Voisko joku tarkistaa onko pöpöjä???
Logfile of HijackThis v1.99.1
Scan saved at 11:41:19, on 14.5.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Norman\Nvc\BIN\NPFSVICE.EXE
C:\Norman\Bin\Zanda.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Norman\Nvc\bin\nvcoas.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\WINDOWS\System32\alg.exe
C:\Norman\bin\NJEEVES.EXE
C:\Norman\Nvc\BIN\nipsvc.exe
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\TeleWell\TW-EA100B_2 ADSL USB\CnxDslTb.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\WINDOWS\system32\ICO.EXE
C:\Norman\bin\ZLH.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\Pelmiced.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Norman\Nvc\bin\cclaw.exe
C:\Norman\Nvc\BIN\npfmsg2.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.soneraplaza.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:\Program Files\ISTbar\istbarcm.dll (file missing)
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\TeleWell\TW-EA100B_2 ADSL USB\CnxDslTb.exe
O4 - HKLM\..\Run: [MotherBoard Sounds] sounds.exe
O4 - HKLM\..\Run: [SYSTRAY] C:\UNMT.EXE
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [t4bal] C:\WINDOWS\ijvwqhm.exe
O4 - HKLM\..\Run: [ngjevit] C:\WINDOWS\ngjevit.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\RunServices: [MotherBoard Sounds] sounds.exe
O4 - HKLM\..\RunOnce: [SpybotSnD] "E:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MotherBoard Sounds] sounds.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c32.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1115835442015
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Mouse Hardware Sync (mousehs) - Unknown owner - C:\WINDOWS\System32\mousehs.exe (file missing)
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Nvc\BIN\NPFSVICE.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
Logfile of HijackThis v1.99.1
Scan saved at 11:41:19, on 14.5.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Norman\Nvc\BIN\NPFSVICE.EXE
C:\Norman\Bin\Zanda.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Norman\Nvc\bin\nvcoas.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\WINDOWS\System32\alg.exe
C:\Norman\bin\NJEEVES.EXE
C:\Norman\Nvc\BIN\nipsvc.exe
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\TeleWell\TW-EA100B_2 ADSL USB\CnxDslTb.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\WINDOWS\system32\ICO.EXE
C:\Norman\bin\ZLH.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\Pelmiced.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Norman\Nvc\bin\cclaw.exe
C:\Norman\Nvc\BIN\npfmsg2.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.soneraplaza.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:\Program Files\ISTbar\istbarcm.dll (file missing)
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\TeleWell\TW-EA100B_2 ADSL USB\CnxDslTb.exe
O4 - HKLM\..\Run: [MotherBoard Sounds] sounds.exe
O4 - HKLM\..\Run: [SYSTRAY] C:\UNMT.EXE
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [t4bal] C:\WINDOWS\ijvwqhm.exe
O4 - HKLM\..\Run: [ngjevit] C:\WINDOWS\ngjevit.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\RunServices: [MotherBoard Sounds] sounds.exe
O4 - HKLM\..\RunOnce: [SpybotSnD] "E:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MotherBoard Sounds] sounds.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c32.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1115835442015
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Mouse Hardware Sync (mousehs) - Unknown owner - C:\WINDOWS\System32\mousehs.exe (file missing)
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Nvc\BIN\NPFSVICE.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
Vastaukset 5
Vanhimmat
logi...
ohje
http://koti.mbnet.fi/pattaya1/hjt11.htm#Ohjelma
scannaa koneesi tällä
http://koti.mbnet.fi/pattaya1/escanmwav.htm
ja laita siitä saadut tulokset tänne.
Ohjeet lokin lähettämisessä ylemmässä linkissä.
Ad-Aware SE Personal
Adobe Reader 6.0.1
ATI Control Panel
ATI Display Driver
HijackThis 1.99.1
Language pack for Ad-Aware SE
Media Access
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Finnish Language Pack
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft Windows Journal Viewer
Microsoft Windows XP -käyttöjärjestelmän ohjatun CD-levylle tallentamisen HighMAT-laajennus
Mouse Suite
MSN Messenger 7.0
MSN Työkalupalkki
Norman Internet Control
ShopAtHomeSelect Cash Back
SlotchBar
Soft Data Fax Modem with SmartCP
Spybot - Search & Destroy 1.3
TeleWell TW-EA100B_2 ADSL USB LAN Adapter
Windows Media Connect
Windows Media Connect
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB887797
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
File C:\PROGRA~1\MEDIAA~1\MEDIAA~2.EXE tagged as not-a-virus:AdWare.WinAD.an. No Action Taken.
File C:\Documents and Settings\Jukka Vento\Local Settings\Temp\iinstall.exe infected by "Trojan-Downloader.Win32.IstBar.je" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Jukka Vento\Local Settings\Temp\uninstall.exe infected by "Trojan-Downloader.Win32.IstBar.gi" Virus. Action Taken: File Deleted.
File C:\Program Files\Media Access\MediaAccC.dll tagged as not-a-virus:AdWare.WinAD.ao. No Action Taken.
File C:\Program Files\Media Access\MediaAccK.exe tagged as not-a-virus:AdWare.WinAD.an. No Action Taken.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP22\A0001180.srg tagged as not-a-virus:AdWare.BargainBuddy.q. No Action Taken.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP22\A0001181.exe tagged as not-a-virus:AdWare.BargainBuddy.n. No Action Taken.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP22\A0001212.exe infected by "Trojan-Dropper.Win32.VB.fk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP22\A0001213.exe infected by "Trojan.WinREG.LowZones.a" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP22\snapshot\MFEX-1.DAT tagged as not-a-virus:AdWare.BargainBuddy.q. No Action Taken.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP39\A0004770.dll infected by "Trojan-Downloader.Win32.IstBar.ik" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP40\A0004928.exe tagged as not-a-virus:AdWare.BargainBuddy.q. No Action Taken.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP42\A0005102.exe tagged as not-a-virus:AdWare.PowerScan.d. No Action Taken.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP42\A0005103.exe infected by "Trojan-Downloader.Win32.IstBar.gi" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP42\A0005106.exe infected by "Trojan-Downloader.Win32.IstBar.jd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP42\A0005108.srg tagged as not-a-virus:AdWare.BargainBuddy.q. No Action Taken.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP42\A0005109.exe tagged as not-a-virus:AdWare.BargainBuddy.q. No Action Taken.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP42\A0005110.exe tagged as not-a-virus:AdWare.BargainBuddy.q. No Action Taken.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP42\A0005113.vxd tagged as not-a-virus:AdWare.BargainBuddy.q. No Action Taken.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP42\A0005114.exe tagged as not-a-virus:AdWare.BargainBuddy.n. No Action Taken.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP42\A0005115.exe tagged as not-a-virus:AdWare.BargainBuddy.n. No Action Taken.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP43\A0005135.dll tagged as not-a-virus:AdWare.BargainBuddy.n. No Action Taken.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP43\A0005136.exe tagged as not-a-virus:AdWare.BargainBuddy.q. No Action Taken.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP43\A0005154.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP44\A0005175.exe tagged as not-a-virus:RiskWare.Tool.ServiceRunner.f. No Action Taken.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP44\A0005176.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E2FA7C54-57EB-4D01-9E86-4601E94CDC8D}\RP44\A0005177.dll tagged as not-a-virus:AdWare.AdMir.a. No Action Taken.
Jos tuo löytyy koneelta
sounds.exe
niin scannaa se tuolla ja ilmoita tulos
http://virusscan.jotti.org/