windows Taustatulostusohjain   Microsoft Corporation   5.01.2600.1106
      winsta.dll   Winstation Library   Microsoft Corporation   5.01.2600.1106
      wintrust.dll   Microsoft Trust Verification APIt   Microsoft Corporation   5.131.2600.0000
      wldap32.dll   Win32 Ldap API dll   Microsoft Corporation   5.01.2600.1106
      ws2_32.dll   Windows Socket 2.0 32-Bit DLL   Microsoft Corporation   5.01.2600.0000
      ws2help.dll   Windows NT:n Windows Socket 2.0 Helper   Microsoft Corporation   5.01.2600.0000
      wtsapi32.dll   Windows Terminal Server SDK APIs   Microsoft Corporation   5.01.2600.1106

      Äänestä

    • Prio kirjoitti:

      Process   PID   CPU   Description   Company Name
      System Idle Process   0   95      
      Interrupts   n/a      Hardware Interrupts   
      DPCs   n/a      Deferred Procedure Calls   
      System   4         
      smss.exe   568      Windows NT Session Manager   Microsoft Corporation
      csrss.exe   672      Client Server Runtime Process   Microsoft Corporation
      winlogon.exe   696      Windows NT -kirjaus   Microsoft Corporation
      services.exe   860      Palvelu- ja ohjainohjelma   Microsoft Corporation
      svchost.exe   1072      Generic Host Process for Win32 Services   Microsoft Corporation
      svchost.exe   1096      Generic Host Process for Win32 Services   Microsoft Corporation
      svchost.exe   1328      Generic Host Process for Win32 Services   Microsoft Corporation
      svchost.exe   1408      Generic Host Process for Win32 Services   Microsoft Corporation
      spoolsv.exe   1572      Spooler SubSystem App   Microsoft Corporation
      NPFSVICE.EXE   1696         
      Zanda.exe   1732         
      SMAgent.exe   1784      SoundMAX service agent component   Analog Devices, Inc.
      wdfmgr.exe   1848      Windows User Mode Driver Manager   Microsoft Corporation
      Nipsvc.exe   788         
      Njeeves.exe   912         
      Nvcsched.exe   1040      NVC Scheduler   Norman Data Defense Systems
      Nvcoas.exe   1272      NVC on-access virus scanner   Norman ASA
      lsass.exe   872      LSA Shell (Export Version)   Microsoft Corporation
      explorer.exe   1400      Resurssienhallinta   Microsoft Corporation
      CnxDslTb.exe   180      TaskBar Application   Conexant Systems Inc.
      Zlh.exe   168   2      
      Nip.exe   484         
      SMTray.exe   212      SoundMAX System Tray   Analog Devices, Inc.
      atiptaxx.exe   232      ATI Desktop Control Panel   ATI Technologies, Inc.
      WkUFind.exe   244      Microsoft® Works Update Detection   Microsoft® Corporation
      qttask.exe   256         Apple Computer, Inc.
      daemon.exe   276      Virtual DAEMON Manager   DAEMON'S HOME
      msmsgs.exe   324      Messenger   Microsoft Corporation
      ctfmon.exe   408      CTF Loader   Microsoft Corporation
      WinCinemaMgr.exe   560      WinCinema Manager   
      IEXPLORE.EXE   2696      Internet Explorer   Microsoft Corporation
      WinRAR.exe   2620         
      procexp.exe   2848   3   Sysinternals Process Explorer   Sysinternals
      CClaw.exe   640         
      connmie.exe   1028         
      truettf.exe   2076         
      dxconf.exe   2096         

      Process: explorer.exe Pid: 1400

      Name   Description   Company Name   Version
      activeds.dll   ADs Router Layer DLL   Microsoft Corporation   5.01.2600.0000
      adsldpc.dll   ADs LDAP Provider C DLL   Microsoft Corporation   5.01.2600.1106
      advapi32.dll   Windows 32 -pohjainen lisä-API   Microsoft Corporation   5.01.2600.1106
      apphelp.dll   Application Compatibility Client Library   Microsoft Corporation   5.01.2600.1106
      atl.dll   ATL Module for Windows NT (Unicode)   Microsoft Corporation   3.00.9435.0000
      batmeter.dll   Battery Meter Helper -kirjasto (DLL)   Microsoft Corporation   6.00.2600.0000
      browselc.dll   Liittymäselaimen käyttöliittymäkirjasto   Microsoft Corporation   6.00.2800.1106
      browseui.dll   Liittymäselaimen käyttöliittymäkirjasto   Microsoft Corporation   6.00.2800.1106
      cfgmgr32.dll   Configuration Manager Forwarder DLL   Microsoft Corporation   5.01.2600.0000
      clbcatq.dll      Microsoft Corporation   2001.12.4414.0042
      comctl32.dll   User Experience Controls Library   Microsoft Corporation   6.00.2800.1106
      comctl32.dll   Common Controls Library   Microsoft Corporation   5.82.2800.1106
      comres.dll      Microsoft Corporation   2001.12.4414.0042
      credui.dll   Credential Manager User Interface   Microsoft Corporation   5.01.2600.1106
      crypt32.dll   Crypto API32   Microsoft Corporation   5.131.2600.1123
      cscdll.dll   Offline-verkkoagentti   Microsoft Corporation   5.01.2600.0000
      cscui.dll   Asiakkaan puskurointiliittymä   Microsoft Corporation   5.01.2600.1106
      ctype.nls         
      davclnt.dll   Web DAV Client DLL   Microsoft Corporation   5.01.2600.0000
      drprov.dll   Microsoft Terminal Server Network Provider   Microsoft Corporation   5.01.2600.0000
      duser.dll   Windows DirectUser Engine   Microsoft Corporation   5.01.2600.1106
      explorer.exe   Resurssienhallinta   Microsoft Corporation   6.00.2800.1106
      fxsapi.dll   Microsoft Fax API Support DLL   Microsoft Corporation   5.02.1776.1023
      fxsst.dll   Faksipalvelu   Microsoft Corporation   5.02.1776.1023
      gdi32.dll   GDI Client DLL   Microsoft Corporation   5.01.2600.1106
      imagehlp.dll   Windows NT Image Helper   Microsoft Corporation   5.01.2600.1106
      index.dat         
      index.dat         
      index.dat         
      index.dat         
      iphlpapi.dll   IP Helper API   Microsoft Corporation   5.01.2600.0002
      kernel32.dll   Windows NT BASE APIn asiakas-DLL   Microsoft Corporation   5.01.2600.1106
      linkinfo.dll   Windows Volume Tracking   Microsoft Corporation   5.01.2600.0000
      locale.nls         
      midimap.dll   Microsoft MIDI-kartoitin   Microsoft Corporation   5.01.2600.0000
      mpr.dll   Monipalvelureititin-DLL   Microsoft Corporation   5.01.2600.0000
      msacm32.dll   Microsoft ACM Audio Filter   Microsoft Corporation   5.01.2600.0000
      msacm32.drv   Microsoft Sound Mapper   Microsoft Corporation   5.01.2600.0000
      msasn1.dll   ASN.1 Runtime APIs   Microsoft Corporation   5.01.2600.0000
      MSCTF.dll   MSCTF Server DLL   Microsoft Corporation   5.01.2600.1106
      msi.dll   Windows Installer   Microsoft Corporation   2.00.2600.1106
      msimg32.dll   GDIEXT Client DLL   Microsoft Corporation   5.01.2600.1106
      mstla.dll         
      msutb.dll   MSUTB Server DLL   Microsoft Corporation   5.01.2600.1106
      msvcrt.dll   Windows NT CRT DLL   Microsoft Corporation   7.00.2600.1106
      mydocs.dll   Omat tiedostot -kansion käyttöliittymä   Microsoft Corporation   6.00.2600.0000
      netapi32.dll   Net Win32 API DLL   Microsoft Corporation   5.01.2600.1106
      netrap.dll   Net Remote Admin Protocol DLL   Microsoft Corporation   5.01.2600.0000
      netshell.dll   Network Connections Shell   Microsoft Corporation   5.01.2600.1106
      netui0.dll   NT LM UI Common Code - GUI-luokat   Microsoft Corporation   5.01.2600.0000
      netui1.dll   NT LM UI Common Code - Networking classes   Microsoft Corporation   5.01.2600.0000
      Niphk.dll         
      ntdll.dll   NT Layer -kirjasto (DLL)   Microsoft Corporation   5.01.2600.1217
      ntlanman.dll   Microsoft® Lan Manager   Microsoft Corporation   5.01.2600.1106
      ntmarta.dll   Windows NT MARTA -toimittaja   Microsoft Corporation   5.01.2600.1106
      ntshrui.dll   Liittymälaajennus jakamista varten   Microsoft Corporation   5.01.2600.1106
      ole32.dll   Microsoft OLE Windowsia varten   Microsoft Corporation   5.01.2600.1263
      oleaut32.dll   Microsoft OLE 3.50 for Windows NT(TM) and Windows 95(TM) Operating Systems   Microsoft Corporation   3.50.5016.0000
      powrprof.dll   Power Profile Helper DLL   Microsoft Corporation   6.00.2600.0000
      printui.dll   Tulostuksen käyttöliittymä   Microsoft Corporation   5.01.2600.1106
      R000000000008.clb         
      rpcrt4.dll   Remote Procedure Call Runtime   Microsoft Corporation   5.01.2600.1254
      rsaenh.dll   Microsoft Base Cryptographic Provider   Microsoft Corporation   5.01.2600.1029
      samlib.dll   SAM Library DLL   Microsoft Corporation   5.01.2600.1106
      secur32.dll   Security Support Provider Interface   Microsoft Corporation   5.01.2600.1106
      setupapi.dll   Windows Setup API   Microsoft Corporation   5.01.2600.1106
      shdoclc.dll   Shell Doc -objekti ja Control-kirjasto   Microsoft Corporation   6.00.2600.0000
      shdocvw.dll   Shell Doc -objekti ja Control-kirjasto   Microsoft Corporation   6.00.2800.1203
      shell32.dll   Windows-käyttöliittymän yleinen DLL   Microsoft Corporation   6.00.2800.1233
      SHLWAPI.DLL   Shell Light-weight Utility Library   Microsoft Corporation   6.00.2800.1226
      sortkey.nls         
      sorttbls.nls         
      stobject.dll   Systray shell -palvelun objekti   Microsoft Corporation   5.01.2600.1106
      sxs.dll   Fusion 2.5   Microsoft Corporation   5.01.2600.1106
      Syncor11.dll   SynthCore R2.0 Midi Interface Driver   SoundMAX   0.01.0002.0003
      themeui.dll   Windows Theme API   Microsoft Corporation   6.00.2800.1106
      unicode.nls         
      urlmon.dll   OLE32-laajennukset Win32:ta varten   Microsoft Corporation   6.00.2800.1226
      user32.dll   Windows XP USER API Client DLL   Microsoft Corporation   5.01.2600.1106
      userenv.dll   Userenv   Microsoft Corporation   5.01.2600.1106
      uxtheme.dll   Microsoft UxTheme Library   Microsoft Corporation   6.00.2800.1106
      wdmaud.drv   WDM Audio driver mapper   Microsoft Corporation   5.01.2600.0000
      webcheck.dll   Web-sivuston valvonta   Microsoft Corporation   6.00.2800.1106
      version.dll   Version Checking and File Installation Libraries   Microsoft Corporation   5.01.2600.0000
      wininet.dll   Internet-laajennus Win32:ta varten   Microsoft Corporation   6.00.2800.1106
      winmm.dll   MCI API DLL   Microsoft Corporation   5.01.2600.1106
      winspool.drv   Windows Taustatulostusohjain   Microsoft Corporation   5.01.2600.1106
      winsta.dll   Winstation Library   Microsoft Corporation   5.01.2600.1106
      wintrust.dll   Microsoft Trust Verification APIt   Microsoft Corporation   5.131.2600.0000
      wldap32.dll   Win32 Ldap API dll   Microsoft Corporation   5.01.2600.1106
      ws2_32.dll   Windows Socket 2.0 32-Bit DLL   Microsoft Corporation   5.01.2600.0000
      ws2help.dll   Windows NT:n Windows Socket 2.0 Helper   Microsoft Corporation   5.01.2600.0000
      wtsapi32.dll   Windows Terminal Server SDK APIs   Microsoft Corporation   5.01.2600.1106

      Taas nää samat on täällä.
      Etsi ja poista nuo

      connmie.exe
      truettf.exe
      dxconf.exe
      mstla.dll

      Käynnistä kone uudestaan ja kato mikä on tilanne.

      Äänestä

    • Juu kirjoitti:

      Taas nää samat on täällä.
      Etsi ja poista nuo

      connmie.exe
      truettf.exe
      dxconf.exe
      mstla.dll

      Käynnistä kone uudestaan ja kato mikä on tilanne.

      Nyt on taas ilmaantunut ongelmia, onko tässä vikaa:

      Logfile of HijackThis v1.99.0
      Scan saved at 21:00:18, on 7.3.2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
      C:\Norman\bin\ZANDA.EXE
      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      C:\WINDOWS\System32\wdfmgr.exe
      C:\Norman\bin\NJEEVES.EXE
      C:\NORMAN\Nvc\BIN\nipsvc.exe
      C:\NORMAN\Nvc\BIN\nvcoas.exe
      C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe
      C:\Norman\bin\ZLH.EXE
      C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
      C:\ATI-CPanel\atiptaxx.exe
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\Norman\Nvc\bin\cclaw.exe
      C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\HJT2\HijackThis2.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe"
      O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
      O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
      O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
      O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
      O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [itcywrg] c:\windows\tkpqsdw.exe
      O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
      O4 - Startup: winupdate07659749[1].exe
      O4 - Global Startup: Adobe Gamma Loader.lnk = ?
      O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by2fd.bay2.hotmail.msn.com/resources/MsnPUpld.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103996560625
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O21 - SSODL: eplrr - {DEF33230-8340-49C3-9975-32821ABBD89F} - C:\WINDOWS\System32\eplrr3.dll
      O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
      O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
      O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
      O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
      O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
      O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
      O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
      O23 - Service: Norman API-hooking helper - Unknown - C:\NORMAN\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown - C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown - C:\Norman\bin\ZANDA.EXE
      O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
      O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
      O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
      O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
      O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
      O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
      O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    Prio kirjoitti:

    Mikäköhän tässä mahtaa olla vikana??


    Logfile of HijackThis v1.99.0
    Scan saved at 18:14:25, on 18.2.2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
    C:\Norman\bin\ZANDA.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe
    C:\Norman\bin\ZLH.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    C:\ATI-CPanel\atiptaxx.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe
    C:\Norman\Nvc\BIN\NIP.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\NORMAN\Nvc\BIN\nipsvc.exe
    C:\NORMAN\Nvc\BIN\nvcoas.exe
    C:\Norman\bin\NJEEVES.EXE
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\Nvc\bin\cclaw.exe
    C:\WINDOWS\System32\connmie.exe
    C:\WINDOWS\System32\truettf.exe
    C:\WINDOWS\System32\dxconf.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\HJT2\HijackThis2.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://clearsurfing.net/srch.php?qq=%s
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
    O2 - BHO: Name - {9FEF02A7-2793-4B08-ABAB-7C0C22089DB4} - C:\WINDOWS\System32\msjnl.dll (file missing)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: FreshBar - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - C:\WINDOWS\System32\iecustom32.dll
    O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TeleWell\TW-EA100B ADSL USB\CnxDslTb.exe"
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Documents and Settings\Tomppa\Omat tiedostot\Geims\Daemon tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = ?
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by2fd.bay2.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103996560625
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{67D507B5-1DD3-4FB5-8C13-4610D3B12D2F}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9BD4D94E-7B48-4A4D-92E5-92A3DBB196D4}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{A6C05EFD-9802-4D27-903E-1D5B17B77C0A}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{CBE5DA09-5240-4EBF-B5F1-3E1FCC493747}: NameServer = 69.50.188.180,195.225.176.31
    O17 - HKLM\System\CS1\Services\Tcpip\..\{67D507B5-1DD3-4FB5-8C13-4610D3B12D2F}: NameServer = 69.50.188.180,195.225.176.31
    O23 - Service: *windows update - Unknown - C:\WINDOWS\System32\wxmvt.exe (file missing)
    O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
    O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
    O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
    O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
    O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
    O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
    O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
    O23 - Service: Norman API-hooking helper - Unknown - C:\NORMAN\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown - C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown - C:\Norman\bin\ZANDA.EXE
    O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
    O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
    O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
    O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
    O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu