Ongelmia selainkaapparin (vaihtaa kotisivuksi
about:blank ja Trojan.Win32.StartPage.uz,qr jne
kanssa. Löytäisikö joku minua viisaampi alta syytä
ogelmiini? Kiitoksia etukäteen!
Riipii raapii jo hermoja...
Logfile of HijackThis v1.99.0
Scan saved at 22:58:31, on 19.3.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AURIAV~1\backweb\1220792\Program\SERVIC~1.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Auria Vahtipalvelut\Anti-Virus\fsgk32st.exe
C:\Program Files\Auria Vahtipalvelut\backweb\1220792\program\fsbwsys.exe
C:\Program Files\Auria Vahtipalvelut\Anti-Virus\FSGK32.EXE
C:\Program Files\Auria Vahtipalvelut\backweb\1220792\Program\BackWeb-1220792.exe
C:\Program Files\Auria Vahtipalvelut\Anti-Virus\fssm32.exe
C:\Program Files\Auria Vahtipalvelut\Common\FSM32.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Auria Vahtipalvelut\Common\FSMA32.EXE
C:\Program Files\Auria Vahtipalvelut\Common\FSMB32.EXE
C:\Program Files\Auria Vahtipalvelut\Common\FCH32.EXE
C:\Program Files\Auria Vahtipalvelut\Common\FAMEH32.EXE
C:\Program Files\Auria Vahtipalvelut\Anti-Virus\fsav32.exe
C:\Program Files\Auria Vahtipalvelut\DFW\Program\fsdfwd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WinMX\WinMX.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Documents and Settings\Omistaja\Työpöytä\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Omistaja\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Omistaja\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {2C9C0462-AC4C-4395-9189-0D680FAEF06C} - C:\WINDOWS\System32\afl.dll
O2 - BHO: (no name) - {2FA95530-D9E0-44AC-BDF8-513D393FE8D2} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {DB603F0F-3DD1-4694-A02A-44F87D563A95} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Auria Vahtipalvelut\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Auria Vahtipalvelut\TNB\TNBUtil.exe" /CHECKALL
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\Omistaja\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab28578.cab
O16 - DPF: {5BDBD95C-1E7F-4FB1-8497-20AF879F8B68} - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fi/filesharingctrl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab28578.cab
O18 - Filter: text/html - {DB309FEE-CC2F-46D0-BD9B-8B2933681B69} - C:\WINDOWS\System32\afl.dll
O18 - Filter: text/plain - {DB309FEE-CC2F-46D0-BD9B-8B2933681B69} - C:\WINDOWS\System32\afl.dll
O23 - Service: Auria Vahtipalvelut - Unknown - C:\PROGRA~1\AURIAV~1\backweb\1220792\Program\SERVIC~1.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - Unknown - C:\Program Files\Auria Vahtipalvelut\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Authentication Agent - Unknown - C:\Program Files\Auria Vahtipalvelut\Common\FSAA.EXE (file missing)
O23 - Service: fsbwsys - Unknown - C:\Program Files\Auria Vahtipalvelut\backweb\1220792\program\fsbwsys.exe
O23 - Service: F-Secure Distributed Firewall Daemon - F-Secure Corporation - C:\Program Files\Auria Vahtipalvelut\DFW\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent - F-Secure Corporation - C:\Program Files\Auria Vahtipalvelut\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service - F-Secure Corporation - C:\Program Files\Auria Vahtipalvelut\fswsclds.exe
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe
about:blank ja Trojan.Win32.StartPage.uz,qr jne
kanssa. Löytäisikö joku minua viisaampi alta syytä
ogelmiini? Kiitoksia etukäteen!
Riipii raapii jo hermoja...
Logfile of HijackThis v1.99.0
Scan saved at 22:58:31, on 19.3.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AURIAV~1\backweb\1220792\Program\SERVIC~1.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Auria Vahtipalvelut\Anti-Virus\fsgk32st.exe
C:\Program Files\Auria Vahtipalvelut\backweb\1220792\program\fsbwsys.exe
C:\Program Files\Auria Vahtipalvelut\Anti-Virus\FSGK32.EXE
C:\Program Files\Auria Vahtipalvelut\backweb\1220792\Program\BackWeb-1220792.exe
C:\Program Files\Auria Vahtipalvelut\Anti-Virus\fssm32.exe
C:\Program Files\Auria Vahtipalvelut\Common\FSM32.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Auria Vahtipalvelut\Common\FSMA32.EXE
C:\Program Files\Auria Vahtipalvelut\Common\FSMB32.EXE
C:\Program Files\Auria Vahtipalvelut\Common\FCH32.EXE
C:\Program Files\Auria Vahtipalvelut\Common\FAMEH32.EXE
C:\Program Files\Auria Vahtipalvelut\Anti-Virus\fsav32.exe
C:\Program Files\Auria Vahtipalvelut\DFW\Program\fsdfwd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WinMX\WinMX.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Documents and Settings\Omistaja\Työpöytä\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Omistaja\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Omistaja\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {2C9C0462-AC4C-4395-9189-0D680FAEF06C} - C:\WINDOWS\System32\afl.dll
O2 - BHO: (no name) - {2FA95530-D9E0-44AC-BDF8-513D393FE8D2} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {DB603F0F-3DD1-4694-A02A-44F87D563A95} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Auria Vahtipalvelut\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Auria Vahtipalvelut\TNB\TNBUtil.exe" /CHECKALL
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\Omistaja\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab28578.cab
O16 - DPF: {5BDBD95C-1E7F-4FB1-8497-20AF879F8B68} - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fi/filesharingctrl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab28578.cab
O18 - Filter: text/html - {DB309FEE-CC2F-46D0-BD9B-8B2933681B69} - C:\WINDOWS\System32\afl.dll
O18 - Filter: text/plain - {DB309FEE-CC2F-46D0-BD9B-8B2933681B69} - C:\WINDOWS\System32\afl.dll
O23 - Service: Auria Vahtipalvelut - Unknown - C:\PROGRA~1\AURIAV~1\backweb\1220792\Program\SERVIC~1.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - Unknown - C:\Program Files\Auria Vahtipalvelut\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Authentication Agent - Unknown - C:\Program Files\Auria Vahtipalvelut\Common\FSAA.EXE (file missing)
O23 - Service: fsbwsys - Unknown - C:\Program Files\Auria Vahtipalvelut\backweb\1220792\program\fsbwsys.exe
O23 - Service: F-Secure Distributed Firewall Daemon - F-Secure Corporation - C:\Program Files\Auria Vahtipalvelut\DFW\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent - F-Secure Corporation - C:\Program Files\Auria Vahtipalvelut\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service - F-Secure Corporation - C:\Program Files\Auria Vahtipalvelut\fswsclds.exe
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe
Vastaukset 5
Vanhimmat
Koitas tätä
http://www.derbilk.de/SpSeHjfix_Beta9.zip
Pura se,avaa ja klikkaa Start Disinfection
Jos se löytää jotain,niin kone vissiin käynnistyy uudestaan.
Pistä sen jälkeen uus Hijack logi.
Tein ohjeesi mukaisesti ja tässä uusi HijackThis-log.
Ihan mielenkiinnosta, mikä on SpSeHjfix?
Logfile of HijackThis v1.99.0
Scan saved at 16:25:32, on 20.3.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\AURIAV~1\backweb\1220792\Program\SERVIC~1.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Auria Vahtipalvelut\Anti-Virus\fsgk32st.exe
C:\Program Files\Auria Vahtipalvelut\Anti-Virus\FSGK32.EXE
C:\Program Files\Auria Vahtipalvelut\Anti-Virus\fssm32.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Auria Vahtipalvelut\Common\FSMA32.EXE
C:\Program Files\Auria Vahtipalvelut\Common\FSMB32.EXE
C:\WINDOWS\System32\Userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Auria Vahtipalvelut\Common\FCH32.EXE
C:\Program Files\Auria Vahtipalvelut\Common\FSM32.EXE
C:\Program Files\Auria Vahtipalvelut\Anti-Virus\fsav32.exe
C:\Program Files\Auria Vahtipalvelut\Common\FAMEH32.EXE
C:\Program Files\Auria Vahtipalvelut\DFW\Program\fsdfwd.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Omistaja\Työpöytä\HijackThis.exe
C:\Program Files\Auria Vahtipalvelut\backweb\1220792\Program\BackWeb-1220792.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {2FA95530-D9E0-44AC-BDF8-513D393FE8D2} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {DB603F0F-3DD1-4694-A02A-44F87D563A95} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Auria Vahtipalvelut\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Auria Vahtipalvelut\TNB\TNBUtil.exe" /CHECKALL
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab28578.cab
O16 - DPF: {5BDBD95C-1E7F-4FB1-8497-20AF879F8B68} - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fi/filesharingctrl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab28578.cab
O23 - Service: Auria Vahtipalvelut - Unknown - C:\PROGRA~1\AURIAV~1\backweb\1220792\Program\SERVIC~1.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - Unknown - C:\Program Files\Auria Vahtipalvelut\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Authentication Agent - Unknown - C:\Program Files\Auria Vahtipalvelut\Common\FSAA.EXE (file missing)
O23 - Service: fsbwsys - Unknown - C:\Program Files\Auria Vahtipalvelut\backweb\1220792\program\fsbwsys.exe
O23 - Service: F-Secure Distributed Firewall Daemon - F-Secure Corporation - C:\Program Files\Auria Vahtipalvelut\DFW\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent - F-Secure Corporation - C:\Program Files\Auria Vahtipalvelut\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service - F-Secure Corporation - C:\Program Files\Auria Vahtipalvelut\fswsclds.exe
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe
> Ihan mielenkiinnosta, mikä on SpSeHjfix <
No sen pitäs poistaa ton kaapparivariantin,joka sulla on\oli ja näyttää siltä,että se toimi.
res://C:\DOCUME~1\Omistaja\LOCALS~1\Temp\se.dll/sp.html
Siirrä se Hijackki oman kansioon tonne
C:\HjT\HijackThis.exe
Merkkaa ja Fix:saa
O2 - BHO: (no name) - {2FA95530-D9E0-44AC-BDF8-513D393FE8D2} - (no file)
O2 - BHO: (no name) - {DB603F0F-3DD1-4694-A02A-44F87D563A95} - (no file)
Sitte nuo 2 riviä
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
Jos ite tai joku muu on ne SpyBotilla tai järjestelmänvalvojana määritelly,niin anna olla,muuten merkkaa ne myös.
Sain pois mutta valitettavasti tuli takaisin.
Puhdistin uudestaan ja odotellaan.
Kiitos tähän astisista!
No sitte siellä on luultavasti piilotiedosto mukana.
Ota tosta DllCompare.exe
http://www.downloads.subratam.org/DllCompare.exe
Aukase se ja klikkaa Run Locate.com kohtaa
Sitte klikkaa Compare kohtaa ja ootat että se tutkii valmiiks.
Sitte klikkaa Make Log of what was found.
Sitte kopioi alla oleva teksti notepadiin
Reg save "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" windows1.hiv
ren windows1.hiv windows.txt
Säästä se työpöydälle nimellä Appinit.bat
Tallennusmuotoon kaikki tiedostot.
Sitte klikkaat sitä Appinit.bat:ia työpöydällä
ja ulos tulee windows.txt logi
Kopioi ja pistä tänne sitte ne molemmat logit