Logfile of HijackThis v1.99.1
Scan saved at 10:23:41, on 11.8.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Norman\Bin\Zanda.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Norman\bin\ZLH.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Norman\bin\NJEEVES.EXE
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\Norman\Nvc\bin\nvcoas.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Norman\Nvc\bin\cclaw.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Norman\bin\ZLH.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Norman\Nvc\bin\cclaw.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\Program Files\Java\jre1.5.0_04\bin\javaw.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ari\Työpöytä\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Realtime Audio Engine] mmrtkrnl.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Asoc] C:\Documents and Settings\ari\Application Data\r???.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] \Program\
O4 - Global Startup: DigiDay Logon.lnk = C:\DIGIDAY\dd_logon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {4E15D681-1D20-11D4-8B72-000021DA1956} - http://www.pillu.com/HotAdult.exe
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O18 - Protocol: bw 0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw 0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Filter: text/html - {F9DF31A9-A4DD-4DFD-A0A9-C64B130FB1F0} - C:\Documents and Settings\ari\Local Settings\Application Data\microsoft\internet explorer\V0.34.dat
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
Scan saved at 10:23:41, on 11.8.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Norman\Bin\Zanda.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Norman\bin\ZLH.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Norman\bin\NJEEVES.EXE
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\Norman\Nvc\bin\nvcoas.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Norman\Nvc\bin\cclaw.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Norman\bin\ZLH.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Norman\Nvc\bin\cclaw.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\Program Files\Java\jre1.5.0_04\bin\javaw.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ari\Työpöytä\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Realtime Audio Engine] mmrtkrnl.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Asoc] C:\Documents and Settings\ari\Application Data\r???.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] \Program\
O4 - Global Startup: DigiDay Logon.lnk = C:\DIGIDAY\dd_logon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {4E15D681-1D20-11D4-8B72-000021DA1956} - http://www.pillu.com/HotAdult.exe
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O18 - Protocol: bw 0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw 0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {B0B5530F-661B-464B-B5D8-72CBAC01D94A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Filter: text/html - {F9DF31A9-A4DD-4DFD-A0A9-C64B130FB1F0} - C:\Documents and Settings\ari\Local Settings\Application Data\microsoft\internet explorer\V0.34.dat
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
Vastaukset 38
Vanhimmat
Siirä ensin se Hijackki omaan kansioon tonne
C:\HjT\HijackThis.exe
Merkkaa ja Fix:saa
R3 - Default URLSearchHook is missing
O4 - HKCU\..\Run: [Asoc] C:\Documents and Settings\ari\Application Data\r???.exe
O16 - DPF: {4E15D681-1D20-11D4-8B72-000021DA1956} - http://www.pillu.com/HotAdult.exe
kaikki 018 rivit.
kiitoksi paljon
Tolta logi nyt näyttää,mutta edelleen löytyy troijana tuo: O4 - HKCU\..\Run: [Asoc] C:\Documents and Settings\ari\Application Data\r???.exe
Logfile of HijackThis v1.99.1
Scan saved at 16:07:54, on 11.8.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Norman\Bin\Zanda.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Norman\bin\NJEEVES.EXE
C:\Norman\Nvc\bin\nvcoas.exe
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Norman\bin\ZLH.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Norman\Nvc\bin\cclaw.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Realtime Audio Engine] mmrtkrnl.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] \Program\
O4 - Global Startup: DigiDay Logon.lnk = C:\DIGIDAY\dd_logon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {4E15D681-1D20-11D4-8B72-000021DA1956} - http://www.pillu.com/HotAdult.exe
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
Merkkaa ja Fix:saa
O16 - DPF: {4E15D681-1D20-11D4-8B72-000021DA1956} - http://www.pillu.com/HotAdult.exe
Sitte etsi ja poista tuo
r???.exe
C:\Documents and Settings\ari\Application Data\r???.exe
r???.exe ton laitoin etsintään ja löyty tämmösiä
rsvp C:\WINDOWS\system32
rmid C:\Program Files\Java\...
rmid bin
Että aika paljon on poistettavaa jos kaikki pitäs poistaa,vai mitäköhän pitäs tehrä.??
Älä käytä Etsi toimintoo vaan seuraa tota polkua ja piilotiedostot näkyvissä.
C:\Documents and Settings\ari\Application Data\r???.exe
Application Data kansiosta ihme ja kyllä löydä en sit millään tätä r???.exe
sulla piilotiedostot näkyvillä ku katot
http://www.xtra.co.nz/help/0,,4155-1916458,00.html
kyllä ne on päällä. Tuo troija on ollu aika hakusessa, sitä etittiin tuki palvelun kaa vaikka miten muttei löytyny. Suorita valikon kautta sitä enimmäkseen yritettiin paikallistaa polun nimien perusteella mut ei löydy
Avaa Hijackki
Config... > Misc Tools > Delete a file on reboot
Sitte kopioi tuo koko rivi ja liitä se sinne ja aukase se sinne ja käynnistä kone uudestaan
C:\Documents and Settings\ari\Application Data\r???.exe
kun menee vaiheeseen avaa niin eipä avaakaan,ei tapahdu mitään.
Sanoit tuolla aikasemmin noin
> mutta edelleen löytyy troijana tuo: O4 - HKCU\..\Run: [Asoc] C:\Documents and Settings\ari\Application Data\r???.exe <
Onko se Norman joka ilmoittaa sittä vai joku muu?
Ota tosta KillBox
http://www.bleepingcomputer.com/files/killbox.php
Pura ,avaa ja täppi kohtaan Delete on Reboot
Sitte kopioi ja liitä tuo rivi sinne kenttään
C:\Documents and Settings\ari\Application Data\r???.exe
Sitte delete kohtaa (punanen jossa on valakonen X)
Vastaa myöntävästi kysymyksiin ja jos kone ei automaattisesti käynnisty uudestaan niin käynnistä se uudestaan.
otin killboxin tein ohjeen mukaan,kone käynnisty uudelleen itestään mutta yllätys yllätys normanni se troijan sieltä vielä löytää...
No mikähän nyt on,estääköhän tuo Microsoft AntiSpyware sen poistoo ku se on näköjään sulla käynnissä.
Tai sitte Norman hälyttää joutavia ku se ei kerran enää logissa näy.
Koita vielä scannata kone tolla ja kopioi kaikki jotka ilmestyy alaikkunaan ja pistä ne tänne
http://koti.mbnet.fi/pattaya1/escanmwav.htm
File C:\Documents and Settings\ari\Local Settings\Application Data\Microsoft\Internet Explorer\V0.15.dat infected by "Trojan.Win32.Dialui" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Application Data\Microsoft\Internet Explorer\V0.30.dat infected by "Trojan-Downloader.Win32.Small.bdl" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temp\~64.exe tagged as not-a-virus:Porn-Dialer.Win32.Generic. No Action Taken.
File C:\Documents and Settings\ari\Local Settings\Temp\~65.exe infected by "Trojan.Win32.StartPage.ow" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temp\~75.exe tagged as not-a-virus:Porn-Dialer.Win32.Generic. No Action Taken.
File C:\Documents and Settings\ari\Local Settings\Temp\~76.exe infected by "Trojan.Win32.StartPage.ow" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\7VISH8IO\prompt[2].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\81A30DY3\netslv32_EN_XP[1].cab tagged as not-a-virus:Dialer.Win32.E-Group.l. No Action Taken.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\9N1S9CT6\prompt[2].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\9N1S9CT6\prompt[3].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\9N1S9CT6\prompt[4].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\9N1S9CT6\prompt[5].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\9N1S9CT6\prompt[6].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\AHSB2RYX\mtrslib2[1].js infected by "Trojan-Downloader.JS.Small.ag" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ETKFUDM5\prompt[1].php infected by "Trojan-Downloader.JS.WinAD.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ETKFUDM5\prompt[2].php infected by "Trojan-Downloader.JS.WinAD.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\F90209U8\prompt[10].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\F90209U8\prompt[11].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\F90209U8\prompt[12].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\F90209U8\prompt[3].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\F90209U8\prompt[4].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\F90209U8\prompt[5].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\F90209U8\prompt[6].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\F90209U8\prompt[7].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\F90209U8\prompt[8].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\F90209U8\prompt[9].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\G9M7O5YR\bestthumb[1].htm infected by "Trojan-Clicker.JS.Linker.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\H5PZI51G\fuck[1].htm infected by "Exploit.HTML.ObjData" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ILP6ZQL8\mtrslib3[1].js infected by "Trojan-Downloader.JS.gen" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ILP6ZQL8\prompt[10].htm infected by "Trojan-Downloader.JS.IstBar.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ILP6ZQL8\prompt[11].htm infected by "Trojan-Downloader.JS.IstBar.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ILP6ZQL8\prompt[12].htm infected by "Trojan-Downloader.JS.IstBar.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ILP6ZQL8\prompt[13].htm infected by "Trojan-Downloader.JS.IstBar.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ILP6ZQL8\prompt[1].htm infected by "Trojan-Downloader.JS.IstBar.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ILP6ZQL8\prompt[2].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ILP6ZQL8\prompt[3].htm infected by "Trojan-Downloader.JS.IstBar.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ILP6ZQL8\prompt[3].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ILP6ZQL8\prompt[4].htm infected by "Trojan-Downloader.JS.IstBar.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ILP6ZQL8\prompt[5].htm infected by "Trojan-Downloader.JS.IstBar.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ILP6ZQL8\prompt[6].htm infected by "Trojan-Downloader.JS.IstBar.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ILP6ZQL8\prompt[7].htm infected by "Trojan-Downloader.JS.IstBar.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ILP6ZQL8\prompt[8].htm infected by "Trojan-Downloader.JS.IstBar.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\ILP6ZQL8\prompt[9].htm infected by "Trojan-Downloader.JS.IstBar.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\IOWPEOLR\prompt[2].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\OVHE1Y3V\prompt[3].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\VEWZZTWL\prompt[1].php infected by "Trojan-Downloader.JS.WinAD.a" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\WT4VGBOR\prompt[2].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\ari\Local Settings\Temporary Internet Files\Content.IE5\WT4VGBOR\prompt[3].php infected by "Trojan-Downloader.JS.IstBar.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\marjaana\Application Data\Mozilla\Firefox\Profiles\nstknnjs.default\Cache\429C0D3Dd01 infected by "Trojan-Clicker.JS.Linker.h" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\marjaana\Application Data\Mozilla\Firefox\Profiles\nstknnjs.default\Cache\5933A522d01 infected by "Trojan-Clicker.JS.Linker.h" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\marjaana\Application Data\Mozilla\Firefox\Profiles\nstknnjs.default\Cache\D184A955d01 infected by "Trojan-Clicker.JS.Linker.h" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\marjaana\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\BlackBox.class-7fb5dbb4-5b79d9f9.class infected by "Trojan.Java.ClassLoader.f" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\marjaana\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-d73f6a9-7e0dbd3a.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\marjaana\Local Settings\Temporary Internet Files\Content.IE5\S56NWXM3\fkfkdsae[1].cab tagged as not-a-virus:AdWare.F1Organizer.c. No Action Taken.
File C:\System Volume Information\_restore{7AD2D17E-D3A0-43A2-8DF2-9AB8D50EE194}\RP307\A0058684.dll tagged as not-a-virus:AdWare.Gator.3124. No Action Taken.
File C:\System Volume Information\_restore{7AD2D17E-D3A0-43A2-8DF2-9AB8D50EE194}\RP307\A0058685.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\System Volume Information\_restore{7AD2D17E-D3A0-43A2-8DF2-9AB8D50EE194}\RP307\A0058686.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\System Volume Information\_restore{7AD2D17E-D3A0-43A2-8DF2-9AB8D50EE194}\RP307\A0058687.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\System Volume Information\_restore{7AD2D17E-D3A0-43A2-8DF2-9AB8D50EE194}\RP307\A0058688.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\System Volume Information\_restore{7AD2D17E-D3A0-43A2-8DF2-9AB8D50EE194}\RP307\A0058689.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\System Volume Information\_restore{7AD2D17E-D3A0-43A2-8DF2-9AB8D50EE194}\RP307\A0058690.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\System Volume Information\_restore{7AD2D17E-D3A0-43A2-8DF2-9AB8D50EE194}\RP307\A0058691.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\System Volume Information\_restore{7AD2D17E-D3A0-43A2-8DF2-9AB8D50EE194}\RP307\A0058737.exe tagged as not-a-virus:Porn-Dialer.Win32.Generic. No Action Taken.
File C:\System Volume Information\_restore{7AD2D17E-D3A0-43A2-8DF2-9AB8D50EE194}\RP307\A0058738.exe tagged as not-a-virus:Porn-Dialer.Win32.Generic. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\ParisVoyeur.exe tagged as not-a-virus:Porn-Dialer.Win32.Generic. No Action Taken.
Kirjota Suorita kohtaan cleanmgr ja Ok
Merkkaa sieltä nuo ja putsaa pois ne
Temporary Files
Temporary Internet Files
Recycle Bin
Sitte poista tuo
C:\WINDOWS\Downloaded Program Files\ParisVoyeur.exe
Sitte sammuta System Restore ja käynnistä kone uudestaan ja pistä se takas päälle ja tee uus palutuspiste.
Tuolla ohje miten se sammutetaan
http://support.f-secure.fi/fin/home/virusproblem/howtoclean/cleansystemrestore.shtml
tein nuo viimesimmät ohjeet ja kuinkas muutenkaan norman löytää v..n troijan aina ja iänkaikkisesti aamen.
Mulla loppu konstit,luulis sen lähtevän pois sillä KillBoxilla.
Eikö Norman voi tehä sille mitään esim. karanteeniin
ei sitä poista, se ilmottaa vaan että tarkasta karanteeni asetukset. Niitäkin on rassattu ei vaan auta.
konstit meikältä että miten sen löytää ja poistaa,tai sitte Normanni hälyttää joutavia.
avusta kumminkin joo juu..
Koitas vielä scannata kone tolla jos se löytää jotain
http://www.sysinternals.com/Utilities/RootkitRevealer.html
vois löytyä. Norman apuohjelmat ja sieltä karanteenistakohan se oli, sieltä sain minä troijalaiset poistettua. Hiiren oikealla painikkaalla (poista komennolla)jokaisen yksitellen ja sitten buuttasin koneen ja örkit hävis.
eipä auttanu scannaus ja kyllä on poistettu karanteenista mitä on löytyny
Niin se scanneri ei löytänny mitään vai?
Voisit vielä koittaa vaihtaa nimee sille r???.exe:lle command promtissa.
Vaikka en tiedä niitä komentoja että miten se oikeen menee,mutta ehkä jotenki näin ja jos oon väärässä,niin ehkä joku muu auttaa joka tietää paremmin ne komennot.
Kirjota Suorita kohtaan cmd ja Ok
Sitte kirjota sinne nämä
cd dokuments and settings
cd ari
cd application data
rename r???.exe rrrr.old ja paina Enter
Tai sitte
cd C:\Documents and Settings\ari\Application Data\
rename r???.exe rrrr.old ja paina Enter
Koitas jos onnistuu.
kyllä tuo rootkit löyti jonkun pöpön,luulin että se poistaa sen abortilla mutta tänään koklasin uudestaan niin löyty kaks pöpöä eikä poista.
se rootkitrevealerin loki tänne, kiitos
rkrevealer listaa filut ja arvot jotka on piilossa windows API:lta, se ei välttämättä tarkoita että kyseessä on virus tai muu tihulainen!!
eli laita se loki ja katotaan mitä poistetaan
miten saan tuon login kopsattua,kun ei maalaannu?
Ku se on scannannu valmiiks,niin sitte ylhäältä
File ja Save...
Säästä se johonki ja sitte kopioi.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ 20.7.2004 0:47 0 bytes Key name contains embedded nulls (*)
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\09CE6E4Cd01 14.8.2005 16:26 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\09DDABF5d01 14.8.2005 16:31 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\09EFB17Cd01 14.8.2005 16:27 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\0B9B4A7Bd01 14.8.2005 16:23 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\0BAF5D06d01 14.8.2005 16:25 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\0BEB7B4Cd01 14.8.2005 16:07 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\0E971D7Ed01 14.8.2005 16:22 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\0FFB24AAd01 14.8.2005 16:30 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\19BA2A7Fd01 14.8.2005 16:30 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\1BBA5F99d01 14.8.2005 16:15 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\1CC21D5Fd01 14.8.2005 16:05 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\1EA97D3Ad01 14.8.2005 16:23 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\22E95D4Dd01 14.8.2005 16:08 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\289D3B6Dd01 14.8.2005 16:29 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\2AEBAF30d01 14.8.2005 16:17 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\2BCB2FD2d01 14.8.2005 16:08 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\2D885F44d01 14.8.2005 16:14 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\2DC931C5d01 14.8.2005 16:20 29.81 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\2FC93559d01 14.8.2005 16:31 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\38E90519d01 14.8.2005 16:06 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\393D6CB9d01 14.8.2005 16:10 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\3E3F7E8Ed01 14.8.2005 16:16 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\49BCBC79d01 14.8.2005 16:24 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\4C360E88d01 14.8.2005 16:24 35.01 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\5DEA5994d01 14.8.2005 16:08 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\5E967F1Bd01 14.8.2005 16:11 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\5F58BCC5d01 14.8.2005 16:04 28.35 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\61DA74FFd01 14.8.2005 16:18 41.56 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\67045A37d01 14.8.2005 16:20 28.72 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\68BD2F0Cd01 14.8.2005 16:25 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\6D5CC2C6d01 14.8.2005 16:11 28.34 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\6EC37B59d01 14.8.2005 16:31 30.50 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\6EDB796Cd01 14.8.2005 16:28 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\7C9A1C6Bd01 14.8.2005 16:31 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\7CB96CA3d01 14.8.2005 16:09 29.37 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\7CDA3C7Ed01 14.8.2005 16:09 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\7DBD4D28d01 14.8.2005 16:25 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\7DFB0833d01 14.8.2005 16:30 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\7EC70C52d01 14.8.2005 16:27 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\7FAF0A83d01 14.8.2005 16:04 30.48 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\8CF84811d01 14.8.2005 16:05 42.33 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\8DBC6F66d01 14.8.2005 16:23 38.33 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\8EA9F034d01 14.8.2005 16:17 31.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\8F877F21d01 14.8.2005 16:30 34.18 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\95C03417d01 14.8.2005 16:20 28.28 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\9AEBE3A5d01 14.8.2005 16:20 34.57 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\9C933104d01 14.8.2005 16:05 30.59 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\AA39DCCCd01 14.8.2005 16:19 45.42 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\AAFA7B3Fd01 14.8.2005 16:12 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\AB3C6E34d01 14.8.2005 16:05 35.34 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\BA1BA5ABd01 14.8.2005 16:19 38.25 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\BEDADB36d01 14.8.2005 16:30 34.63 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\C8F216C1d01 14.8.2005 16:18 31.56 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\CBCB0913d01 14.8.2005 16:30 40.48 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\DC1D2B27d01 14.8.2005 16:24 37.99 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\EAB5FBC3d01 14.8.2005 16:24 27.59 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\EB981E2Bd01 14.8.2005 16:19 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\ECEB6A22d01 14.8.2005 16:24 37.49 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\F6EB1968d01 14.8.2005 16:05 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\F7B54EE5d01 14.8.2005 16:25 40.32 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\F8FE4763d01 14.8.2005 16:20 31.16 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\F9085EFEd01 14.8.2005 16:20 29.89 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\FAD67A2Fd01 14.8.2005 16:25 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\FC8F582Ad01 14.8.2005 16:10 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\Cache\FDE93A78d01 14.8.2005 16:20 10.84 KB Hidden from Windows API.
C:\Documents and Settings\ari\Application Data\Mozilla\Firefox\Profiles\kdlfx8qt.default\parent.lock 14.8.2005 16:02 0 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\LocalService\Omat tiedostot 14.8.2005 16:33 0 bytes Hidden from Windows API.
C:\Documents and Settings\LocalService\Omat tiedostot\desktop.ini 14.8.2005 16:33 79 bytes Hidden from Windows API.
C:\Documents and Settings\LocalService\Recent 14.8.2005 16:32 0 bytes Hidden from Windows API.
C:\Documents and Settings\LocalService\Recent\Desktop.ini 14.8.2005 16:32 150 bytes Hidden from Windows API.
en tohi lähtee veikkaileen tosta logista,kyllä Illukka ilmoitelee jos siinä on jotain kuhan kerkee.
Koitikko muuten sitä nimen vaihtoo.
juu,ei löydy
Mitäköhän tuo tarkoittaa.
Koitit siis sitä nimen vaihtoo ja Norman valittaa siitä vieläki vai.
kysymys ootko kirjautunu sisäään käyttäjänä ari?
noi ei sinänsä merkkaa mitää harmilista, koitas tyhjätä firefoxin cache
ja sen pitäs hoitua
ei tossa siis syytä huoleen!
laitappa vielä silent runners loki
saat ohjelmat osoitteesta www.silentrunners.org
(silent runners.vbs)
tallenna se työpöydälle
ja tuplaklikkaa anna skriptin pyöriä ja se tekee lokin jonka laitat tänne
koita myös ettiä tuota tiedostoa r????.exe vikasietotilassa
huom: tiedoston nimen loput kirjaimet voi olla mitä tahansa merkkejä, vain toi eka kirjain on windowsin tunnistama, siksi noi kyssämerkit
eli eti r kirjaimella alakava exe jossa on 4 merkkiä ja poista kaikki sellaiset
en ole kirjautunut millään nimellä ja rakkaalla koneella on useampi käyttäjä ,ttä sillain ilkka.Mikä on cache ja missä? Tommosia on vaikee tajuta kun ei sanakirjakaan tiedä sanaa ja jos ohjeita tulee suomeksi niin koneella ne on englanniksi tai päin vastoin,hankala on amatöörin löytää..
Kuule sain login vihdoin ja viimein..
"Silent Runners.vbs", revision 40.1, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{ }"
Startup items buried in registry:
---------------------------------
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ { }
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"MsnMsgr" = ""C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background" [MS]
"LDM" = "\Program\" [file not found]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ { }
"Wizard" = "" [file not found]
"IgfxTray" = "C:\WINDOWS\System32\igfxtray.exe" ["Intel Corporation"]
"HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"Microsoft Works Update Detection" = "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" ["Microsoft® Corporation"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"HP Component Manager" = ""C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"" ["Hewlett-Packard Company"]
"HP Software Update" = "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Co."]
"LVCOMSX" = "C:\WINDOWS\system32\LVCOMSX.EXE" ["Logitech Inc."]
"LogitechVideoRepair" = "C:\Program Files\Logitech\Video\ISStart.exe " ["Logitech Inc."]
"LogitechVideoTray" = "C:\Program Files\Logitech\Video\LogiTray.exe" ["Logitech Inc."]
"gcasServ" = ""C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"" [MS]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" ["Sun Microsystems, Inc."]
"Norman ZANDA" = "C:\Norman\bin\ZLH.EXE /LOAD /SPLASH" [null data]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL -laajennus"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal-kuvakkeen tunniste"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
moi