spyaxe. aaaaapuuuuva aaapuva apuva apuva!

Logfile of HijackThis v1.99.1
Scan saved at 17:40:02, on 11.1.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINTOOSA\System32\smss.exe
C:\WINTOOSA\system32\winlogon.exe
C:\WINTOOSA\system32\services.exe
C:\WINTOOSA\system32\lsass.exe
C:\WINTOOSA\system32\svchost.exe
C:\WINTOOSA\System32\svchost.exe
C:\WINTOOSA\Explorer.EXE
C:\WINTOOSA\system32\spoolsv.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINTOOSA\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\RamBooster 2.0\Rambooster.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Opera\Opera.exe
C:\WINTOOSA\system32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINTOOSA\Explorer.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\HjT\HijackThis.exe
C:\WINTOOSA\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Oj\LOCALS~1\Temp\se.dll/space.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINTOOSA\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [RAMBooster.Net] C:\Program Files\RAMBooster.Net\RAMBooster.exe -m
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINTOOSA\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINTOOSA\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RamBooster] C:\Program Files\RamBooster 2.0\Rambooster.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: Adobe Photoshop 7.0 - {3BB7D8E6-27DE-FD01-0820-4E2FE178D532} - c:\program files\adobe\photoshop 7.0\ysphlk8.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINTOOSA\system32\nvsvc32.exe







smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [versio 5.1.2600]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

msvol.tlb
ld****.tmp
ncompat.tlb
mscornet.exe
hp***.tmp


~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 876 'explorer.exe'
Killing PID 876 'explorer.exe'

Starting registry repairs

Deleting files


Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Miscellaneous Files/folders ~~~




~~~ Wininet.dll ~~~

CLEAN! :)

atk (ex)expertti kirjoitti:

Logfile of HijackThis v1.99.1
Scan saved at 17:40:02, on 11.1.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINTOOSA\System32\smss.exe
C:\WINTOOSA\system32\winlogon.exe
C:\WINTOOSA\system32\services.exe
C:\WINTOOSA\system32\lsass.exe
C:\WINTOOSA\system32\svchost.exe
C:\WINTOOSA\System32\svchost.exe
C:\WINTOOSA\Explorer.EXE
C:\WINTOOSA\system32\spoolsv.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINTOOSA\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\RamBooster 2.0\Rambooster.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Opera\Opera.exe
C:\WINTOOSA\system32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINTOOSA\Explorer.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\HjT\HijackThis.exe
C:\WINTOOSA\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Oj\LOCALS~1\Temp\se.dll/space.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINTOOSA\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [RAMBooster.Net] C:\Program Files\RAMBooster.Net\RAMBooster.exe -m
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINTOOSA\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINTOOSA\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RamBooster] C:\Program Files\RamBooster 2.0\Rambooster.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: Adobe Photoshop 7.0 - {3BB7D8E6-27DE-FD01-0820-4E2FE178D532} - c:\program files\adobe\photoshop 7.0\ysphlk8.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINTOOSA\system32\nvsvc32.exe







smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [versio 5.1.2600]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

msvol.tlb
ld****.tmp
ncompat.tlb
mscornet.exe
hp***.tmp


~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 876 'explorer.exe'
Killing PID 876 'explorer.exe'

Starting registry repairs

Deleting files


Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Miscellaneous Files/folders ~~~




~~~ Wininet.dll ~~~

CLEAN! :)

SpyAxelähti pois, mutta siellä on vielä muuta.

Fixaa tämä:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Oj\LOCALS~1\Temp\se.dll/space.html

Ja poista:

C:\DOCUME~1\Oj\LOCALS~1\Temp\==>se.dll

Fixaaja kirjoitti:

SpyAxelähti pois, mutta siellä on vielä muuta.

Fixaa tämä:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Oj\LOCALS~1\Temp\se.dll/space.html

Ja poista:

C:\DOCUME~1\Oj\LOCALS~1\Temp\==>se.dll

Logfile of HijackThis v1.99.1
Scan saved at 18:23:45, on 11.1.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINTOOSA\System32\smss.exe
C:\WINTOOSA\system32\winlogon.exe
C:\WINTOOSA\system32\services.exe
C:\WINTOOSA\system32\lsass.exe
C:\WINTOOSA\system32\svchost.exe
C:\WINTOOSA\System32\svchost.exe
C:\WINTOOSA\Explorer.EXE
C:\WINTOOSA\system32\spoolsv.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINTOOSA\system32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINTOOSA\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\RamBooster 2.0\Rambooster.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINTOOSA\system32\wuauclt.exe
C:\HjT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINTOOSA\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [RAMBooster.Net] C:\Program Files\RAMBooster.Net\RAMBooster.exe -m
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINTOOSA\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINTOOSA\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RamBooster] C:\Program Files\RamBooster 2.0\Rambooster.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: Adobe Photoshop 7.0 - {3BB7D8E6-27DE-FD01-0820-4E2FE178D532} - c:\program files\adobe\photoshop 7.0\ysphlk8.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINTOOSA\system32\nvsvc32.exe



Tota se.dll-tiedostoa ei löytynyt tuolta kansiosta (C:\DOCUME~1\Oj\LOCALS~1\Temp\), eikä koko koneesta, vaikka piilotiedostot on näkyvissä.
Sen sijaan tuolla ko. kansiossa on tiedostot nimeltään Perflib_Perfdata_168.dat ja ~DFF4F0.dat. Noita kun yrittää poistaa niin kone herjaa yhteiskäyttövirhettä. Koitan nyt poistaa nuo vikasietotilassa.

atk(ex)pertti kirjoitti:

Logfile of HijackThis v1.99.1
Scan saved at 18:23:45, on 11.1.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINTOOSA\System32\smss.exe
C:\WINTOOSA\system32\winlogon.exe
C:\WINTOOSA\system32\services.exe
C:\WINTOOSA\system32\lsass.exe
C:\WINTOOSA\system32\svchost.exe
C:\WINTOOSA\System32\svchost.exe
C:\WINTOOSA\Explorer.EXE
C:\WINTOOSA\system32\spoolsv.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINTOOSA\system32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINTOOSA\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\RamBooster 2.0\Rambooster.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINTOOSA\system32\wuauclt.exe
C:\HjT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINTOOSA\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [RAMBooster.Net] C:\Program Files\RAMBooster.Net\RAMBooster.exe -m
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINTOOSA\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINTOOSA\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RamBooster] C:\Program Files\RamBooster 2.0\Rambooster.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: Adobe Photoshop 7.0 - {3BB7D8E6-27DE-FD01-0820-4E2FE178D532} - c:\program files\adobe\photoshop 7.0\ysphlk8.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINTOOSA\system32\nvsvc32.exe



Tota se.dll-tiedostoa ei löytynyt tuolta kansiosta (C:\DOCUME~1\Oj\LOCALS~1\Temp\), eikä koko koneesta, vaikka piilotiedostot on näkyvissä.
Sen sijaan tuolla ko. kansiossa on tiedostot nimeltään Perflib_Perfdata_168.dat ja ~DFF4F0.dat. Noita kun yrittää poistaa niin kone herjaa yhteiskäyttövirhettä. Koitan nyt poistaa nuo vikasietotilassa.

Tuo jäi äsken:

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

Fixaa se vielä muuten loki on ok.

Fixaaja kirjoitti:

Tuo jäi äsken:

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

Fixaa se vielä muuten loki on ok.

Eipäs vaan lähde pois toi "virus alert-puhekupla" tuolta palkista. Kun sitä klikkaa, niin palomuuri ilmoittaa, että kone yrittää yhteyttä osoitteeseen 195.22.176.68 Portti 80

Tuossa viimeisin logi, jonka olen ajanut vikasietotilassa.

Logfile of HijackThis v1.99.1
Scan saved at 20:35:20, on 11.1.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINTOOSA\System32\smss.exe
C:\WINTOOSA\system32\winlogon.exe
C:\WINTOOSA\system32\services.exe
C:\WINTOOSA\system32\lsass.exe
C:\WINTOOSA\system32\svchost.exe
C:\WINTOOSA\System32\svchost.exe
C:\WINTOOSA\Explorer.EXE
C:\WINTOOSA\system32\spoolsv.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINTOOSA\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\RamBooster 2.0\Rambooster.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINTOOSA\system32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Opera\Opera.exe
C:\WINTOOSA\system32\wuauclt.exe
C:\HjT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINTOOSA\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [RAMBooster.Net] C:\Program Files\RAMBooster.Net\RAMBooster.exe -m
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINTOOSA\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINTOOSA\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RamBooster] C:\Program Files\RamBooster 2.0\Rambooster.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: Adobe Photoshop 7.0 - {3BB7D8E6-27DE-FD01-0820-4E2FE178D532} - c:\program files\adobe\photoshop 7.0\ysphlk8.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINTOOSA\system32\nvsvc32.exe

atk(ex)pertti kirjoitti:

Eipäs vaan lähde pois toi "virus alert-puhekupla" tuolta palkista. Kun sitä klikkaa, niin palomuuri ilmoittaa, että kone yrittää yhteyttä osoitteeseen 195.22.176.68 Portti 80

Tuossa viimeisin logi, jonka olen ajanut vikasietotilassa.

Logfile of HijackThis v1.99.1
Scan saved at 20:35:20, on 11.1.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINTOOSA\System32\smss.exe
C:\WINTOOSA\system32\winlogon.exe
C:\WINTOOSA\system32\services.exe
C:\WINTOOSA\system32\lsass.exe
C:\WINTOOSA\system32\svchost.exe
C:\WINTOOSA\System32\svchost.exe
C:\WINTOOSA\Explorer.EXE
C:\WINTOOSA\system32\spoolsv.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINTOOSA\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\RamBooster 2.0\Rambooster.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINTOOSA\system32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Opera\Opera.exe
C:\WINTOOSA\system32\wuauclt.exe
C:\HjT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINTOOSA\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [RAMBooster.Net] C:\Program Files\RAMBooster.Net\RAMBooster.exe -m
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINTOOSA\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINTOOSA\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RamBooster] C:\Program Files\RamBooster 2.0\Rambooster.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: Adobe Photoshop 7.0 - {3BB7D8E6-27DE-FD01-0820-4E2FE178D532} - c:\program files\adobe\photoshop 7.0\ysphlk8.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINTOOSA\system32\nvsvc32.exe

Eli Liettuaan yrittää ottaa yhteyttä :)

Hae -> http://www.sysinternals.com/files/procexpnt.zip

Pura se omaan kansioon ja sitte auki
Sitten ylhäältä View ja katso, että siellä on täpit näissä kohdissa

Show processes from all users.
Show Lower Pane
Lower Pane View DLL's

Sitte siitä ikkunasta klikkaa Explorer.exe-kohtaa
Sitte ylhäältä File > Save As > ja säästät sen ja sitte pistä tänne se logi,niin katotaan jos siinä näky jotain.

Fixaaja kirjoitti:

Eli Liettuaan yrittää ottaa yhteyttä :)

Hae -> http://www.sysinternals.com/files/procexpnt.zip

Pura se omaan kansioon ja sitte auki
Sitten ylhäältä View ja katso, että siellä on täpit näissä kohdissa

Show processes from all users.
Show Lower Pane
Lower Pane View DLL's

Sitte siitä ikkunasta klikkaa Explorer.exe-kohtaa
Sitte ylhäältä File > Save As > ja säästät sen ja sitte pistä tänne se logi,niin katotaan jos siinä näky jotain.

Process   PID   CPU   Description   Company Name
System Idle Process   0   85.59      
Interrupts   n/a      Hardware Interrupts   
DPCs   n/a      Deferred Procedure Calls   
System   4   0.90      
smss.exe   428      Windows NT:n istunnonhallinta   Microsoft Corporation
csrss.exe   476      Client Server Runtime Process   Microsoft Corporation
winlogon.exe   500      Windows NT -kirjaus   Microsoft Corporation
services.exe   544   0.90   Palvelu- ja ohjainohjelma   Microsoft Corporation
svchost.exe   712   0.90   Generic Host Process for Win32 Services   Microsoft Corporation
svchost.exe   796      Generic Host Process for Win32 Services   Microsoft Corporation
svchost.exe   848      Generic Host Process for Win32 Services   Microsoft Corporation
svchost.exe   936      Generic Host Process for Win32 Services   Microsoft Corporation
svchost.exe   1008      Generic Host Process for Win32 Services   Microsoft Corporation
spoolsv.exe   1296      Spooler SubSystem App   Microsoft Corporation
avgamsvr.exe   1708      AVG Alert Manager   GRISOFT, s.r.o.
avgupsvc.exe   1752      AVG Update Service   GRISOFT, s.r.o.
ewidoctrl.exe   1808      ewido control   ewido networks
kpf4ss.exe   1892      Kerio Personal Firewall 4 - Service   Kerio Technologies
kpf4gui.exe   248      Kerio Personal Firewall 4 - GUI   Kerio Technologies
kpf4gui.exe   656      Kerio Personal Firewall 4 - GUI   Kerio Technologies
nvsvc32.exe   1964      NVIDIA Driver Helper Service, Version 81.95   NVIDIA Corporation
wdfmgr.exe   2016      Windows User Mode Driver Manager   Microsoft Corporation
alg.exe   1468      Application Layer Gateway Service   Microsoft Corporation
lsass.exe   556      LSA Shell (Export Version)   Microsoft Corporation
Explorer.EXE   1156   1.80   Resurssienhallinta   Microsoft Corporation
avgcc.exe   1476      AVG Control Center   GRISOFT, s.r.o.
avgemc.exe   1484      AVG E-Mail Scanner   GRISOFT, s.r.o.
jusched.exe   1492      Java(TM) 2 Platform Standard Edition binary   Sun Microsystems, Inc.
ctfmon.exe   1532      CTF Loader   Microsoft Corporation
msmsgs.exe   1540      Windows Messenger   Microsoft Corporation
Rambooster.exe   1548      RamBooster   J.Pajula
Opera.exe   3084      Opera Internet Browser   Opera Software
NOTEPAD.EXE   2568      Notepad   Microsoft Corporation
Explorer.EXE   3308      Resurssienhallinta   Microsoft Corporation
procexp.exe   3388   9.01   Sysinternals Process Explorer   Sysinternals

Process: Explorer.EXE Pid: 1156

Name   Description   Company Name   Version
AcGenral.dll   Windows Compatibility DLL   Microsoft Corporation   5.01.2600.2180
advapi32.dll   Windows 32 -pohjainen lisä-API   Microsoft Corporation   5.01.2600.2180
apphelp.dll   Application Compatibility Client Library   Microsoft Corporation   5.01.2600.2180
atl.dll   ATL Module for Windows XP (Unicode)   Microsoft Corporation   3.05.2284.0000
batmeter.dll   Battery Meter Helper -kirjasto (DLL)   Microsoft Corporation   6.00.2900.2180
browseui.dll   Liittymäselaimen käyttöliittymäkirjasto   Microsoft Corporation   6.00.2900.2802
clbcatq.dll      Microsoft Corporation   2001.12.4414.0308
comctl32.dll   User Experience Controls Library   Microsoft Corporation   6.00.2900.2180
comctl32.dll   Common Controls Library   Microsoft Corporation   5.82.2900.2180
comdlg32.dll   Yleisten valintaikkunoiden dll-tiedosto   Microsoft Corporation   6.00.2900.2180
comres.dll      Microsoft Corporation   2001.12.4414.0258
credui.dll   Credential Manager User Interface   Microsoft Corporation   5.01.2600.2180
crypt32.dll   Crypto API32   Microsoft Corporation   5.131.2600.2180
cryptui.dll   Microsoft Luottamusliittymän tarjoaja   Microsoft Corporation   5.131.2600.2180
cscdll.dll   Offline-verkkoagentti   Microsoft Corporation   5.01.2600.2180
cscui.dll   Asiakkaan puskurointiliittymä   Microsoft Corporation   5.01.2600.2180
ctype.nls         
davclnt.dll   Web DAV Client DLL   Microsoft Corporation   5.01.2600.2180
dnsapi.dll   DNS Client API DLL   Microsoft Corporation   5.01.2600.2180
drprov.dll   Microsoft Terminal Server Network Provider   Microsoft Corporation   5.01.2600.2180
explorer.exe   Resurssienhallinta   Microsoft Corporation   6.00.2900.2180
gdi32.dll   GDI Client DLL   Microsoft Corporation   5.01.2600.2818
hnetcfg.dll   Home Networking Configuration Manager   Microsoft Corporation   5.01.2600.2180
imagehlp.dll   Windows NT Image Helper   Microsoft Corporation   5.01.2600.2180
index.dat         
index.dat         
index.dat         
index.dat         
iphlpapi.dll   IP Helper API   Microsoft Corporation   5.01.2600.2180
kernel32.dll   Windows NT BASE APIn asiakas-DLL   Microsoft Corporation   5.01.2600.2180
linkinfo.dll   Windows Volume Tracking   Microsoft Corporation   5.01.2600.2751
locale.nls         
midimap.dll   Microsoft MIDI-kartoitin   Microsoft Corporation   5.01.2600.2180
mpr.dll   Monipalvelureititin-DLL   Microsoft Corporation   5.01.2600.2180
msacm32.dll   Microsoft ACM Audio Filter   Microsoft Corporation   5.01.2600.2180
msacm32.drv   Microsoft Sound Mapper   Microsoft Corporation   5.01.2600.0000
msasn1.dll   ASN.1 Runtime APIs   Microsoft Corporation   5.01.2600.2180
msctf.dll   MSCTF Server DLL   Microsoft Corporation   5.01.2600.2180
msgina.dll   Windows NT -kirjaus GINA DLL   Microsoft Corporation   5.01.2600.2180
msi.dll   Windows Installer   Microsoft Corporation   3.01.4000.2435
msimg32.dll   GDIEXT Client DLL   Microsoft Corporation   5.01.2600.2180
msutb.dll   MSUTB Server DLL   Microsoft Corporation   5.01.2600.2180
msv1_0.dll   Microsoft Authentication Package v1.0   Microsoft Corporation   5.01.2600.2180
msvcr71.dll   Microsoft® C Runtime Library   Microsoft Corporation   7.10.3052.0004
msvcrt.dll   Windows NT CRT DLL   Microsoft Corporation   7.00.2600.2180
mswsock.dll   Microsoft Windows Sockets 2.0 -palveluntarjoaja   Microsoft Corporation   5.01.2600.2180
netapi32.dll   Net Win32 API DLL   Microsoft Corporation   5.01.2600.2180
netrap.dll   Net Remote Admin Protocol DLL   Microsoft Corporation   5.01.2600.2180
netshell.dll   Network Connections Shell   Microsoft Corporation   5.01.2600.2180
netui0.dll   NT LM UI Common Code - GUI-luokat   Microsoft Corporation   5.01.2600.2180
netui1.dll   NT LM UI Common Code - Networking classes   Microsoft Corporation   5.01.2600.2180
ntdll.dll   NT Layer -kirjasto (DLL)   Microsoft Corporation   5.01.2600.2180
ntlanman.dll   Microsoft® Lan Manager   Microsoft Corporation   5.01.2600.2180
ntshrui.dll   Liittymälaajennus jakamista varten   Microsoft Corporation   5.01.2600.2180
odbc32.dll   Microsoft Data Access - ODBC Driver Manager   Microsoft Corporation   3.525.1117.0000
odbcint.dll   Microsoft Data Access - ODBC-resurssit   Microsoft Corporation   3.525.1117.0000
ole32.dll   Microsoft OLE Windowsia varten   Microsoft Corporation   5.01.2600.2726
oleaut32.dll      Microsoft Corporation   5.01.2600.2180
powrprof.dll   Power Profile Helper DLL   Microsoft Corporation   6.00.2900.2180
rasadhlp.dll   Remote Access AutoDial Helper   Microsoft Corporation   5.01.2600.2180
rasapi32.dll   Remote Access API   Microsoft Corporation   5.01.2600.2180
rasman.dll   Remote Access Connection Manager   Microsoft Corporation   5.01.2600.2180
rpcrt4.dll   Remote Procedure Call Runtime   Microsoft Corporation   5.01.2600.2180
rsaenh.dll   Microsoft Enhanced Cryptographic Provider   Microsoft Corporation   5.01.2600.2161
rtutils.dll   Routing Utilities   Microsoft Corporation   5.01.2600.2180
samlib.dll   SAM Library DLL   Microsoft Corporation   5.01.2600.2180
secur32.dll   Security Support Provider Interface   Microsoft Corporation   5.01.2600.2180
sensapi.dll   SENS Connectivity API DLL   Microsoft Corporation   5.01.2600.2180
setupapi.dll   Windows Setup API   Microsoft Corporation   5.01.2600.2180
shdocvw.dll   Shell Doc -objekti ja Control-kirjasto   Microsoft Corporation   6.00.2900.2805
shell32.dll   Windows-käyttöliittymän yleinen DLL   Microsoft Corporation   6.00.2900.2763
shellhook.dll         1.00.0000.0001
shimeng.dll   Shim Engine DLL   Microsoft Corporation   5.01.2600.2180
shlwapi.dll   Shell Light-weight Utility Library   Microsoft Corporation   6.00.2900.2781
sortkey.nls         
sorttbls.nls         
stobject.dll   Systray shell -palvelun objekti   Microsoft Corporation   5.01.2600.2180
sxs.dll   Fusion 2.5   Microsoft Corporation   5.01.2600.2180
tapi32.dll   Microsoft® Windows(TM) puhelin-API-liittymän asiakas-DLL   Microsoft Corporation   5.01.2600.2180
themeui.dll   Windows Theme API   Microsoft Corporation   6.00.2900.2180
unicode.nls         
urlmon.dll   OLE32-laajennukset Win32:ta varten   Microsoft Corporation   6.00.2900.2790
user32.dll   Windows XP USER API Client DLL   Microsoft Corporation   5.01.2600.2622
userenv.dll   Userenv   Microsoft Corporation   5.01.2600.2180
uxtheme.dll   Microsoft UxTheme Library   Microsoft Corporation   6.00.2900.2180
wdmaud.drv   WDM Audio driver mapper   Microsoft Corporation   5.01.2600.2180
webcheck.dll   Web-sivuston valvonta   Microsoft Corporation   6.00.2900.2180
version.dll   Version Checking and File Installation Libraries   Microsoft Corporation   5.01.2600.2180
wiatwain.dll         
wininet.dll   Internet-laajennus Win32:ta varten   Microsoft Corporation   6.00.2900.2781
winmm.dll   MCI API DLL   Microsoft Corporation   5.01.2600.2180
winsta.dll   Winstation Library   Microsoft Corporation   5.01.2600.2180
wintrust.dll   Microsoft Trust Verification APIt   Microsoft Corporation   5.131.2600.2180
wldap32.dll   Win32 Ldap API dll   Microsoft Corporation   5.01.2600.2180
wmpshell.dll   Windows Media Playerin käynnistin   Microsoft Corporation   10.00.0000.3646
ws2_32.dll   Windows Socket 2.0 32-Bit DLL   Microsoft Corporation   5.01.2600.2180
ws2help.dll   Windows NT:n Windows Socket 2.0 Helper   Microsoft Corporation   5.01.2600.2180
wshtcpip.dll   Windows Sockets Helper DLL   Microsoft Corporation   5.01.2600.2180
wsock32.dll   Windows Socketin 32-bittinen DLL-tiedosto   Microsoft Corporation   5.01.2600.2180
wtsapi32.dll   Windows Terminal Server SDK APIs   Microsoft Corporation   5.01.2600.2180
xpsp2res.dll   Service Pack 2 -viestit   Microsoft Corporation   5.01.2600.2180

atk(expertti)/burnout kirjoitti:

Process   PID   CPU   Description   Company Name
System Idle Process   0   85.59      
Interrupts   n/a      Hardware Interrupts   
DPCs   n/a      Deferred Procedure Calls   
System   4   0.90      
smss.exe   428      Windows NT:n istunnonhallinta   Microsoft Corporation
csrss.exe   476      Client Server Runtime Process   Microsoft Corporation
winlogon.exe   500      Windows NT -kirjaus   Microsoft Corporation
services.exe   544   0.90   Palvelu- ja ohjainohjelma   Microsoft Corporation
svchost.exe   712   0.90   Generic Host Process for Win32 Services   Microsoft Corporation
svchost.exe   796      Generic Host Process for Win32 Services   Microsoft Corporation
svchost.exe   848      Generic Host Process for Win32 Services   Microsoft Corporation
svchost.exe   936      Generic Host Process for Win32 Services   Microsoft Corporation
svchost.exe   1008      Generic Host Process for Win32 Services   Microsoft Corporation
spoolsv.exe   1296      Spooler SubSystem App   Microsoft Corporation
avgamsvr.exe   1708      AVG Alert Manager   GRISOFT, s.r.o.
avgupsvc.exe   1752      AVG Update Service   GRISOFT, s.r.o.
ewidoctrl.exe   1808      ewido control   ewido networks
kpf4ss.exe   1892      Kerio Personal Firewall 4 - Service   Kerio Technologies
kpf4gui.exe   248      Kerio Personal Firewall 4 - GUI   Kerio Technologies
kpf4gui.exe   656      Kerio Personal Firewall 4 - GUI   Kerio Technologies
nvsvc32.exe   1964      NVIDIA Driver Helper Service, Version 81.95   NVIDIA Corporation
wdfmgr.exe   2016      Windows User Mode Driver Manager   Microsoft Corporation
alg.exe   1468      Application Layer Gateway Service   Microsoft Corporation
lsass.exe   556      LSA Shell (Export Version)   Microsoft Corporation
Explorer.EXE   1156   1.80   Resurssienhallinta   Microsoft Corporation
avgcc.exe   1476      AVG Control Center   GRISOFT, s.r.o.
avgemc.exe   1484      AVG E-Mail Scanner   GRISOFT, s.r.o.
jusched.exe   1492      Java(TM) 2 Platform Standard Edition binary   Sun Microsystems, Inc.
ctfmon.exe   1532      CTF Loader   Microsoft Corporation
msmsgs.exe   1540      Windows Messenger   Microsoft Corporation
Rambooster.exe   1548      RamBooster   J.Pajula
Opera.exe   3084      Opera Internet Browser   Opera Software
NOTEPAD.EXE   2568      Notepad   Microsoft Corporation
Explorer.EXE   3308      Resurssienhallinta   Microsoft Corporation
procexp.exe   3388   9.01   Sysinternals Process Explorer   Sysinternals

Process: Explorer.EXE Pid: 1156

Name   Description   Company Name   Version
AcGenral.dll   Windows Compatibility DLL   Microsoft Corporation   5.01.2600.2180
advapi32.dll   Windows 32 -pohjainen lisä-API   Microsoft Corporation   5.01.2600.2180
apphelp.dll   Application Compatibility Client Library   Microsoft Corporation   5.01.2600.2180
atl.dll   ATL Module for Windows XP (Unicode)   Microsoft Corporation   3.05.2284.0000
batmeter.dll   Battery Meter Helper -kirjasto (DLL)   Microsoft Corporation   6.00.2900.2180
browseui.dll   Liittymäselaimen käyttöliittymäkirjasto   Microsoft Corporation   6.00.2900.2802
clbcatq.dll      Microsoft Corporation   2001.12.4414.0308
comctl32.dll   User Experience Controls Library   Microsoft Corporation   6.00.2900.2180
comctl32.dll   Common Controls Library   Microsoft Corporation   5.82.2900.2180
comdlg32.dll   Yleisten valintaikkunoiden dll-tiedosto   Microsoft Corporation   6.00.2900.2180
comres.dll      Microsoft Corporation   2001.12.4414.0258
credui.dll   Credential Manager User Interface   Microsoft Corporation   5.01.2600.2180
crypt32.dll   Crypto API32   Microsoft Corporation   5.131.2600.2180
cryptui.dll   Microsoft Luottamusliittymän tarjoaja   Microsoft Corporation   5.131.2600.2180
cscdll.dll   Offline-verkkoagentti   Microsoft Corporation   5.01.2600.2180
cscui.dll   Asiakkaan puskurointiliittymä   Microsoft Corporation   5.01.2600.2180
ctype.nls         
davclnt.dll   Web DAV Client DLL   Microsoft Corporation   5.01.2600.2180
dnsapi.dll   DNS Client API DLL   Microsoft Corporation   5.01.2600.2180
drprov.dll   Microsoft Terminal Server Network Provider   Microsoft Corporation   5.01.2600.2180
explorer.exe   Resurssienhallinta   Microsoft Corporation   6.00.2900.2180
gdi32.dll   GDI Client DLL   Microsoft Corporation   5.01.2600.2818
hnetcfg.dll   Home Networking Configuration Manager   Microsoft Corporation   5.01.2600.2180
imagehlp.dll   Windows NT Image Helper   Microsoft Corporation   5.01.2600.2180
index.dat         
index.dat         
index.dat         
index.dat         
iphlpapi.dll   IP Helper API   Microsoft Corporation   5.01.2600.2180
kernel32.dll   Windows NT BASE APIn asiakas-DLL   Microsoft Corporation   5.01.2600.2180
linkinfo.dll   Windows Volume Tracking   Microsoft Corporation   5.01.2600.2751
locale.nls         
midimap.dll   Microsoft MIDI-kartoitin   Microsoft Corporation   5.01.2600.2180
mpr.dll   Monipalvelureititin-DLL   Microsoft Corporation   5.01.2600.2180
msacm32.dll   Microsoft ACM Audio Filter   Microsoft Corporation   5.01.2600.2180
msacm32.drv   Microsoft Sound Mapper   Microsoft Corporation   5.01.2600.0000
msasn1.dll   ASN.1 Runtime APIs   Microsoft Corporation   5.01.2600.2180
msctf.dll   MSCTF Server DLL   Microsoft Corporation   5.01.2600.2180
msgina.dll   Windows NT -kirjaus GINA DLL   Microsoft Corporation   5.01.2600.2180
msi.dll   Windows Installer   Microsoft Corporation   3.01.4000.2435
msimg32.dll   GDIEXT Client DLL   Microsoft Corporation   5.01.2600.2180
msutb.dll   MSUTB Server DLL   Microsoft Corporation   5.01.2600.2180
msv1_0.dll   Microsoft Authentication Package v1.0   Microsoft Corporation   5.01.2600.2180
msvcr71.dll   Microsoft® C Runtime Library   Microsoft Corporation   7.10.3052.0004
msvcrt.dll   Windows NT CRT DLL   Microsoft Corporation   7.00.2600.2180
mswsock.dll   Microsoft Windows Sockets 2.0 -palveluntarjoaja   Microsoft Corporation   5.01.2600.2180
netapi32.dll   Net Win32 API DLL   Microsoft Corporation   5.01.2600.2180
netrap.dll   Net Remote Admin Protocol DLL   Microsoft Corporation   5.01.2600.2180
netshell.dll   Network Connections Shell   Microsoft Corporation   5.01.2600.2180
netui0.dll   NT LM UI Common Code - GUI-luokat   Microsoft Corporation   5.01.2600.2180
netui1.dll   NT LM UI Common Code - Networking classes   Microsoft Corporation   5.01.2600.2180
ntdll.dll   NT Layer -kirjasto (DLL)   Microsoft Corporation   5.01.2600.2180
ntlanman.dll   Microsoft® Lan Manager   Microsoft Corporation   5.01.2600.2180
ntshrui.dll   Liittymälaajennus jakamista varten   Microsoft Corporation   5.01.2600.2180
odbc32.dll   Microsoft Data Access - ODBC Driver Manager   Microsoft Corporation   3.525.1117.0000
odbcint.dll   Microsoft Data Access - ODBC-resurssit   Microsoft Corporation   3.525.1117.0000
ole32.dll   Microsoft OLE Windowsia varten   Microsoft Corporation   5.01.2600.2726
oleaut32.dll      Microsoft Corporation   5.01.2600.2180
powrprof.dll   Power Profile Helper DLL   Microsoft Corporation   6.00.2900.2180
rasadhlp.dll   Remote Access AutoDial Helper   Microsoft Corporation   5.01.2600.2180
rasapi32.dll   Remote Access API   Microsoft Corporation   5.01.2600.2180
rasman.dll   Remote Access Connection Manager   Microsoft Corporation   5.01.2600.2180
rpcrt4.dll   Remote Procedure Call Runtime   Microsoft Corporation   5.01.2600.2180
rsaenh.dll   Microsoft Enhanced Cryptographic Provider   Microsoft Corporation   5.01.2600.2161
rtutils.dll   Routing Utilities   Microsoft Corporation   5.01.2600.2180
samlib.dll   SAM Library DLL   Microsoft Corporation   5.01.2600.2180
secur32.dll   Security Support Provider Interface   Microsoft Corporation   5.01.2600.2180
sensapi.dll   SENS Connectivity API DLL   Microsoft Corporation   5.01.2600.2180
setupapi.dll   Windows Setup API   Microsoft Corporation   5.01.2600.2180
shdocvw.dll   Shell Doc -objekti ja Control-kirjasto   Microsoft Corporation   6.00.2900.2805
shell32.dll   Windows-käyttöliittymän yleinen DLL   Microsoft Corporation   6.00.2900.2763
shellhook.dll         1.00.0000.0001
shimeng.dll   Shim Engine DLL   Microsoft Corporation   5.01.2600.2180
shlwapi.dll   Shell Light-weight Utility Library   Microsoft Corporation   6.00.2900.2781
sortkey.nls         
sorttbls.nls         
stobject.dll   Systray shell -palvelun objekti   Microsoft Corporation   5.01.2600.2180
sxs.dll   Fusion 2.5   Microsoft Corporation   5.01.2600.2180
tapi32.dll   Microsoft® Windows(TM) puhelin-API-liittymän asiakas-DLL   Microsoft Corporation   5.01.2600.2180
themeui.dll   Windows Theme API   Microsoft Corporation   6.00.2900.2180
unicode.nls         
urlmon.dll   OLE32-laajennukset Win32:ta varten   Microsoft Corporation   6.00.2900.2790
user32.dll   Windows XP USER API Client DLL   Microsoft Corporation   5.01.2600.2622
userenv.dll   Userenv   Microsoft Corporation   5.01.2600.2180
uxtheme.dll   Microsoft UxTheme Library   Microsoft Corporation   6.00.2900.2180
wdmaud.drv   WDM Audio driver mapper   Microsoft Corporation   5.01.2600.2180
webcheck.dll   Web-sivuston valvonta   Microsoft Corporation   6.00.2900.2180
version.dll   Version Checking and File Installation Libraries   Microsoft Corporation   5.01.2600.2180
wiatwain.dll         
wininet.dll   Internet-laajennus Win32:ta varten   Microsoft Corporation   6.00.2900.2781
winmm.dll   MCI API DLL   Microsoft Corporation   5.01.2600.2180
winsta.dll   Winstation Library   Microsoft Corporation   5.01.2600.2180
wintrust.dll   Microsoft Trust Verification APIt   Microsoft Corporation   5.131.2600.2180
wldap32.dll   Win32 Ldap API dll   Microsoft Corporation   5.01.2600.2180
wmpshell.dll   Windows Media Playerin käynnistin   Microsoft Corporation   10.00.0000.3646
ws2_32.dll   Windows Socket 2.0 32-Bit DLL   Microsoft Corporation   5.01.2600.2180
ws2help.dll   Windows NT:n Windows Socket 2.0 Helper   Microsoft Corporation   5.01.2600.2180
wshtcpip.dll   Windows Sockets Helper DLL   Microsoft Corporation   5.01.2600.2180
wsock32.dll   Windows Socketin 32-bittinen DLL-tiedosto   Microsoft Corporation   5.01.2600.2180
wtsapi32.dll   Windows Terminal Server SDK APIs   Microsoft Corporation   5.01.2600.2180
xpsp2res.dll   Service Pack 2 -viestit   Microsoft Corporation   5.01.2600.2180

Klikkaa HjT:ssä
Open the MiscTools section > Delete a file on reboot

Sitten kopioi tuo rivi

C:\windows\system32\wiatwain.dll

Liitä se sinne kenttään ja aukase se sinne ja vastaa myöntävästi ja käynnistä kone uudestaan. Ja kerro onko vielä ongelmia.

Fixaaja kirjoitti:

Klikkaa HjT:ssä
Open the MiscTools section > Delete a file on reboot

Sitten kopioi tuo rivi

C:\windows\system32\wiatwain.dll

Liitä se sinne kenttään ja aukase se sinne ja vastaa myöntävästi ja käynnistä kone uudestaan. Ja kerro onko vielä ongelmia.

Junalauta!! Se toimii! Tuhannet kiitokset avusta! Luulen, että ilman näitä foorumeita ja ilman Sinun apuasi olisin todennäköisesti joutunut asentamaan XP:n uusiksi! :)

atk(Ex)pertti kirjoitti:

Junalauta!! Se toimii! Tuhannet kiitokset avusta! Luulen, että ilman näitä foorumeita ja ilman Sinun apuasi olisin todennäköisesti joutunut asentamaan XP:n uusiksi! :)

Hitto, 9 tuntia meni tämän viruksen kanssa. 9 tuntia!!

Kyllä se on sillä tavalla, että nykyään koodaaja pitää tätä maailmaa pystyssä! Hullua!

Kiitokset vielä kerran! :)

atk(Ex)pertti kirjoitti:

Junalauta!! Se toimii! Tuhannet kiitokset avusta! Luulen, että ilman näitä foorumeita ja ilman Sinun apuasi olisin todennäköisesti joutunut asentamaan XP:n uusiksi! :)

Ole hyvä :) Tuo on spyaxen uusi variantti eli siksi smitrem ei vielä osannut poistaa sitä ja piti vähän "säätää".