logii

umm siit e-scanni virus lista kopioinnist tuli vaa jottai yhteenpötköön menevää mössöö ja tallensin sen ja tommose se tallens


Mon Jun 20 00:19:44 2005 => ***** Checking for specific ITW Viruses *****
Mon Jun 20 00:19:45 2005 => Checking for Welchia Virus...
Mon Jun 20 00:19:45 2005 => Checking for LovGate Virus...
Mon Jun 20 00:19:45 2005 => Checking for CodeRed Virus...
Mon Jun 20 00:19:45 2005 => Checking for OpaServ Virus...
Mon Jun 20 00:19:45 2005 => Checking for Sobig.e Virus...
Mon Jun 20 00:19:45 2005 => Checking for Winupie Virus...
Mon Jun 20 00:19:45 2005 => Checking for Swen Virus...
Mon Jun 20 00:19:45 2005 => Checking for JS.Fortnight Virus...
Mon Jun 20 00:19:45 2005 => Checking for Novarg Virus...
Mon Jun 20 00:19:45 2005 => Checking for Pagabot Virus...
Mon Jun 20 00:19:45 2005 => Checking for Parite.b Virus...
Mon Jun 20 00:19:45 2005 => Checking for Parite.a Virus...

Mon Jun 20 00:19:45 2005 => ***** Scanning complete. *****

Mon Jun 20 00:19:45 2005 => Total Number of Files Scanned: 55353
Mon Jun 20 00:19:45 2005 => Total Number of Virus(es) Found: 71
Mon Jun 20 00:19:45 2005 => Total Number of Disinfected Files: 0
Mon Jun 20 00:19:45 2005 => Total Number of Files Renamed: 7
Mon Jun 20 00:19:45 2005 => Total Number of
Deleted Files: 24
Mon Jun 20 00:19:45 2005 => Total Number of Errors: 14
Mon Jun 20 00:19:45 2005 => Time Elapsed: 01:07:22
Mon Jun 20 00:19:45 2005 => Virus Database Date: 2005/06/19
Mon Jun 20 00:19:45 2005 => Virus Database Count: 135507

Mon Jun 20 00:19:45 2005 => Scan Completed.




Logfile of HijackThis v1.99.1
Scan saved at 8:47:53, on 20.6.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Windows ControlAd\WinCtlAd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Windows ControlAd\WinCtlAdAlt.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FCH32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsav32.exe
C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Sonera Internet Tietoturva\FSGUI\fsguiexe.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DIABLO666] IEXPLORE.exe
O4 - HKLM\..\Run: [WindowsRegKey upd4te2d4te] pbhwyztcc.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Internet Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Internet Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\RunServices: [system manager] system.exe
O4 - HKLM\..\RunServices: [Workstation Services] wrkstn.exe
O4 - HKLM\..\RunServices: [kernel32dll] guardpc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [system manager] system.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Windows secure] setver32.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Kalenterin muistutukset.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: kernel32dll (0) - Unknown owner - C:\WINDOWS\system32\guardpc.exe" -netsvcs (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sonera Tietoturva (BackWeb Client - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: MS SyS Restore (sysrestore.exe) - Unknown owner - C:\WINDOWS\System32\sysrestore.exe" -netsvcs (file missing)
O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)

jepujee kirjoitti:

umm siit e-scanni virus lista kopioinnist tuli vaa jottai yhteenpötköön menevää mössöö ja tallensin sen ja tommose se tallens


Mon Jun 20 00:19:44 2005 => ***** Checking for specific ITW Viruses *****
Mon Jun 20 00:19:45 2005 => Checking for Welchia Virus...
Mon Jun 20 00:19:45 2005 => Checking for LovGate Virus...
Mon Jun 20 00:19:45 2005 => Checking for CodeRed Virus...
Mon Jun 20 00:19:45 2005 => Checking for OpaServ Virus...
Mon Jun 20 00:19:45 2005 => Checking for Sobig.e Virus...
Mon Jun 20 00:19:45 2005 => Checking for Winupie Virus...
Mon Jun 20 00:19:45 2005 => Checking for Swen Virus...
Mon Jun 20 00:19:45 2005 => Checking for JS.Fortnight Virus...
Mon Jun 20 00:19:45 2005 => Checking for Novarg Virus...
Mon Jun 20 00:19:45 2005 => Checking for Pagabot Virus...
Mon Jun 20 00:19:45 2005 => Checking for Parite.b Virus...
Mon Jun 20 00:19:45 2005 => Checking for Parite.a Virus...

Mon Jun 20 00:19:45 2005 => ***** Scanning complete. *****

Mon Jun 20 00:19:45 2005 => Total Number of Files Scanned: 55353
Mon Jun 20 00:19:45 2005 => Total Number of Virus(es) Found: 71
Mon Jun 20 00:19:45 2005 => Total Number of Disinfected Files: 0
Mon Jun 20 00:19:45 2005 => Total Number of Files Renamed: 7
Mon Jun 20 00:19:45 2005 => Total Number of
Deleted Files: 24
Mon Jun 20 00:19:45 2005 => Total Number of Errors: 14
Mon Jun 20 00:19:45 2005 => Time Elapsed: 01:07:22
Mon Jun 20 00:19:45 2005 => Virus Database Date: 2005/06/19
Mon Jun 20 00:19:45 2005 => Virus Database Count: 135507

Mon Jun 20 00:19:45 2005 => Scan Completed.




Logfile of HijackThis v1.99.1
Scan saved at 8:47:53, on 20.6.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Windows ControlAd\WinCtlAd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Windows ControlAd\WinCtlAdAlt.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FCH32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsav32.exe
C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Sonera Internet Tietoturva\FSGUI\fsguiexe.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DIABLO666] IEXPLORE.exe
O4 - HKLM\..\Run: [WindowsRegKey upd4te2d4te] pbhwyztcc.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Internet Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Internet Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\RunServices: [system manager] system.exe
O4 - HKLM\..\RunServices: [Workstation Services] wrkstn.exe
O4 - HKLM\..\RunServices: [kernel32dll] guardpc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [system manager] system.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Windows secure] setver32.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Kalenterin muistutukset.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: kernel32dll (0) - Unknown owner - C:\WINDOWS\system32\guardpc.exe" -netsvcs (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sonera Tietoturva (BackWeb Client - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: MS SyS Restore (sysrestore.exe) - Unknown owner - C:\WINDOWS\System32\sysrestore.exe" -netsvcs (file missing)
O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)

File C:\PROGRA~1\WIC422~1\WinCtlAd.exe tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
File C:\PROGRA~1\WIC422~1\WINCTL~1.EXE tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
File C:\WINDOWS\localNRD.dll tagged as not-a-virus:AdWare.BiSpy.s. No Action Taken.
File C:\PROGRA~1\WIC422~1\WinCtlAd.exe tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
File C:\WINDOWS\localNRD.dll tagged as not-a-virus:AdWare.BiSpy.s. No Action Taken.
File C:\WINDOWS\preInsln.exe tagged as not-a-virus:AdWare.BiSpy.o. No Action Taken.
File C:\WINDOWS\PYDMX.0XE tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\Documents and Settings\esko\Local Settings\Temp\Del32.tmp tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\Documents and Settings\esko\Local Settings\Temp\nsz130.tmp tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\Documents and Settings\esko\Local Settings\Temporary Internet Files\Content.IE5\ONTFMY39\abiuninst[1].exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\Documents and Settings\esko\Local Settings\Temporary Internet Files\Content.IE5\YHRG5SZI\ceres[1].cab tagged as not-a-virus:AdWare.BetterInternet.d. No Action Taken.
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\FIRC.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.01. No Action Taken.
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\moo.dll tagged as not-a-virus:Tool.Win32.Moo. No Action Taken.
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\system\bin\dll\moo.dll tagged as not-a-virus:Tool.Win32.Moo. No Action Taken.
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\system\moo.dll tagged as not-a-virus:Tool.Win32.Moo. No Action Taken.
File C:\Documents and Settings\esko\Työpöytä\mirc616.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.16. No Action Taken.
File C:\Documents and Settings\esko\Työpöytä\residentti\RE3 Tr. 5.exe tagged as not-a-virus:CrackTool.Win32.HotHook. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temp\djtopr1150.exe tagged as not-a-virus:AdWare.WebRebates.g. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temp\THI2E1E.tmp\localNrd.cab tagged as not-a-virus:AdWare.BiSpy.s. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temp\THI2E1E.tmp\localNRD.dll tagged as not-a-virus:AdWare.BiSpy.s. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temp\THI2E1E.tmp\preInsln.exe tagged as not-a-virus:AdWare.BiSpy.o. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temporary Internet Files\Content.IE5\O0TYJDM1\WinAdShift[1].dll tagged as not-a-virus:AdWare.WinAD.b. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temporary Internet Files\Content.IE5\P0F6TONS\bridge-c18[1].cab tagged as not-a-virus:AdWare.WinAD. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temporary Internet Files\Content.IE5\P0F6TONS\WinAdAlt[1].exe tagged as not-a-virus:AdWare.WinAD. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temporary Internet Files\Content.IE5\P3XV9766\WinAdCtl[1].exe tagged as not-a-virus:AdWare.WinAD.b. No Action Taken.
File C:\Program Files\SearchRelevant\SearchRelevant.dll tagged as not-a-virus:AdWare.Relevance.c. No Action Taken.
File C:\Program Files\Windows ControlAd\WinCtlAd.exe tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
File C:\Program Files\Windows ControlAd\WinCtlAdAlt.exe tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
File C:\Program Files\Windows ControlAd\WinCtlAdShift.dll tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
File C:\WINDOWS\localNRD.dll tagged as not-a-virus:AdWare.BiSpy.s. No Action Taken.
File C:\WINDOWS\preInsln.exe tagged as not-a-virus:AdWare.BiSpy.o. No Action Taken.
File C:\WINDOWS\PYDMX.0XE tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\Documents and Settings\esko\Local Settings\Temp\Del32.tmp tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\Documents and Settings\esko\Local Settings\Temp\nsz130.tmp tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\Documents and Settings\esko\Local Settings\Temporary Internet Files\Content.IE5\ONTFMY39\abiuninst[1].exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\Documents and Settings\esko\Local Settings\Temporary Internet Files\Content.IE5\YHRG5SZI\ceres[1].cab tagged as not-a-virus:AdWare.BetterInternet.d. No Action Taken.
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\FIRC.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.01. No Action Taken.
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\moo.dll tagged as not-a-virus:Tool.Win32.Moo. No Action Taken.
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\system\bin\dll\moo.dll tagged as not-a-virus:Tool.Win32.Moo. No Action Taken.
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\system\moo.dll tagged as not-a-virus:Tool.Win32.Moo. No Action Taken.
File C:\Documents and Settings\esko\Työpöytä\mirc616.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.16. No Action Taken.
File C:\Documents and Settings\esko\Työpöytä\residentti\RE3 Tr. 5.exe tagged as not-a-virus:CrackTool.Win32.HotHook. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temp\djtopr1150.exe tagged as not-a-virus:AdWare.WebRebates.g. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temp\THI2E1E.tmp\localNrd.cab tagged as not-a-virus:AdWare.BiSpy.s. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temp\THI2E1E.tmp\localNRD.dll tagged as not-a-virus:AdWare.BiSpy.s. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temp\THI2E1E.tmp\preInsln.exe tagged as not-a-virus:AdWare.BiSpy.o. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temporary Internet Files\Content.IE5\O0TYJDM1\WinAdShift[1].dll tagged as not-a-virus:AdWare.WinAD.b. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temporary Internet Files\Content.IE5\P0F6TONS\bridge-c18[1].cab tagged as not-a-virus:AdWare.WinAD. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temporary Internet Files\Content.IE5\P0F6TONS\WinAdAlt[1].exe tagged as not-a-virus:AdWare.WinAD. No Action Taken.
File C:\Documents and Settings\joku\Local Settings\Temporary Internet Files\Content.IE5\P3XV9766\WinAdCtl[1].exe tagged as not-a-virus:AdWare.WinAD.b. No Action Taken.
File C:\Program Files\SearchRelevant\SearchRelevant.dll tagged as not-a-virus:AdWare.Relevance.c. No Action Taken.
File C:\Program Files\Windows ControlAd\WinCtlAd.exe tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
File C:\Program Files\Windows ControlAd\WinCtlAdAlt.exe tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
File C:\Program Files\Windows ControlAd\WinCtlAdShift.dll tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
File C:\WINDOWS\localNRD.dll tagged as not-a-virus:AdWare.BiSpy.s. No Action Taken.
File C:\WINDOWS\preInsln.exe tagged as not-a-virus:AdWare.BiSpy.o. No Action Taken.
File C:\WINDOWS\PYDMX.0XE tagged as not-a-virus:AdWare.180Solutions. No Action Taken.

jepujee kirjoitti:

umm siit e-scanni virus lista kopioinnist tuli vaa jottai yhteenpötköön menevää mössöö ja tallensin sen ja tommose se tallens


Mon Jun 20 00:19:44 2005 => ***** Checking for specific ITW Viruses *****
Mon Jun 20 00:19:45 2005 => Checking for Welchia Virus...
Mon Jun 20 00:19:45 2005 => Checking for LovGate Virus...
Mon Jun 20 00:19:45 2005 => Checking for CodeRed Virus...
Mon Jun 20 00:19:45 2005 => Checking for OpaServ Virus...
Mon Jun 20 00:19:45 2005 => Checking for Sobig.e Virus...
Mon Jun 20 00:19:45 2005 => Checking for Winupie Virus...
Mon Jun 20 00:19:45 2005 => Checking for Swen Virus...
Mon Jun 20 00:19:45 2005 => Checking for JS.Fortnight Virus...
Mon Jun 20 00:19:45 2005 => Checking for Novarg Virus...
Mon Jun 20 00:19:45 2005 => Checking for Pagabot Virus...
Mon Jun 20 00:19:45 2005 => Checking for Parite.b Virus...
Mon Jun 20 00:19:45 2005 => Checking for Parite.a Virus...

Mon Jun 20 00:19:45 2005 => ***** Scanning complete. *****

Mon Jun 20 00:19:45 2005 => Total Number of Files Scanned: 55353
Mon Jun 20 00:19:45 2005 => Total Number of Virus(es) Found: 71
Mon Jun 20 00:19:45 2005 => Total Number of Disinfected Files: 0
Mon Jun 20 00:19:45 2005 => Total Number of Files Renamed: 7
Mon Jun 20 00:19:45 2005 => Total Number of
Deleted Files: 24
Mon Jun 20 00:19:45 2005 => Total Number of Errors: 14
Mon Jun 20 00:19:45 2005 => Time Elapsed: 01:07:22
Mon Jun 20 00:19:45 2005 => Virus Database Date: 2005/06/19
Mon Jun 20 00:19:45 2005 => Virus Database Count: 135507

Mon Jun 20 00:19:45 2005 => Scan Completed.




Logfile of HijackThis v1.99.1
Scan saved at 8:47:53, on 20.6.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Windows ControlAd\WinCtlAd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Windows ControlAd\WinCtlAdAlt.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FCH32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsav32.exe
C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Sonera Internet Tietoturva\FSGUI\fsguiexe.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DIABLO666] IEXPLORE.exe
O4 - HKLM\..\Run: [WindowsRegKey upd4te2d4te] pbhwyztcc.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Internet Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Internet Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\RunServices: [system manager] system.exe
O4 - HKLM\..\RunServices: [Workstation Services] wrkstn.exe
O4 - HKLM\..\RunServices: [kernel32dll] guardpc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [system manager] system.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Windows secure] setver32.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Kalenterin muistutukset.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: kernel32dll (0) - Unknown owner - C:\WINDOWS\system32\guardpc.exe" -netsvcs (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sonera Tietoturva (BackWeb Client - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: MS SyS Restore (sysrestore.exe) - Unknown owner - C:\WINDOWS\System32\sysrestore.exe" -netsvcs (file missing)
O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)

No siivoontuu se vähän. Olen töissä, joten en ehdi nyt tarkemmin syynäämään. Katson illalla jos "juu" ei ole antanut lisäohjeita.

jepujee kirjoitti:

umm siit e-scanni virus lista kopioinnist tuli vaa jottai yhteenpötköön menevää mössöö ja tallensin sen ja tommose se tallens


Mon Jun 20 00:19:44 2005 => ***** Checking for specific ITW Viruses *****
Mon Jun 20 00:19:45 2005 => Checking for Welchia Virus...
Mon Jun 20 00:19:45 2005 => Checking for LovGate Virus...
Mon Jun 20 00:19:45 2005 => Checking for CodeRed Virus...
Mon Jun 20 00:19:45 2005 => Checking for OpaServ Virus...
Mon Jun 20 00:19:45 2005 => Checking for Sobig.e Virus...
Mon Jun 20 00:19:45 2005 => Checking for Winupie Virus...
Mon Jun 20 00:19:45 2005 => Checking for Swen Virus...
Mon Jun 20 00:19:45 2005 => Checking for JS.Fortnight Virus...
Mon Jun 20 00:19:45 2005 => Checking for Novarg Virus...
Mon Jun 20 00:19:45 2005 => Checking for Pagabot Virus...
Mon Jun 20 00:19:45 2005 => Checking for Parite.b Virus...
Mon Jun 20 00:19:45 2005 => Checking for Parite.a Virus...

Mon Jun 20 00:19:45 2005 => ***** Scanning complete. *****

Mon Jun 20 00:19:45 2005 => Total Number of Files Scanned: 55353
Mon Jun 20 00:19:45 2005 => Total Number of Virus(es) Found: 71
Mon Jun 20 00:19:45 2005 => Total Number of Disinfected Files: 0
Mon Jun 20 00:19:45 2005 => Total Number of Files Renamed: 7
Mon Jun 20 00:19:45 2005 => Total Number of
Deleted Files: 24
Mon Jun 20 00:19:45 2005 => Total Number of Errors: 14
Mon Jun 20 00:19:45 2005 => Time Elapsed: 01:07:22
Mon Jun 20 00:19:45 2005 => Virus Database Date: 2005/06/19
Mon Jun 20 00:19:45 2005 => Virus Database Count: 135507

Mon Jun 20 00:19:45 2005 => Scan Completed.




Logfile of HijackThis v1.99.1
Scan saved at 8:47:53, on 20.6.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Windows ControlAd\WinCtlAd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Windows ControlAd\WinCtlAdAlt.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FCH32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsav32.exe
C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Sonera Internet Tietoturva\FSGUI\fsguiexe.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DIABLO666] IEXPLORE.exe
O4 - HKLM\..\Run: [WindowsRegKey upd4te2d4te] pbhwyztcc.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Internet Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Internet Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\RunServices: [system manager] system.exe
O4 - HKLM\..\RunServices: [Workstation Services] wrkstn.exe
O4 - HKLM\..\RunServices: [kernel32dll] guardpc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [system manager] system.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Windows secure] setver32.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Kalenterin muistutukset.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: kernel32dll (0) - Unknown owner - C:\WINDOWS\system32\guardpc.exe" -netsvcs (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sonera Tietoturva (BackWeb Client - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: MS SyS Restore (sysrestore.exe) - Unknown owner - C:\WINDOWS\System32\sysrestore.exe" -netsvcs (file missing)
O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)

Tyhjää kaikki temp ja temporary internet files hakemistot kaikista käyttäjätileistä

Esim näin
Näppää "käynnistä" "suorita" kirjoita ruutuun "cleanmgr" ja paina enter ja ok

Valitse

temporary internet files
roskakori
tilapäiset tiedostot

Ja näppää "ok"

piilotiedostot näkyviin

Oma Tietokone >
- Työkalut >
- Kansion asetukset >
- Näytä
Tiedostot ja kansiot >
- vieritä alaspäin
RUKSI pois seuraavasta kohdasta
- Piilota tunnettujen tiedostotyyppien tunnisteet
Piilotetut tiedostot ja kansiot
- RUKSI > Näytä piilotetut tiedostot ja kansiot
Käytä > OK

Sitten hijack-logiin

Poista lisää poista sovelluksen kautta seuraava:

Windows ControlAd

Sammuta seuraavat prosessit tehtävienhallinnasta:
IEXPLORE.exe
pbhwyztcc.exe
system.exe
wrkstn.exe
guardpc.exe
setver32.exe

Scannaa hijackilla ja ruksaa:

O4 - HKLM\..\Run: [DIABLO666] IEXPLORE.exe
O4 - HKLM\..\Run: [WindowsRegKey upd4te2d4te] pbhwyztcc.exe
O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe
O4 - HKLM\..\RunServices: [system manager] system.exe
O4 - HKLM\..\RunServices: [Workstation Services] wrkstn.exe
O4 - HKLM\..\RunServices: [kernel32dll] guardpc.exe
O4 - HKCU\..\Run: [system manager] system.exe
O4 - HKCU\..\Run: [Windows secure] setver32.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Works Kalenterin muistutukset.lnk = ?

Sammuta kaikki muut ohjelmat ja paina Fix checked.

Käynnistä kone vikasietotilaan ja etsi ja poista seuraavat tiedostot:

IEXPLORE.exe < tuo ei sijaitse \internet explorer- hakemistossa
pbhwyztcc.exe
system.exe
wrkstn.exe
guardpc.exe
setver32.exe

Sitten escanin jäljelle jääneet.
Poista nuo jos eivät ole tarpeelliisia (IRC, MIRC,FIRC)

File C:\PROGRA~1\WIC422~1\
File C:\WINDOWS\localNRD.dll
File C:\WINDOWS\preInsln.exe
File C:\WINDOWS\PYDMX.0XE.
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\FIRC.exe
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\moo.dll
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\system\bin\dll\moo.dll
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\system\moo.
File C:\Documents and Settings\esko\Työpöytä\mirc616.
File C:\Documents and Settings\esko\Työpöytä\residentti\RE3 Tr. 5.exe
File C:\Program Files\SearchRelevant\SearchRelevant.dll

Ja tuo hakemisto:
C:\Program Files\Windows ControlAd

juggis kirjoitti:

Tyhjää kaikki temp ja temporary internet files hakemistot kaikista käyttäjätileistä

Esim näin
Näppää "käynnistä" "suorita" kirjoita ruutuun "cleanmgr" ja paina enter ja ok

Valitse

temporary internet files
roskakori
tilapäiset tiedostot

Ja näppää "ok"

piilotiedostot näkyviin

Oma Tietokone >
- Työkalut >
- Kansion asetukset >
- Näytä
Tiedostot ja kansiot >
- vieritä alaspäin
RUKSI pois seuraavasta kohdasta
- Piilota tunnettujen tiedostotyyppien tunnisteet
Piilotetut tiedostot ja kansiot
- RUKSI > Näytä piilotetut tiedostot ja kansiot
Käytä > OK

Sitten hijack-logiin

Poista lisää poista sovelluksen kautta seuraava:

Windows ControlAd

Sammuta seuraavat prosessit tehtävienhallinnasta:
IEXPLORE.exe
pbhwyztcc.exe
system.exe
wrkstn.exe
guardpc.exe
setver32.exe

Scannaa hijackilla ja ruksaa:

O4 - HKLM\..\Run: [DIABLO666] IEXPLORE.exe
O4 - HKLM\..\Run: [WindowsRegKey upd4te2d4te] pbhwyztcc.exe
O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe
O4 - HKLM\..\RunServices: [system manager] system.exe
O4 - HKLM\..\RunServices: [Workstation Services] wrkstn.exe
O4 - HKLM\..\RunServices: [kernel32dll] guardpc.exe
O4 - HKCU\..\Run: [system manager] system.exe
O4 - HKCU\..\Run: [Windows secure] setver32.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Works Kalenterin muistutukset.lnk = ?

Sammuta kaikki muut ohjelmat ja paina Fix checked.

Käynnistä kone vikasietotilaan ja etsi ja poista seuraavat tiedostot:

IEXPLORE.exe < tuo ei sijaitse \internet explorer- hakemistossa
pbhwyztcc.exe
system.exe
wrkstn.exe
guardpc.exe
setver32.exe

Sitten escanin jäljelle jääneet.
Poista nuo jos eivät ole tarpeelliisia (IRC, MIRC,FIRC)

File C:\PROGRA~1\WIC422~1\
File C:\WINDOWS\localNRD.dll
File C:\WINDOWS\preInsln.exe
File C:\WINDOWS\PYDMX.0XE.
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\FIRC.exe
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\moo.dll
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\system\bin\dll\moo.dll
File C:\Documents and Settings\esko\Työpöytä\Firc3.0\system\moo.
File C:\Documents and Settings\esko\Työpöytä\mirc616.
File C:\Documents and Settings\esko\Työpöytä\residentti\RE3 Tr. 5.exe
File C:\Program Files\SearchRelevant\SearchRelevant.dll

Ja tuo hakemisto:
C:\Program Files\Windows ControlAd

Logfile of HijackThis v1.99.1
Scan saved at 18:50:51, on 20.6.2005

MSIE: Unable to get Internet Explorer version

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsav32.exe
C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Sonera Internet Tietoturva\FSGUI\fsguiexe.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Internet Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Internet Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\RunServices: [Workstation Services] wrkstn.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: kernel32dll (0) - Unknown owner - C:\WINDOWS\system32\guardpc.exe" -netsvcs (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sonera Tietoturva (BackWeb Client - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: MS SyS Restore (sysrestore.exe) - Unknown owner - C:\WINDOWS\System32\sysrestore.exe" -netsvcs (file missing)
O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)


siin on mut öö en pystyny poistaa jottai noist tiedostoist esim.

system.exe en löytäny?
guardpc.exe en löytäny
setver32.exe en löytäny
wrkstn.exe sama juttu
ja ku yritän sammuttaa sitä system.exe ni ei se sammu

jepujee kirjoitti:

Logfile of HijackThis v1.99.1
Scan saved at 18:50:51, on 20.6.2005

MSIE: Unable to get Internet Explorer version

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsav32.exe
C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Sonera Internet Tietoturva\FSGUI\fsguiexe.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Internet Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Internet Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\RunServices: [Workstation Services] wrkstn.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: kernel32dll (0) - Unknown owner - C:\WINDOWS\system32\guardpc.exe" -netsvcs (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sonera Tietoturva (BackWeb Client - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: MS SyS Restore (sysrestore.exe) - Unknown owner - C:\WINDOWS\System32\sysrestore.exe" -netsvcs (file missing)
O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)


siin on mut öö en pystyny poistaa jottai noist tiedostoist esim.

system.exe en löytäny?
guardpc.exe en löytäny
setver32.exe en löytäny
wrkstn.exe sama juttu
ja ku yritän sammuttaa sitä system.exe ni ei se sammu

Parani taas paljon.

Sammuta järjestelmän palautus, ohje:
Oma Tietokone >
- Muuta asetusta >
- järjestelmä >
- järjestelmän palautus-välilehti >
- ruksi ruutuun "poista järjestelmän palauttaminen kaikista asemista >
- Käytä >
- Ok

Ruksaa nuo:

O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll (file missing)
4 - HKLM\..\RunServices: [Workstation Services] wrkstn.exe

Sammuta muut ohjelmat ja paina fix checked.

Näppää "käynnistä" "suorita" kirjoita ruutuun servises.msc

Etsi ja sammuta nuo:

O23 - Service: kernel32dll (0) - Unknown owner - C:\WINDOWS\system32\guardpc.exe" -netsvcs (file missing)
O23 - Service: MS SyS Restore (sysrestore.exe) - Unknown owner - C:\WINDOWS\System32\sysrestore.exe" -netsvcs (file missing)
O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)


Käynnistä vikasietotilaan ja etsi ja poista nuo jos löytyy, Escan poisti osan.

system.exe
guardpc.exe
setver32.exe
wrkstn.exe

Käynnistä kone normaalisti.

Laita järjestelmän palautus päälle.

Lähetä uusi logi.

juggis kirjoitti:

Parani taas paljon.

Sammuta järjestelmän palautus, ohje:
Oma Tietokone >
- Muuta asetusta >
- järjestelmä >
- järjestelmän palautus-välilehti >
- ruksi ruutuun "poista järjestelmän palauttaminen kaikista asemista >
- Käytä >
- Ok

Ruksaa nuo:

O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll (file missing)
4 - HKLM\..\RunServices: [Workstation Services] wrkstn.exe

Sammuta muut ohjelmat ja paina fix checked.

Näppää "käynnistä" "suorita" kirjoita ruutuun servises.msc

Etsi ja sammuta nuo:

O23 - Service: kernel32dll (0) - Unknown owner - C:\WINDOWS\system32\guardpc.exe" -netsvcs (file missing)
O23 - Service: MS SyS Restore (sysrestore.exe) - Unknown owner - C:\WINDOWS\System32\sysrestore.exe" -netsvcs (file missing)
O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)


Käynnistä vikasietotilaan ja etsi ja poista nuo jos löytyy, Escan poisti osan.

system.exe
guardpc.exe
setver32.exe
wrkstn.exe

Käynnistä kone normaalisti.

Laita järjestelmän palautus päälle.

Lähetä uusi logi.

system.exe tätä löytyy miljoona tiedostoo poistanko ne kaikki?

guardpc.exe
setver32.exe
wrkstn.exe

en löydä noit?
vai siis poistanko noi käsin koneelta vai hjt avul?
eli siis jos käsin pitäis poistaa niin en löydä noit tiedostoja

jepujee kirjoitti:

system.exe tätä löytyy miljoona tiedostoo poistanko ne kaikki?

guardpc.exe
setver32.exe
wrkstn.exe

en löydä noit?
vai siis poistanko noi käsin koneelta vai hjt avul?
eli siis jos käsin pitäis poistaa niin en löydä noit tiedostoja

jokaista joka löytyy hiiren oikealla ja valitse properties tai ominaisuudet. Jos ei ole windows tiedosto tai joku muu tunnettu ohjelma joka koneellasi on niin pois vaan.

Oikeastaan tuo oli äskeisessä hjt-logissa wrkstn.exe.

Muut oli pois ne varmaan on jo poistettu.

TYhjää muuten roskakori kun saat kaiken valmiiksi.

juggis kirjoitti:

Parani taas paljon.

Sammuta järjestelmän palautus, ohje:
Oma Tietokone >
- Muuta asetusta >
- järjestelmä >
- järjestelmän palautus-välilehti >
- ruksi ruutuun "poista järjestelmän palauttaminen kaikista asemista >
- Käytä >
- Ok

Ruksaa nuo:

O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll (file missing)
4 - HKLM\..\RunServices: [Workstation Services] wrkstn.exe

Sammuta muut ohjelmat ja paina fix checked.

Näppää "käynnistä" "suorita" kirjoita ruutuun servises.msc

Etsi ja sammuta nuo:

O23 - Service: kernel32dll (0) - Unknown owner - C:\WINDOWS\system32\guardpc.exe" -netsvcs (file missing)
O23 - Service: MS SyS Restore (sysrestore.exe) - Unknown owner - C:\WINDOWS\System32\sysrestore.exe" -netsvcs (file missing)
O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)


Käynnistä vikasietotilaan ja etsi ja poista nuo jos löytyy, Escan poisti osan.

system.exe
guardpc.exe
setver32.exe
wrkstn.exe

Käynnistä kone normaalisti.

Laita järjestelmän palautus päälle.

Lähetä uusi logi.

Logfile of HijackThis v1.99.1
Scan saved at 21:48:58, on 20.6.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSMB32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsav32.exe
C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
C:\Program Files\Sonera Internet Tietoturva\FSGUI\fsguiexe.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Internet Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Internet Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: kernel32dll (0) - Unknown owner - C:\WINDOWS\system32\guardpc.exe" -netsvcs (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sonera Tietoturva (BackWeb Client - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: MS SyS Restore (sysrestore.exe) - Unknown owner - C:\WINDOWS\System32\sysrestore.exe" -netsvcs (file missing)
O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)

noi pari ei lähe tost eikä se suorita servises.msc
toimi?

jepujee kirjoitti:

Logfile of HijackThis v1.99.1
Scan saved at 21:48:58, on 20.6.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSMB32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsav32.exe
C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
C:\Program Files\Sonera Internet Tietoturva\FSGUI\fsguiexe.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Internet Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Internet Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: kernel32dll (0) - Unknown owner - C:\WINDOWS\system32\guardpc.exe" -netsvcs (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sonera Tietoturva (BackWeb Client - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: MS SyS Restore (sysrestore.exe) - Unknown owner - C:\WINDOWS\System32\sysrestore.exe" -netsvcs (file missing)
O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)

noi pari ei lähe tost eikä se suorita servises.msc
toimi?

services.msc

kokeileppas kirjoitti:

services.msc

eihä enää tos pitäis mittää rumempaa olla muutaku toi setver32.exe -netsvcs

mikä ei suostuu lähtee vai pitääk toi vikasietotilan kautta poistaa ja päteek sama muihin paskoihin

Logfile of HijackThis v1.99.1
Scan saved at 23:20:37, on 20.6.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSMB32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsav32.exe
C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
C:\Program Files\Sonera Internet Tietoturva\FSGUI\fsguiexe.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Internet Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Internet Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sonera Tietoturva (BackWeb Client - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)

jepujee kirjoitti:

eihä enää tos pitäis mittää rumempaa olla muutaku toi setver32.exe -netsvcs

mikä ei suostuu lähtee vai pitääk toi vikasietotilan kautta poistaa ja päteek sama muihin paskoihin

Logfile of HijackThis v1.99.1
Scan saved at 23:20:37, on 20.6.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSMB32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsav32.exe
C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
C:\Program Files\Sonera Internet Tietoturva\FSGUI\fsguiexe.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Internet Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Internet Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sonera Tietoturva (BackWeb Client - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)

Koitas lähtiskö tuolla:

http://www.sophos.com/tools/sav32sfx.exe

Lataa se ja asenna omaan hakemistoon.

Scannin jälkeen boottaus ja lähetä uusi logi.

juggis kirjoitti:

Koitas lähtiskö tuolla:

http://www.sophos.com/tools/sav32sfx.exe

Lataa se ja asenna omaan hakemistoon.

Scannin jälkeen boottaus ja lähetä uusi logi.

scannattu on kaikel mahdollisel

Logfile of HijackThis v1.99.1
Scan saved at 14:57:35, on 21.6.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsav32.exe
C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
C:\Program Files\Sonera Internet Tietoturva\FSGUI\fsguiexe.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Rami\Työpöytä\Firc3.0\FIRC.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Internet Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Internet Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sonera Tietoturva (BackWeb Client - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)

jepujee kirjoitti:

scannattu on kaikel mahdollisel

Logfile of HijackThis v1.99.1
Scan saved at 14:57:35, on 21.6.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Internet Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsav32.exe
C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
C:\Program Files\Sonera Internet Tietoturva\FSGUI\fsguiexe.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Rami\Työpöytä\Firc3.0\FIRC.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Internet Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Internet Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Internet Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sonera Tietoturva (BackWeb Client - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Internet Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Internet Tietoturva\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)

Tuolla scannerilla mitään?

Löytyykö tuo prosessi vielä koneelta (setver.exe)?

Niin ja aiempaan kysymykseen, Poistot vikasietotilassa jos ei muuten suostu poistumaan.

Löytyikö services.msc kautta tuo:
O23 - Service: Windows secure (Windows Safety)

Ruksaa tuo jos tota prosessia ei ole käynnissä (setver.exe):

O23 - Service: Windows secure (Windows Safety) - Unknown owner - C:\WINDOWS\System32\setver32.exe" -netsvcs (file missing)

Fixi muut ohjelmat sammutettuna.

Bootti perään.