Sain seuraavan Trojanin lahjana koneelle (osas muuten sammuttaa/tiltata spybotin)
Trojan.WinREG.Startpage.57
http://www.f-secure.com/v-descs/startpag.shtml
Jonka F-secure nimes uudelleen...
F-securen sivut sanoo seuraavaa:
"In many cases StartPage trojan files are dropped by other files, so sometimes it's not enough to delete only the StartPage trojan's file - there's a need to find the dropper and to delete it as well. Also the startup keys for StartPage trojans should be deleted from Windows Registry. "
Kysymykseni kuuluu, mistä löydän tuon startup -avaimen regeditistä?? Helppiä aloittelijalle.... Kitoosss
Trojan.WinREG.Startpage.57
http://www.f-secure.com/v-descs/startpag.shtml
Jonka F-secure nimes uudelleen...
F-securen sivut sanoo seuraavaa:
"In many cases StartPage trojan files are dropped by other files, so sometimes it's not enough to delete only the StartPage trojan's file - there's a need to find the dropper and to delete it as well. Also the startup keys for StartPage trojans should be deleted from Windows Registry. "
Kysymykseni kuuluu, mistä löydän tuon startup -avaimen regeditistä?? Helppiä aloittelijalle.... Kitoosss
Vastaukset 45
Vanhimmat
http://koti.mbnet.fi/pattaya1/hijackthis.htm
katso ohjeet tarkkaan ja ÄLÄ FIXSAA MITÄÄN ENNENKUIN SAAT OHJEET TUOLTA.
http://keskustelu.suomi24.fi/show.fcgi?category=108&conference=4500000000000628&subcat=758
Logfile of HijackThis v1.99.1
Scan saved at 22:57:14, on 28.7.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Windows\System32\ad_elmd.exe
C:\Windows\System32\Ati2evxx.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Windows\system32\crypserv.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
C:\Program Files\LonWorks\bin\LnsMtsSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Windows\System32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\ltmsg.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\a2 free\a2start.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\HijackThis\HijackThis.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
O15 - Trusted Zone: http://*.www.vd.fi
O15 - Trusted Zone: http://*.www.vg.no
ekaa kertaa näkyy lyhyt logi.
kokonaisuudeessaan tänne tai sitten sinne hijackthis palstalle.
Tossa EI ole kaikki rivit.
eipä loki ole ton pidempi....
hauskan pitoa. Josta joku vielä kärsii. Sefu vois poistaa koko aloitus ketjun.
toimiakaan voi.
niin päättelit??
Jos kysyn yksinkertaisen(?) kysymyksen, niin olenko mielestäsi saanut vastauksen siihen??
Tässä vielä kysymykseni
http://keskustelu.suomi24.fi/show.fcgi?category=108&conference=1500000000000007&posting=22000000009686224
Minun puolesta viestiketjun voi sulkea, mutta mielelläni haluaisin sitä ennen kysymykseeni vastauksen....
etkös oo kuullu tekniikasta??
Mutta siihen kysymykseen??
Sefu viskaa tämän roskiin !
Logfile of HijackThis v1.99.1
Scan saved at 3:37:06, on 28.7.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_AICN03.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\HJTHotkey\HJTHotkey.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://laajakaista.elisa.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus COLOR 480] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_AICN03.EXE /P22 "EPSON Stylus COLOR 480" /O5 "LPT1:" /M "Stylus COLOR 480"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
ihan VARMASTI rivejä.
esim. oletetaan että toi F-Secure on virustorjuntaohjelma nii´n sen rivejä TÄYTYY löytyä 04- riveistä ja 023-riveistä koska sulla on tuossa prosesseissa se käynnissä.
Sitten jos toi F-Secure on örkki niin ymmärrän ,että niitä rivejä puuttuu eikä ne kaikki näy.
Mutta koska koneesi on SINUN eikä mun / meidän niin saat toki fuskata lokin lähettämisessä tai poistaa niitä rivejä muuta tällöin et tule saamaan niitä ohjeita.
mä pidän konetta (no ****** yritän pitää) puhtaana ja huoltelen sitä säännöllisesti, SEN LISÄKSI olen lisännyt Hijackin "IgnoreListiin" minun VARMASTI turvalliseksi tietämiäni kohtia... Siksi listani on hieman lyhyempi kuin normaalisti...
Mutta kysymykseeni vastaus??
rivejä !
sillä se voi olla niissä riveissä näkyvissä.
IgnoreListilta pois .
Buuttaa kone ja pistä uusi loki.
Kiitos vaan...
Tässä vielä se ainut kysymykseni johon kaipaan vastausta:
"In many cases StartPage trojan files are dropped by other files, so sometimes it's not enough to delete only the StartPage trojan's file - there's a need to find the dropper and to delete it as well. Also the startup keys for StartPage trojans should be deleted from Windows Registry. "
Kysymykseni kuuluu, mistä löydän tuon startup -avaimen regeditistä?? Helppiä aloittelijalle.... Kitoosss
....
polusta troijalainen löytyi.
Sillä ei ole enään mitään vastattavaa.
Putsaa siintä koneeasta loputkin eli formatoi se kokonaan niin tulee puhasta ja siistiä.
END
"Kysymykseni kuuluu, mistä löydän tuon startup -avaimen regeditistä?? Helppiä aloittelijalle.... Kitoosss "
KOSKA et tiedä mitä etsiä !!
SE ei ole välttämättä startup-avaimeissa vaan jossain muussa avaimessa
Muistinkin just että se ei ollukkaan mun tiedostossa ... kuten yleensä...
C:\Documents and Settings\...\Regubp2b-lala.reg
vaan osoitteessa All Users... Noh meninpä tarkemmin kattoon et missä siellä... (f-securen ilmoituksessa ei muistaakseni näkynyt koko polkua(?)...tai en kiinnittänyt siihen huomiota...
Noh... polku tässä:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots
Ja sieltä löytyy tosiaan tiedosto .0eg jonka siis F-secure muokkas... Noh, mites tuo tiedosto
REGUBP2B-LALA.0EG
Mikäs se on miehiään, mix se on spybotin alla? Miten korjataan / estetään ongelma tulevaisuudessa...
P.S. Syy mix SpyBotti kaatu, löytyy myös...
END
"KOSKA et tiedä mitä etsiä !!
SE ei ole välttämättä startup-avaimeissa vaan jossain muussa avaimessa "
Helppo ja yksinkertainen vastaus, kiitos...
ehkä tuolla:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
tai
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
Näyttäs olevan ok, kuinka paljon nuo osaa kopioida nimiä "luotettavista" ohjelmista?? esim. tyyliin
C:\Windows\System32\spool\drivers\w32x86\3\hpztsb03.exe
Osaako nää troijalaiset piiloutua tämmöisen "muka ok näyttävän" jutun taakse?
Näkyy olevan useampia variaatioita tuosta troijalaisesta, mutta Symantecin yksi ohje tässä:
http://securityresponse.symantec.com/avcenter/venc/data/java.startpage.html
Kokeiles ajaa toi eScan läpi:
http://koti.mbnet.fi/pattaya1/escanmwav.htm
Lue sivun ohjeet latauksesta ja päivityksestä.
eScan on hitaahko, mutta tarkka.
Kiitos hyvästä ohjelmavinkistä...
Tässä lyhyt kooste skannauksesta... Alkuperäinen loki -tiedosto lienee turha... (tallennettuna on kyllä)
Mon Aug 01 15:27:03 2005 => ***** Scanning complete. *****
Mon Aug 01 15:27:03 2005 => Total Number of Files Scanned: 139078
Mon Aug 01 15:27:03 2005 => Total Number of Virus(es) Found: 1
Mon Aug 01 15:27:04 2005 => Total Number of Disinfected Files: 0
Mon Aug 01 15:27:04 2005 => Total Number of Files Renamed: 0
Mon Aug 01 15:27:04 2005 => Total Number of Deleted Files: 0
Mon Aug 01 15:27:04 2005 => Total Number of Errors: 1
Mon Aug 01 15:27:04 2005 => Time Elapsed: 06:27:29
Mon Aug 01 15:27:04 2005 => Virus Database Date: 2005/08/01
Mon Aug 01 15:27:04 2005 => Virus Database Count: 141397
Mon Aug 01 15:27:05 2005 => Scan Completed.
Löytynyt "virus" tässä
File C:\Program Files\F-Secure\BackWeb\7681197\program\backWeb-7681197.exe tagged as not-a-virus:AdWare.BackWeb.a. No Action Taken.
Onko tämä nyt AdWare vai F-Securen osa, ts. pitääköhän tämä poistaa?
Raportin mukaan tapahtui yksi "virhe"??!!?? Siis häh? Pitäisik minun tarkemmin tuota virheen syytä selvittää (esim. blokattiinko tiedoston luku tms.)??
No entäs osaatko sanoa, miksi se alkuperäinen troijalainen sieltä SpyBotin kansiosta löyty?
Lisäohjeita otan mielelläni vastaan!! Kiitos.
eScan tunnisti f-securen päivitysohjelman "virukseksi" (tagged as not-a-virus),mutta ei tehnyt sille mitään. Meni siis oikein. Älä sinäkään poista sitä. Löydetystä virheestä (Mon Aug 01 15:27:04 2005 => Total Number of Errors: 1 ); oletettavasti ei ole tapahtunut virhettä vaan on löytynyt rekisteristä virheellinen avain tai sen osa. Mulla tulee pysyvästi yksi errori johtuen aikaisemmin koneessa olleesta zonealarm-palomuurista:
=> ERROR!!! Invalid Entry in SYSTEM\CurrentControlSet\Services\vsdatant...
Vaikka tuon käyn poistamassa/korjaamassa rekisteristä, se palaa aina uudestaan sinne. Haittaa en ole havainnut, joten olkoon.
Tuohon Spybotin löydökseen en osaa ottaa kantaa, en käytä sitä. Mutta yritän etsiä lisätietoa, aikaa saattaa kulua.
Löytyihän se virhekin sieltä, saman tapainen juu...
Mon Aug 01 08:58:56 2005 => ERROR!!! Invalid Entry C:\Ohjelmatiedostot\webserver\bin\win32\matlabserver.exe in
Matlab... OK
___________________________________________
File C:\Program Files\F-Secure\BackWeb\7681197\program\backWeb-7681197.exe tagged as not-a-virus:AdWare.BackWeb.a. No Action Taken.
Arvelinkin että se on OK, mutta kooklettamalla löysin (lähinnä saksankielisiä) sivuja esim a2 sivut, jossa AdWare.BackWeb.a oli luokiteltu TOP10 listalla sijalle 2... Ja luokittelu nimenomaan Malware... Tuumasin, et onko se nyt ohjelman mukana tullut osa vai naamioitunut sinne jälkeenpäin... Mut ilmeisesti OK, koska ei sitä eri foorumeissakaan juurikaan käsketty poistamaan...
_________________________________________________
"Tuohon Spybotin löydökseen en osaa ottaa kantaa, en käytä sitä. Mutta yritän etsiä lisätietoa, aikaa saattaa kulua. "
Jos jaksat vaivaa nähdä niin olisin kiitollinen, pistän dsl:ää pitkin kylmän huurteisen tulemaan...
SpyBot tunnistaa virheellisesti F-securen automaattiseen päivitysten hakuun liittyvän BackWeb-ohjelman adwareksi eli haittaohjelmaksi, älä vaan poista sitä koneeltasi, jos poistat niin F-securesi päivitykset ei enää sen jälkeen toimi.
Täältä saa ladattua BackWeb ohjelman uudelleen jos olet sen poistanut: Lataa BackWeb ohjelma:
http://support.f-secure.fi/fin/home/onlineservices/
SE ohjelmahan, joka sen tunnisti sen Adware.Backweb.a, oli tuo e-Scan... Mutta ilmeisesti siihen pätee tuo sama asia, eli noh... Kai F-Secure kerää sillä infoo surffailukäyttäitymisistä/viruksista/tjmsp.... Joten ne havaitaa, juu en poista!! kiittis jeesistä... Osaatkos sanoo, miksi tuo Trojan.WinREG.Startpage.57 löyty SpyBot -kansiosta:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots\REGUBP2B-LALA.REG
Toisinsanoen, onko tuo jokin SpyBotin osa, jonka F-Secure äkkäs, vai eristääkö SpyBot löytämänsä pöpöt tonne? Mix SpyBotti kaatu ku troijalainen tuli, mitä muuta tapahtu koneellani, onko koneeni ny puhdas? Siinäpä muutama avoin kysymys...
onko se puhas.
lataa hjt koneelle ja pistä logi hjt palstalle.
ai niin nyt tulikin mieleen, että eihän sulla mitään kysyttävää ole.
Jatka vain jahkaamista se olisi ajat sitten ollut kunossa mutta ei niin ei.
Piiusta se sieltä SpySpotin kansiosta, spyspot on siirtanäyt sen karanteeniin ja se siksi se F-securesi sen löytää siletä spyspotin karanteeni listalta.
Sinuna minä poistaisin SpySpot ja e-scan ohjelmat koneeltani ja asentaisin niiden tilalle microsoft AntiSpyware ohjelman joka on paljon parempi kuin nuo mainitut:
http://www.microsoft.com/athome/security/spyware/software/default.mspx
Tästä suoraan lataussivustolle:
http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en&Hash=9XS56RF
SpyBot väittää löytäneensä CoolWebSearchin... Löytyykö se myös Hijackistä?
--- Spybot - Search & Destroy version: 1.4 ß2 (build: 20041211) ---
2004-05-12 blindman.exe (1.0.0.0)
2004-12-11 SpyBotSD.exe (1.4.0.0)
2004-05-12 TeaTimer.exe (1.3.0.12)
2004-04-27 unins000.exe (51.13.0.0)
2004-05-12 Update.exe (1.3.0.0)
2004-11-29 advcheck.dll (1.0.1.0)
2004-05-12 borlndmm.dll (7.0.4.453)
2004-05-12 delphimm.dll (7.0.4.453)
2004-10-20 SDHelper.dll (1.3.0.12)
2004-05-12 Tools.dll (2.0.0.0)
2004-05-12 UnzDll.dll (1.73.1.1)
2004-05-12 ZipDll.dll (1.73.2.0)
2005-05-11 Includes\Beta.sbi
2005-02-16 Includes\Beta.uti
2005-04-26 Includes\Cookies.sbi
2005-07-29 Includes\Dialer.sbi
2005-07-29 Includes\Hijackers.sbi
2005-06-23 Includes\Keyloggers.sbi
2004-11-29 Includes\LSP.sbi
2005-07-29 Includes\Malware.sbi
2005-07-22 Includes\PUPS.sbi
2005-04-27 Includes\Revision.sbi
2005-07-29 Includes\Security.sbi
2005-07-29 Includes\Spybots.sbi
2005-02-17 Includes\Tracks.uti
2005-07-29 Includes\Trojans.sbi
Located: HK_LM:Run, AdaptecDirectCD
command: C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
file: C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
size: 684032
MD5: bfa83b551abd8084b4623887d0e3b53c
Located: HK_LM:Run, ATIModeChange
command: Ati2mdxx.exe
file: C:\Windows\system32\Ati2mdxx.exe
size: 28672
MD5: fae95d6d7651b5629c4e19adbc9a3863
Located: HK_LM:Run, Cpqset
command: C:\Program Files\compaq\cpqsetup\cpqset.exe
file: C:\Program Files\compaq\cpqsetup\cpqset.exe
size: 172101
MD5: ef05141774c4ada31bc5bbc263d8f708
Located: HK_LM:Run, eabconfg.cpl
command: C:\Program Files\Compaq\EAB\EabServr.exe /Start
file:
Located: HK_LM:Run, EPSON Stylus CX3600 Series
command: C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB002" /M "Stylus CX3600"
file: C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
size: 98304
MD5: ca0c2bbdc4aba093d7f7e448c6391bce
Located: HK_LM:Run, frxmxins
command: frxmxins
file: C:\Windows\system32\frxmxins.exe
size: 53248
MD5: 876e916cf6d75db7ff51802b1663534e
Located: HK_LM:Run, F-Secure Manager
command: "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
file: C:\Program Files\F-Secure\Common\FSM32.EXE
size: 118832
MD5: 0f2f4fdb7e1de09593fd7855d28f3e9b
Located: HK_LM:Run, F-Secure TNB
command: "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
file: C:\Program Files\F-Secure\TNB\TNBUtil.exe
size: 684032
MD5: 53cc050273ca9b6e0011b05644bd8482
Located: HK_LM:Run, HPDJ Taskbar Utility
command: C:\Windows\System32\spool\drivers\w32x86\3\hpztsb03.exe
file: C:\Windows\System32\spool\drivers\w32x86\3\hpztsb03.exe
size: 196608
MD5: ebee1e613e526663a6ea4b52335f1e34
Located: HK_LM:Run, Iomega Drive Icons
command: C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
file: C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
size: 61440
MD5: dfdfd202f0c0a29088e043bbcd71002d
Located: HK_LM:Run, Iomega Startup Options
command: C:\Program Files\Iomega\Common\ImgStart.exe
file: C:\Program Files\Iomega\Common\ImgStart.exe
size: 45056
MD5: 1808f91fa578e8572bd1a9649fabb518
Located: HK_LM:Run, LTWinModem1
command: ltmsg.exe 9
file: C:\Windows\system32\ltmsg.exe
size: 38912
MD5: 12086c5a0eac64cc1115fe016943e67c
Located: HK_LM:Run, QuickTime Task
command: "C:\Program Files\QuickTime\qttask.exe" -atboottime
file: C:\Program Files\QuickTime\qttask.exe
size: 77824
MD5: 5d22b4258489575412f6d18affc847a2
Located: HK_LM:Run, Synchronization Manager
command: %SystemRoot%\system32\mobsync.exe /logon
file: C:\Windows\system32\mobsync.exe
size: 143360
MD5: 5531c63f05c7d041f7da9f8b7d88f00e
Located: HK_LM:Run, SynTPEnh
command: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
file: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
size: 557056
MD5: ba3ecd733ac0fbb3daa7f9c3d5adbb9b
Located: HK_LM:Run, SynTPLpr
command: C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
file: C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
size: 126976
MD5: 81584c2623894657f9f05eedcc9b780e
Located: HK_LM:Run, TkBellExe
command: "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
file: C:\Program Files\Common Files\Real\Update_OB\realsched.exe
size: 180269
MD5: 77ed13fd3196ebc7311ccd6899c7488c
Located: HK_LM:RunOnce, ACMWrapperV2.dll
command: c:\windows\system32\regsvr32.exe /s "C:\Program Files\Common Files\Adaptec Shared\CDEngine\ACMWrapperV2.dll"
file: c:\windows\system32\regsvr32.exe
size: 11776
MD5: 9709ead856a690333138ac40804f914e
Located: HK_LM:RunOnce, Cdbootable.dll
command: c:\windows\system32\regsvr32.exe /s "C:\Program Files\Common Files\Adaptec Shared\CreatorAPI\Cdbootable.dll"
file: c:\windows\system32\regsvr32.exe
size: 11776
MD5: 9709ead856a690333138ac40804f914e
Located: HK_LM:RunOnce, cdDataPS.dll
command: c:\windows\system32\regsvr32.exe /s "C:\Program Files\Common Files\Adaptec Shared\CreatorAPI\cdDataPS.dll"
file: c:\windows\system32\regsvr32.exe
size: 11776
MD5: 9709ead856a690333138ac40804f914e
Located: HK_LM:RunOnce, CDEngine.dll
command: c:\windows\system32\regsvr32.exe /s "C:\Program Files\Common Files\Adaptec Shared\CDEngine\CDEngine.dll"
file: c:\windows\system32\regsvr32.exe
size: 11776
MD5: 9709ead856a690333138ac40804f914e
Located: HK_LM:RunOnce, cdExtra.dll
command: c:\windows\system32\regsvr32.exe /s "C:\Program Files\Common Files\Adaptec Shared\CreatorAPI\cdExtra.dll"
file: c:\windows\system32\regsvr32.exe
size: 11776
MD5: 9709ead856a690333138ac40804f914e
Located: HK_LM:RunOnce, cdmp3.dll
command: c:\windows\system32\regsvr32.exe /s "C:\Program Files\Common Files\Adaptec Shared\CreatorAPI\cdmp3.dll"
file: c:\windows\system32\regsvr32.exe
size: 11776
MD5: 9709ead856a690333138ac40804f914e
Located: HK_LM:RunOnce, creator.dll
command: c:\windows\system32\regsvr32.exe /s "C:\Program Files\Common Files\Adaptec Shared\CreatorAPI\creator.dll"
file: c:\windows\system32\regsvr32.exe
size: 11776
MD5: 9709ead856a690333138ac40804f914e
Located: HK_LM:RunOnce, database.dll
command: c:\windows\system32\regsvr32.exe /s "C:\Program Files\Common Files\Adaptec Shared\CreatorAPI\database.dll"
file: c:\windows\system32\regsvr32.exe
size: 11776
MD5: 9709ead856a690333138ac40804f914e
Located: HK_LM:RunOnce, driversV2.dll
command: c:\windows\system32\regsvr32.exe /s "C:\Program Files\Common Files\Adaptec Shared\CDEngine\driversV2.dll"
file: c:\windows\system32\regsvr32.exe
size: 11776
MD5: 9709ead856a690333138ac40804f914e
Located: HK_LM:RunOnce, ISO9660.dll
command: c:\windows\system32\regsvr32.exe /s "C:\Program Files\Common Files\Adaptec Shared\CreatorAPI\ISO9660.dll"
file: c:\windows\system32\regsvr32.exe
size: 11776
MD5: 9709ead856a690333138ac40804f914e
Located: HK_LM:RunOnce, Joliet.dll
command: c:\windows\system32\regsvr32.exe /s "C:\Program Files\Common Files\Adaptec Shared\CreatorAPI\Joliet.dll"
file: c:\windows\system32\regsvr32.exe
size: 11776
MD5: 9709ead856a690333138ac40804f914e
Located: HK_LM:RunOnce, MediaPlayerV2.dll
command: c:\windows\system32\regsvr32.exe /s "C:\Program Files\Common Files\Adaptec Shared\CDEngine\MediaPlayerV2.dll"
file: c:\windows\system32\regsvr32.exe
size: 11776
MD5: 9709ead856a690333138ac40804f914e
Located: HK_LM:RunOnce, Translator.dll
command: c:\windows\system32\regsvr32.exe /s "C:\Program Files\Common Files\Adaptec Shared\CreatorAPI\Translator.dll"
file: c:\windows\system32\regsvr32.exe
size: 11776
MD5: 9709ead856a690333138ac40804f914e
Located: HK_LM:RunOnce, Udf.dll
command: c:\windows\system32\regsvr32.exe /s "C:\Program Files\Common Files\Adaptec Shared\CreatorAPI\Udf.dll"
file: c:\windows\system32\regsvr32.exe
size: 11776
MD5: 9709ead856a690333138ac40804f914e
Located: HK_LM:Run, QuickTime Task (DISABLED)
command: "C:\Program Files\QuickTime\qttask.exe" -atboottime
file: C:\Program Files\QuickTime\qttask.exe
size: 77824
MD5: 5d22b4258489575412f6d18affc847a2
Located: HK_LM:Run, TkBellExe (DISABLED)
command: "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
file: C:\Program Files\Common Files\Real\Update_OB\realsched.exe
size: 180269
MD5: 77ed13fd3196ebc7311ccd6899c7488c
Located: HK_CU:Run, ctfmon.exe
command: C:\Windows\system32\ctfmon.exe
file: C:\Windows\system32\ctfmon.exe
size: 15360
MD5: 24232996a38c0b0cf151c2140ae29fc8
Located: HK_CU:Run, EPSON Stylus CX3600 Series
command: C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /M "Stylus CX3600" /EF "HKCU"
file: C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
size: 98304
MD5: ca0c2bbdc4aba093d7f7e448c6391bce
Located: HK_CU:Run, MSMSGS
command: "C:\Program Files\Messenger\msmsgs.exe" /background
file: C:\Program Files\Messenger\msmsgs.exe
size: 1694208
MD5: 74e6e96c6f0e2eca4edbb7f7a468f259
Located: HK_CU:Run, SpybotSD TeaTimer
command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
size: 1038336
MD5: 58f7e6434d285f4c98ad3621e0bd8c8d
Located: Startup (common), Acrobat Assistant.lnk
command: C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
file: C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
size: 82026
MD5: 21189b8f2d747b6981a54d5c5d554c8e
Located: Startup (common), Adobe Gamma Loader.lnk
command: C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
file: C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
size: 110592
MD5: 5cd0cd0ec4dc5df459b3ac016764f5aa
Located: Startup (common), Adobe Reader Speed Launch.lnk
command: C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
file: C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
size: 29696
MD5: deb88aef013dd1eefb462d7cad642166
Located: Startup (common), F-Secure Automatic Update.lnk
command: C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
file: C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
size: 32807
MD5: 4b746faa34af8bb8edd80bc8bfd5ee2f
Located: Startup (common), Microsoft Office.lnk
command: C:\Program Files\Microsoft Office\Office10\OSA.EXE
file: C:\Program Files\Microsoft Office\Office10\OSA.EXE
size: 83360
MD5: 5bc65464354a9fd3beaa28e18839734a
Located: Startup (user), SpywareGuard.lnk
command: C:\Program Files\SpywareGuard\sgmain.exe
file: C:\Program Files\SpywareGuard\sgmain.exe
size: 360448
MD5: 61c028aba5e49573a6332f4a7c744e87
Located: WinLogon, crypt32chain
command: crypt32.dll
file: crypt32.dll
Located: WinLogon, cryptnet
command: cryptnet.dll
file: cryptnet.dll
Located: WinLogon, cscdll
command: cscdll.dll
file: cscdll.dll
Located: WinLogon, ScCertProp
command: wlnotify.dll
file: wlnotify.dll
Located: WinLogon, Schedule
command: wlnotify.dll
file: wlnotify.dll
Located: WinLogon, sclgntfy
command: sclgntfy.dll
file: sclgntfy.dll
Located: WinLogon, SensLogn
command: WlNotify.dll
file: WlNotify.dll
Located: WinLogon, termsrv
command: wlnotify.dll
file: wlnotify.dll
Located: WinLogon, wlballoon
command: wlnotify.dll
file: wlnotify.dll
________________________________________________
Huom, rivi Cftmon.exe:
Current filename: C:\Windows\system32\ctfmon.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: ctfmon.exe
Filename: ctfmon32.exe
Description
_CoolWebSearch_ parasite related - hijacking to Slawsearch.com
Source: Paul Collins Startup list
_________________________________________________
________________________________________________
Noniin, yleisön pyynnöstä "pitkä" loki, muokkasin vain Kohdan O15 "Trusted Zone" www-osoitteet... Sekä peittelin firman yms... tiedot...
Logfile of HijackThis v1.99.1
Scan saved at 12:04:25, on 3.8.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Windows\System32\ad_elmd.exe
C:\Windows\System32\Ati2evxx.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Windows\system32\crypserv.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\LonWorks\bin\LnsMtsSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Windows\System32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\ltmsg.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\Windows\system32\NOTEPAD.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Olen netissä
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:4001
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [frxmxins] frxmxins
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\Windows\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB002" /M "Stylus CX3600"
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\System32\msjava.dll
O9 - Extra button: Add to Restricted Zone - {B06300D0-CCDE-11d2-92D3-0000F87A4A55} - C:\Windows\System32\webzone.dll
O9 - Extra 'Tools' menuitem: Add to R&estricted Zone - {B06300D0-CCDE-11d2-92D3-0000F87A4A55} - C:\Windows\System32\webzone.dll
O9 - Extra button: Add to Trusted Zone - {BF80219A-CCDD-11d2-92D3-0000F87A4A55} - C:\Windows\System32\webzone.dll
O9 - Extra 'Tools' menuitem: Add to Tr&usted Zone - {BF80219A-CCDD-11d2-92D3-0000F87A4A55} - C:\Windows\System32\webzone.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O15 - Trusted Zone: www.jokinosoite.fi
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = FIRMAN NIMI.FI
O17 - HKLM\Software\..\Telephony: DomainName = FIRMAN NIMI.FI
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = FIRMAN NIMI.FI
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = FIRMAN NIMI.FI
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = FIRMAN NIMI.FI
O23 - Service: Autodesk License Manager (AdLM) - Unknown owner - C:\Windows\System32\ad_elmd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\Windows\System32\Ati2evxx.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - BackWeb Technologies Inc. - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\Windows\system32\crypserv.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Iomega Activity Disk2 - Iomega Corporation - C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
O23 - Service: Echelon xDriver Connection Broker (LdvxBroker) - Echelon Corporation - C:\Program Files\LonWorks\bin\LdvxBroker.exe
O23 - Service: Echelon Support Service for Microsoft Terminal Services (MTS) (LnsMtsSvc) - Echelon Corporation - C:\Program Files\LonWorks\bin\LnsMtsSvc.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\Ohjelmatiedostot\webserver\bin\win32\matlabserver.exe (file missing)
_____________________________________
Tässä vielä Hijack Start Up loki
StartupList report, 3.8.2005, 12:21:57
StartupList version: 1.52.2
Started from : C:\Program Files\HijackThis\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================
Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Windows\System32\ad_elmd.exe
C:\Windows\System32\Ati2evxx.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Windows\system32\crypserv.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\LonWorks\bin\LnsMtsSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Windows\System32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\ltmsg.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
--------------------------------------------------
Listing of startup folders:
Shell folders Startup:
[C:\Documents and Settings\lala\Start Menu\Programs\Startup]
SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
Shell folders AltStartup:
*Folder not found*
User shell folders Startup:
*Folder not found*
User shell folders AltStartup:
*Folder not found*
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
Shell folders Common AltStartup:
*Folder not found*
User shell folders Common Startup:
*Folder not found*
User shell folders Alternate Common Startup:
*Folder not found*
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*
[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ATIModeChange = Ati2mdxx.exe
LTWinModem1 = ltmsg.exe 9
SynTPLpr = C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
frxmxins = frxmxins
eabconfg.cpl = C:\Program Files\Compaq\EAB\EabServr.exe /Start
Cpqset = C:\Program Files\compaq\cpqsetup\cpqset.exe
AdaptecDirectCD = C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
HPDJ Taskbar Utility = C:\Windows\System32\spool\drivers\w32x86\3\hpztsb03.exe
Iomega Startup Options = C:\Program Files\Iomega\Common\ImgStart.exe
F-Secure Manager = "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
F-Secure TNB = "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
EPSON Stylus CX3600 Series = C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB002" /M "Stylus CX3600"
Iomega Drive Icons = C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
ctfmon.exe = C:\Windows\system32\ctfmon.exe
SpybotSD TeaTimer = C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
[OptionalComponents]
*No values found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command
(Default) = "%1" /S
--------------------------------------------------
File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command
(Default) = C:\WINDOWS\System32\mshta.exe "%1" %*
--------------------------------------------------
File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command
(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1
--------------------------------------------------
Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)
[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\Windows\inf\unregmp2.exe /ShowWMP
[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
[{4b218e3e-bc98-4770-93d3-2731b9329278}] *
StubPath = %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf
[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\Windows\INF\msmsgs.inf,BLC.QuietInstall.PerUser
[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\Windows\INF\wmp10.inf,PerUserStub
[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll
[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe
[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\Windows\System32\Rundll32.exe C:\Windows\System32\mscories.dll,Install
--------------------------------------------------
Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps
*Registry key not found*
--------------------------------------------------
Load/Run keys from C:\Windows\WIN.INI:
load=*INI section not found*
run=*INI section not found*
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=
--------------------------------------------------
Shell & screensaver key from C:\Windows\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\Windows\System32\ssmypics.scr
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Checking for EXPLORER.EXE instances:
C:\Windows\Explorer.exe: PRESENT!
C:\Explorer.exe: not present
C:\Windows\Explorer\Explorer.exe: not present
C:\Windows\System\Explorer.exe: not present
C:\Windows\System32\Explorer.exe: not present
C:\Windows\Command\Explorer.exe: not present
C:\Windows\Fonts\Explorer.exe: not present
--------------------------------------------------
Checking for superhidden extensions:
.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden
--------------------------------------------------
Verifying REGEDIT.EXE integrity:
- Regedit.exe found in C:\Windows
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'
Registry check passed
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\GetRight\xx2gr.dll - {31FF080D-12A3-439A-A2EF-4BA95A3148E8}
SpywareGuard Download Protection - C:\Program Files\SpywareGuard\dlprotect.dll - {4A368E80-174F-4872-96B5-0B27DDD11DB2}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - c:\program files\google\googletoolbar1.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}
--------------------------------------------------
Enumerating Task Scheduler jobs:
Scheduled scanning task.job
--------------------------------------------------
Enumerating Download Program Files:
[Microsoft XML Parser for Java]
CODEBASE = file://C:\Windows\Java\classes\xmldso.cab
OSD = C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
[QuickTime Object]
InProcServer32 = C:\Program Files\QuickTime\QTPlugin.ocx
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab
[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
[MSSecurityAdvisor Class]
InProcServer32 = C:\Windows\System32\mssecadv.dll
CODEBASE = http://download.microsoft.com/download/0/5/c/05c905f4-dd30-427d-a3de-373c3e5552fc/msSecAdv.cab?1070698222880
[Office Update Installation Engine]
InProcServer32 = C:\Windows\opuc.dll
CODEBASE = http://office.microsoft.com/officeupdate/content/opuc2.cab
[Java Plug-in 1.4.1_07]
InProcServer32 = C:\Program Files\Java\j2re1.4.1_07\bin\npjpi141_07.dll
CODEBASE = http://java.sun.com/products/plugin/1.4/jinstall-14_07-windows-i586.cab
[Java Plug-in 1.4.1_03]
InProcServer32 = C:\Program Files\Java\j2re1.4.1_03\bin\npjpi141_03.dll
CODEBASE = http://java.sun.com/products/plugin/1.4/jinstall-14_03-windows-i586.cab
[Java Plug-in 1.4.1_07]
InProcServer32 = C:\Program Files\Java\j2re1.4.1_07\bin\npjpi141_07.dll
CODEBASE = http://java.sun.com/products/plugin/1.4/jinstall-14_07-windows-i586.cab
[Shockwave Flash Object]
InProcServer32 = C:\Windows\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
--------------------------------------------------
Enumerating Winsock LSP files:
NameSpace #1: C:\Windows\System32\mswsock.dll
NameSpace #2: C:\Windows\System32\winrnr.dll
NameSpace #3: C:\Windows\System32\mswsock.dll
Protocol #1: C:\Windows\system32\mswsock.dll
Protocol #2: C:\Windows\system32\mswsock.dll
Protocol #3: C:\Windows\system32\mswsock.dll
Protocol #4: C:\Windows\system32\mswsock.dll
Protocol #5: C:\Windows\system32\rsvpsp.dll
Protocol #6: C:\Windows\system32\rsvpsp.dll
Protocol #7: C:\Windows\system32\mswsock.dll
Protocol #8: C:\Windows\system32\mswsock.dll
Protocol #9: C:\Windows\system32\mswsock.dll
Protocol #10: C:\Windows\system32\mswsock.dll
Protocol #11: C:\Windows\system32\mswsock.dll
Protocol #12: C:\Windows\system32\mswsock.dll
Protocol #13: C:\Windows\system32\mswsock.dll
Protocol #14: C:\Windows\system32\mswsock.dll
Protocol #15: C:\Windows\system32\mswsock.dll
Protocol #16: C:\Windows\system32\mswsock.dll
--------------------------------------------------
Enumerating Windows NT/2000/XP services
Intel(r) 82801 Audio Driver Install Service (WDM): system32\drivers\ac97intc.sys (manual start)
Microsoft ACPI Driver: System32\DRIVERS\ACPI.sys (system)
Microsoft Embedded Controller Driver: System32\DRIVERS\ACPIEC.sys (system)
Autodesk License Manager: C:\Windows\System32\ad_elmd.exe (autostart)
adpu160m: \SystemRoot\System32\DRIVERS\adpu160m.sys (disabled)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (system)
Intel AGP Bus Filter: System32\DRIVERS\agp440.sys (system)
aic78u2: \SystemRoot\System32\DRIVERS\aic78u2.sys (disabled)
aic78xx: \SystemRoot\System32\DRIVERS\aic78xx.sys (disabled)
Alerter: %SystemRoot%\System32\svchost.exe -k LocalService (disabled)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
ESS Allegro Audio Driver (WDM): system32\drivers\es198x.sys (manual start)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Aspi32: System32\drivers\aspi32.sys (autostart)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (manual start)
RAS Asynchronous Media Driver: System32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: System32\DRIVERS\atapi.sys (system)
Ati HotKey Poller: %SystemRoot%\System32\Ati2evxx.exe (autostart)
ati2mtag: System32\DRIVERS\ati2mtag.sys (manual start)
atimpab: System32\DRIVERS\atimpab.sys (manual start)
ATM ARP Client Protocol: System32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: System32\DRIVERS\audstub.sys (manual start)
F-Secure Automatic Update: C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE (autostart)
basic2: System32\DRIVERS\basic2.sys (manual start)
Background Intelligent Transfer Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Computer Browser: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
CD-ROM Driver: System32\DRIVERS\cdrom.sys (system)
Indexing Service: C:\Windows\system32\cisvc.exe (disabled)
ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled)
ClntMgmt.sys: \SystemRoot\System32\Drivers\ClntMgmt.sys (system)
Microsoft AC Adapter Driver: System32\DRIVERS\CmBatt.sys (manual start)
Cnxtdiag: System32\DRIVERS\cnxtdiag.sys (autostart)
Microsoft Composite Battery Driver: System32\DRIVERS\compbatt.sys (system)
COM+ System Application: C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
Crypkey License: crypserv.exe (autostart)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Disk Driver: System32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
dmio: System32\drivers\dmio.sys (disabled)
dmload: System32\drivers\dmload.sys (disabled)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
dpti2o: \SystemRoot\System32\DRIVERS\dpti2o.sys (disabled)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
Intel(R) PRO Adapter Driver: System32\DRIVERS\e100b325.sys (manual start)
EABFiltr: \??\C:\Windows\System32\drivers\EABFiltr.sys (system)
eabusb: \??\C:\Windows\System32\drivers\eabusb.sys (manual start)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: C:\WINDOWS\System32\svchost.exe -k netsvcs (manual start)
F-Secure File System Filter: \??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys (autostart)
F-Secure Gatekeeper: \??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys (autostart)
F-Secure Gatekeeper Handler Starter: "C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe" (autostart)
F-Secure Network Request Broker: "C:\Program Files\F-Secure\Common\FNRB32.EXE" (manual start)
F-Secure File System Recognizer: \??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys (autostart)
Fallback: System32\DRIVERS\fallback.sys (autostart)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Floppy Disk Controller Driver: System32\DRIVERS\fdc.sys (manual start)
Floppy Disk Driver: System32\DRIVERS\flpydisk.sys (manual start)
FltMgr: system32\drivers\fltmgr.sys (system)
fsbwsys: "C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe" (autostart)
F-Secure Anti-Virus Firewall Daemon: "C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe" (manual start)
F-Secure Firewall Driver: System32\drivers\fsdfw.sys (system)
Fsks: System32\DRIVERS\fsksnt.sys (autostart)
FSMA: "C:\Program Files\F-Secure\Common\FSMA32.EXE" (autostart)
FTD2XX.SYS FT8U2XX device driver: System32\Drivers\FTD2XX.sys (manual start)
Volume Manager Driver: System32\DRIVERS\ftdisk.sys (system)
GDInterceptor: \??\C:\Windows\system32\interceptor.sys (manual start)
Generic Packet Classifier: System32\DRIVERS\msgpc.sys (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft HID Class Driver: System32\DRIVERS\hidusb.sys (manual start)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i8042 Keyboard and PS/2 Mouse Port Driver: System32\DRIVERS\i8042prt.sys (system)
Imapi: system32\drivers\Imapi.sys (system)
IMAPI CD-Burning COM Service: C:\Windows\system32\Imapi.exe (manual start)
IntelIde: System32\DRIVERS\intelide.sys (system)
Intel Processor Driver: System32\DRIVERS\intelppm.sys (system)
Iomega Devices Disk Filter Services: System32\DRIVERS\iomdisk.sys (system)
Iomega Activity Disk2: "C:\PROGRA~1\Iomega\System32\ActivityDisk.exe" (autostart)
IPv6 Windows Firewall Driver: system32\drivers\ip6fw.sys (manual start)
IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: System32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: System32\DRIVERS\ipnat.sys (manual start)
IPSEC driver: System32\DRIVERS\ipsec.sys (system)
IrDA Protocol: System32\DRIVERS\irda.sys (autostart)
IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start)
Infrared Monitor: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
PnP ISA/EISA Bus Driver: System32\DRIVERS\isapnp.sys (system)
K56: System32\DRIVERS\k56nt.sys (autostart)
Keyboard Class Driver: System32\DRIVERS\kbdclass.sys (system)
Keyboard HID Driver: System32\DRIVERS\kbdhid.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Echelon xDriver Connection Broker: "C:\Program Files\LonWorks\bin\LdvxBroker.exe" (manual start)
TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Echelon Support Service for Microsoft Terminal Services (MTS): "C:\Program Files\LonWorks\bin\LnsMtsSvc.exe" (autostart)
Lucent Modem Driver: System32\DRIVERS\ltmdmxp.sys (manual start)
MATLAB Server: C:\Ohjelmatiedostot\webserver\bin\win32\matlabserver.exe (autostart)
Machine Debug Manager: "C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe" (autostart)
mdmxsdk: system32\DRIVERS\mdmxsdk.sys (autostart)
Messenger: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
NetMeeting Remote Desktop Sharing: C:\WINDOWS\System32\mnmsrvc.exe (manual start)
Mouse Class Driver: System32\DRIVERS\mouclass.sys (system)
Mouse HID Driver: System32\DRIVERS\mouhid.sys (manual start)
WebDav Client Redirector: System32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: System32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\Windows\System32\msdtc.exe (manual start)
Microsoft IR Communications Driver: System32\DRIVERS\MSIRCOMM.sys (manual start)
Windows Installer: C:\Windows\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: System32\DRIVERS\mssmbios.sys (manual start)
Remote Access NDIS TAPI Driver: System32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: System32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: System32\DRIVERS\ndiswan.sys (manual start)
NetBIOS Interface: System32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: System32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
Net Logon: %SystemRoot%\System32\lsass.exe (autostart)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
NetworkX: \SystemRoot\system32\ckldrv.sys (system)
Network Location Awareness (NLA): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
NSC Infrared Device Driver: System32\DRIVERS\nscirda.sys (manual start)
NT LM Security Support Provider: %SystemRoot%\System32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
IPX Traffic Filter Driver: System32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: System32\DRIVERS\nwlnkfwd.sys (manual start)
Intel PentiumIII Processor Driver: System32\DRIVERS\p3.sys (system)
Parallel port driver: System32\DRIVERS\parport.sys (manual start)
PCI Bus Driver: System32\DRIVERS\pci.sys (system)
PCIIde: \SystemRoot\System32\DRIVERS\pciide.sys (disabled)
Pcmcia: System32\DRIVERS\pcmcia.sys (system)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\System32\lsass.exe (disabled)
Iomega Parallel Port Filter Driver: System32\DRIVERS\ppa.sys (system)
WAN Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start)
Processor Driver: System32\DRIVERS\processr.sys (system)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: System32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: System32\DRIVERS\ptilink.sys (manual start)
Remote Access Auto Connection Driver: System32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WAN Miniport (IrDA): System32\DRIVERS\rasirda.sys (manual start)
WAN Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: System32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: System32\DRIVERS\raspti.sys (manual start)
Rdbss: System32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Terminal Server Device Redirector Driver: System32\DRIVERS\rdpdr.sys (manual start)
Remote Desktop Help Session Manager: C:\Windows\system32\sessmgr.exe (manual start)
Digital CD Audio Playback Filter Driver: System32\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Remote Registry: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Rksample: System32\DRIVERS\rksample.sys (manual start)
Microsoft Legacy Modem Driver: System32\Drivers\RootMdm.sys (manual start)
Remote Procedure Call (RPC) Locator: %SystemRoot%\System32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
QoS RSVP: %SystemRoot%\System32\rsvp.exe (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: System32\DRIVERS\secdrv.sys (manual start)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Sentinel: \SystemRoot\System32\Drivers\SENTINEL.SYS (autostart)
SIEMENS Serial port driver: System32\DRIVERS\ser2pl.sys (manual start)
Serenum Filter Driver: System32\DRIVERS\serenum.sys (manual start)
Serial port driver: System32\DRIVERS\serial.sys (system)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
SMC IrCC Miniport Device Driver: System32\DRIVERS\smcirda.sys (manual start)
smwdm: system32\drivers\smwdm.sys (manual start)
SoftFax: System32\DRIVERS\faxnt.sys (autostart)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Filter Driver: System32\DRIVERS\sr.sys (system)
System Restore Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Srv: System32\DRIVERS\srv.sys (manual start)
SSDP Discovery Service: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
Windows Image Acquisition (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (autostart)
Software Bus Driver: System32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\System32\dllhost.exe /Processid:{2330D815-2E3E-49E3-80FE-2536FD264055} (manual start)
symc810: \SystemRoot\System32\DRIVERS\symc810.sys (disabled)
symc8xx: \SystemRoot\System32\DRIVERS\symc8xx.sys (disabled)
sym_hi: \SystemRoot\System32\DRIVERS\sym_hi.sys (disabled)
Synaptics TouchPad Driver: System32\DRIVERS\SynTP.sys (manual start)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP Protocol Driver: System32\DRIVERS\tcpip.sys (system)
Terminal Device Driver: System32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost -k DComLaunch (manual start)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Telnet: C:\WINDOWS\System32\tlntsvr.exe (manual start)
Tones: System32\DRIVERS\tonesnt.sys (autostart)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows User Mode Driver Framework: C:\Windows\system32\wdfmgr.exe (autostart)
Microcode Update Driver: System32\DRIVERS\update.sys (manual start)
Universal Plug and Play Device Host: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
Microsoft USB Generic Parent Driver: System32\DRIVERS\usbccgp.sys (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: System32\DRIVERS\usbehci.sys (manual start)
USB Root Hub (usbport): System32\DRIVERS\usbhub.sys (manual start)
Microsoft USB Open Host Controller Miniport Driver: System32\DRIVERS\usbohci.sys (manual start)
Microsoft USB PRINTER Class: System32\DRIVERS\usbprint.sys (manual start)
USB Scanner Driver: System32\DRIVERS\usbscan.sys (manual start)
USB Mass Storage Driver: System32\DRIVERS\USBSTOR.SYS (manual start)
Microsoft USB Universal Host Controller Miniport Driver: System32\DRIVERS\usbuhci.sys (manual start)
V124: System32\DRIVERS\v124nt.sys (autostart)
VGA Display Controller.: \SystemRoot\System32\drivers\vga.sys (system)
ViaIde: \SystemRoot\System32\DRIVERS\viaide.sys (disabled)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Remote Access IP ARP Driver: System32\DRIVERS\wanarp.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
winachsf: System32\DRIVERS\HSF_CNXT.sys (manual start)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Windows Media Connect (WMC): c:\program files\windows media connect\mswmccds.exe (manual start)
Windows Media Connect (WMC) Helper: C:\Program Files\Windows Media Connect\mswmcls.exe (manual start)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Windows Management Instrumentation Driver Extensions: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WMI Performance Adapter: C:\WINDOWS\System32\wbem\wmiapsrv.exe (manual start)
Windows Socket 2.0 Non-IFS Service Provider Support Environment: \SystemRoot\System32\drivers\ws2ifsl.sys (system)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic Updates: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\Windows\system32\SHELL32.dll
CDBurn: C:\Windows\system32\SHELL32.dll
WebCheck: C:\Windows\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
*Registry key not found*
--------------------------------------------------
End of report, 39 049 bytes
Report generated in 0,160 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
_________________________________________________
Ja kuten jo aikaisemmin sanoin esim. CWshredder ei löydä mitään
**** Run Keys ****
RUN: [ATIModeChange] Ati2mdxx.exe
RUN: [LTWinModem1] ltmsg.exe 9
RUN: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
RUN: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
RUN: [frxmxins] frxmxins
RUN: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
RUN: [Cpqset] C:\Program Files\compaq\cpqsetup\cpqset.exe
RUN: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
RUN: [HPDJ Taskbar Utility] C:\Windows\System32\spool\drivers\w32x86\3\hpztsb03.exe
RUN: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
RUN: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
RUN: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
RUN: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
RUN: [EPSON Stylus CX3600 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB002" /M "Stylus CX3600"
RUN: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
RUN: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
RUN: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
RUN: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
RUN: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
RUN: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
RUN: [EPSON Stylus CX3600 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /M "Stylus CX3600" /EF "HKCU"
**** Browser Helper Objects ****
BHO: [AcroIEHlprObj Class] C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
BHO: [bho2gr Class] C:\Program Files\GetRight\xx2gr.dll
BHO: [SpywareGuardDLBLOCK.CBrowserHelper] C:\Program Files\SpywareGuard\dlprotect.dll
BHO: [] C:\PROGRA~1\SPYBOT~1\SDHelper.dll
BHO: [Google Toolbar Helper] c:\program files\google\googletoolbar1.dll
**** IE Toolbars
koska, jos mulla olis CoolWebSearch, niin loki näyttäs tältä
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.slawsearch.com/autosearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.slawsearch.com/autosearch.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.slawsearch.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.slawsearch.com/autosearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = javascript:window.close()
O4 - HKLM\..\Run: [CTFMON32.EXE] "C:\WINDOWS\System32\ctfmon32.exe"
Eikös vain? No mix SpyBot sitten herjaa siitä?
ladata koneelleni ohjelmia joissa on lisenssi voimassa johonkin asti ja sen jälkeisestä elämästä ei ole tietoa...? Varsinkin jos kyseessä on Maikrosoofti...
http://www.safer-networking.org/files/delcwssk.zip
Sillä jos se ton tekee niin voi Jopa PALOMUURIN myös sammuttaa.
linkin ohjelmalla eikä CWShredderilläkään...
minkä annoin mallia zip
tarkoitin siis ettei löytynyt mitään pöpöjä... Kyllä ohjelma löyty ... ;)
olen kyllä skannannut koneeni mm.
- a2
- Ad-awarella
- Hijack
- CWShredder
- SpyBot
- EasyCleaner
jne.... Mitään ei löytynyt....
Mutta alkuperäiseen kysymykseeni kukaan ei vastannut; Miten pääsen tsekkaan sitä Startup-juttuu????
http://keskustelu.suomi24.fi/show.fcgi?category=108&conference=4500000000000628&subcat=758
eihän tossa oo mitään kysyttävää... Kuhan liitteex laitoin, ja tiedoksi... Siellä toisella palstalla se olis ilman asiayhteyttä... Asia olis eri, jos haluaisin siitä jotain kysyä...
Mutta vastaus siihen kysymykseen?? Kiitos vaan huolenpidosta...
Sori ku nyt spämmään postittamalla kahteen kertaan, mutta aattelin tiedon hukkuneen tuonne hankalaan väliin, kukapa jaksais kaikkee lukee, no tässä aktuaalinen tilanne
_____________________________________
Muistinkin just että se ei ollukkaan mun tiedostossa ... kuten yleensä...
C:\Documents and Settings\...\Regubp2b-lala.reg
vaan osoitteessa All Users... Noh meninpä tarkemmin kattoon et missä siellä... (f-securen ilmoituksessa ei muistaakseni näkynyt koko polkua(?)...tai en kiinnittänyt siihen huomiota...
Noh... polku tässä:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots
Ja sieltä löytyy tosiaan tiedosto .0eg jonka siis F-secure muokkas... Noh, mites tuo tiedosto
REGUBP2B-LALA.0EG
Mikäs se on miehiään, mix se on spybotin alla? Miten korjataan / estetään ongelma tulevaisuudessa...
P.S. Syy mix SpyBotti kaatu, löytynee myös...
____________________________________________
tossa polussa snapshots lienee rekisteri backuppi jonka joku on koneella ottanu joskus spybotin avulla..
ilmeisesti tossa reg filessä on joku arvo jonka vuoksi fsecure on sen uudelleen nimennyt, huom .reg=>.0eg
löytyskö f-securen raporteista jotain mainintaa
ole sitä raporttia tallessa... Mut tässä tapahtumien kulku;
- käynnistin koneen
- sisäänkirjautumisen jälkeen F-secure ilmoitti
"Trojan.WinREG.StartPage -löytynyt" valitse toiminta...
- tämän jälkeen alkoi netti aukeemaan, ja samantein spybotti ilmoitti rekisterin muutoksista, sallitaanko? No en sallinut... Tätä jatku kunnes F-secure ehti nimeämään uudelleen sen tiedoston...
- valitsin puhdista tai jotain muuta, vastaus "ei voitu puhdistaa, nimettiin uudelleen"
- ongelmat hävisivät...
JA ehkä omituisinta on, että olen tehnyt SpyBotilla rekisteli backupin joskus useita kuukausia sitten, 6kk? Ellei se tee niitä automaattisesti, ei muistaakseni...