Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    APUA, kone jumittaa

    moi,

    kone taas täynnä jotain bugeja! on hidas jne..miten saan ne pois??
    Logfile of HijackThis v1.99.1
    Scan saved at 10:35:50, on 31.7.2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsgk32st.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\FSGK32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\backweb\6629059\program\fsbwsys.exe
    C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fssm32.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSM32.EXE
    C:\WINDOWS\system32\HPConfig.exe
    C:\WINDOWS\System32\carpserv.exe
    C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSMA32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSMB32.EXE
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FCH32.EXE
    C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsav32.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FAMEH32.EXE
    C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
    C:\WINDOWS\System32\LVCOMSX.EXE
    C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Java\jre1.5.0_03\bin\jucheck.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\LimeWire\LimeWire.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_director.exe
    C:\PROGRA~1\MUSICM~1\MUSICM~2\MM_TDM~1.EXE
    C:\Program Files\Musicmatch\Musicmatch Jukebox\MMJB.EXE
    C:\Program Files\Musicmatch\Musicmatch Jukebox\MMDiag.exe
    C:\HjT\Hijackthis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.compaq.com/2Q00CPT/040B/bF7.asp
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Welho-tietoturvapalvelut\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Welho-tietoturvapalvelut\TNB\TNBUtil.exe" /CHECKALL
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [CARPService] carpserv.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
    O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
    O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
    O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Global Startup: Image Transfer.lnk = ?
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by20fd.bay20.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O23 - Service: Welho-tietoturvapalvelut (BackWeb Client - 6629059) - Unknown owner - C:\PROGRA~1\WELHO-~1\backweb\6629059\Program\SERVIC~1.EXE (file missing)
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\Welho-tietoturvapalvelut\Common\FSAA.EXE (file missing)
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Welho-tietoturvapalvelut\backweb\6629059\program\fsbwsys.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\Common\FSMA32.EXE
    O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\fswsclds.exe
    O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
    O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
    7365
    Äänestä

    Muut lukivat myös

    Vastaukset 7

    Vanhimmat

    käytät?
    Näyttäisi olevan tuplana ohjelmat Palomuuri ja virusohjelma.

    Äänestä

    • miten niin tuplana? F-Secure mulla on ja ihan vaan yksi ohjelma. Voisiko joku nyt auttaa näiden viiruksien kanssa , please :) ?Juggis? :)

      Äänestä

    No niin, tuolahan on welhon toimittama virusturva ja palomuuri (F-Secure), eikä muita. F-secure on kyllä raskas ohjelma.

    En kyllä löydä logista örkkejä. Onko kone hidastunut yhtäkkiä? Oletko asentanut jotain uutta koneelle?

    Äänestä

    • Moi,

      F-Secure ilmoittaa että 69 kohteessa C:asemalla on seuraavat virukset:
      trojan.win32.startpage
      Trojan-Downloader.Win32.agent.ap
      Trojan-Downloader.Win32.agent.bg
      Trojan-Dropper.Win32.180Solutions.a
      sekä
      Exploit.CodeBaseExec

      Miksiköhän ne ei näy logissa?

      Äänestä

    • kuu kirjoitti:

      Moi,

      F-Secure ilmoittaa että 69 kohteessa C:asemalla on seuraavat virukset:
      trojan.win32.startpage
      Trojan-Downloader.Win32.agent.ap
      Trojan-Downloader.Win32.agent.bg
      Trojan-Dropper.Win32.180Solutions.a
      sekä
      Exploit.CodeBaseExec

      Miksiköhän ne ei näy logissa?

      Lataa Escan:

      http://koti.mbnet.fi/pattaya1/escanmwav.htm

      Samalla sivulla on ohjeet ohjelman käyttön ja päivitykseen. Päivitä ennen scannausta.

      Kopioi alaikkunaan tulleet rivit vastaukseen.

      Äänestä

    • juggis kirjoitti:

      Lataa Escan:

      http://koti.mbnet.fi/pattaya1/escanmwav.htm

      Samalla sivulla on ohjeet ohjelman käyttön ja päivitykseen. Päivitä ennen scannausta.

      Kopioi alaikkunaan tulleet rivit vastaukseen.

      Tähän meni aikaa 4 tuntia...Tässä se nyt on, miten saisin vielä osan noista spystä pois?
      Kiitos avusta :)
      File C:\WINDOWS\msxmidi.exe infected by "Trojan-Downloader.Win32.Agent.eq" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\0378.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\0673.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\3205.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\4079.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\6812.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\bg3.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\WINDOWS\System32\bg5.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\WINDOWS\System32\cryy.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\fix.exe infected by "Trojan-Downloader.Win32.Small.ash" Virus. Action Taken: File Deleted.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\1.tmp infected by "Trojan.Win32.HideProc.a" Virus. Action Taken: File Deleted.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\159.tmp infected by "Trojan.Win32.HideProc.a" Virus. Action Taken: File Deleted.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\DrTemp\thin-128-1-x-x.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\ICD1.tmp\WinServAdX.dll tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\temp.fr36D6 tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THI35A9.tmp\farmmext.cab infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: File Deleted.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THI35A9.tmp\farmmext.exe infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: File Deleted.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THI650F.tmp\ceres.cab tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THI650F.tmp\ceres.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THI6599.tmp\ceres.cab tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THI6599.tmp\ceres.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THI6599.tmp\polall1c.exe infected by "Trojan-Downloader.Win32.Small.pv" Virus. Action Taken: File Deleted.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THID5E.tmp\ceres.cab tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THID5E.tmp\ceres.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THIDFA.tmp\farmmext.cab infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: File Deleted.
      File C:\Documents and Settings\Compaq\Local Settings\Temporary Internet Files\Content.IE5\SXUVCDIF\prompt[2].php infected by "Trojan-Downloader.JS.IstBar.k" Virus. Action Taken: File Deleted.
      File C:\fox.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\HjT\backups\backup-20041207-232154-732.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: File Deleted.
      File C:\HjT\backups\backup-20050119-175405-419.dll tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\HjT\backups\backup-20050310-140554-792.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\HjT\backups\backup-20050310-150922-589.dll tagged as not-a-virus:Porn-Downloader.Win32.Holistyc.a. No Action Taken.
      File C:\ixplore.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\Program Files\Internet Explorer\iufmuqlr.exe infected by "Trojan-Downloader.Win32.Agent.eq" Virus. Action Taken: File Deleted.
      File C:\Program Files\Windows ControlAd\WinCtlAdAlt.exe tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\Program Files\Windows ControlAd\WinCtlAdShift.dll tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\Program Files\Windows ServeAd\WinAtServ.dll tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\Program Files\Windows ServeAd\WinServAd.exe tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\Program Files\Windows ServeAd\WinServSuit.exe tagged as not-a-virus:AdWare.WinAD.h. No Action Taken.
      File C:\RECYCLER\S-1-5-21-1046679745-269379545-699353713-500\Dc3.exe infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: File Deleted.
      File C:\RECYCLER\S-1-5-21-1046679745-269379545-699353713-500\Dc5.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP199\A0010948.exe infected by "Trojan-Downloader.Win32.Swizzor.do" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011961.exe infected by "Trojan-Downloader.Win32.Agent.eq" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011962.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011963.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011964.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011965.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011966.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011967.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011968.exe infected by "Trojan-Downloader.Win32.Small.ash" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011969.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011970.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011971.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011972.exe infected by "Trojan-Downloader.Win32.Agent.eq" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011973.exe infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011974.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\temp\SearchRelevancy.exe tagged as not-a-virus:AdWare.Relevance.a. No Action Taken.
      File C:\temp\WebRebates_Auto_InstallSilent_Euro.exe tagged as not-a-virus:AdWare.WebRebates.g. No Action Taken.
      File C:\WINDOWS\Downloaded Program Files\open.exe infected by "Trojan-Downloader.Win32.Agent.eq" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\Downloaded Program Files\WinCtlAdX.dll tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\WINDOWS\system32\bg3.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\WINDOWS\system32\bg5.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.

      Äänestä

    • kuu kirjoitti:

      Tähän meni aikaa 4 tuntia...Tässä se nyt on, miten saisin vielä osan noista spystä pois?
      Kiitos avusta :)
      File C:\WINDOWS\msxmidi.exe infected by "Trojan-Downloader.Win32.Agent.eq" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\0378.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\0673.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\3205.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\4079.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\6812.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\bg3.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\WINDOWS\System32\bg5.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\WINDOWS\System32\cryy.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\System32\fix.exe infected by "Trojan-Downloader.Win32.Small.ash" Virus. Action Taken: File Deleted.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\1.tmp infected by "Trojan.Win32.HideProc.a" Virus. Action Taken: File Deleted.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\159.tmp infected by "Trojan.Win32.HideProc.a" Virus. Action Taken: File Deleted.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\DrTemp\thin-128-1-x-x.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\ICD1.tmp\WinServAdX.dll tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\temp.fr36D6 tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THI35A9.tmp\farmmext.cab infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: File Deleted.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THI35A9.tmp\farmmext.exe infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: File Deleted.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THI650F.tmp\ceres.cab tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THI650F.tmp\ceres.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THI6599.tmp\ceres.cab tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THI6599.tmp\ceres.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THI6599.tmp\polall1c.exe infected by "Trojan-Downloader.Win32.Small.pv" Virus. Action Taken: File Deleted.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THID5E.tmp\ceres.cab tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THID5E.tmp\ceres.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\Documents and Settings\Compaq\Local Settings\Temp\THIDFA.tmp\farmmext.cab infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: File Deleted.
      File C:\Documents and Settings\Compaq\Local Settings\Temporary Internet Files\Content.IE5\SXUVCDIF\prompt[2].php infected by "Trojan-Downloader.JS.IstBar.k" Virus. Action Taken: File Deleted.
      File C:\fox.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\HjT\backups\backup-20041207-232154-732.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: File Deleted.
      File C:\HjT\backups\backup-20050119-175405-419.dll tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\HjT\backups\backup-20050310-140554-792.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\HjT\backups\backup-20050310-150922-589.dll tagged as not-a-virus:Porn-Downloader.Win32.Holistyc.a. No Action Taken.
      File C:\ixplore.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\Program Files\Internet Explorer\iufmuqlr.exe infected by "Trojan-Downloader.Win32.Agent.eq" Virus. Action Taken: File Deleted.
      File C:\Program Files\Windows ControlAd\WinCtlAdAlt.exe tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\Program Files\Windows ControlAd\WinCtlAdShift.dll tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\Program Files\Windows ServeAd\WinAtServ.dll tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\Program Files\Windows ServeAd\WinServAd.exe tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\Program Files\Windows ServeAd\WinServSuit.exe tagged as not-a-virus:AdWare.WinAD.h. No Action Taken.
      File C:\RECYCLER\S-1-5-21-1046679745-269379545-699353713-500\Dc3.exe infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: File Deleted.
      File C:\RECYCLER\S-1-5-21-1046679745-269379545-699353713-500\Dc5.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP199\A0010948.exe infected by "Trojan-Downloader.Win32.Swizzor.do" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011961.exe infected by "Trojan-Downloader.Win32.Agent.eq" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011962.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011963.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011964.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011965.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011966.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011967.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011968.exe infected by "Trojan-Downloader.Win32.Small.ash" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011969.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011970.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011971.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011972.exe infected by "Trojan-Downloader.Win32.Agent.eq" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011973.exe infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: File Deleted.
      File C:\System Volume Information\_restore{B1FB7096-F946-4D86-B1C3-995D7F1476F4}\RP208\A0011974.exe infected by "Trojan-Downloader.Win32.Small.aqa" Virus. Action Taken: File Deleted.
      File C:\temp\SearchRelevancy.exe tagged as not-a-virus:AdWare.Relevance.a. No Action Taken.
      File C:\temp\WebRebates_Auto_InstallSilent_Euro.exe tagged as not-a-virus:AdWare.WebRebates.g. No Action Taken.
      File C:\WINDOWS\Downloaded Program Files\open.exe infected by "Trojan-Downloader.Win32.Agent.eq" Virus. Action Taken: File Deleted.
      File C:\WINDOWS\Downloaded Program Files\WinCtlAdX.dll tagged as not-a-virus:AdWare.WinAD.f. No Action Taken.
      File C:\WINDOWS\system32\bg3.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
      File C:\WINDOWS\system32\bg5.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.

      Poista lisää poista sovelluksen kautta jos löytyy:

      WinAd
      Windows ControlAd
      Windows ServeAd

      Tyhjää kaikki temp ja temporary internet files hakemistot kaikista käyttäjätileistä

      Esim näin
      Näppää "käynnistä" "suorita" kirjoita ruutuun "cleanmgr" ja paina enter ja ok

      Valitse

      temporary internet files
      roskakori
      tilapäiset tiedostot

      Ja näppää "ok"

      Laita piilotiedostot näkyviin ja sammuta järjestelmän palautus, ohjeet:

      Piilotiedostot:

      Oma Tietokone >
      - Työkalut >
      - Kansion asetukset >
      - Näytä
      Tiedostot ja kansiot >
      - vieritä alaspäin
      RUKSI pois seuraavasta kohdasta
      - Piilota tunnettujen tiedostotyyppien tunnisteet
      Piilotetut tiedostot ja kansiot
      - RUKSI > Näytä piilotetut tiedostot ja kansiot
      Käytä > OK


      Järjestelmän palautus:

      Oma Tietokone >
      - Muuta asetusta >
      - järjestelmä >
      - järjestelmän palautus-välilehti >
      - ruksi ruutuun "poista järjestelmän palauttaminen kaikista asemista >
      - Käytä >
      - Ok

      Käynnistä kone vikasietotilaan ja etsi ja poista nuo, jotka jäivät enää jäljelle:

      File C:\WINDOWS\System32\bg3.exe

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    kuu kirjoitti:

    moi,

    kone taas täynnä jotain bugeja! on hidas jne..miten saan ne pois??
    Logfile of HijackThis v1.99.1
    Scan saved at 10:35:50, on 31.7.2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsgk32st.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\FSGK32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\backweb\6629059\program\fsbwsys.exe
    C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fssm32.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSM32.EXE
    C:\WINDOWS\system32\HPConfig.exe
    C:\WINDOWS\System32\carpserv.exe
    C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSMA32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSMB32.EXE
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FCH32.EXE
    C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsav32.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FAMEH32.EXE
    C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
    C:\WINDOWS\System32\LVCOMSX.EXE
    C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Java\jre1.5.0_03\bin\jucheck.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\LimeWire\LimeWire.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_director.exe
    C:\PROGRA~1\MUSICM~1\MUSICM~2\MM_TDM~1.EXE
    C:\Program Files\Musicmatch\Musicmatch Jukebox\MMJB.EXE
    C:\Program Files\Musicmatch\Musicmatch Jukebox\MMDiag.exe
    C:\HjT\Hijackthis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.compaq.com/2Q00CPT/040B/bF7.asp
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Welho-tietoturvapalvelut\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Welho-tietoturvapalvelut\TNB\TNBUtil.exe" /CHECKALL
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [CARPService] carpserv.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
    O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
    O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
    O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Global Startup: Image Transfer.lnk = ?
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by20fd.bay20.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O23 - Service: Welho-tietoturvapalvelut (BackWeb Client - 6629059) - Unknown owner - C:\PROGRA~1\WELHO-~1\backweb\6629059\Program\SERVIC~1.EXE (file missing)
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\Welho-tietoturvapalvelut\Common\FSAA.EXE (file missing)
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Welho-tietoturvapalvelut\backweb\6629059\program\fsbwsys.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\Common\FSMA32.EXE
    O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\fswsclds.exe
    O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
    O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu