Uudet logit(Hijack ja eScan)..Löytyykös vielä mitään??

Logfile of HijackThis v1.99.0
Scan saved at 0:08:19, on 12.7.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Media Gateway\MediaGateway.exe
C:\Pelit\Winamp\winampa.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\F-Secure\Common\FSM32.EXE
C:\Pelit\VirtuaaliCDasema\daemon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\pchbutton.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\rundll32.exe
C:\F-Secure\Anti-Virus\fsgk32st.exe
C:\F-Secure\backweb\4436233\program\fsbwsys.exe
C:\F-Secure\Anti-Virus\FSGK32.EXE
C:\F-Secure\Common\FSMA32.EXE
C:\F-Secure\Anti-Virus\fssm32.exe
C:\WINDOWS\System32\gearsec.exe
C:\F-Secure\Common\FSMB32.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\F-Secure\Common\FCH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\F-Secure\Common\FAMEH32.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\F-Secure\FWES\Program\fsdfwd.exe
C:\F-Secure\Anti-Virus\fsav32.exe
C:\F-Secure\FSGUI\fsguiexe.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: HP-näkymä - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Pelit\Winamp\winampa.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [News Service] "C:\F-Secure\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [F-Secure TNB] "C:\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Manager] "C:\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Pelit\VirtuaaliCDasema\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\pchbutton.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: Sonera Tietoturva - Unknown - C:\F-Secure\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - Unknown - C:\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: fsbwsys - Unknown - C:\F-Secure\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon - F-Secure Corporation - C:\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent - F-Secure Corporation - C:\F-Secure\Common\FSMA32.EXE
O23 - Service: Gear Security Service -turvapalvelu - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
O23 - Service: iPod-palvelu - Unknown - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe




Ja sitten Escan

File C:\WINDOWS\7pccn3a6.exe tagged as not-a-virus:AdWare.Sahat.ah. No Action Taken.
File C:\WINDOWS\NEM220.0LL infected by "Trojan-Downloader.Win32.Dyfuca.gen" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\ezNewS5.exe tagged as not-a-virus:AdWare.EZula.m. No Action Taken.
File C:\WINDOWS\system32\ezStub3.dll tagged as not-a-virus:AdWare.EZula.m. No Action Taken.
File C:\WINDOWS\system32\KVIF_11.dll tagged as not-a-virus:AdWare.EZula.t. No Action Taken.
File C:\WINDOWS\system32\KVIF_11.exe tagged as not-a-virus:AdWare.EZula.t. No Action Taken.
File C:\WINDOWS\system32\mbbi8016.dll tagged as not-a-virus:AdWare.BargainBuddy.h. No Action Taken.
File C:\WINDOWS\system32\MEGAV2WBR.0LL infected by "Trojan-Dropper.Win32.Small.uv" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\r436b2pg.dll tagged as not-a-virus:AdWare.Sahat.ad. No Action Taken.
File C:\WINDOWS\system32\s2srcu3n.exe tagged as not-a-virus:AdWare.Sahat.f. No Action Taken.
File C:\WINDOWS\system32\shell32.exe tagged as not-a-virus:AdWare.WinAD.b. No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Megasearch.zip infected by "Password-protected-EXE" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Counter.class-4f780aa4-3a646bc3.class infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-1b96ec9f-69e56ef5.class infected by "Trojan.Java.ClassLoader.Dummy.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-222c8acf-3c642e22.class infected by "Trojan.Java.ClassLoader.Dummy.d" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\VerifierBug.class-7d3dca66-4ba1edf9.class infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-5157872c-4ee8b8e9.zip infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-5ef20017-762bb925.zip infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-6198e311-10075a94.zip infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-78ee691-64dee995.zip infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-2a7f8db4-56b1e1e7.zip infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-2bd098fc-419aa081.zip infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-5b3646cb-78c19caa.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-5980bc51-43917dad.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-5980c178-701f72b0.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count1.jar-65fb6bb0-1c8da5b8.zip infected by "Trojan.Java.Needy.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\dialarch.jar-5396f0c7-24d38cf4.zip infected by "Trojan.Java.ClassLoader.Dummy.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\dialarch.jar-5396f0c8-79bcb865.zip infected by "Trojan.Java.ClassLoader.Dummy.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\goatse.jar-339caf0-6dc6ff19.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loader.jar-4d341b5c-61db1496.zip infected by "Trojan.Java.ClassLoader.h" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv301.jar-5cf49a53-65defd1a.zip infected by "Trojan-Downloader.Java.OpenStream.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv418.jar-1889b403-44867883.zip infected by "Trojan-Downloader.Java.OpenStream.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temp\res7.tmp tagged as not-a-virus:AdWare.180Solutions.g. No Action Taken.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\01234NOP\NEM220[1].0LL infected by "Trojan-Downloader.Win32.Dyfuca.gen" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\21ORA5Y5\YSB_PROMPT[1].0TM infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\3YCVFL0D\INPUT[1].0TM infected by "Exploit.HTML.DragDrop" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\C5WNO7KF\INDEX[2].0TM infected by "Exploit.VBS.Phel.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\C5WNO7KF\WEB[1].0XE infected by "Trojan.Win32.BKClient" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\MLWFE9Y5\INPUT[1].0TM infected by "Exploit.HTML.DragDrop" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\MLWFE9Y5\WOW[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\MX56JUH8\PROMPT[1].0TM infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\MZIFY1MJ\wbk68.tmp infected by "Exploit.VBS.Phel.i" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\MZIFY1MJ\X3[1].0TM infected by "Trojan-Downloader.JS.Small.t" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\Y5KZQDU5\NEM220[1].0LL infected by "Trojan-Downloader.Win32.Dyfuca.gen" Virus. Action Taken: File Deleted.
File C:\hijackthis\backups\backup-20050711-220436-220.dll tagged as not-a-virus:AdWare.180Solutions.g. No Action Taken.
File C:\hijackthis\backups\backup-20050711-220436-960.dll tagged as not-a-virus:AdWare.180Solutions.j. No Action Taken.
File C:\hp\bin\win32all-146.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Pelit\Pelit\Höpöä\Elastomania\ctmnauth.zip infected by "Trojan-Dropper.Win32.Small.ff" Virus. Action Taken: File Deleted.
File C:\Pelit\Roskaa\[All codecs needed for Windows Media Player - DivX & SVCD movies\04...DivX5\DivXPro5Bundle.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Windows TaskAd\WinProject.dll tagged as not-a-virus:AdWare.WinAD.b. No Action Taken.
File C:\temp\180SAInstaller.exe tagged as not-a-virus:AdWare.180Solutions.g. No Action Taken.
File C:\temp\OPTIMIZE.0XE infected by "Trojan-Downloader.Win32.Dyfuca.ei" Virus. Action Taken: File Deleted.
File C:\WINDOWS\7pccn3a6.exe tagged as not-a-virus:AdWare.Sahat.ah. No Action Taken.
File C:\WINDOWS\system32\ezNewS5.exe tagged as not-a-virus:AdWare.EZula.m. No Action Taken.
File C:\WINDOWS\system32\ezStub3.dll tagged as not-a-virus:AdWare.EZula.m. No Action Taken.
File C:\WINDOWS\system32\KVIF_11.dll tagged as not-a-virus:AdWare.EZula.t. No Action Taken.
File C:\WINDOWS\system32\KVIF_11.exe tagged as not-a-virus:AdWare.EZula.t. No Action Taken.
File C:\WINDOWS\system32\mbbi8016.dll tagged as not-a-virus:AdWare.BargainBuddy.h. No Action Taken.
File C:\WINDOWS\system32\r436b2pg.dll tagged as not-a-virus:AdWare.Sahat.ad. No Action Taken.
File C:\WINDOWS\system32\s2srcu3n.exe tagged as not-a-virus:AdWare.Sahat.f. No Action Taken.
File C:\WINDOWS\system32\shell32.exe tagged as not-a-virus:AdWare.WinAD.b. No Action Taken.