Elikkä pitäs saada konetta vähän putsattua kun rupee olee täynnä kaikenlaista roskaa. Miltä tämä loki näyttää asiantuntijoiden mielestä?
Sit ois toinen ongelma eli aina ku koneen käynnistää nii aukee about:blank tyhjä ikkuna eikä auta vaikka vaihtaa aloitus sivua.
Logfile of HijackThis v1.99.1
Scan saved at 14:04:53, on 23.6.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\ctfmon.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Toni Laitinen\Työpöytä\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.kkbpvqbjdwx.biz/u1JV_M3_NbmGEZbvUP8Opnl/rJXoM7iDdnC4diVuFv3sr9Q72imn82ufzU2l9e9s.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\qfcfd.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.the-exit.com/search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\qfcfd.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\qfcfd.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\qfcfd.dll/sp.html#55135
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\qfcfd.dll/sp.html#55135
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Class - {C6A53716-4EDC-CC43-99E1-9DBC615B7F1D} - C:\WINDOWS\system32\ntwl32.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [IE Menu Extension toolbar] rundll32.exe "C:\PROGRA~1\IEMENU~1\tbextn.dll" DllShowTB
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [Preview AdService] C:\Program Files\Preview AdService\PrevAdServ.exe
O4 - HKLM\..\Run: [WinProfile] sndcfg16.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [netob.exe] C:\WINDOWS\netob.exe
O4 - HKLM\..\Run: [appzo.exe] C:\WINDOWS\system32\appzo.exe
O4 - HKLM\..\Run: [crne.exe] C:\WINDOWS\system32\crne.exe
O4 - HKLM\..\RunServices: [WinProfile] sndcfg16.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [32 Junk] C:\DOCUME~1\TONILA~1\APPLIC~1\Flagwipe\MULTI STYLE.exe
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZRxdm185YYFI
O8 - Extra context menu item: >>> FREE PORN GALLERIES
Sit ois toinen ongelma eli aina ku koneen käynnistää nii aukee about:blank tyhjä ikkuna eikä auta vaikka vaihtaa aloitus sivua.
Logfile of HijackThis v1.99.1
Scan saved at 14:04:53, on 23.6.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\ctfmon.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Toni Laitinen\Työpöytä\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.kkbpvqbjdwx.biz/u1JV_M3_NbmGEZbvUP8Opnl/rJXoM7iDdnC4diVuFv3sr9Q72imn82ufzU2l9e9s.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\qfcfd.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.the-exit.com/search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\qfcfd.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\qfcfd.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\qfcfd.dll/sp.html#55135
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\qfcfd.dll/sp.html#55135
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Class - {C6A53716-4EDC-CC43-99E1-9DBC615B7F1D} - C:\WINDOWS\system32\ntwl32.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [IE Menu Extension toolbar] rundll32.exe "C:\PROGRA~1\IEMENU~1\tbextn.dll" DllShowTB
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [Preview AdService] C:\Program Files\Preview AdService\PrevAdServ.exe
O4 - HKLM\..\Run: [WinProfile] sndcfg16.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [netob.exe] C:\WINDOWS\netob.exe
O4 - HKLM\..\Run: [appzo.exe] C:\WINDOWS\system32\appzo.exe
O4 - HKLM\..\Run: [crne.exe] C:\WINDOWS\system32\crne.exe
O4 - HKLM\..\RunServices: [WinProfile] sndcfg16.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [32 Junk] C:\DOCUME~1\TONILA~1\APPLIC~1\Flagwipe\MULTI STYLE.exe
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZRxdm185YYFI
O8 - Extra context menu item: >>> FREE PORN GALLERIES
Vastaukset 15
Vanhimmat
Ainakin SP2-päivitys puuttuu ja kannattaa ehdottomasti asentaa.
Tuota kerrotko mistä lataan sen?? Ja oliko loki muuten ookoo??
Lataa AboutBuster täältä:
http://www.subratam.org/?page=removal
Käynnistä se ja päivitä, älä aja vielä.
Laita piilotiedostot näkyviin, ohje:
Oma Tietokone >
- Työkalut >
- Kansion asetukset >
- Näytä
Tiedostot ja kansiot >
- vieritä alaspäin
RUKSI pois seuraavasta kohdasta
- Piilota tunnettujen tiedostotyyppien tunnisteet
Piilotetut tiedostot ja kansiot
- RUKSI > Näytä piilotetut tiedostot ja kansiot
Käytä > OK
Käynnistä kone vikasietotilaan
Scannaa hijack thisillä ja ruksaa:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.kkbpvqbjdwx.biz/u1JV_M3_NbmGEZbvUP8Opnl/rJXoM7iDdnC4diVuFv3sr9Q72imn82ufzU2l9e9s.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\qfcfd.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.the-exit.com/search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\qfcfd.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\qfcfd.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\qfcfd.dll/sp.html#55135
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\qfcfd.dll/sp.html#55135
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {C6A53716-4EDC-CC43-99E1-9DBC615B7F1D} - C:\WINDOWS\system32\ntwl32.dll (file missing)
O4 - HKLM\..\Run: [WinProfile] sndcfg16.exe
O4 - HKLM\..\Run: [netob.exe] C:\WINDOWS\netob.exe
O4 - HKLM\..\Run: [appzo.exe] C:\WINDOWS\system32\appzo.exe
O4 - HKLM\..\Run: [crne.exe] C:\WINDOWS\system32\crne.exe
O4 - HKLM\..\RunServices: [WinProfile] sndcfg16.exe
O4 - HKCU\..\Run: [32 Junk] C:\DOCUME~1\TONILA~1\APPLIC~1\Flagwipe\MULTI STYLE.exe
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZRxdm185YYFI
O8 - Extra context menu item: >>> FREE PORN GALLERIES
Joo ajoin HJT:n läpi vikasietoilassa ja ruksin nuo mitä käskit. AboutBusteri ei löytänyt mitään.
Mutta se ilmoitti virheen joka oli:
Run-time error '372':
Failed to load control 'TabStrip' from comctl32.ocx. Your version of comctl32.ocx may be outdated.Make sure you are using the version of the control that was provided with your application.
Tuota mulla ei oo niin hyvä kielipää, että tajuisin mitä toi tarkoittaa niin voisko joku vähä jeesata?
Sitten unohtui tuosta ekasta viestistä mainita vielä, että ku koneen avaa niin tulee seuraavanlainen virhesanoma:
Virhe ladattaessa "C:\PROGRA~1\IEMENU~1\tbextn.dll" määritettyä osaa ei löydy. Mitähän toi mahtaa sitten tarkoittaa ja miten sais korjattua?
Ja tässä olisi eScanin loki:
File C:\WINDOWS\d3vs32.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: File Deleted.
File C:\WINDOWS\IEMenuExtension.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\ipmq.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: File Deleted.
File C:\WINDOWS\System32\atlem32.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: File Deleted.
File C:\WINDOWS\System32\atluj32.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: File Deleted.
File C:\WINDOWS\System32\f3PSSavr.scr tagged as not-a-virus:AdWare.ToolBar.MyWebSearch. No Action Taken.
File C:\WINDOWS\System32\in10tvmk37s.dll infected by "Trojan-Dropper.Win32.Small.abd" Virus. Action Taken: File Deleted.
File C:\WINDOWS\System32\LiveService_9.dll tagged as not-a-virus:Porn-Dialer.Win32.InstantAccess. No Action Taken.
File C:\WINDOWS\System32\mssm.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: File Deleted.
File C:\WINDOWS\System32\ntmz32.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\All Users\Application Data\Copy Meta Ooze Heart\ACID THIRD.exe tagged as not-a-virus:AdWare.Lop.j. No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Copy Meta Ooze Heart\does anti.exe tagged as not-a-virus:AdWare.Lop.p. No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Copy Meta Ooze Heart\More Part.exe tagged as not-a-virus:AdWare.Lop.j. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Application Data\antifind\Stupidthird.exe infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Flagwipe\bqrxlneg.exe tagged as not-a-virus:AdWare.Lop.p. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Application Data\Flagwipe\browse vc nurb iso.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Flagwipe\dalegridseek.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Flagwipe\epdpqopf.exe tagged as not-a-virus:AdWare.Lop.j. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Application Data\Flagwipe\MULTI STYLE.exe tagged as not-a-virus:AdWare.Lop.k. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Application Data\Flagwipe\phrvkryn.exe tagged as not-a-virus:AdWare.Lop.j. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Application Data\Flagwipe\zaugfhyi.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\BlackBox.class-15b237dd-5860b39a.class infected by "Trojan.Java.ClassLoader.f" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\BlackBox.class-16f9f9b-66c2c9b6.class infected by "Trojan.Java.ClassLoader.f" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\BlackBox.class-40a1f1db-613df4cb.class infected by "Trojan.Java.ClassLoader.f" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-193a827f-424ea94b.class infected by "Trojan.Java.ClassLoader.Dummy.d" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-2edf3941-68c4c974.class infected by "Trojan.Java.ClassLoader.Dummy.d" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-4ae9b430-2141e5a7.class infected by "Trojan.Java.ClassLoader.Dummy.d" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-67752ecf-7a2ee67d.class infected by "Trojan.Java.ClassLoader.Dummy.d" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-774d507d-23404c2a.class infected by "Trojan.Java.Nocheat" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-bf36a53-35aff2fb.class infected by "Trojan.Java.ClassLoader.Dummy.d" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\ok.class-602516f-69ed7e55.class infected by "Trojan.Java.Nocheat" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\a.jar-1d7f14ea-7c7dd564.zip infected by "Trojan.Java.ClassLoader.b" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-5157872c-3e18affc.zip infected by "Trojan.Java.ClassLoader.i" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-5ef20017-7fe5448c.zip infected by "Trojan.Java.ClassLoader.i" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-7b2b78dd-563fd7a7.zip infected by "Trojan.Java.ClassLoader.i" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-487b52a0-629fb21c.zip infected by "Trojan-Dropper.Java.Beyond.g" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-7f1c6e55-1322ec3e.zip infected by "Trojan.Java.ClassLoader.z" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-10ffa0b5-1e4c12c5.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-10ffa0b5-2b41d09f.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-10ffa0b5-68727a19.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-11faa9ed-1d29779b.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-22287d43-1c162e16.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-2638ab15-51958ad9.zip infected by "Trojan.Java.ClassLoader.Dummy.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-37d1ba0f-2151d998.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-3fc5c767-34fabe87.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-51b163cc-1fd10970.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-598ba985-55b56a88.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-6a0f8d6d-4ba62259.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-74f8a61e-21adebbc.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-7d9192de-13dbbdde.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-7eb4d059-4601b95c.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-baf4049-6bdb3443.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-d35111a-2dbc990a.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-5980c178-40662014.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count1.jar-5e1a96b1-3be616c6.zip infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\Counters.jar-339562b-575b3e37.zip infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\Counters.jar-4edb4b03-3d39323e.zip infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\demo.jar-30f1f1ac-4f84441f.zip infected by "Trojan.Java.ClassLoader.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\freemovies.jar-677d2343-2a3b700a.zip infected by "Trojan.Java.StartPage.o" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv453.jar-1f16a0fa-3d0b3f88.zip infected by "Trojan.Java.ClassLoader.h" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\playup_ro.jar-45c6f3d0-38be77df.zip infected by "Trojan.Java.ClassLoader.Dummy.e" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\e2e4c.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\faepwjch.exe tagged as not-a-virus:AdWare.Lop.k. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\i30.tmp tagged as not-a-virus:AdWare.SurfSide.a. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\ltgljgui.exe tagged as not-a-virus:AdWare.Lop.k. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\res2.tmp tagged as not-a-virus:AdWare.180Solutions.b. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\res307.tmp tagged as not-a-virus:AdWare.180Solutions.b. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\temp.fr42FD tagged as not-a-virus:AdWare.WinAD.ab. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\tvmupdater.exe tagged as not-a-virus:AdWare.SurfSide.b. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\vqvyxgyo.exe tagged as not-a-virus:AdWare.Lop.k. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\wezbqsad.exe tagged as not-a-virus:AdWare.Lop.m. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Työpöytä\=JAKO=\=Ohjelmat=\Avi to mpeg\avitompeg.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Työpöytä\=JAKO=\=Ohjelmat=\DivX502\DivX502Bundle.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Työpöytä\ad-aware\aawsepersonal.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Työpöytä\ad-aware\pllangs.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Työpöytä\Lavasoft\Ad-aware 6\Lang\Language-pack 2\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Työpöytä\Lavasoft\Ad-aware 6\Unwise.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\AVI to MPEG Converter\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Call of Duty\Uninstall\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Lavasoft\Ad-Aware SE Personal\Plugins\Langs\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Lavasoft\Ad-Aware SE Personal\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Preview AdService\PrevAdComm.dll tagged as not-a-virus:AdWare.WinAD.ab. No Action Taken.
File C:\Program Files\Preview AdService\PrevAdKeep.exe tagged as not-a-virus:AdWare.WinAD.ab. No Action Taken.
File C:\Program Files\Soldier of Fortune II - Double Helix\Uninstall\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Steam\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Steam\Unwise32.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\WinISD\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\System Volume Information\_restore{E23695EF-CDAF-407A-A43C-10949EE87209}\RP358\A0554969.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E23695EF-CDAF-407A-A43C-10949EE87209}\RP359\A0555056.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E23695EF-CDAF-407A-A43C-10949EE87209}\RP359\A0555057.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E23695EF-CDAF-407A-A43C-10949EE87209}\RP359\A0555058.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E23695EF-CDAF-407A-A43C-10949EE87209}\RP359\A0555059.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E23695EF-CDAF-407A-A43C-10949EE87209}\RP359\A0555060.dll infected by "Trojan-Dropper.Win32.Small.abd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E23695EF-CDAF-407A-A43C-10949EE87209}\RP359\A0555061.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E23695EF-CDAF-407A-A43C-10949EE87209}\RP359\A0555062.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E23695EF-CDAF-407A-A43C-10949EE87209}\RP359\A0555064.exe infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E23695EF-CDAF-407A-A43C-10949EE87209}\RP359\A0555065.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E23695EF-CDAF-407A-A43C-10949EE87209}\RP359\A0555066.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{E23695EF-CDAF-407A-A43C-10949EE87209}\RP359\A0555067.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\ClientAX.dll tagged as not-a-virus:AdWare.180Solutions.b. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ParisVoyeur.exe tagged as not-a-virus:Porn-Dialer.Win32.CapreDiem.d. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\ParisVoyeur.exe tagged as not-a-virus:Porn-Dialer.Win32.CapreDiem.d. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\PrevAdX.dll tagged as not-a-virus:AdWare.WinAD.aa. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\webdlg32.dll tagged as not-a-virus:AdWare.ToolBar.SBSoft.g. No Action Taken.
File C:\WINDOWS\IEMenuExtension.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\Installer\7a8b98.msi tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\system32\f3PSSavr.scr tagged as not-a-virus:AdWare.ToolBar.MyWebSearch. No Action Taken.
File C:\WINDOWS\system32\LiveService_9.dll tagged as not-a-virus:Porn-Dialer.Win32.InstantAccess. No Action Taken.
Ja tässä HJT uusi loki:
Logfile of HijackThis v1.99.1
Scan saved at 13:02:51, on 24.6.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Toni Laitinen\Työpöytä\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [IE Menu Extension toolbar] rundll32.exe "C:\PROGRA~1\IEMENU~1\tbextn.dll" DllShowTB
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://stareat.it.helsinki.fi/activex/AMC.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://koti.sonkajarvi.net/activex/AxisCamControl.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
> Run-time error '372':
Failed to load control 'TabStrip' from comctl32.ocx. Your version of comctl32.ocx may be outdated.Make sure you are using the version of the control that was provided with your application. < Sulla on vanha versio tuosta:
comctl32.ocx
tuolta saat ladattua uudemman.
http://www.ascentive.com/support/new/images/lib/COMCTL32.OCX
>Virhe ladattaessa "C:\PROGRA~1\IEMENU~1\tbextn.dll" määritettyä osaa ei löydy. Mitähän toi mahtaa sitten tarkoittaa ja miten sais korjattua? < Toi on örkki jonka lataus ei toimi. johtuu tuosta rivistä:
O4 - HKLM\..\Run: [IE Menu Extension toolbar] rundll32.exe "C:\PROGRA~1\IEMENU~1\tbextn.dll" DllShowTB
Scannaa hijackilla ja ruksaa:
O4 - HKLM\..\Run: [IE Menu Extension toolbar] rundll32.exe "C:\PROGRA~1\IEMENU~1\tbextn.dll" DllShowTB
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
Sammuta muut ohjelmat ja paina Fix checked
Boottaa kone.
Katson tuon escanin listan kohta
Laita piilotiedostot näkyviin ja sammuta järjestelmän palautus.
piilotiedostot
Oma Tietokone >
- Työkalut >
- Kansion asetukset >
- Näytä
Tiedostot ja kansiot >
- vieritä alaspäin
RUKSI pois seuraavasta kohdasta
- Piilota tunnettujen tiedostotyyppien tunnisteet
Piilotetut tiedostot ja kansiot
- RUKSI > Näytä piilotetut tiedostot ja kansiot
Käytä > OK
Järjestelmän palautus:
Oma Tietokone >
- Muuta asetusta >
- järjestelmä >
- järjestelmän palautus-välilehti >
- ruksi ruutuun "poista järjestelmän palauttaminen kaikista asemista >
- Käytä >
- Ok
cleanmgr
Tämä.
Tyhjää kaikki temp ja temporary internet files hakemistot kaikista käyttäjätileistä
Esim näin
Näppää "käynnistä" "suorita" kirjoita ruutuun "cleanmgr" ja paina enter ja ok
Valitse
temporary internet files
roskakori
tilapäiset tiedostot
Ja näppää "ok"
Käynnistä kone vikasietotilaan ja etsi ja poista nuo escannin löydökset, jos et tiedä tarpeelliseksi.
File C:\WINDOWS\IEMenuExtension.exe
File C:\WINDOWS\System32\f3PSSavr.scr.
File C:\WINDOWS\System32\LiveService_9.dll
File C:\Documents and Settings\All Users\Application Data\Copy Meta Ooze Heart\ACID THIRD. exe
File C:\Documents and Settings\All Users\Application Data\Copy Meta Ooze Heart\does anti.exe
File C:\Documents and Settings\All Users\Application Data\Copy Meta Ooze Heart\More Part.exe
File C:\Documents and Settings\Toni Laitinen\Application Data\Flagwipe\bqrxlneg.exe
File C:\Documents and Settings\Toni Laitinen\Application Data\Flagwipe\epdpqopf.exe
File C:\Documents and Settings\Toni Laitinen\Application Data\Flagwipe\MULTI STYLE.exe
File C:\Documents and Settings\Toni Laitinen\Application Data\Flagwipe\phrvkryn.exe
File C:\Documents and Settings\Toni Laitinen\Työpöytä\=JAKO=\=Ohjelmat=\Avi to mpeg\avitompeg.exe
File C:\Documents and Settings\Toni Laitinen\Työpöytä\=JAKO=\=Ohjelmat=\DivX502\DivX502Bundle.exe
File C:\Program Files\AVI to MPEG Converter\UNWISE.
File C:\Program Files\Call of Duty\Uninstall\UNWISE. exe
File C:\Program Files\Preview AdService\PrevAdComm.dll
File C:\Program Files\Preview AdService\PrevAdKeep.
File C:\Program Files\Soldier of Fortune II - Double Helix\Uninstall\UNWISE.
File C:\Program Files\Steam\UNWISE.EXE
File C:\Program Files\Steam\Unwise32..
File C:\Program Files\WinISD\UNWISE.exe
File C:\WINDOWS\Downloaded Program Files\ClientAX.dll
File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ParisVoyeur.exe
File C:\WINDOWS\Downloaded Program Files\ParisVoyeur.exe
File C:\WINDOWS\Downloaded Program Files\PrevAdX. dll
File C:\WINDOWS\Downloaded Program Files\webdlg32.dll
File C:\WINDOWS\IEMenuExtension.exe
File C:\WINDOWS\Installer\7a8b98. msi
File C:\WINDOWS\system32\f3PSSavr.scr
File C:\WINDOWS\system32\LiveService_9.dll
Käynnistä kone normaalisti ja scannaa escanilla
ja hijackill ja lähetä logit.
Minne siirrän tuon comctl32.ocx uuden version?
Pitää huomenna scannata uudestaan ja fixata nuo rivit, mutta nyt täytyy lähtee juhannuksen viettoon. Ja hyvät juhannukset sullekkin!! Ja kiitos vinkeistä ja palataan asiaan juhannuksen jälkeen.
Ohjeet tosiaan jäivät pois.
Tuolla on hyvät lontoon kieliset ohjeet:
http://www.ascentive.com/support/new/support_dll.phtml?dllname=COMCTL32.OCX
Sain korjattua tuon Run-Time errorin, eikä sitä enää tullut. Eikä tullut myös tuota latausvirhe viestiä sen jälkeen, kun fixailin nuo kaks riviä.
Vikasieto tilassa poistin tuosta eScanin listasta kaikki muut paitsi nämä joita ei löytynyt:
File C:\WINDOWS\Downloaded Program Files\ClientAX.dll
File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ParisVoyeur.exe
File C:\WINDOWS\Downloaded Program Files\ParisVoyeur.exe
File C:\WINDOWS\Downloaded Program Files\PrevAdX. dll
File C:\WINDOWS\Downloaded Program Files\webdlg32.dll
Nyt kone rupeaa toimimaan lähes niinkuin ennen, mutta vielä, kun sen avaa niin aukeaa netti suoraan tosin aloitus sivu pysyy entisellään. Eli saako jostain internet asetuksista muutettua
silleen, että se ei avautuisi?
Laitan eScanin lokin vähän myöhemmin,mutta tässä olisi uusi HJT:n loki:
Logfile of HijackThis v1.99.1
Scan saved at 19:50:31, on 27.6.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Toni Laitinen\Työpöytä\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://stareat.it.helsinki.fi/activex/AMC.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://koti.sonkajarvi.net/activex/AxisCamControl.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
Logi mielestäni ok.
Tuon P2P Networking voit poistaa koneelta kokonaan (suositus) tai pois käynnistyvistä.
> kun sen avaa niin aukeaa netti suoraan < Tarkoitat kai selainta (O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe )
Klikkaa "käynnistä" "suorita" ja kirjoita "msconfig" ja "ok".
Valitse käynnistys-välilehti, Etsi sieltä
iexplore.exe
P2P Networking.exe
Ota ruksit pois edestä. Klikkaa "käytä" "ok"
Käynnistä kone uudelleen.
Joo selainta tarkoitin. Ja tässä olisi vielä eScanin loki:
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\faepwjch.exe tagged as not-a-virus:AdWare.Lop.k. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\i30.tmp tagged as not-a-virus:AdWare.SurfSide.a. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\ltgljgui.exe tagged as not-a-virus:AdWare.Lop.k. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\res2.tmp tagged as not-a-virus:AdWare.180Solutions.b. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\res307.tmp tagged as not-a-virus:AdWare.180Solutions.b. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\temp.fr42FD tagged as not-a-virus:AdWare.WinAD.ab. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\tvmupdater.exe tagged as not-a-virus:AdWare.SurfSide.b. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\vqvyxgyo.exe tagged as not-a-virus:AdWare.Lop.k. No Action Taken.
File C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\wezbqsad.exe tagged as not-a-virus:AdWare.Lop.m. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\ClientAX.dll tagged as not-a-virus:AdWare.180Solutions.b. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ParisVoyeur.exe tagged as not-a-virus:Porn-Dialer.Win32.CapreDiem.d. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\ParisVoyeur.exe tagged as not-a-virus:Porn-Dialer.Win32.CapreDiem.d. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\PrevAdX.dll tagged as not-a-virus:AdWare.WinAD.aa. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\webdlg32.dll tagged as not-a-virus:AdWare.ToolBar.SBSoft.g. No Action Taken.
No paljon lyhee jo.
Pistä piilotiedostot näkyviin jos ei enää ole.
Käynnistä kone vikasietotilaan.
Tyhjää tuo temp- hakemisto :
C:\Documents and Settings\Toni Laitinen\Local Settings\Temp\
Ja sitte nuo tiedostot:
File C:\WINDOWS\Downloaded Program files\ClientAX.dll
File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ParisVoyeur.exe
File C:\WINDOWS\Downloaded Program Files\ParisVoyeur.exe
File C:\WINDOWS\Downloaded Program Files\PrevAdX.dll
File C:\WINDOWS\Downloaded Program Files\webdlg32.dll
Laitoin piilotiedostot näkyviin ja tyhjensin tuon temp hakemiston vikasietotilassa.
Mutta näitä en edelleenkään löytänyt, koska tuo hakemisto on tyhjä.
File C:\WINDOWS\Downloaded Program files\ClientAX.dll
File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ParisVoyeur.exe
File C:\WINDOWS\Downloaded Program Files\ParisVoyeur.exe
File C:\WINDOWS\Downloaded Program Files\PrevAdX.dll
File C:\WINDOWS\Downloaded Program Files\webdlg32.dll
Tuohon en tiedä nyt kyllä syytä.
ne KillBox:lla täppi kohtaan Delete on Reboot
http://www.bleepingcomputer.com/files/spyware/KillBox.zip