Logfile of HijackThis v1.99.1
Scan saved at 20:36:37, on 7.8.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Anti-Virus\backweb\2376288\program\fsbwsys.exe
C:\Program Files\F-Secure Anti-Virus\fswsclds.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\F-Secure Anti-Virus\Common\FSMA32.EXE
C:\Program Files\F-Secure Anti-Virus\Common\FSMB32.EXE
C:\Program Files\F-Secure Anti-Virus\Common\FAMEH32.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\rmctrl.exe
C:\Program Files\F-Secure Anti-Virus\Common\FSM32.EXE
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\F-Secure Anti-Virus\Common\FCH32.EXE
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fsav32.exe
C:\Program Files\Cheating-Death\cdeath.exe
G:\Valve\Steam\Steam.exe
C:\Kaspersky\mwavscan.com
C:\Kaspersky\kavss.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Warblow.MOUKKU\Työpöytä\highjack this\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.qsrch.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F2 - REG:system.ini: UserInit=
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\system32\rmctrl.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Anti-Virus\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [RunDll32 c:\WINDOWS\system\cmicnfg.cpl,CMICtrlWnd] RunDll32 cmicnfg.cpl,CMICtrlWnd
O8 - Extra context menu item: &Search - http://kc.bar.need2find.com/KC/menusearch.html?p=KC
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1111080976441
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure Anti-Virus (BackWeb Client - 2376288) - Unknown owner - C:\PROGRA~1\F-SECU~1\backweb\2376288\Program\SERVIC~1.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\F-Secure Anti-Virus\Common\FSAA.EXE (file missing)
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Anti-Virus\backweb\2376288\program\fsbwsys.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Anti-Virus\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure Anti-Virus\fswsclds.exe
Scan saved at 20:36:37, on 7.8.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Anti-Virus\backweb\2376288\program\fsbwsys.exe
C:\Program Files\F-Secure Anti-Virus\fswsclds.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\F-Secure Anti-Virus\Common\FSMA32.EXE
C:\Program Files\F-Secure Anti-Virus\Common\FSMB32.EXE
C:\Program Files\F-Secure Anti-Virus\Common\FAMEH32.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\rmctrl.exe
C:\Program Files\F-Secure Anti-Virus\Common\FSM32.EXE
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\F-Secure Anti-Virus\Common\FCH32.EXE
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fsav32.exe
C:\Program Files\Cheating-Death\cdeath.exe
G:\Valve\Steam\Steam.exe
C:\Kaspersky\mwavscan.com
C:\Kaspersky\kavss.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Warblow.MOUKKU\Työpöytä\highjack this\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.qsrch.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F2 - REG:system.ini: UserInit=
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\system32\rmctrl.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Anti-Virus\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [RunDll32 c:\WINDOWS\system\cmicnfg.cpl,CMICtrlWnd] RunDll32 cmicnfg.cpl,CMICtrlWnd
O8 - Extra context menu item: &Search - http://kc.bar.need2find.com/KC/menusearch.html?p=KC
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1111080976441
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure Anti-Virus (BackWeb Client - 2376288) - Unknown owner - C:\PROGRA~1\F-SECU~1\backweb\2376288\Program\SERVIC~1.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\F-Secure Anti-Virus\Common\FSAA.EXE (file missing)
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Anti-Virus\backweb\2376288\program\fsbwsys.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Anti-Virus\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure Anti-Virus\fswsclds.exe
Vastaukset 35
Vanhimmat
C:\HJT\HijackThis.exe
Logfile of HijackThis v1.99.1
Scan saved at 21:27:00, on 7.8.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Anti-Virus\backweb\2376288\program\fsbwsys.exe
C:\Program Files\F-Secure Anti-Virus\fswsclds.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\rmctrl.exe
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Cheating-Death\cdeath.exe
G:\Valve\Steam\Steam.exe
C:\Kaspersky\mwavscan.com
C:\Kaspersky\kavss.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\F-Secure Anti-Virus\Common\FSLAUNCH.EXE
C:\Program Files\F-Secure Anti-Virus\Common\FSMA32.EXE
C:\Program Files\F-Secure Anti-Virus\Common\FSMB32.EXE
C:\Program Files\F-Secure Anti-Virus\Common\FCH32.EXE
C:\Program Files\F-Secure Anti-Virus\Common\FAMEH32.EXE
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fsav32.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.qsrch.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F2 - REG:system.ini: UserInit=
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\system32\rmctrl.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Anti-Virus\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [RunDll32 c:\WINDOWS\system\cmicnfg.cpl,CMICtrlWnd] RunDll32 cmicnfg.cpl,CMICtrlWnd
O8 - Extra context menu item: &Search - http://kc.bar.need2find.com/KC/menusearch.html?p=KC
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1111080976441
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure Anti-Virus (BackWeb Client - 2376288) - Unknown owner - C:\PROGRA~1\F-SECU~1\backweb\2376288\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\F-Secure Anti-Virus\Common\FSAA.EXE (file missing)
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Anti-Virus\backweb\2376288\program\fsbwsys.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Anti-Virus\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure Anti-Virus\fswsclds.exe
Siirrä ensin se Hijackki omaan kansioon tonne
C:\HjT\HijackThis.exe
Merkkaa ja Fix:saa
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.qsrch.com/
O8 - Extra context menu item: &Search - http://kc.bar.need2find.com/KC/menusearch.html?p=KC
Logfile of HijackThis v1.99.1
Scan saved at 21:31:56, on 7.8.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Anti-Virus\backweb\2376288\program\fsbwsys.exe
C:\Program Files\F-Secure Anti-Virus\fswsclds.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\rmctrl.exe
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Cheating-Death\cdeath.exe
G:\Valve\Steam\Steam.exe
C:\Kaspersky\mwavscan.com
C:\Kaspersky\kavss.exe
C:\Program Files\F-Secure Anti-Virus\Common\FSLAUNCH.EXE
C:\Program Files\F-Secure Anti-Virus\Common\FSMA32.EXE
C:\Program Files\F-Secure Anti-Virus\Common\FSMB32.EXE
C:\Program Files\F-Secure Anti-Virus\Common\FCH32.EXE
C:\Program Files\F-Secure Anti-Virus\Common\FAMEH32.EXE
C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fsav32.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F2 - REG:system.ini: UserInit=
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\system32\rmctrl.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Anti-Virus\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [RunDll32 c:\WINDOWS\system\cmicnfg.cpl,CMICtrlWnd] RunDll32 cmicnfg.cpl,CMICtrlWnd
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1111080976441
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure Anti-Virus (BackWeb Client - 2376288) - Unknown owner - C:\PROGRA~1\F-SECU~1\backweb\2376288\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure Anti-Virus\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\F-Secure Anti-Virus\Common\FSAA.EXE (file missing)
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Anti-Virus\backweb\2376288\program\fsbwsys.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Anti-Virus\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure Anti-Virus\fswsclds.exe
niin :D
File C:\WINDOWS\system32\InstaFinder_inst245.exe tagged as not-a-virus:AdWare.InstaFinder.a. No Action Taken.
File C:\WINDOWS\system32\RX.0XE infected by "Trojan-Spy.Win32.Delf.du" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\SYSTEMOUT.0XE infected by "Trojan-Spy.Win32.Delf.du" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Warblow\Local Settings\Temp\perfectnavUninstall.exe infected by "Trojan-Downloader.Win32.Keenval.f" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Warblow\Local Settings\Temp\temp.fr3280\sepng.dll.tcf tagged as not-a-virus:AdWare.EZula.bf. No Action Taken.
File C:\Documents and Settings\Warblow.MOUKKU\Application Data\Mozilla\Firefox\Profiles\uaofqjej.default\Cache\464FEFBCd01 infected by "Backdoor.Win32.SdBot.act" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Warblow.MOUKKU\Local Settings\Temp\bundle_cdt1006.exe tagged as not-a-virus:AdWare.Sahat.w. No Action Taken.
File C:\Documents and Settings\Warblow.MOUKKU\Local Settings\Temporary Internet Files\Content.IE5\GD6JS56B\prompt[1].0tm infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Warblow.MOUKKU\Local Settings\Temporary Internet Files\Content.IE5\YPRKDWNU\sploit[1].0nr infected by "Trojan-Downloader.Win32.Ani.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Warblow.MOUKKU\Omat tiedostot\videot 2\Dungeon Keeper\DUNGEON_KEEPER.0XE infected by "Backdoor.Win32.Rbot.vq" Virus. Action Taken: File Renamed.
File C:\Program Files\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP127\A0033090.dll tagged as not-a-virus:Monitor.Win32.XPCSpy124. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP127\A0033091.dll tagged as not-a-virus:Monitor.Win32.XPCSpy124. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP127\A0033092.dll tagged as not-a-virus:Monitor.Win32.XPCSpy.180. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP127\A0033093.exe tagged as not-a-virus:Monitor.Win32.XPCSpy124. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP144\A0040738.com infected by "Backdoor.Win32.SdBot.act" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP144\A0040743.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP144\A0040746.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP144\A0040834.exe tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP146\A0041770.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP146\A0041771.exe tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP146\A0041773.exe tagged as not-a-virus:AdWare.WinAD.bf. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP146\A0041774.exe tagged as not-a-virus:AdWare.WinAD.bf. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP146\A0041782.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP146\A0041787.exe tagged as not-a-virus:AdWare.WinAD.bf. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP146\A0041790.exe infected by "Backdoor.Win32.SdBot.act" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP148\A0041922.exe infected by "Trojan-Downloader.Win32.Keenval.f" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP55\A0011343.0XE infected by "Trojan-Dropper.Win32.Agent.pd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP55\A0011345.exe tagged as not-a-virus:AdWare.InstaFinder.a. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP55\A0011348.exe tagged as not-a-virus:AdWare.EZula.z. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP55\A0011355.exe tagged as not-a-virus:AdWare.Gator.3103. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP55\A0011359.exe tagged as not-a-virus:AdWare.NewDotNet. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP55\A0011457.exe tagged as not-a-virus:AdWare.NewDotNet. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP55\A0011459.exe tagged as not-a-virus:AdWare.NewDotNet. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP55\A0011460.exe tagged as not-a-virus:AdWare.Gator.3103. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP55\A0011489.dll tagged as not-a-virus:AdWare.EZula.bf. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP68\A0019184.exe tagged as not-a-virus:AdWare.Gator.6051. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP68\A0019212.dll tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP68\A0019214.dll tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP68\A0019221.exe tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP68\A0019223.dll tagged as not-a-virus:AdWare.BrilliantDigital.3039. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP68\A0019224.dll tagged as not-a-virus:AdWare.Altnet.j. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP68\A0019225.dll tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP69\A0019702.exe tagged as not-a-virus:AdWare.Gator.6051. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP69\A0019909.DLL tagged as not-a-virus:AdWare.ToolBar.MyWebSearch.l. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP69\A0019910.DLL tagged as not-a-virus:AdWare.ToolBar.MyWebSearch.o. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP69\A0019951.exe tagged as not-a-virus:RiskTool.Win32.Processor.1001. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP69\A0019978.EXE infected by "Trojan-Downloader.Win32.Keenval.f" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP69\A0019996.exe tagged as not-a-virus:Porn-Dialer.Win32.AGBDial. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP69\A0020758.DLL tagged as not-a-virus:AdWare.MySearch.e. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP70\A0020940.dll tagged as not-a-virus:AdWare.MySearch.e. No Action Taken.
File C:\System Volume Information\_restore{DC0D1C0D-AE37-4BBF-BCB5-C9CE0DB21741}\RP81\A0023563.0XE infected by "Trojan-Dropper.Win32.Agent.pd" Virus. Action Taken: File Deleted.
File C:\temp\180SAInstaller.exe tagged as not-a-virus:AdWare.180Solutions.g. No Action Taken.
File C:\temp\bundle_cdt1006.exe tagged as not-a-virus:AdWare.Sahat.w. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\INSTAFIN.0LL infected by "Trojan.Win32.Delf.gh" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\systemin.sys tagged as not-a-virus:Monitor.Win32.XPCSpy.124. No Action Taken.
File C:\WINDOWS\system32\InstaFinder_inst245.exe tagged as not-a-virus:AdWare.InstaFinder.a. No Action Taken.
File D:\zip\Cliprexdsfree.exe tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File D:\zip\Ohjelmat\mirc616.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
File G:\musiikki\uutta\Inguistion symphony farway\01 Sciezka 1.wma infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File G:\musiikki\uutta\Inguistion symphony farway\02 Sciezka 2.wma infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File G:\musiikki\uutta\Inguistion symphony farway\03 Sciezka 3.wma infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File G:\musiikki\uutta\Inguistion symphony farway\04 Sciezka 4.wma infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File G:\musiikki\uutta\Inguistion symphony farway\05 Sciezka 5.wma infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File G:\musiikki\uutta\Inguistion symphony farway\06 Sciezka 6.wma infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File G:\musiikki\uutta\Inguistion symphony farway\07 Sciezka 7.wma infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
Klikkaa niitä linkkejä,niin näkyy mitä ne oli.
Poista nuo
C:\WINDOWS\system32\InstaFinder_inst245.exe
D:\zip\Cliprexdsfree.exe
Sitte sammuta järjestelmänpalautustoiminto ja sitte käynnistä kone uudestaan ja pistä se takas pälle ja tee uus palautuspiste.
Tuolla ohje miten se sammutetaan
http://support.f-secure.fi/fin/home/virusproblem/howtoclean/cleansystemrestore.shtml
koneeni kaatui kun tein tuon mitä pyysit :D
eli kun yritän kirjautua sisään se salasanan jälkeen sanoo kirjaudutaan sisälle ja sitten samantien kirjaudutaan pihAlle eikä auta vikasietotilat edes :DDDDD
ku sammutit sen palutustoiminnon vai?
Ei sen pitäs kaatua sen takia.
sen pistin että suljin palautus toiminan ja nyt ei ole wintoosaan asiaa :D
se pistää yhden viestin ensimäisellä sisään kirjautmisella ja sit ei päästä enää ollenkan ja ilmoitus on invalid BackWeb applications id "237688"
http://support.f-secure.fi/fin/home/onlineservices/
Tuolla saat sen korjattua BackWeb
ei vaikusta tein sen tunti sitten
No ihme miten se niin lukkoon meni jos sen sammutti,sehän on ihan normaalia sammuttaa se jos haluaa putsata System Restoren.
Tuo BackWeb liittyy vissiin F-secureen.
sen nyt luulisi estävän windowsiin pääsyä ja miten tuota enää asentaa kun ei ole asiaakaan windowsiin?
vikasietotilan kautta
vikasieto tilassa sama juttu :D
ja se minua ihmetyttääkin että miten f-secure voi kaataa koko koneen kun sen tehtävä olisi pitää sitä pystyssä :D
josko tokenisi.
ollut virrat poikki, nettipiuha irtin vikasietotila netillä ja vikasieto tila ilman nettiä ja mikään ei toimi. backwebillä ei ole asiaan tekeistä kun kerran ilman nettiä se ei ilmoita sitä eikä siltikään pääse windowsiin
Koita naputtaa F8:sia ku kone käynnistyy ja sieltä valikosta vaihtoehto viimeisin toimiva kokoonpano tai jotain tollasta en tiedä tarkkaan sitä muotoa suomenkielellä.
on paljon noita wintoosa system32 että siellä on virukset melskanneet ja nyt kun joutu pois niin tiltasikos sen takia .... hmmmm käväsenpä sivulla...
alkaa tuntua aika epätoivoiselta
Jos sulla on Xp:n cd niin pukka se sisään ja koita korjausta.
odottelen tässä ja vilkasen 15min välein vähintään onko tullut mitään räpään samalla omaa konetta
muttakun sattuu olemaan pikkuveljen mukana eripaikkakunnalla :/
taitaa olla homam niin että pitää kaataa koko kone ja asentaa uudestaan kaikki *huoh*
http://koti.mbnet.fi/pattaya1/adaware.htm#INFO
onko sulla toinen kone käytössä. nyt tällä hetkellä.
eli sain eilen päivällä messengeriin viestin kaverilta missä luki: omg. ja sitten osoite sivustolle "kaveri lähettelee netti osotteita usein" ja menin avaaman sen ja sieltä tuli tiedosto minkä sitten avasin ja se alkoi spämmäämään sitä kaikille mese kavereille.
sen jälkeen aukesi parit nettiikkunat ja sain ihania toobaareja lisää sun muita highjackereitä... loppujen lopuksi kun luulin viirustorjunnoilla poistaneeni ne kaikki se kaappasi koko nettini............. *masentavaa*
ja tuo oli joku uudempi malli mikä on ollut liikkeellä tänään.. onko muita uhreja?? jos on antakaa sen linkin osoite heti!! kun omg:llä ei ole vielä löytynyt tätä uusinta virusta/highjaceriä .. se vanha kyllä löytyy..
ja ilmoittakaa toki jos joku osaa poistaa sen..
tuossa oli ongelma paripäivää sitten siirsin konetta ajatssa4pv taakseppäin tuolla järjestelmän plauttamisella ettei se siitä vetänyt hernettä nenäänsä???
viiruksen tiedosto nimi on:
C:\RECYCLER\NPROTECT\00001817.exe Virustartunta: could be infected with an unknown virus
samalla f-secure löysi nämä muttei halunnut tehdä niille mitään
* C:\WINDOWS\system32\RX.0XE Virustartunta: Trojan-Spy.Win32.Delf.du
* C:\WINDOWS\system32\SYSTEMOUT.0XE Virustartunta: Trojan-Spy.Win32.Delf.du
* C:\Documents and Settings\Warblow.MOUKKU\Omat tiedostot\videot 2\Dungeon Keeper\DUNGEON_KEEPER.0XE Virustartunta: Backdoor.Win32.Rbot.vq
* C:\Documents and Settings\Warblow.MOUKKU\Local Settings\Temporary Internet Files\Content.IE5\YPRKDWNU\sploit[1].0nr Virustartunta: Trojan-Downloader.Win32.Ani.c
* C:\Documents and Settings\Warblow.MOUKKU\Local Settings\Temporary Internet Files\Content.IE5\GD6JS56B\prompt[1].0tm Virustartunta: Trojan-Downloader.JS.IstBar.j
että se on nimenyt muutamia uudestaan siintäkin f-secure voi otaa herneet nenään.
mulla oli f-secure aikasemmin ja kun formatoin ja rupesin asentamaan uudestaan ohjelmaa niin se käynnistyi ja sammuili itestään.
Mulla oli asetukset sillain manuaalisesti ja automaatisesti poisti heti jos virus tietoa tuli.
Nyt mulla on avasti. On kevyempi ja päivitykset toimii.
muuten sulla on valmiiksi viruksia koneella ja liikenne on kovaa.
asennan ensin viirustorjunnat ja muut palomuurit sitten vasta netti
Niin mäkin teen ja puhas kone ... heti alussa.
Eikö muuten herjannut se palautus piste olenkaan kun palautit koneen taaksepäin.
kone alkoi vaan taas toimia
Kun escanilla oli scannatu niin ne mitä F-secure oli nimennyt uudestaan.
Ja nyt kun kaikki sai lähtöpassit deletoitiin niin f-secure sekosi.
Virukset mitä ei oltu deletoitu olivat järjästelmän palautuksessa. Escan deletoi ne toiminassa olevat virukset. Puhdistetiin järjestelmän palautus.
Siis koko Escan logi.
nyt vain jostain metsästämään windowsin levyä :/