voisko joku auttaa

amatööriä kirjoitti:

kone ilmoittaa käynnistäessä että jokin gator dll joatin misssing ja f-securen palomuuri ilmoittaa välillä että se ois pois päältä...

tässä logi :


Logfile of HijackThis v1.99.1
Scan saved at 18:13:49, on 29.4.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\DNANET~1\backweb\4653381\Program\SERVIC~1.EXE
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\dna Nettiturva\Anti-Virus\fsgk32st.exe
C:\Program Files\dna Nettiturva\backweb\4653381\program\fsbwsys.exe
C:\Program Files\dna Nettiturva\Anti-Virus\FSGK32.EXE
C:\Program Files\dna Nettiturva\fswsclds.exe
C:\Program Files\dna Nettiturva\Anti-Virus\fssm32.exe
C:\Program Files\dna Nettiturva\backweb\4653381\Program\BackWeb-4653381.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\dna Nettiturva\Common\FSMA32.EXE
C:\Program Files\dna Nettiturva\Common\FSMB32.EXE
C:\Program Files\dna Nettiturva\Common\FCH32.EXE
C:\Program Files\dna Nettiturva\Common\FAMEH32.EXE
C:\Program Files\dna Nettiturva\Anti-Virus\fsav32.exe
C:\Program Files\dna Nettiturva\DFW\Program\fsdfwd.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\ahead\InCD\InCD.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\dna Nettiturva\Common\FSM32.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\eDonkey2000\eDonkey2000.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dnainternet.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dnainternet.fi
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.fi/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja dna Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://paivitys.dnainternet.fi/ yhteys/proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Adios Pop-Ups] C:\Program Files\Adios Pop-Ups\Adios Pop-Ups.exe
O4 - HKLM\..\Run: [EPSON Stylus C82 Series] C:\WINDOWS\System32\spool\DRIVERS\ W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C82 Series" /O5 "LPT1:" /M "Stylus C82"
O4 - HKLM\..\Run: [avserve2.exe] C:\WINDOWS\avserve2.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\dna Nettiturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\dna Nettiturva\TNB\TNBUtil.exe" /CHECKALL
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [eDonkey2000] "C:\Program Files\eDonkey2000\eDonkey2000.exe" -t
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: Registration Silent Hunter III.LNK = C:\Program Files\Ubisoft\SilentHunterIII\Support\Register\RegistrationReminder.exe
O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = C:\Documents and Settings\Kiprusov\Local Settings\Temp\{194E3F1F-A980-42D3-9245-244C8FF1DC0D}\ {907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.dnainternet.fi
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/ download/msnmessengersetupdownloader.cab
O18 - Filter: text/html - {463F02CE-6A23-454B-AB3C-C7B509777EC4} - C:\Documents and Settings\Kiprusov\Local Settings\Application Data\microsoft\internet explorer\V0.15.dat
O23 - Service: dna Nettiturva (BackWeb Client - 4653381) - Unknown owner - C:\PROGRA~1\DNANET~1\backweb\4653381\Program\SERVIC~1.EXE
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\dna Nettiturva\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\dna Nettiturva\Common\FSAA.EXE (file missing)
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\dna Nettiturva\backweb\4653381\program\fsbwsys.exe
O23 - Service: F-Secure Distributed Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\dna Nettiturva\DFW\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\dna Nettiturva\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\dna Nettiturva\fswsclds.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe



tässä microsoft antispywaren tulokset:

Spyware Scan Details
Start Date: 29.4.2005 18:28:33
End Date: 29.4.2005 18:34:56
Total Time: 6 mins 23 secs

Detected Threats

CoolWebSearch.StartPage Browser Modifier more information...
Details: CoolWebSearch StartPage changes Internet Explorers start page, however, it does not allow you to change the URL.
Status: Ignored
Severe threat - Severe-risk items have an extreme potential for harm, such as a security exploit, and should be removed.

Infected registry keys/values detected
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main Search Page_bak
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main Start Page_bak


Twain Tech Adware more information...
Details: Twain Tech is an adware based Internet Explorer browser helper object that displays targeted advertisements based on your browsing patterns.
Status: Ignored
High threat - High-risk items have a large potential for harm, such as loss of computer control, and should be removed unless knowingly installed.

Infected files detected
c:\windows\smdat32a.sys
c:\windows\smdat32m.sys


DownloadWare Adware more information...
Details: DownloadWare downloads and installs software from advertisers. It runs at Windows startup, and, if a network connection is available, it connects to its servers. It can be installed through an ActiveX control.
Status: Ignored
High threat - High-risk items have a large potential for harm, such as loss of computer control, and should be removed unless knowingly installed.

Infected registry keys/values detected
HKEY_CURRENT_USER\software\medialoads
HKEY_LOCAL_MACHINE\software\classes\interface\ {0494d0dc-f8e0-41ad-92a3-14154ece70ac}
HKEY_LOCAL_MACHINE\software\classes\interface\ {0494d0dc-f8e0-41ad-92a3-14154ece70ac}\ProxyStubClsid {00020420-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\software\classes\interface\ {0494d0dc-f8e0-41ad-92a3-14154ece70ac}\ProxyStubClsid32 {00020420-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\software\classes\interface\ {0494d0dc-f8e0-41ad-92a3-14154ece70ac}\TypeLib {0494D0D0-F8E0-41AD-92A3-14154ECE70AC}
HKEY_LOCAL_MACHINE\software\classes\interface\ {0494d0dc-f8e0-41ad-92a3-14154ece70ac}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\software\classes\interface\ {0494d0dc-f8e0-41ad-92a3-14154ece70ac} _IMyWaySettingsEvents
HKEY_CURRENT_USER\software\medialoads\Prefs Filename C:\DOCUME~1\Kiprusov\LOCALS~1\Temp\rem9.tmp
HKEY_CURRENT_USER\software\medialoads\Prefs Guid 760633B64C694B8FBAE3DD3DA3F658A5
HKEY_LOCAL_MACHINE\software\classes\interface\ {0494d0da-f8e0-41ad-92a3-14154ece70ac}
HKEY_LOCAL_MACHINE\software\classes\interface\ {0494d0da-f8e0-41ad-92a3-14154ece70ac}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\software\classes\interface\ {0494d0da-f8e0-41ad-92a3-14154ece70ac}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\software\classes\interface\ {0494d0da-f8e0-41ad-92a3-14154ece70ac}\TypeLib {0494D0D0-F8E0-41AD-92A3-14154ECE70AC}
HKEY_LOCAL_MACHINE\software\classes\interface\ {0494d0da-f8e0-41ad-92a3-14154ece70ac}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\software\classes\interface\ {0494d0da-f8e0-41ad-92a3-14154ece70ac} IMyWaySettings


eGroup Adware more information...
Status: Ignored
High threat - High-risk items have a large potential for harm, such as loss of computer control, and should be removed unless knowingly installed.

Infected files detected
c:\windows\dialpass\dfuck.ico
c:\windows\dialpass\video party.ico

Infected folders detected
c:\windows\dialpass
c:\windows\dialpass\internet sex provider


IST.SlotchBar Toolbar more information...
Details: Slotch Bar is an adware toolbar program for affiliates to distribute on sites. Affiliates get paid per install of the toolbar.
Status: Ignored
High threat - High-risk items have a large potential for harm, such as loss of computer control, and should be removed unless knowingly installed.

Infected registry keys/values detected
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\App Management\ARPCache\ISTsvc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\App Management\ARPCache\ISTsvc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\App Management\ARPCache\ISTsvc Changed 0


Claria Adware more information...
Details: Claria (Gator) may automatically fill in passwords and other information on Web forms. Its main purpose is to load an advertising module called OfferCompanion that displays pop-up advertisements when you visit some Web sites.
Status: Ignored
Elevated threat - Eleveated-risk items have some potential for harm. Users should review such programs and remove them if unwanted.

Infected files detected
c:\program files\common files\cmeii\cmediagnostics.log
c:\program files\common files\cmeii\gobjs.dll
c:\program files\common files\cmeii\gops.bac
c:\program files\common files\cmeii\greg.reg
c:\program files\common files\cmeii\gstore.dll
c:\program files\common files\cmeii\gstoreserver.dll
c:\program files\common files\cmeii\gtools.dll
c:\program files\common files\cmeii\store\core\locappllist
c:\program files\common files\cmeii\store\core\svclist
c:\program files\common files\gmt\eggcengine.dll
c:\program files\common files\gmt\egieengine.dll
c:\program files\common files\cmeii\cmeiiapi.dll
c:\program files\common files\gmt\egieprocess.dll
c:\program files\common files\gmt\fillin.wav
c:\program files\common files\gmt\gator.log
c:\program files\common files\gmt\gatorstubsetup.exe
c:\program files\common files\gmt\ginstaller.dll
c:\program files\common files\gmt\gmt.exe
C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\GStartup.lnk
c:\program files\common files\gmt\gmt.exe.manifest
c:\program files\common files\gmt\gtrawbm.fil
c:\program files\common files\gmt\guninstaller.exe
c:\program files\common files\cmeii\gappmgr.dll
c:\program files\common files\gmt\helper.wav
c:\program files\common files\gmt\mepbs.dat
c:\program files\common files\gmt\mepcat.dat
c:\program files\common files\gmt\mepcatne.dat
c:\program files\common files\gmt\mepcme.dat
c:\program files\common files\gmt\mepcmeft.dat
c:\program files\common files\gmt\mepconv.dat
c:\program files\common files\gmt\mepgh.dat
c:\program files\common files\gmt\mepimg.dat
c:\program files\common files\gmt\meprca.dat
c:\program files\common files\cmeii\gatorsupportinfo.txt
c:\program files\common files\gmt\mepsi.dat
c:\program files\common files\gmt\meptafi.dat
c:\program files\common files\gmt\data\user1.gud
c:\program files\common files\gmt\scripts\meperr.dat
c:\program files\common files\gmt\scripts\mepgus.dat
c:\program files\common files\gmt\scripts\mepoem.dat
c:\program files\common files\gmt\scripts\mepsnd-gs.dat
c:\program files\common files\gmt\scripts\mepsnd-ksa.dat
c:\program files\common files\cmeii\gcontroller.dll
c:\program files\common files\cmeii\gdwldeng.dll
c:\program files\common files\cmeii\giocl.dll
c:\program files\common files\cmeii\gioclclient.dll
c:\program files\common files\cmeii\gmtproxy.dll

Infected folders detected
c:\program files\common files\cmeii
c:\program files\common files\gmt\scripts
c:\program files\common files\gmt\downloadtemp\accum
c:\program files\common files\gmt\downloadtemp\accum\gmt
c:\program files\common files\cmeii\gui
c:\program files\common files\cmeii\store
c:\program files\common files\cmeii\gui\appmgr
c:\program files\common files\cmeii\store\core
c:\program files\common files\gmt
c:\program files\common files\gmt\0ga5yji83z
c:\program files\common files\gmt\data
c:\program files\common files\gmt\downloadtemp

Infected registry keys/values detected
HKEY_CLASSES_ROOT\clsid\{21ffb6c0-0da1-11d5-a9d5-00500413153c}
HKEY_LOCAL_MACHINE\software\gator.com\Gator\dyn\SD SdOpTime 1114784016
HKEY_LOCAL_MACHINE\software\gator.com\Gator\dyn\SD SdOp ExitInstance Done.
HKEY_LOCAL_MACHINE\software\gator.com\Gator\dyn\SD SdEnd 1114784016
HKEY_LOCAL_MACHINE\software\gator.com\Gator\stat\GMT\Settings GFD tle3xrpwqp
HKEY_LOCAL_MACHINE\software\gator.com\Gator\stat\GMT\Settings SegBucket 20
HKEY_LOCAL_MACHINE\software\gator.com\GInternet\Proxy Enabled 0
HKEY_CLASSES_ROOT\clsid\{21ffb6c0-0da1-11d5-a9d5-00500413153c}
HKEY_CLASSES_ROOT\clsid\{21ffb6c0-0da1-11d5-a9d5-00500413153c} GEF 512
HKEY_LOCAL_MACHINE\software\classes\clsid\{21ffb6c0-0da1-11d5-a9d5-00500413153c}
HKEY_LOCAL_MACHINE\software\classes\clsid\{21ffb6c0-0da1-11d5-a9d5-00500413153c}
HKEY_LOCAL_MACHINE\software\classes\clsid\{21ffb6c0-0da1-11d5-a9d5-00500413153c} GEF 512
HKEY_LOCAL_MACHINE\software\gator.com
HKEY_LOCAL_MACHINE\software\gator.com\Gator\dyn\AutoUpdate DefaultCheckIntervalHours 24
HKEY_LOCAL_MACHINE\software\gator.com\Gator\dyn\GUS Shutdowns 4


Claria.DashBar Toolbar more information...
Details: DashBar is provided free by GAIN Publishing. DashBar displays pop-up advertisements on your computer based on your Web browsing behavior. It also changes your browser settings.
Status: Ignored
Elevated threat - Eleveated-risk items have some potential for harm. Users should review such programs and remove them if unwanted.

Infected registry keys/values detected
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\GInternet\Proxy
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\GInternet\Proxy Enabled 0
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\AutoUpdate DefaultCheckIntervalHours 24
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GUS Shutdowns 4
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\SD SdOpTime 1114784016
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\SD SdOp ExitInstance Done.
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\SD SdEnd 1114784016
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat\GMT\Settings GFD tle3xrpwqp
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat\GMT\Settings SegBucket 20


GAIN Adware more information...
Details: GAIN (Gator) automatically fills in passwords and other elements on Web forms. Its main purpose is to install an advertising module called OfferCompanion, which displays pop-up advertisements when you view certain Web sites.
Status: Ignored
Elevated threat - Eleveated-risk items have some potential for harm. Users should review such programs and remove them if unwanted.

Infected registry keys/values detected
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\AutoUpdate
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat\GMT\Settings SegBucket 20
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat\Users
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\AutoUpdate DefaultCheckIntervalHours 24
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GUS
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GUS Shutdowns 4
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat\GMT\Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat\GMT\Settings GFD tle3xrpwqp
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat\GMT\Settings SegBucket 20
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat\GMT
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat\GMT\Settings GFD tle3xrpwqp


Altnet P2P Networking Adware more information...
Details: Altnet P2P Networking enables other applications to use adware-based peer-to-peer functionality.
Status: Ignored
Elevated threat - Eleveated-risk items have some potential for harm. Users should review such programs and remove them if unwanted.

Infected registry keys/values detected
HKEY_LOCAL_MACHINE\SOFTWARE\P2P Networking


DelFin Media Viewer Adware more information...
Details: DelFin Media Viewer, also called PromulGate, is an adware-based media player.
Status: Ignored
Moderate threat - Moderate-risk items have some potential for harm, but may be part of a wanted service. Users may decide to ignore such programs after review.

Infected files detected
c:\program files\delfin\promulgate\preference.dat

Infected folders detected
c:\program files\delfin
c:\program files\delfin\promulgate


KaZaA Software Bundler more information...
Details: KaAaA is a peer-to-peer file sharing software that displays adware advertising and installs third party adware software on your computer.
Status: Ignored
Moderate threat - Moderate-risk items have some potential for harm, but may be part of a wanted service. Users may decide to ignore such programs after review.

Infected files detected
C:\WINDOWS\Temp\Brilliant\setup.exe

Infected registry keys/values detected
HKEY_CURRENT_USER\Software\Kazaa\Advanced
HKEY_CURRENT_USER\software\kazaa\UserDetails
HKEY_CURRENT_USER\software\kazaa Tmp 0
HKEY_LOCAL_MACHINE\software\kazaa
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\in b0 89387
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\in b1 8057
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\in b0seconds 78153
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\LastEstimate b 5000
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\LastEstimate time 1104849290
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\out b0 73183
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\out b1 5472
HKEY_CURRENT_USER\Software\Kazaa\Advanced Status Installed
HKEY_LOCAL_MACHINE\software\kazaa\Bandwidth\out b0seconds 60335
HKEY_LOCAL_MACHINE\software\kazaa\CloudLoad ShareDir C:\Program Files\Kazaa\My Shared Folder
HKEY_LOCAL_MACHINE\software\kazaa\CloudLoad ExeDir C:\Program Files\Kazaa
HKEY_LOCAL_MACHINE\software\kazaa\ConnectionInfo
HKEY_LOCAL_MACHINE\software\kazaa\ConnectionInfo
HKEY_LOCAL_MACHINE\software\kazaa\LocalContent
HKEY_LOCAL_MACHINE\software\kazaa\LocalContent DownloadDir C:\Program Files\Kazaa\My Shared Folder
HKEY_LOCAL_MACHINE\software\kazaa\LocalContent DatabaseDir C:\Program Files\Kazaa\Db
HKEY_LOCAL_MACHINE\software\kazaa Tmp 0
HKEY_LOCAL_MACHINE\software\kazaa ListenPort 1557
HKEY_CURRENT_USER\software\kazaa
HKEY_LOCAL_MACHINE\software\kazaa my_ip_address 213.141.102.103
HKEY_LOCAL_MACHINE\software\kazaa UDP_probe_successes -256
HKEY_LOCAL_MACHINE\software\kazaa
HKEY_LOCAL_MACHINE\software\kazaa UDP_receive_status -763721290
HKEY_LOCAL_MACHINE\software\kazaa FirewallStatus -1
HKEY_LOCAL_MACHINE\software\kazaa DisablePort80Listen 0
HKEY_LOCAL_MACHINE\software\kazaa
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app management\arpcache\p2p networking
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app management\arpcache\p2p networking
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app management\arpcache\p2p networking Changed 0
HKEY_CURRENT_USER\software\kazaa\Advanced Status Installed
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\D:\InstallShield\Kazaa\kazaa.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\D:\InstallShield\Kazaa\kazaa.exe C:\Program Files\Kazaa\D:\InstallShield\Kazaa\kazaa.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\d:\installshield\kazaa
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\d:\installshield\kazaa\kazaa.exe C:\Program Files\Kazaa\D:\InstallShield\Kazaa\kazaa.exe
HKEY_LOCAL_MACHINE\software\sharman networks ltd
HKEY_CURRENT_USER\software\kazaa\Settings
HKEY_CURRENT_USER\software\kazaa\Settings Date
HKEY_CURRENT_USER\software\kazaa\Settings UseCount 0
HKEY_CURRENT_USER\software\kazaa\Transfer
HKEY_CURRENT_USER\software\kazaa\Transfer NoUploadLimitWhenIdle 1


NewDotNet Browser Plug-in more information...
Details: New.Net is an Internet Explorer redirection plug-in that adds subdomains of new.net to your name resolution system (Windows’ Host file), resulting in what appears to be extra top-level domains.
Status: Ignored
Moderate threat - Moderate-risk items have some potential for harm, but may be part of a wanted service. Users may decide to ignore such programs after review.

Infected files detected
c:\windows\ndnuninstall4_50.exe
c:\windows\ndnuninstall4_80.exe
c:\windows\ndnuninstall4_88.exe
c:\windows\ndnuninstall5_20.exe
c:\windows\ndnuninstall5_40.exe
c:\windows\ndnuninstall5_48.exe
c:\windows\ndnuninstall6_38.exe


Overnet Software Bundler more information...
Details: Overnet/eDonkey is a file sharing software that bundles third party adware and spyware with the free version.
Status: Ignored
Moderate threat - Moderate-risk items have some potential for harm, but may be part of a wanted service. Users may decide to ignore such programs after review.

Infected files detected
C:\Program Files\eDonkey2000\Plugins\ed2kie.dll

Infected registry keys/values detected
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ CLSID\{320154BB-D666-48F6-990E-172B32954620}
HKEY_CLASSES_ROOT\eD2KDownloadManager.object.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\eD2KDownloadManager.object.1


PowerReg Scheduler Spyware more information...
Details: PowerReg Scheduler is a registration system used by some legitimate software programs.
Status: Ignored
Moderate threat - Moderate-risk items have some potential for harm, but may be part of a wanted service. Users may decide to ignore such programs after review.

Infected files detected
C:\Documents and Settings\Kiprusov\Käynnistä-valikko\Ohjelmat\Käynnistys\PowerReg Scheduler V3.exe


eDonkey2000 Software Bundler more information...
Details: eDonkey2000 is a peer-to-peer file sharing program that installs with adware and spyware such as Webhancer, Web Search Toolbar, and New.Net.
Status: Ignored
Low threat - Low-risk items have little potential for harm, but users may wish to examine the item further.

Infected files detected
C:\Program Files\eDonkey2000\eDonkey2000.exe
c:\program files\edonkey2000\known.met
c:\program files\edonkey2000\skins\default\share-down.png
c:\program files\edonkey2000\skins\default\share-hover.png
c:\program files\edonkey2000\skins\default\share-up.png
c:\program files\edonkey2000\skins\default\tab-friends-down.png
c:\program files\edonkey2000\skins\default\tab-friends-hover.png
c:\program files\edonkey2000\skins\default\tab-friends-up.png
c:\program files\edonkey2000\skins\default\tab-home-down.png
c:\program files\edonkey2000\skins\default\tab-home-hover.png
c:\program files\edonkey2000\skins\default\tab-home-up.png
c:\program files\edonkey2000\skins\default\tab-media-down.png
c:\program files\edonkey2000\known.met.bak
c:\program files\edonkey2000\skins\default\tab-media-hover.png
c:\program files\edonkey2000\skins\default\tab-media-up.png
c:\program files\edonkey2000\skins\default\tab-search-down.png
c:\program files\edonkey2000\skins\default\tab-search-hover.png
c:\program files\edonkey2000\skins\default\tab-search-up.png
c:\program files\edonkey2000\skins\default\tab-servers-down.png
c:\program files\edonkey2000\skins\default\tab-servers-hover.png
c:\program files\edonkey2000\skins\default\tab-servers-up.png
c:\program files\edonkey2000\skins\default\tab-shared-down.png
c:\program files\edonkey2000\skins\default\tab-shared-hover.png
c:\program files\edonkey2000\layout.xml
c:\program files\edonkey2000\skins\default\tab-shared-up.png
c:\program files\edonkey2000\skins\default\tab-stats-down.png
c:\program files\edonkey2000\skins\default\tab-stats-hover.png
c:\program files\edonkey2000\skins\default\tab-stats-up.png
c:\program files\edonkey2000\skins\default\tab-transfers-down.png
c:\program files\edonkey2000\skins\default\tab-transfers-hover.png
c:\program files\edonkey2000\skins\default\tab-transfers-up.png
c:\program files\edonkey2000\skins\default\ui.xml
c:\program files\edonkey2000\skins\default\unshare-dis.png
c:\program files\edonkey2000\skins\default\unshare-down.png
c:\program files\edonkey2000\log.txt
c:\program files\edonkey2000\skins\default\unshare-hover.png
c:\program files\edonkey2000\skins\default\unshare-up.png
c:\program files\edonkey2000\skins\default\x-down.png
c:\program files\edonkey2000\skins\default\x-hover.png
c:\program files\edonkey2000\skins\default\x-up.png
c:\program files\edonkey2000\temp\don't mess with temp files!!!!!.txt
c:\program files\edonkey2000\media.xml
c:\program files\edonkey2000\pref.xml
c:\program files\edonkey2000\reg.jpg
c:\program files\edonkey2000\server.met
c:\program files\edonkey2000\server.met.bak
c:\program files\edonkey2000\share.dat
c:\documents and settings\kiprusov\application data\microsoft\internet explorer\quick launch\edonkey2000.lnk
c:\program files\edonkey2000\share.dat.bak
c:\program files\edonkey2000\tempserver.met
c:\program files\edonkey2000\uninstall_edonkey2000.exe
c:\program files\edonkey2000\uploadq.dat
c:\program files\edonkey2000\dis-plugins\btplugin.dll
c:\program files\edonkey2000\plugins\boost_thread-vc6-mt-1_31.dll
c:\program files\edonkey2000\plugins\btplugin.dll
c:\program files\edonkey2000\plugins\ed2kie.dll
c:\program files\edonkey2000\plugins\httpprotocol.dll
c:\program files\edonkey2000\plugins\jpcplugin.ini
C:\Documents and Settings\Kiprusov\Omat tiedostot\edonkey(eli tää on ohjelma millä saa niit tavaroi ladattua netistä...=)\edonkey.exe
c:\program files\edonkey2000\plugins\jpcplugin5.dll
c:\program files\edonkey2000\plugins\launchmyapp.dll
c:\program files\edonkey2000\plugins\leeme_esp.rtf
c:\program files\edonkey2000\plugins\lesemich_ger.rtf
c:\program files\edonkey2000\plugins\lma readme.txt
c:\program files\edonkey2000\plugins\readme_eng.rtf
c:\program files\edonkey2000\plugins\_libtorrent_bsd_licence.txt
c:\program files\edonkey2000\skins\default\arrow-down.png
c:\program files\edonkey2000\skins\default\arrow-up.png
c:\program files\edonkey2000\skins\default\background.png
c:\program files\edonkey2000\5.html
c:\program files\edonkey2000\skins\default\console-big-down.png
c:\program files\edonkey2000\skins\default\console-big-hover.png
c:\program files\edonkey2000\skins\default\console-big-up.png
c:\program files\edonkey2000\skins\default\console-small-down.png
c:\program files\edonkey2000\skins\default\console-small-hover.png
c:\program files\edonkey2000\skins\default\console-small-up.png
c:\program files\edonkey2000\skins\default\download-dis.png
c:\program files\edonkey2000\skins\default\download-down.png
c:\program files\edonkey2000\skins\default\download-hover.png
c:\program files\edonkey2000\skins\default\download-up.png
c:\program files\edonkey2000\contact.dat
c:\program files\edonkey2000\skins\default\ed2k-connect.png
c:\program files\edonkey2000\skins\default\ed2k-connected.png
c:\program files\edonkey2000\skins\default\ed2k-connecting.png
c:\program files\edonkey2000\skins\default\ed2k-disconnect.png
c:\program files\edonkey2000\skins\default\ed2k-disconnected.png
c:\program files\edonkey2000\skins\default\exclaim.png
c:\program files\edonkey2000\skins\default\folder-closed-both.png
c:\program files\edonkey2000\skins\default\folder-closed-childshared.png
c:\program files\edonkey2000\skins\default\folder-closed-shared.png
c:\program files\edonkey2000\skins\default\folder-closed-unshared.png
c:\program files\edonkey2000\def.html
c:\program files\edonkey2000\skins\default\folder-go-up-level.png
c:\program files\edonkey2000\skins\default\folder-open-both.png
c:\program files\edonkey2000\skins\default\folder-open-childshared.png
c:\program files\edonkey2000\skins\default\folder-open-shared.png
c:\program files\edonkey2000\skins\default\folder-open-unshared.png
c:\program files\edonkey2000\skins\default\folder-refresh.png
c:\program files\edonkey2000\skins\default\little-back.png
c:\program files\edonkey2000\skins\default\main-help-down.png
c:\program files\edonkey2000\skins\default\main-help-hover.png
c:\program files\edonkey2000\skins\default\main-help-up.png
c:\program files\edonkey2000\filters.txt
c:\program files\edonkey2000\skins\default\main-options-down.png
c:\program files\edonkey2000\skins\default\main-options-hover.png
c:\program files\edonkey2000\skins\default\main-options-up.png
c:\program files\edonkey2000\skins\default\main-register-down.png
c:\program files\edonkey2000\skins\default\main-register-hover.png
c:\program files\edonkey2000\skins\default\main-register-up.png
c:\program files\edonkey2000\skins\default\mediaplayer.png
c:\program files\edonkey2000\skins\default\moreres-dis.png
c:\program files\edonkey2000\skins\default\moreres-down.png
c:\program files\edonkey2000\skins\default\moreres-hover.png
c:\program files\edonkey2000\friend.met
c:\program files\edonkey2000\skins\default\moreres-up.png
c:\program files\edonkey2000\skins\default\on-connect.png
c:\program files\edonkey2000\skins\default\on-connected.png
c:\program files\edonkey2000\skins\default\on-connecting.png
c:\program files\edonkey2000\skins\default\on-disconnect.png
c:\program files\edonkey2000\skins\default\on-disconnected.png
c:\program files\edonkey2000\skins\default\options-down.png
c:\program files\edonkey2000\skins\default\options-hover.png
c:\program files\edonkey2000\skins\default\options-up.png
c:\program files\edonkey2000\skins\default\preview.png
c:\program files\edonkey2000\friend.met.bak
c:\program files\edonkey2000\skins\default\refresh-dis.png
c:\program files\edonkey2000\skins\default\refresh-down.png
c:\program files\edonkey2000\skins\default\refresh-hover.png
c:\program files\edonkey2000\skins\default\refresh-up.png
c:\program files\edonkey2000\skins\default\search-dis.png
c:\program files\edonkey2000\skins\default\search-down.png
c:\program files\edonkey2000\skins\default\search-hover.png
c:\program files\edonkey2000\skins\default\search-up.png
c:\program files\edonkey2000\skins\default\searching.mng
c:\program files\edonkey2000\skins\default\share-dis.png

Infected folders detected
c:\program files\edonkey2000
c:\program files\edonkey2000\dis-plugins
c:\program files\edonkey2000\plugins
c:\program files\edonkey2000\skins
c:\program files\edonkey2000\temp
c:\program files\edonkey2000\skins\default

Infected registry keys/values detected
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run eDonkey2000
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\ {320154BB-D666-48F6-990E-172B32954620}\InProcServer32 C:\Program Files\eDonkey2000\plugins\ed2kie.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\ {320154BB-D666-48F6-990E-172B32954620}\InProcServer32 ThreadingModel Both
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\ {320154BB-D666-48F6-990E-172B32954620}\ProgID eD2KDownloadManager.object.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\ {320154BB-D666-48F6-990E-172B32954620}\ TypeLib {379919F2-1612-45B7-B9F4-773F6D5214F5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\ {320154BB-D666-48F6-990E-172B32954620}\ VersionIndependentProgID eD2KDownloadManager.object
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\ {320154BB-D666-48F6-990E-172B32954620} eD2K downloadManager object
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Run eDonkey2000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Uninstall\eDonkey2000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eDonkey2000 DisplayName eDonkey2000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Uninstall\eDonkey2000 UninstallString "C:\Program Files\eDonkey2000\uninstall_eDonkey2000.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Run eDonkey2000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Uninstall\eDonkey2000 DisplayIcon "C:\Program Files\eDonkey2000\eDonkey2000.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Uninstall\eDonkey2000 NoModify 1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Uninstall\eDonkey2000 NoRepair 1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run eDonkey2000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run eDonkey2000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run eDonkey2000
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\ {320154BB-D666-48F6-990E-172B32954620}
HKEY_CLASSES_ROOT\eD2KDownloadManager.object.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\eD2KDownloadManager.object.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\ {320154BB-D666-48F6-990E-172B32954620}


Detected Spyware Cookies
No spyware cookies were found during this scan.

kirjoitti:

Anonyymi

Kirjoita kommentti

5000

Lähetä