Kävin ei-kivalla sivulla ja sain sieltä ilmeisesti koneelleni viruksen tai spywarea. Sain blue-screenin ja fatal error -varoituksen, jossa kehoitettiin skannaamaan kone heti.
Tässä ensiksi hijackthis-logi:
Logfile of HijackThis v1.99.1
Scan saved at 12:58:38, on 8.4.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\realsched.exe
C:\Ohjelmatiedostot\Winamp\winampa.exe
C:\Ohjelmatiedostot\QuickTime\qttask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Ohjelmatiedostot\MSN Messenger\MsnMsgr.Exe
c:\q791137.exe
C:\WINDOWS\Downloaded Program Files\Q330995.exe
C:\WINDOWS\system32\rundll32.exe
c:\wp.exe
C:\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\MIKKOS~1\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\MIKKOS~1\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Ohjelmatiedostot\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {4A8BB6DF-6B89-4E2E-AB0E-88D8EB56452E} - C:\WINDOWS\System32\blgi.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [MPFTray] C:\OHJELM~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
O4 - HKLM\..\Run: [TrojanScanner] C:\trojanjutska\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Ohjelmatiedostot\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Ohjelmatiedostot\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\MIKKOS~1\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Ohjelmatiedostot\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\OHJELM~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Microsoft AntiSpyware helper - {4C47065B-EFDF-4BC2-8887-4CF14F5D64DA} - C:\WINDOWS\System32\wldr.dll
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {4C47065B-EFDF-4BC2-8887-4CF14F5D64DA} - C:\WINDOWS\System32\wldr.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Ohjelmatiedostot\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Ohjelmatiedostot\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {4C47065B-EFDF-4BC2-8887-4CF14F5D64DA} - C:\WINDOWS\System32\wldr.dll (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {4C47065B-EFDF-4BC2-8887-4CF14F5D64DA} - C:\WINDOWS\System32\wldr.dll (HKCU)
O12 - Plugin for .spop: C:\Ohjelmatiedostot\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Filter: text/html - {3D45CAE8-4E19-4881-82BE-3140283DC04E} - C:\WINDOWS\System32\blgi.dll
O18 - Filter: text/plain - {3D45CAE8-4E19-4881-82BE-3140283DC04E} - C:\WINDOWS\System32\blgi.dll
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Ohjelmatiedostot\Yhteiset tiedostot\Symantec Shared\SNDSrvc.exe
Apua, kiitos!
Tässä ensiksi hijackthis-logi:
Logfile of HijackThis v1.99.1
Scan saved at 12:58:38, on 8.4.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\realsched.exe
C:\Ohjelmatiedostot\Winamp\winampa.exe
C:\Ohjelmatiedostot\QuickTime\qttask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Ohjelmatiedostot\MSN Messenger\MsnMsgr.Exe
c:\q791137.exe
C:\WINDOWS\Downloaded Program Files\Q330995.exe
C:\WINDOWS\system32\rundll32.exe
c:\wp.exe
C:\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\MIKKOS~1\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\MIKKOS~1\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Ohjelmatiedostot\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {4A8BB6DF-6B89-4E2E-AB0E-88D8EB56452E} - C:\WINDOWS\System32\blgi.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [MPFTray] C:\OHJELM~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
O4 - HKLM\..\Run: [TrojanScanner] C:\trojanjutska\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Ohjelmatiedostot\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Ohjelmatiedostot\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\MIKKOS~1\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Ohjelmatiedostot\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\OHJELM~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Microsoft AntiSpyware helper - {4C47065B-EFDF-4BC2-8887-4CF14F5D64DA} - C:\WINDOWS\System32\wldr.dll
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {4C47065B-EFDF-4BC2-8887-4CF14F5D64DA} - C:\WINDOWS\System32\wldr.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Ohjelmatiedostot\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Ohjelmatiedostot\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {4C47065B-EFDF-4BC2-8887-4CF14F5D64DA} - C:\WINDOWS\System32\wldr.dll (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {4C47065B-EFDF-4BC2-8887-4CF14F5D64DA} - C:\WINDOWS\System32\wldr.dll (HKCU)
O12 - Plugin for .spop: C:\Ohjelmatiedostot\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Filter: text/html - {3D45CAE8-4E19-4881-82BE-3140283DC04E} - C:\WINDOWS\System32\blgi.dll
O18 - Filter: text/plain - {3D45CAE8-4E19-4881-82BE-3140283DC04E} - C:\WINDOWS\System32\blgi.dll
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Ohjelmatiedostot\Yhteiset tiedostot\Symantec Shared\SNDSrvc.exe
Apua, kiitos!
Vastaukset 20
Vanhimmat
Ota tuo
http://www.derbilk.de/SpSeHjfix112.zip
Sitte pura,aukase ja klikkaa Start disinfection
Sitte ku se putsaa,niin kone vissiin käynnistyy uudestaan.
Pistä sen jälkeen uus Hijack logi ja sen ohjelman logi.
Jotain logia sain.. olenkohan tehnyt kaiken oikein? Edelleen taustani on sininen ja siinä luke security warning - fatal error "Error was caused by Trojan-Spy.HTML.Smitfraud.c
Mitä tulisi tehdä?
(4.8.05 13:39:41) SPSeHjFix started v1.1.2
(4.8.05 13:39:41) OS: WinXP (5.1.2600)
(4.8.05 13:39:41) Language: suomi
(4.8.05 13:39:41) Win-Path: C:\WINDOWS
(4.8.05 13:39:41) System-Path: C:\WINDOWS\System32
(4.8.05 13:39:41) Temp-Path: C:\DOCUME~1\KÄYTTÄJÄ~1\LOCALS~1\Temp\
(4.8.05 13:40:13) SPSeHjFix started v1.1.2
(4.8.05 13:40:13) OS: WinXP (5.1.2600)
(4.8.05 13:40:13) Language: suomi
(4.8.05 13:40:13) Win-Path: C:\WINDOWS
(4.8.05 13:40:13) System-Path: C:\WINDOWS\System32
(4.8.05 13:40:13) Temp-Path: C:\DOCUME~1\KÄYTTÄJÄ~1\LOCALS~1\Temp\
(4.8.05 13:40:31) Disinfection started
(4.8.05 13:40:31) Bad-Dll(IEP): (not found)
(4.8.05 13:40:31) Bad-Dll(IEP) in BHO: (not found)
(4.8.05 13:40:31) UBF: 5 - UBB: 0 - UBR: 10
(4.8.05 13:40:31) UBF: 5 - UBB: 0 - UBR: 10
(4.8.05 13:40:31) Bad IE-pages: (none)
(4.8.05 13:40:31) Stealth-String not found
(4.8.05 13:40:31) Not infected->END
Pistä uus Hijack logi
Tässä on uusi logi. Huomasin, että äsken koneessani oli joku "wp" niminen ohjelma, joka vei prosessiani. Mielestäni minulla ei ole ollut sitä ennen. Poistin sen deletoimalla, kun eräästä paikkaa sen löysin hetki sitten.
IE ei muuten toimi tällä hetkellä.
Logfile of HijackThis v1.99.1
Scan saved at 13:50:09, on 8.4.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\realsched.exe
C:\Ohjelmatiedostot\Winamp\winampa.exe
C:\Ohjelmatiedostot\QuickTime\qttask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Ohjelmatiedostot\MSN Messenger\MsnMsgr.Exe
C:\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Ohjelmatiedostot\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [MPFTray] C:\OHJELM~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
O4 - HKLM\..\Run: [TrojanScanner] C:\trojanjutska\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Ohjelmatiedostot\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Ohjelmatiedostot\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Security iGuard] C:\Ohjelmatiedostot\Security iGuard\Security iGuard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Ohjelmatiedostot\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\OHJELM~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Ohjelmatiedostot\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Ohjelmatiedostot\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {4C47065B-EFDF-4BC2-8887-4CF14F5D64DA} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {4C47065B-EFDF-4BC2-8887-4CF14F5D64DA} - (no file) (HKCU)
O12 - Plugin for .spop: C:\Ohjelmatiedostot\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Ohjelmatiedostot\Yhteiset tiedostot\Symantec Shared\SNDSrvc.exe
Scanna tuo tuolla ja ilmoita sitte tulos
c:\wp.exe
http://virusscan.jotti.org/
Ehdin valitettavasti jo poistaa sen, mutta tiedän sen olevan paha örkki, koska se söi koneeni prosessia ikävästi ja pisti silmään ikävästi.
Onko mitään tehtävissä?
Niin sää näköjään poistit sen jo.
Poista Lisää/Poista paneelista jos näkyy
Security iGuard
Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina Fix checked
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O4 - HKLM\..\Run: [Security iGuard] C:\Ohjelmatiedostot\Security iGuard\Security iGuard.exe
O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe
O9 - Extra button: Microsoft AntiSpyware helper - {4C47065B-EFDF-4BC2-8887-4CF14F5D64DA} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {4C47065B-EFDF-4BC2-8887-4CF14F5D64DA} - (no file) (HKCU)
Sitte poista tuo kansio
C:\Ohjelmatiedostot\Security iGuard\ <
Tärkeitä päivityksiä puuttuu koneesta (Windows Update)
Kiitos paljon! Nyt IE toimii.
Osaatko sanoa miten saan työpöydälläni olevan blue screen -ilmoituksen pois? Se edelleen varoittaa jostain vakavasta vaarasta, enkä pysty vaihtamaan taustakuvaa.
Scannaa kone tolla
http://koti.mbnet.fi/pattaya1/escanmwav.htm
Jos se löytää jotain niin kopioi tänne ne sieltä alaikkunasta.
Ok, skannaan koneen sillä ja tulen kertomaan sinulle tuloksen tänään illalla.
Tässä olisi eScan-logi. Skannaus kesti noin pari tuntia.
File C:\WINDOWS\System32\sysdrc.dll infected by "Trojan-Dropper.Win32.Agent.cy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\System32\netslv32.dll tagged as not-a-virus:RiskWare.Dialer.E-Group.l. No Action Taken.
File C:\WINDOWS\System32\dxrhvfzk.exe infected by "Trojan-Downloader.Win32.Dluca.gen" Virus. Action Taken: File Deleted.
File C:\WINDOWS\COMMAND\EBD\EBD.CAB tagged as not-a-virus:Tool.DOS.Restart. No Action Taken.
File C:\WINDOWS\SYSTEM32\netslv32.dll tagged as not-a-virus:RiskWare.Dialer.E-Group.l. No Action Taken.
File C:\WINDOWS\iLookup\TTIL.exe tagged as not-a-virus:AdWare.EZula.a. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\videobox.0xe infected by "Trojan.Win32.Dialer.ce" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\videobox.0xe infected by "Trojan.Win32.Dialer.ce" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1101.dll tagged as not-a-virus:AdWare.Gator.1101. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.2\videobox.0xe infected by "Trojan.Win32.Dialer.ce" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\PrevAdX.dll tagged as not-a-virus:AdWare.WinAD.aa. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\esp.dll infected by "Trojan.Win32.Dialer.ep" Virus. Action Taken: File Deleted.
File C:\RECYCLED\Q330995.exe infected by "Trojan-Downloader.Win32.Small.amb" Virus. Action Taken: File Deleted.
File C:\RECYCLED\Q678340.exe infected by "Trojan-Downloader.Win32.Small.rr" Virus. Action Taken: File Deleted.
File C:\Tavaraa\mIRC\mirc.exe tagged as not-a-virus:RiskWare.mIRC.6.16. No Action Taken.
File C:\Tavaraa\mIRC\mirc616.exe tagged as not-a-virus:RiskWare.mIRC.6.16. No Action Taken.
File C:\Tavaraa\edonkey\Supplies\Ny mapp\setup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Documents and Settings\Käyttäjä\Local Settings\Temp\ICD6.tmp\HDPlugin1101.dll tagged as not-a-virus:AdWare.Gator.1101. No Action Taken.
File C:\Documents and Settings\Käyttäjä\Local Settings\Temp\ICD4.tmp\fastvideoplayer.dll infected by "Trojan-Downloader.Win32.Dyfuca.dn" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Käyttäjä\Local Settings\Temp\~23.exe tagged as not-a-virus:Porn-Dialer.Win32.Generic. No Action Taken.
File C:\Documents and Settings\Käyttäjä\Local Settings\Temp\ICD3.tmp\netslv32.dll tagged as not-a-virus:RiskWare.Dialer.E-Group.l. No Action Taken.
File C:\Documents and Settings\Käyttäjä\Local Settings\Temp\temp.fr3645 tagged as not-a-virus:Porn-Downloader.Win32.TibSystems. No Action Taken.
File C:\Documents and Settings\Käyttäjä\Local Settings\Temp\temp.fr9A3C tagged as not-a-virus:Porn-Downloader.Win32.TibSystems. No Action Taken.
File C:\Documents and Settings\Käyttäjä\Local Settings\Temp\temp.frF92F tagged as not-a-virus:AdWare.WinAD.ab. No Action Taken.
File C:\Documents and Settings\Käyttäjä\Local Settings\Temp\ICD7.tmp\esp.dll infected by "Trojan.Win32.Dialer.ep" Virus. Action Taken: File Deleted.
File C:\FOUND.056\FILE0004.CHK infected by "Trojan-Downloader.Win32.Dluca.gen" Virus. Action Taken: File Deleted.
File C:\Hijackthis\backups\backup-20050311-000049-821.dll infected by "Trojan.Win32.Dialer.ep" Virus. Action Taken: File Deleted.
File C:\FOUND.058\FILE0004.CHK infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\FOUND.058\FILE0005.CHK infected by "Trojan.Java.ClassLoader.z" Virus. Action Taken: File Deleted.
File C:\FOUND.058\FILE0020.CHK infected by "Trojan-Downloader.JS.Small.ao" Virus. Action Taken: File Deleted.
File C:\FOUND.058\FILE0022.CHK infected by "Trojan-Dropper.VBS.Inor.a" Virus. Action Taken: File Deleted.
File D:\WINDOWS\COMMAND\EBD\EBD.CAB tagged as not-a-virus:Tool.DOS.Restart. No Action Taken.
Mitäs näille tulisi tehdä?
PS. Juu, suoritin myös eräällä online-skannerilla (Panda Active Scan) koneen skannin, ja tulos on seuraavanlainen:
Incident Status Location
Spyware:Spyware/Dluca No disinfected C:\WINDOWS\SYSTEM32\dxrhvfzk.exe
Adware:Adware/nCase No disinfected C:\WINDOWS\iLookup\TTIL.exe
Adware:Adware/WinAD No disinfected C:\WINDOWS\Downloaded Program Files\PrevAdX.dll
Adware:Adware/SuperSpider No disinfected C:\RECYCLED\Q678340.exe
Adware:Adware/Fastvideoplayer No disinfected C:\Documents and Settings\Käyttäjä\Local Settings\Temp\ICD4.tmp\fastvideoplayer.dll
Adware:Adware/WUpd No disinfected C:\Documents and Settings\Käyttäjä\Local Settings\Temp\temp.frF92F
Virus:Trj/StartPage.SV Disinfected C:\FOUND.058\FILE0033.CHK
Virus:Trj/StartPage.SV Disinfected C:\FOUND.058\FILE0040.CHK
Jään odottelemaan vastaustasi.
Poista nuo
C:\WINDOWS\System32\netslv32.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1101.dll
C:\WINDOWS\Downloaded Program Files\PrevAdX.dll
C:\WINDOWS\iLookup\ < kansio
Tyhjennä tuolta tuo Temp kansio (älä poista sitä)
C:\Documents and Settings\Käyttäjä\Local Settings\Temp\
Kiitoksia. Puhtaalta nyt näyttää - bluescreen lähti myös pois ja kone näyttää pelittävän mainiosti. Temp-kansiosta lähti tavaraa melkein 200 megaa.
Hyvät kevään jatkot.
Mää unohin piti jo aikasemmin sanoo,että lähetä vielä StartupList logi Hijackistä.
Config.. > Misc Tools > Generate Startuplist log
Pistä ensin täpit molempiin pikkuruutuihin ja sitte vasta scannaa.
Jees, elikkäs.. Olisiko se tämä logi? Sano jos tein jotain väärin.. Ruksasin molemmat ruudut, ja painoin "Gerenate Startuplist log"
StartupList report, 8.4.2005, 20:27:08
StartupList version: 1.52.2
Started from : C:\Hijackthis\HijackThis.EXE
Detected: Windows XP (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\realsched.exe
C:\Ohjelmatiedostot\Winamp\winampa.exe
C:\Ohjelmatiedostot\QuickTime\qttask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Ohjelmatiedostot\MSN Messenger\MsnMsgr.Exe
C:\Ohjelmatiedostot\Yhteiset tiedostot\Microsoft Shared\Source Engine\OSE.EXE
C:\Hijackthis\HijackThis.exe
--------------------------------------------------
Listing of startup folders:
Shell folders Startup:
[C:\Documents and Settings\Käyttäjä\Käynnistä-valikko\Ohjelmat\Käynnistys]
*No files*
Shell folders AltStartup:
*Folder not found*
User shell folders Startup:
*Folder not found*
User shell folders AltStartup:
*Folder not found*
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys]
*No files*
Shell folders Common AltStartup:
*Folder not found*
User shell folders Common Startup:
*Folder not found*
User shell folders Alternate Common Startup:
*Folder not found*
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*
[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SystemTray = SysTray.Exe
MISAggregator =
TkBellExe = "C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\realsched.exe" -osboot
WinampAgent = C:\Ohjelmatiedostot\Winamp\winampa.exe
QuickTime Task = "C:\Ohjelmatiedostot\QuickTime\qttask.exe" -atboottime
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE = C:\WINDOWS\System32\ctfmon.exe
MsnMsgr = "C:\Ohjelmatiedostot\MSN Messenger\MsnMsgr.Exe" /background
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
[OptionalComponents]
*No values found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command
(Default) = "%1" /S
--------------------------------------------------
File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command
(Default) = C:\WINDOWS\System32\mshta.exe "%1" %*
--------------------------------------------------
File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command
(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1
--------------------------------------------------
Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)
[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
[{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\mplayer2.inf,PerUserStub.NT
[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\msmsgs.inf,BLC.Install.PerUser
[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub
[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll
[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe
[{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}] *
StubPath = rundll32 iesetup.dll,IEAccessUserInst
[{CA0A4247-44BE-11d1-A005-00805F8ABE06}] *
StubPath = RunDLL setupx.dll,InstallHinfSection PowerCfg.user 0 powercfg.inf
--------------------------------------------------
Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps
*Registry key not found*
--------------------------------------------------
Load/Run keys from C:\WINDOWS\WIN.INI:
load=*INI section not found*
run=*INI section not found*
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Checking for EXPLORER.EXE instances:
C:\WINDOWS\Explorer.exe: PRESENT!
C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present
--------------------------------------------------
Checking for superhidden extensions:
.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden
--------------------------------------------------
Verifying REGEDIT.EXE integrity:
- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Regedit.exe has no CompanyName property! It is either missing or named something else.
- Regedit.exe has no OriginalFilename property! It is either missing or named something else.
- Regedit.exe has no FileDescription property! It is either missing or named something else.
Registry check failed!
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - C:\Ohjelmatiedostot\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
--------------------------------------------------
Enumerating Task Scheduler jobs:
Säätötoiminnon aloitus.job
--------------------------------------------------
Enumerating Download Program Files:
[QuickTime Object]
InProcServer32 = C:\Ohjelmatiedostot\QuickTime\QTPlugin.ocx
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab
[MessengerStatsClient Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll
CODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM32\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
[Java Plug-in 1.4.0]
InProcServer32 = C:\Ohjelmatiedostot\Java\jre1.5.0_01\bin\npjpi140.dll
CODEBASE = http://java.sun.com/update/1.4.0/jinstall-1_4_0-windows-i586.cab
[MessengerStatsClient Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\messengerstatsclient.dll
CODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
[ActiveScan Installer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dll
CODEBASE = http://www.pandasoftware.com/activescan/as5/asinst.cab
[MsnMessengerSetupDownloadControl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.ocx
CODEBASE = http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
[Java Plug-in 1.4.0]
InProcServer32 = C:\Ohjelmatiedostot\Java\jre1.5.0_01\bin\npjpi140.dll
CODEBASE = http://java.sun.com/update/1.4.0/jinstall-1_4_0-windows-i586.cab
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
--------------------------------------------------
Enumerating Winsock LSP files:
NameSpace #1: C:\WINDOWS\System32\mswsock.dll
NameSpace #2: C:\WINDOWS\System32\winrnr.dll
NameSpace #3: C:\WINDOWS\System32\mswsock.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
--------------------------------------------------
Enumerating Windows NT/2000/XP services
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AFD Networking Support -ympäristö: \SystemRoot\System32\drivers\afd.sys (autostart)
Intel AGP Bus Filter: System32\DRIVERS\agp440.sys (system)
Sovelluskerroksen yhdyskäytäväpalvelu: %SystemRoot%\System32\alg.exe (manual start)
Sovellusten hallinta: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
RAS Asynchronous Media Driver: System32\DRIVERS\asyncmac.sys (manual start)
Standardi IDE/ESDI-kiintolevyohjain: System32\DRIVERS\atapi.sys (system)
ATM ARP Client -protokolla: System32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: System32\DRIVERS\audstub.sys (manual start)
BITS-tausta-ajo (Background Intelligent Transfer Service): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
CD-ROM Driver: System32\DRIVERS\cdrom.sys (system)
Indeksointipalvelu: C:\WINDOWS\System32\cisvc.exe (manual start)
Leikekirja: %SystemRoot%\system32\clipsrv.exe (manual start)
COM+-järjestelmäsovellus: C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
Salauspalvelut: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Creative SB16/AWE32/AWE64 Driver (WDM): system32\drivers\ctlsb16.sys (manual start)
DHCP-asiakas: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Levyohjain: System32\DRIVERS\disk.sys (system)
Loogisen levyn hallinnan valvontapalvelu: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
Loogisen levyn hallinta -ohjain: System32\drivers\dmio.sys (system)
dmload: System32\drivers\dmload.sys (system)
Loogisen levyn hallinta: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS-asiakas: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
3Com EtherLink XL 90XB/C Adapter Driver: System32\DRIVERS\el90xbc5.sys (manual start)
Virheraportointipalvelut: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Tapahtumaloki: %SystemRoot%\system32\services.exe (autostart)
COM+-tapahtumajärjestelmä: C:\WINDOWS\System32\svchost.exe -k netsvcs (manual start)
Lavalys EVEREST Kernel Driver: \??\C:\Ohjelmatiedostot\Lavalys\EVEREST Home Edition\kerneld.wnt (manual start)
Nopean käyttäjän vaihdon yhteensopivuus: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Levykeaseman ohjain: System32\DRIVERS\fdc.sys (manual start)
Levykeasemaohjain: System32\DRIVERS\flpydisk.sys (manual start)
Volume Manager -ohjain: System32\DRIVERS\ftdisk.sys (system)
Game Port Enumerator: System32\DRIVERS\gameenum.sys (manual start)
Yleinen paketinmääritys: System32\DRIVERS\msgpc.sys (manual start)
Ohjeet ja tuotetuki: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID (Human Interface Device) -liittymä: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Microsoft HID -luokkaohjain: System32\DRIVERS\hidusb.sys (manual start)
i8042-näppäimistö ja PS/2-hiiriohjain: System32\DRIVERS\i8042prt.sys (system)
CD-levyjen kirjoittamisen IMAPI COM -palvelu: C:\WINDOWS\System32\imapi.exe (manual start)
IntelIde: System32\DRIVERS\intelide.sys (system)
IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: System32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: System32\DRIVERS\ipnat.sys (manual start)
IPSEC-ohjain: System32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA -väyläohjain: System32\DRIVERS\isapnp.sys (system)
Näppäimistön luokkaohjain: System32\DRIVERS\kbdclass.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
Palvelin: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
NetMeeting etätyöpöydän jakaminen: C:\WINDOWS\System32\mnmsrvc.exe (manual start)
Hiiren luokkaohjain: System32\DRIVERS\mouclass.sys (system)
Hiiren HID-ohjain: System32\DRIVERS\mouhid.sys (manual start)
WebDav Client Redirector: System32\DRIVERS\mrxdav.sys (manual start)
Distributed Transaction Coordinator: C:\WINDOWS\System32\msdtc.exe (manual start)
Windows Installer -ohjelma: C:\WINDOWS\System32\msiexec.exe /V (manual start)
Microsoft Streaming Service -välityspalvelin: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Remote Access NDIS TAPI Driver: System32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O -protokolla: System32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: System32\DRIVERS\ndiswan.sys (manual start)
NetBT: System32\DRIVERS\netbt.sys (system)
Verkon DDE: %SystemRoot%\system32\netdde.exe (manual start)
Verkon DDE DSDM: %SystemRoot%\system32\netdde.exe (manual start)
Verkkoyhteydet: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
NLA-nimiavaruus (Network Location Awareness): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
NT Apm/Legacy Interface -ohjain: System32\DRIVERS\NtApm.sys (manual start)
Siirrettävät tallennusvälineet: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
IPX Traffic Filter Driver: System32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: System32\DRIVERS\nwlnkfwd.sys (manual start)
Office Source Engine: C:\Ohjelmatiedostot\Yhteiset tiedostot\Microsoft Shared\Source Engine\OSE.EXE (manual start)
Rinnakkaisporttiohjain: System32\DRIVERS\parport.sys (manual start)
PCI-väyläohjain: System32\DRIVERS\pci.sys (system)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC-palvelut: %SystemRoot%\System32\lsass.exe (autostart)
WAN Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start)
Suojattu tallennuspaikka: %SystemRoot%\system32\lsass.exe (autostart)
Direct Parallel Link Driver: System32\DRIVERS\ptilink.sys (manual start)
PxHelp20: System32\DRIVERS\PxHelp20.sys (system)
Remote Access Auto Connection -ohjain: System32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection -hallinta: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)
Etäkäytön (RAS) yhteyksienhallinta: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: System32\DRIVERS\raspppoe.sys (manual start)
Suora rinnakkainen: System32\DRIVERS\raspti.sys (manual start)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Terminal Server Device Redirector -ohjain: System32\DRIVERS\rdpdr.sys (manual start)
Etätyöpöydän ohjeen istunnonhallinta: C:\WINDOWS\system32\sessmgr.exe (manual start)
Digital CD Audio Playback Filter Driver: System32\DRIVERS\redbook.sys (system)
Reititys ja etäkäyttö: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Etärekisteri: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Etäproseduurikutsu (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
QoS RSVP: %SystemRoot%\System32\rsvp.exe (manual start)
s3m: System32\DRIVERS\s3m.sys (manual start)
Käyttöoikeustilien hallinta: %SystemRoot%\system32\lsass.exe (autostart)
Älykortti-apuohjelma: %SystemRoot%\System32\SCardSvr.exe (manual start)
Älykortti: %SystemRoot%\System32\SCardSvr.exe (manual start)
Tehtävien ajoitus: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: System32\DRIVERS\secdrv.sys (manual start)
Toissijainen kirjautuminen: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Järjestelmätapahtuman ilmoitus: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Serenum Filter -ohjain: System32\DRIVERS\serenum.sys (manual start)
Sarjaporttiohjain: System32\DRIVERS\serial.sys (system)
Internet-yhteyden palomuuri (ICF) / Internet-yhteyden jakaminen (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Käyttöliittymän laitteistotunnistus: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Symantec Network Drivers Service: C:\Ohjelmatiedostot\Yhteiset tiedostot\Symantec Shared\SNDSrvc.exe (manual start)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Taustatulostusohjain: %SystemRoot%\system32\spoolsv.exe (autostart)
Järjestelmän palautussuodatin -ohjain: System32\DRIVERS\sr.sys (system)
Järjestelmän palauttaminen -palvelu: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Srv: System32\DRIVERS\srv.sys (manual start)
SSDP-palvelu (Simple Service Discovery Protocol): %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
WIA (Windows Image Acquisition): %SystemRoot%\System32\svchost.exe -k imgsvc (manual start)
Ohjelmistoväyläohjain: System32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\System32\dllhost.exe /Processid:{4584DEDF-ED7A-496D-8C0F-3C28D2E42F0E} (manual start)
SymEvent: \??\C:\Ohjelmatiedostot\Symantec\SYMEVENT.SYS (manual start)
SYMIDSCO: \??\C:\WINDOWS\System32\Drivers\SYMIDSCO.SYS (manual start)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Resurssilokit ja -hälytykset: %SystemRoot%\system32\smlogsvc.exe (manual start)
Puhelin: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP-protokollaohjain: System32\DRIVERS\tcpip.sys (system)
Päätelaiteohjain: System32\DRIVERS\termdd.sys (system)
Päätepalvelut: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Teemat: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Telnet: C:\WINDOWS\System32\tlntsvr.exe (manual start)
Tiedostolinkkijäljityksen asiakas: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Microcode Update -ohjain: System32\DRIVERS\update.sys (manual start)
Latauksenhallinta: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Universal Plug & Play -laiteisäntä: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
UPS: %SystemRoot%\System32\ups.exe (manual start)
USB2 Enabled Hub: System32\DRIVERS\usbhub.sys (manual start)
USB-massamuistiohjain: System32\DRIVERS\USBSTOR.SYS (manual start)
Microsoft USB Universal Host Controller Miniport Driver: System32\DRIVERS\usbuhci.sys (manual start)
VgaSave: \SystemRoot\System32\drivers\vga.sys (system)
Aseman tilannevedos: %SystemRoot%\System32\vssvc.exe (manual start)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Remote Access IP ARP Driver: System32\DRIVERS\wanarp.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
SyGate for NT, wg4n: \SystemRoot\SYSTEM32\Drivers\wg4n.sys (autostart)
SyGate for NT, wg5n: \SystemRoot\SYSTEM32\Drivers\wg5n.sys (autostart)
SyGate for NT, wg6n: \SystemRoot\SYSTEM32\Drivers\wg6n.sys (autostart)
WMI-palvelu (Windows Management Instrumentation): %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Kannettavan soittimen sarjanumero: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
WMI-palvelun ohjainlaajennukset: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WMI resurssisovitin: C:\WINDOWS\System32\wbem\wmiapsrv.exe (manual start)
Automaattiset päivitykset: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Security Service (NSS): C:\WINDOWS\system32\appfo32.exe /s (disabled)
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
*Registry key not found*
--------------------------------------------------
End of report, 29 239 bytes
Report generated in 0,461 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
Joo tuli oikeen ja ei näy mitään,homma selvä.
Loistavaa! Kiitos kärsivällisyydestäsi! ^^
toi niin paha ole ,skannaa kone ja poista pöpöt yksinkertainen lääke.
On se vaan merkillistä kun ihmiset ei opi, jotta Kaikki vähintäännkin Tärkeät päivitykset kannattaa aivan ehdottomasti asentaa käyttikseensä.
Asenna jo sinäkin viimeinkin Sp2-päivitys, niin koneesi on paljon turvallisempia ja jopa nopeampi käyttää.