paljon varmasti vikana..

Kuinkas kone saatiinkaan vikasietotilaan?

Joo, googlen avulla löysinkin keinon tuohon vikasietotilaan pääsemiseksi. Huntbaria ja ErrorGuardia en saanut poistettua millään, kumpaistakaan ei löytynyt yhtään mistään. Mutta tässä nyt se logfile:

Logfile of HijackThis v1.99.1
Scan saved at 19:44:01, on 1.6.2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\OHJELMATIEDOSTOT\MESSENGER PLUS! 3\MSGPLUS.EXE
C:\NORMAN\BIN\ZANDA.EXE
C:\OHJELMATIEDOSTOT\KERIO\PERSONAL FIREWALL 4\KPF4SS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\NORMAN\NVC\BIN\CCLAW.EXE
C:\NORMAN\NVC\BIN\NVCSCHED.EXE
C:\NORMAN\NVC\BIN\NIP.EXE
C:\NORMAN\BIN\NJEEVES.EXE
C:\OHJELMATIEDOSTOT\KERIO\PERSONAL FIREWALL 4\KPF4GUI.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\OHJELMATIEDOSTOT\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\OHJELMATIEDOSTOT\AHEAD\INCD\INCD.EXE
C:\WINDOWS\SYSTEM\HPZTSB03.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\OHJELMATIEDOSTOT\HEWLETT-PACKARD\DIGITAL IMAGING\UNLOAD\HPQCMON.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\OHJELMATIEDOSTOT\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\OHJELMATIEDOSTOT\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\OHJELMATIEDOSTOT\YHTEISET TIEDOSTOT\REAL\UPDATE_OB\REALSCHED.EXE
C:\NORMAN\BIN\ZLH.EXE
C:\OHJELMATIEDOSTOT\INTERNET EXPLORER\IEXPLORE.EXE
C:\OHJELMATIEDOSTOT\LOGITECH\IMAGESTUDIO\LOGITRAY.EXE
C:\WINDOWS\SYSTEM\7VJF2343.EXE
C:\OHJELMATIEDOSTOT\WINAMP\WINAMPA.EXE
C:\OHJELMATIEDOSTOT\LOGITECH\IMAGESTUDIO\LOWLIGHT.EXE
C:\OHJELMATIEDOSTOT\TROJANHUNTER 4.2\THGUARD.EXE
C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\LOGITECHDESKTOPMESSENGER.EXE
C:\LOTUS\REGISTER\REMIND32.EXE
C:\OHJELMATIEDOSTOT\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\OHJELMATIEDOSTOT\MICROSOFT OFFICE\OFFICE\MSOFFICE.EXE
C:\OHJELMATIEDOSTOT\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\OHJELMATIEDOSTOT\WINDOWS MEDIA COMPONENTS\ENCODER\WMENCAGT.EXE
C:\LOTUS\ORGANIZE\EASYCLIP.EXE
C:\OHJELMATIEDOSTOT\MSN MESSENGER\MSNMSGR.EXE
C:\OHJELMATIEDOSTOT\MOZILLA FIREFOX\FIREFOX.EXE
C:\OHJELMATIEDOSTOT\WINRAR\WINRAR.EXE
C:\WINDOWS\TEMP\RAR$EX00.968\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.luukku.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\OHJELM~1\TOOLBAR\TOOLBAR.DLL/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\OHJELM~1\TOOLBAR\TOOLBAR.DLL/sa
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\OHJELMATIEDOSTOT\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\OHJELMATIEDOSTOT\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\OHJELMATIEDOSTOT\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Ohjelmatiedostot\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ATIPTA] C:\Ohjelmatiedostot\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [InCD] C:\Ohjelmatiedostot\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb03.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [CamMonitor] C:\Ohjelmatiedostot\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Ohjelmatiedostot\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [LVComs] C:\WINDOWS\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CampRemoteDogGrim] C:\WINDOWS\All Users\Application Data\Free Enc Camp Remote\Wait Ping.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Ohjelmatiedostot\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Ohjelmatiedostot\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [7vjf2343] C:\WINDOWS\SYSTEM\7vjf2343.exe
O4 - HKLM\..\Run: [AdwareAlert] C:\OHJELMATIEDOSTOT\ADWAREALERT\ADWAREALERT.Exe -boot
O4 - HKLM\..\Run: [WinampAgent] C:\Ohjelmatiedostot\Winamp\winampa.exe
O4 - HKLM\..\Run: [TBPS] C:\Ohjelmatiedostot\Toolbar\TBPS.exe
O4 - HKLM\..\Run: [THGuard] "C:\OHJELMATIEDOSTOT\TROJANHUNTER 4.2\THGUARD.EXE"
O4 - HKLM\..\RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM\..\RunServices: [ATISmart] C:\WINDOWS\SYSTEM\ati2s9ag.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [MessengerPlus3] "C:\Ohjelmatiedostot\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\RunServices: [Norman ZANDA] C:\NORMAN\BIN\ZANDA.EXE /LOAD
O4 - HKLM\..\RunServices: [KPF4] C:\Ohjelmatiedostot\Kerio\Personal Firewall 4\kpf4ss.exe
O4 - HKCU\..\Run: [LDM] C:\Ohjelmatiedostot\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Startup: Logitech Desktop Messenger.lnk = C:\Ohjelmatiedostot\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Startup: Lotus SmartSuite versioon 9 -rekisteröinti.lnk = C:\lotus\register\remind32.exe
O4 - Startup: Officen käynnistys.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office -pikavalintapalkki.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\MSOFFICE.EXE
O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Encoder Agent.lnk = C:\Ohjelmatiedostot\Windows Media Components\Encoder\WMENCAGT.EXE
O4 - Startup: Lotus SmartCenter.lnk = C:\lotus\smartctr\smartctr.exe
O4 - Startup: Lotus SuiteStart.lnk = C:\lotus\smartctr\suitest.exe
O4 - Startup: Lotus Opetusohjelma.lnk = C:\lotus\wordpro\ltsstart.exe
O4 - Startup: Lotus Organizer EasyClip.lnk = C:\lotus\organize\easyclip.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Ohjelmatiedostot\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Ohjelmatiedostot\Java\jre1.5.0_01\bin\npjpi150_01.dll
O12 - Plugin for .spop: C:\OHJELM~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cab
O16 - DPF: {5BDBD95C-1E7F-4FB1-8497-20AF879F8B68} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fi/filesharingctrl.cab
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab
O18 - Protocol: offline-8876480 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw00 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw00s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw10 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw10s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw20 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw20s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw30 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw30s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw40 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw40s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw50 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw50s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw60 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw60s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw70 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw70s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw80 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw80s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw90 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw90s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwa0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwa0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwb0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwb0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwc0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwc0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwd0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwd0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwe0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwe0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwf0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwf0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwg0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwg0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwh0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwh0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwi0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwi0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwj0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwj0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwk0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwk0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwl0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwl0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwm0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwm0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwn0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwn0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwo0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwo0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwp0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwp0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwq0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwq0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwr0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwr0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bws0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bws0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwt0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwt0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwu0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwu0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwv0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwv0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bww0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bww0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwx0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwx0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwy0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwy0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwz0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwz0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw-0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw-0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw 0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw 0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\GAPLUGPROTOCOL-8876480.DLL

... kirjoitti:

Joo, googlen avulla löysinkin keinon tuohon vikasietotilaan pääsemiseksi. Huntbaria ja ErrorGuardia en saanut poistettua millään, kumpaistakaan ei löytynyt yhtään mistään. Mutta tässä nyt se logfile:

Logfile of HijackThis v1.99.1
Scan saved at 19:44:01, on 1.6.2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\OHJELMATIEDOSTOT\MESSENGER PLUS! 3\MSGPLUS.EXE
C:\NORMAN\BIN\ZANDA.EXE
C:\OHJELMATIEDOSTOT\KERIO\PERSONAL FIREWALL 4\KPF4SS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\NORMAN\NVC\BIN\CCLAW.EXE
C:\NORMAN\NVC\BIN\NVCSCHED.EXE
C:\NORMAN\NVC\BIN\NIP.EXE
C:\NORMAN\BIN\NJEEVES.EXE
C:\OHJELMATIEDOSTOT\KERIO\PERSONAL FIREWALL 4\KPF4GUI.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\OHJELMATIEDOSTOT\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\OHJELMATIEDOSTOT\AHEAD\INCD\INCD.EXE
C:\WINDOWS\SYSTEM\HPZTSB03.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\OHJELMATIEDOSTOT\HEWLETT-PACKARD\DIGITAL IMAGING\UNLOAD\HPQCMON.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\OHJELMATIEDOSTOT\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\OHJELMATIEDOSTOT\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\OHJELMATIEDOSTOT\YHTEISET TIEDOSTOT\REAL\UPDATE_OB\REALSCHED.EXE
C:\NORMAN\BIN\ZLH.EXE
C:\OHJELMATIEDOSTOT\INTERNET EXPLORER\IEXPLORE.EXE
C:\OHJELMATIEDOSTOT\LOGITECH\IMAGESTUDIO\LOGITRAY.EXE
C:\WINDOWS\SYSTEM\7VJF2343.EXE
C:\OHJELMATIEDOSTOT\WINAMP\WINAMPA.EXE
C:\OHJELMATIEDOSTOT\LOGITECH\IMAGESTUDIO\LOWLIGHT.EXE
C:\OHJELMATIEDOSTOT\TROJANHUNTER 4.2\THGUARD.EXE
C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\LOGITECHDESKTOPMESSENGER.EXE
C:\LOTUS\REGISTER\REMIND32.EXE
C:\OHJELMATIEDOSTOT\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\OHJELMATIEDOSTOT\MICROSOFT OFFICE\OFFICE\MSOFFICE.EXE
C:\OHJELMATIEDOSTOT\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\OHJELMATIEDOSTOT\WINDOWS MEDIA COMPONENTS\ENCODER\WMENCAGT.EXE
C:\LOTUS\ORGANIZE\EASYCLIP.EXE
C:\OHJELMATIEDOSTOT\MSN MESSENGER\MSNMSGR.EXE
C:\OHJELMATIEDOSTOT\MOZILLA FIREFOX\FIREFOX.EXE
C:\OHJELMATIEDOSTOT\WINRAR\WINRAR.EXE
C:\WINDOWS\TEMP\RAR$EX00.968\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.luukku.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\OHJELM~1\TOOLBAR\TOOLBAR.DLL/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\OHJELM~1\TOOLBAR\TOOLBAR.DLL/sa
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\OHJELMATIEDOSTOT\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\OHJELMATIEDOSTOT\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\OHJELMATIEDOSTOT\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Ohjelmatiedostot\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ATIPTA] C:\Ohjelmatiedostot\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [InCD] C:\Ohjelmatiedostot\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb03.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [CamMonitor] C:\Ohjelmatiedostot\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Ohjelmatiedostot\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [LVComs] C:\WINDOWS\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CampRemoteDogGrim] C:\WINDOWS\All Users\Application Data\Free Enc Camp Remote\Wait Ping.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Ohjelmatiedostot\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Ohjelmatiedostot\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [7vjf2343] C:\WINDOWS\SYSTEM\7vjf2343.exe
O4 - HKLM\..\Run: [AdwareAlert] C:\OHJELMATIEDOSTOT\ADWAREALERT\ADWAREALERT.Exe -boot
O4 - HKLM\..\Run: [WinampAgent] C:\Ohjelmatiedostot\Winamp\winampa.exe
O4 - HKLM\..\Run: [TBPS] C:\Ohjelmatiedostot\Toolbar\TBPS.exe
O4 - HKLM\..\Run: [THGuard] "C:\OHJELMATIEDOSTOT\TROJANHUNTER 4.2\THGUARD.EXE"
O4 - HKLM\..\RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM\..\RunServices: [ATISmart] C:\WINDOWS\SYSTEM\ati2s9ag.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [MessengerPlus3] "C:\Ohjelmatiedostot\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\RunServices: [Norman ZANDA] C:\NORMAN\BIN\ZANDA.EXE /LOAD
O4 - HKLM\..\RunServices: [KPF4] C:\Ohjelmatiedostot\Kerio\Personal Firewall 4\kpf4ss.exe
O4 - HKCU\..\Run: [LDM] C:\Ohjelmatiedostot\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Startup: Logitech Desktop Messenger.lnk = C:\Ohjelmatiedostot\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Startup: Lotus SmartSuite versioon 9 -rekisteröinti.lnk = C:\lotus\register\remind32.exe
O4 - Startup: Officen käynnistys.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office -pikavalintapalkki.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\MSOFFICE.EXE
O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Encoder Agent.lnk = C:\Ohjelmatiedostot\Windows Media Components\Encoder\WMENCAGT.EXE
O4 - Startup: Lotus SmartCenter.lnk = C:\lotus\smartctr\smartctr.exe
O4 - Startup: Lotus SuiteStart.lnk = C:\lotus\smartctr\suitest.exe
O4 - Startup: Lotus Opetusohjelma.lnk = C:\lotus\wordpro\ltsstart.exe
O4 - Startup: Lotus Organizer EasyClip.lnk = C:\lotus\organize\easyclip.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Ohjelmatiedostot\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Ohjelmatiedostot\Java\jre1.5.0_01\bin\npjpi150_01.dll
O12 - Plugin for .spop: C:\OHJELM~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cab
O16 - DPF: {5BDBD95C-1E7F-4FB1-8497-20AF879F8B68} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fi/filesharingctrl.cab
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab
O18 - Protocol: offline-8876480 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw00 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw00s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw10 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw10s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw20 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw20s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw30 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw30s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw40 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw40s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw50 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw50s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw60 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw60s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw70 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw70s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw80 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw80s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw90 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw90s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwa0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwa0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwb0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwb0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwc0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwc0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwd0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwd0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwe0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwe0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwf0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwf0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwg0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwg0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwh0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwh0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwi0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwi0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwj0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwj0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwk0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwk0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwl0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwl0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwm0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwm0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwn0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwn0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwo0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwo0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwp0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwp0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwq0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwq0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwr0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwr0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bws0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bws0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwt0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwt0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwu0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwu0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwv0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwv0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bww0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bww0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwx0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwx0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwy0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwy0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwz0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwz0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw-0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw-0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw 0 - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bw 0s - {E3D2A1BE-C6CE-421A-9548-1734A5346599} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BWPLUGPROTOCOL-8876480.DLL
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\GAPLUGPROTOCOL-8876480.DLL

Siirrä ensin se Hijackki omaan kansioon tonne
C:\HjT\HijackThis.exe

Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina Fix checked

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\OHJELM~1\TOOLBAR\TOOLBAR.DLL/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\OHJELM~1\TOOLBAR\TOOLBAR.DLL/sa
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\OHJELMATIEDOSTOT\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL (file missing
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O4 - HKLM\..\Run: [AdwareAlert] C:\OHJELMATIEDOSTOT\ADWAREALERT\ADWAREALERT.Exe -boot
O4 - HKLM\..\Run: [TBPS] C:\Ohjelmatiedostot\Toolbar\TBPS.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cab
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab

kaikki 018 rivit.

Käynnistä sitte vikasietotilassa ja poista tuo kansio jos se on poistamatta

C:\Ohjelmatiedostot\Toolbar\

Käynnistä sitte normaalisti ja scannaa tuo tuolla ja ilmoita tulos ja uus Hijack logi

C:\WINDOWS\SYSTEM\7vjf2343.exe

http://virusscan.jotti.org/

Juu kirjoitti:

Siirrä ensin se Hijackki omaan kansioon tonne
C:\HjT\HijackThis.exe

Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina Fix checked

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\OHJELM~1\TOOLBAR\TOOLBAR.DLL/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\OHJELM~1\TOOLBAR\TOOLBAR.DLL/sa
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\OHJELMATIEDOSTOT\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL (file missing
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O4 - HKLM\..\Run: [AdwareAlert] C:\OHJELMATIEDOSTOT\ADWAREALERT\ADWAREALERT.Exe -boot
O4 - HKLM\..\Run: [TBPS] C:\Ohjelmatiedostot\Toolbar\TBPS.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cab
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab

kaikki 018 rivit.

Käynnistä sitte vikasietotilassa ja poista tuo kansio jos se on poistamatta

C:\Ohjelmatiedostot\Toolbar\

Käynnistä sitte normaalisti ja scannaa tuo tuolla ja ilmoita tulos ja uus Hijack logi

C:\WINDOWS\SYSTEM\7vjf2343.exe

http://virusscan.jotti.org/

Toolbar kansion olin jo poistanut, sitä ei enää löytynyt. Tälläistä tuli tuolta nettisivulta:

" Status:    
INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) (Note: only non-destructive malware has been found. Considering the non-destructive nature of samples like these - although they can be a pain -, results will not be stored in the database.)
MD5    40b94b441d7eaef811a1c1068cba1502
Packers detected:    
-
Scanner results
AntiVir    
Found nothing
Avast    
Found Win32:Adan-003
AVG Antivirus    
Found nothing
BitDefender    
Found nothing
ClamAV    
Found Adware.Shopathome
Dr.Web    
Found not a virus Adware.SAHAgent
F-Prot Antivirus    
Found nothing
Fortinet    
Found Adware/SahAgent
Kaspersky Anti-Virus    
Found not-a-virus:AdWare.Sahat.aa
mks_vir    
Found .Sahagent
NOD32    
Found nothing
Norman Virus Control    
Found nothing
VBA32    
Found AdWare.Sahat.aa"




logfile näyttää tältä:



Logfile of HijackThis v1.99.1
Scan saved at 21:50:54, on 1.6.2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\OHJELMATIEDOSTOT\MESSENGER PLUS! 3\MSGPLUS.EXE
C:\NORMAN\BIN\ZANDA.EXE
C:\OHJELMATIEDOSTOT\KERIO\PERSONAL FIREWALL 4\KPF4SS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\NORMAN\NVC\BIN\CCLAW.EXE
C:\NORMAN\NVC\BIN\NVCSCHED.EXE
C:\NORMAN\NVC\BIN\NIP.EXE
C:\NORMAN\BIN\NJEEVES.EXE
C:\OHJELMATIEDOSTOT\KERIO\PERSONAL FIREWALL 4\KPF4GUI.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\OHJELMATIEDOSTOT\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\OHJELMATIEDOSTOT\AHEAD\INCD\INCD.EXE
C:\WINDOWS\SYSTEM\HPZTSB03.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\OHJELMATIEDOSTOT\HEWLETT-PACKARD\DIGITAL IMAGING\UNLOAD\HPQCMON.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\OHJELMATIEDOSTOT\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\OHJELMATIEDOSTOT\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\OHJELMATIEDOSTOT\YHTEISET TIEDOSTOT\REAL\UPDATE_OB\REALSCHED.EXE
C:\NORMAN\BIN\ZLH.EXE
C:\OHJELMATIEDOSTOT\INTERNET EXPLORER\IEXPLORE.EXE
C:\OHJELMATIEDOSTOT\LOGITECH\IMAGESTUDIO\LOGITRAY.EXE
C:\WINDOWS\SYSTEM\7VJF2343.EXE
C:\OHJELMATIEDOSTOT\WINAMP\WINAMPA.EXE
C:\OHJELMATIEDOSTOT\LOGITECH\IMAGESTUDIO\LOWLIGHT.EXE
C:\OHJELMATIEDOSTOT\TROJANHUNTER 4.2\THGUARD.EXE
C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\LOGITECHDESKTOPMESSENGER.EXE
C:\LOTUS\REGISTER\REMIND32.EXE
C:\OHJELMATIEDOSTOT\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\OHJELMATIEDOSTOT\MICROSOFT OFFICE\OFFICE\MSOFFICE.EXE
C:\OHJELMATIEDOSTOT\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\OHJELMATIEDOSTOT\WINDOWS MEDIA COMPONENTS\ENCODER\WMENCAGT.EXE
C:\LOTUS\ORGANIZE\EASYCLIP.EXE
C:\OHJELMATIEDOSTOT\MSN MESSENGER\MSNMSGR.EXE
C:\OHJELMATIEDOSTOT\MOZILLA FIREFOX\FIREFOX.EXE
C:\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.luukku.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\OHJELMATIEDOSTOT\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\OHJELMATIEDOSTOT\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Ohjelmatiedostot\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ATIPTA] C:\Ohjelmatiedostot\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [InCD] C:\Ohjelmatiedostot\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb03.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [CamMonitor] C:\Ohjelmatiedostot\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Ohjelmatiedostot\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [LVComs] C:\WINDOWS\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CampRemoteDogGrim] C:\WINDOWS\All Users\Application Data\Free Enc Camp Remote\Wait Ping.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Ohjelmatiedostot\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Ohjelmatiedostot\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [7vjf2343] C:\WINDOWS\SYSTEM\7vjf2343.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Ohjelmatiedostot\Winamp\winampa.exe
O4 - HKLM\..\Run: [THGuard] "C:\OHJELMATIEDOSTOT\TROJANHUNTER 4.2\THGUARD.EXE"
O4 - HKLM\..\RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM\..\RunServices: [ATISmart] C:\WINDOWS\SYSTEM\ati2s9ag.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [MessengerPlus3] "C:\Ohjelmatiedostot\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\RunServices: [Norman ZANDA] C:\NORMAN\BIN\ZANDA.EXE /LOAD
O4 - HKLM\..\RunServices: [KPF4] C:\Ohjelmatiedostot\Kerio\Personal Firewall 4\kpf4ss.exe
O4 - HKCU\..\Run: [LDM] C:\Ohjelmatiedostot\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Startup: Logitech Desktop Messenger.lnk = C:\Ohjelmatiedostot\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Startup: Lotus SmartSuite versioon 9 -rekisteröinti.lnk = C:\lotus\register\remind32.exe
O4 - Startup: Officen käynnistys.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office -pikavalintapalkki.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\MSOFFICE.EXE
O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Encoder Agent.lnk = C:\Ohjelmatiedostot\Windows Media Components\Encoder\WMENCAGT.EXE
O4 - Startup: Lotus SmartCenter.lnk = C:\lotus\smartctr\smartctr.exe
O4 - Startup: Lotus SuiteStart.lnk = C:\lotus\smartctr\suitest.exe
O4 - Startup: Lotus Opetusohjelma.lnk = C:\lotus\wordpro\ltsstart.exe
O4 - Startup: Lotus Organizer EasyClip.lnk = C:\lotus\organize\easyclip.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Ohjelmatiedostot\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Ohjelmatiedostot\Java\jre1.5.0_01\bin\npjpi150_01.dll
O12 - Plugin for .spop: C:\OHJELM~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {5BDBD95C-1E7F-4FB1-8497-20AF879F8B68} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fi/filesharingctrl.cab

... kirjoitti:

Toolbar kansion olin jo poistanut, sitä ei enää löytynyt. Tälläistä tuli tuolta nettisivulta:

" Status:    
INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) (Note: only non-destructive malware has been found. Considering the non-destructive nature of samples like these - although they can be a pain -, results will not be stored in the database.)
MD5    40b94b441d7eaef811a1c1068cba1502
Packers detected:    
-
Scanner results
AntiVir    
Found nothing
Avast    
Found Win32:Adan-003
AVG Antivirus    
Found nothing
BitDefender    
Found nothing
ClamAV    
Found Adware.Shopathome
Dr.Web    
Found not a virus Adware.SAHAgent
F-Prot Antivirus    
Found nothing
Fortinet    
Found Adware/SahAgent
Kaspersky Anti-Virus    
Found not-a-virus:AdWare.Sahat.aa
mks_vir    
Found .Sahagent
NOD32    
Found nothing
Norman Virus Control    
Found nothing
VBA32    
Found AdWare.Sahat.aa"




logfile näyttää tältä:



Logfile of HijackThis v1.99.1
Scan saved at 21:50:54, on 1.6.2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\OHJELMATIEDOSTOT\MESSENGER PLUS! 3\MSGPLUS.EXE
C:\NORMAN\BIN\ZANDA.EXE
C:\OHJELMATIEDOSTOT\KERIO\PERSONAL FIREWALL 4\KPF4SS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\NORMAN\NVC\BIN\CCLAW.EXE
C:\NORMAN\NVC\BIN\NVCSCHED.EXE
C:\NORMAN\NVC\BIN\NIP.EXE
C:\NORMAN\BIN\NJEEVES.EXE
C:\OHJELMATIEDOSTOT\KERIO\PERSONAL FIREWALL 4\KPF4GUI.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\OHJELMATIEDOSTOT\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\OHJELMATIEDOSTOT\AHEAD\INCD\INCD.EXE
C:\WINDOWS\SYSTEM\HPZTSB03.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\OHJELMATIEDOSTOT\HEWLETT-PACKARD\DIGITAL IMAGING\UNLOAD\HPQCMON.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\OHJELMATIEDOSTOT\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\OHJELMATIEDOSTOT\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\OHJELMATIEDOSTOT\YHTEISET TIEDOSTOT\REAL\UPDATE_OB\REALSCHED.EXE
C:\NORMAN\BIN\ZLH.EXE
C:\OHJELMATIEDOSTOT\INTERNET EXPLORER\IEXPLORE.EXE
C:\OHJELMATIEDOSTOT\LOGITECH\IMAGESTUDIO\LOGITRAY.EXE
C:\WINDOWS\SYSTEM\7VJF2343.EXE
C:\OHJELMATIEDOSTOT\WINAMP\WINAMPA.EXE
C:\OHJELMATIEDOSTOT\LOGITECH\IMAGESTUDIO\LOWLIGHT.EXE
C:\OHJELMATIEDOSTOT\TROJANHUNTER 4.2\THGUARD.EXE
C:\OHJELMATIEDOSTOT\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\LOGITECHDESKTOPMESSENGER.EXE
C:\LOTUS\REGISTER\REMIND32.EXE
C:\OHJELMATIEDOSTOT\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\OHJELMATIEDOSTOT\MICROSOFT OFFICE\OFFICE\MSOFFICE.EXE
C:\OHJELMATIEDOSTOT\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\OHJELMATIEDOSTOT\WINDOWS MEDIA COMPONENTS\ENCODER\WMENCAGT.EXE
C:\LOTUS\ORGANIZE\EASYCLIP.EXE
C:\OHJELMATIEDOSTOT\MSN MESSENGER\MSNMSGR.EXE
C:\OHJELMATIEDOSTOT\MOZILLA FIREFOX\FIREFOX.EXE
C:\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.luukku.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\OHJELMATIEDOSTOT\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\OHJELMATIEDOSTOT\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Ohjelmatiedostot\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ATIPTA] C:\Ohjelmatiedostot\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [InCD] C:\Ohjelmatiedostot\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb03.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [CamMonitor] C:\Ohjelmatiedostot\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Ohjelmatiedostot\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [LVComs] C:\WINDOWS\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CampRemoteDogGrim] C:\WINDOWS\All Users\Application Data\Free Enc Camp Remote\Wait Ping.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Ohjelmatiedostot\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Ohjelmatiedostot\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [7vjf2343] C:\WINDOWS\SYSTEM\7vjf2343.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Ohjelmatiedostot\Winamp\winampa.exe
O4 - HKLM\..\Run: [THGuard] "C:\OHJELMATIEDOSTOT\TROJANHUNTER 4.2\THGUARD.EXE"
O4 - HKLM\..\RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM\..\RunServices: [ATISmart] C:\WINDOWS\SYSTEM\ati2s9ag.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [MessengerPlus3] "C:\Ohjelmatiedostot\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\RunServices: [Norman ZANDA] C:\NORMAN\BIN\ZANDA.EXE /LOAD
O4 - HKLM\..\RunServices: [KPF4] C:\Ohjelmatiedostot\Kerio\Personal Firewall 4\kpf4ss.exe
O4 - HKCU\..\Run: [LDM] C:\Ohjelmatiedostot\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Startup: Logitech Desktop Messenger.lnk = C:\Ohjelmatiedostot\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Startup: Lotus SmartSuite versioon 9 -rekisteröinti.lnk = C:\lotus\register\remind32.exe
O4 - Startup: Officen käynnistys.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office -pikavalintapalkki.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\MSOFFICE.EXE
O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Encoder Agent.lnk = C:\Ohjelmatiedostot\Windows Media Components\Encoder\WMENCAGT.EXE
O4 - Startup: Lotus SmartCenter.lnk = C:\lotus\smartctr\smartctr.exe
O4 - Startup: Lotus SuiteStart.lnk = C:\lotus\smartctr\suitest.exe
O4 - Startup: Lotus Opetusohjelma.lnk = C:\lotus\wordpro\ltsstart.exe
O4 - Startup: Lotus Organizer EasyClip.lnk = C:\lotus\organize\easyclip.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Ohjelmatiedostot\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Ohjelmatiedostot\Java\jre1.5.0_01\bin\npjpi150_01.dll
O12 - Plugin for .spop: C:\OHJELM~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {5BDBD95C-1E7F-4FB1-8497-20AF879F8B68} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fi/filesharingctrl.cab

Merkkaa ja Fix:saa

O4 - HKLM\..\Run: [7vjf2343] C:\WINDOWS\SYSTEM\7vjf2343.exe

Sitte poista vikasietotilassa jos löytyy

C:\WINDOWS\SYSTEM\7vjf2343.exe

Eipä muuta näy enää.