HJT logi

terve... ei oo miestä näkynny pitkiin aikoihin.

Juu kirjoitti:

terve... ei oo miestä näkynny pitkiin aikoihin.

Joo, pakkaa olla noita töitä viikolla iltaan asti ja harrastuksia viikonloppuisin. Olen kyllä seuraillut teidän menestyksekästä örkintorjuntaa aina kun olen ehtinyt.

smitfiles- loki oli hiukan vaajaan näköinen, mutta kyllä tuon mukaan örkin piti saada lähtö.

Poista lisää/poista sovelluksen kautta tuo jos löytyy:

webHancer

Ruksaa hijackista noi:

O2 - BHO: HomepageBHO - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\system32\hp68CC.tmp
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll (file missing)

Sammuta muut ohjelmat ja paina fix checked

Käynnistä kone vikasietotilaan ja etsi ja poista tuo tiedosto:
C:\WINDOWS\system32\mssearchnet.exe

juggis kirjoitti:

smitfiles- loki oli hiukan vaajaan näköinen, mutta kyllä tuon mukaan örkin piti saada lähtö.

Poista lisää/poista sovelluksen kautta tuo jos löytyy:

webHancer

Ruksaa hijackista noi:

O2 - BHO: HomepageBHO - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\system32\hp68CC.tmp
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll (file missing)

Sammuta muut ohjelmat ja paina fix checked

Käynnistä kone vikasietotilaan ja etsi ja poista tuo tiedosto:
C:\WINDOWS\system32\mssearchnet.exe

Lue lisää

Kiitoksia vaan tähän astisista neuvoista!

mssearchnet ei suostu poitumaan, kun kone ilmoittaa, että ei voida poistaa, kun voi olla joittenkin ohjelmien käytössä.

Jaska4 kirjoitti:

Kiitoksia vaan tähän astisista neuvoista!

mssearchnet ei suostu poitumaan, kun kone ilmoittaa, että ei voida poistaa, kun voi olla joittenkin ohjelmien käytössä.

Lue lisää

Koitas ajaa smitrem uudestaan kun se edellinen logi oli vajaa ja mssearchnet olisi pitänyt poistua jo sillä. Laita uudet logit vielä sen jälkeen.

juggis kirjoitti:

Koitas ajaa smitrem uudestaan kun se edellinen logi oli vajaa ja mssearchnet olisi pitänyt poistua jo sillä. Laita uudet logit vielä sen jälkeen.

Tehtävienhallinta näyttää, että mssearchnet ohjelma on käynnissä.

Tämä siirsin roskakoriin
MSSEARCHNET.EXE-36109133

Mutta system32:ssa on vielä yksi mssearschnet, joka ei siirry.



smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [versio 5.1.2600]

Running from
C:\Documents and Settings\Henry\Ty”p”yt„\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~

SpywareStrike


~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

replmap.dll
1024 dir
msvol.tlb
ld****.tmp
mssearchnet.exe
ncompat.tlb
nvctrl.exe
mscornet.exe
hp***.tmp


~~~ Icons in System32 ~~~

ts.ico
ot.ico


~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1360 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Logfile of HijackThis v1.99.1
Scan saved at 21:30:47, on 8.2.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvctrl.exe
C:\WINDOWS\system32\mssearchnet.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\mo09\firefox.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Documents and Settings\Henry\Työpöytä\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fin.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://google/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: HomepageBHO - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\system32\hp63DA.tmp
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - Startup: Mozilla Firefox.lnk = C:\Program Files\mo09\firefox.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fin.htm
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

Jaska4 kirjoitti:

Tehtävienhallinta näyttää, että mssearchnet ohjelma on käynnissä.

Tämä siirsin roskakoriin
MSSEARCHNET.EXE-36109133

Mutta system32:ssa on vielä yksi mssearschnet, joka ei siirry.



smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [versio 5.1.2600]

Running from
C:\Documents and Settings\Henry\Ty”p”yt„\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~

SpywareStrike


~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

replmap.dll
1024 dir
msvol.tlb
ld****.tmp
mssearchnet.exe
ncompat.tlb
nvctrl.exe
mscornet.exe
hp***.tmp


~~~ Icons in System32 ~~~

ts.ico
ot.ico


~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1360 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Logfile of HijackThis v1.99.1
Scan saved at 21:30:47, on 8.2.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvctrl.exe
C:\WINDOWS\system32\mssearchnet.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\mo09\firefox.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Documents and Settings\Henry\Työpöytä\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fin.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://google/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: HomepageBHO - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\system32\hp63DA.tmp
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - Startup: Mozilla Firefox.lnk = C:\Program Files\mo09\firefox.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fin.htm
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

Lue lisää

Smitrem-logi on vieläkin vajaa.

Lataa killbox:

http://www.downloads.subratam.org/KillBox.exe

Asenna ne koneelle.

Käynnistä Killbox.
Laita merkki ympyrään "delete on reboot"

kopioi seuraavat rivit:

C:\WINDOWS\system32\nvctrl.exe
C:\WINDOWS\system32\mssearchnet.exe

Sitten KillBoxissa ylhäältä File > Paste from Clipboard.
Nyt pitäisi kaikki rivit näkyä KillBoxissa.

Paina nappia hiirellä joka on punainen ja siinä valkoinen ruksi.
Vastaa "yes" Kysymyksiin .
Sammuta ja käynnistä kone, jos se ei sitä tehnyt.
Käynnistä kone suoraan vikasietotilaan ja aja smithrem.


Käynistä normaalisti ja uudet smitrem ja hijack logit.

juggis kirjoitti:

Smitrem-logi on vieläkin vajaa.

Lataa killbox:

http://www.downloads.subratam.org/KillBox.exe

Asenna ne koneelle.

Käynnistä Killbox.
Laita merkki ympyrään "delete on reboot"

kopioi seuraavat rivit:

C:\WINDOWS\system32\nvctrl.exe
C:\WINDOWS\system32\mssearchnet.exe

Sitten KillBoxissa ylhäältä File > Paste from Clipboard.
Nyt pitäisi kaikki rivit näkyä KillBoxissa.

Paina nappia hiirellä joka on punainen ja siinä valkoinen ruksi.
Vastaa "yes" Kysymyksiin .
Sammuta ja käynnistä kone, jos se ei sitä tehnyt.
Käynnistä kone suoraan vikasietotilaan ja aja smithrem.


Käynistä normaalisti ja uudet smitrem ja hijack logit.

Lue lisää

Kohta pitää luovuttaa tai pitää luova tauko...:-) Suuret kiitokset vaan avusta!


smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [versio 5.1.2600]

Running from
C:\Documents and Settings\Henry\Ty”p”yt„\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~

SpywareStrike


~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

replmap.dll
1024 dir
msvol.tlb
ld****.tmp
mssearchnet.exe
ncompat.tlb
mscornet.exe
hp***.tmp


~~~ Icons in System32 ~~~

ts.ico
ot.ico


~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1340 'explorer.exe'
Killing PID 1340 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Logfile of HijackThis v1.99.1
Scan saved at 22:00:27, on 8.2.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\imapi.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\mssearchnet.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\mo09\firefox.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Documents and Settings\Henry\Työpöytä\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fin.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://google/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - Startup: Mozilla Firefox.lnk = C:\Program Files\mo09\firefox.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fin.htm
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

Jaska4 kirjoitti:

Kohta pitää luovuttaa tai pitää luova tauko...:-) Suuret kiitokset vaan avusta!


smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [versio 5.1.2600]

Running from
C:\Documents and Settings\Henry\Ty”p”yt„\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~

SpywareStrike


~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

replmap.dll
1024 dir
msvol.tlb
ld****.tmp
mssearchnet.exe
ncompat.tlb
mscornet.exe
hp***.tmp


~~~ Icons in System32 ~~~

ts.ico
ot.ico


~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1340 'explorer.exe'
Killing PID 1340 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Logfile of HijackThis v1.99.1
Scan saved at 22:00:27, on 8.2.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\imapi.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\mssearchnet.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\mo09\firefox.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Documents and Settings\Henry\Työpöytä\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fin.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://google/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - Startup: Mozilla Firefox.lnk = C:\Program Files\mo09\firefox.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fin.htm
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

Lue lisää

onko smitrem ajettu vikasietotilassa, jos ei niin aja

Jaska4 kirjoitti:

Kohta pitää luovuttaa tai pitää luova tauko...:-) Suuret kiitokset vaan avusta!


smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [versio 5.1.2600]

Running from
C:\Documents and Settings\Henry\Ty”p”yt„\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~

SpywareStrike


~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

replmap.dll
1024 dir
msvol.tlb
ld****.tmp
mssearchnet.exe
ncompat.tlb
mscornet.exe
hp***.tmp


~~~ Icons in System32 ~~~

ts.ico
ot.ico


~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1340 'explorer.exe'
Killing PID 1340 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Logfile of HijackThis v1.99.1
Scan saved at 22:00:27, on 8.2.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\imapi.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\mssearchnet.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\mo09\firefox.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Documents and Settings\Henry\Työpöytä\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fin.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://google/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - Startup: Mozilla Firefox.lnk = C:\Program Files\mo09\firefox.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fin.htm
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

Lue lisää

Nyt näyttää jo paremmalta, Mutta toi on täällä vieläkin : C:\WINDOWS\system32\mssearchnet.exe



Ruksaa ja fixaa toi:

O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"

Käynnistä kone vika sietotilaan ja koita poistaa tuo:

C:\WINDOWS\system32\mssearchnet.exe

juggis kirjoitti:

Nyt näyttää jo paremmalta, Mutta toi on täällä vieläkin : C:\WINDOWS\system32\mssearchnet.exe



Ruksaa ja fixaa toi:

O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"

Käynnistä kone vika sietotilaan ja koita poistaa tuo:

C:\WINDOWS\system32\mssearchnet.exe

Lue lisää

En oikein tuota vikasietotilaa ymmärrä, kun painan käynnistyksen yhteydessä F8, niin tulee kolme vaihtoehtoa, eli miten haluat boottauksen käynnistyvän.

Tässä kuitenkin yksi listaus lisää


PID   CPU   Description   Company Name
0   88.57      
n/a      Hardware Interrupts   
n/a      Deferred Procedure Calls   
4         
420      Windows NT:n istunnonhallinta   Microsoft Corporation
476   1.43   Client Server Runtime Process   Microsoft Corporation
500      Windows NT -kirjaus   Microsoft Corporation
544   1.43   Palvelu- ja ohjainohjelma   Microsoft Corporation
704      Generic Host Process for Win32 Services   Microsoft Corporation
188      HP OfficeJet COM Event Manager   Hewlett-Packard Co.
2444      HP OfficeJet Status   Hewlett-Packard Co.
752      Generic Host Process for Win32 Services   Microsoft Corporation
816      Generic Host Process for Win32 Services   Microsoft Corporation
1732      Windows Security Center Notification App   Microsoft Corporation
876      Generic Host Process for Win32 Services   Microsoft Corporation
936      Generic Host Process for Win32 Services   Microsoft Corporation
1132      Spooler SubSystem App   Microsoft Corporation
1312      Generic Host Process for Win32 Services   Microsoft Corporation
1356      Windows User Mode Driver Manager   Microsoft Corporation
1408      Virtual CD v4.3 SDK - Security Service   H H Software GmbH
1708      PML Driver   HP
1800      Application Layer Gateway Service   Microsoft Corporation
556      LSA Shell (Export Version)   Microsoft Corporation
3100         
1808   1.43   Resurssienhallinta   Microsoft Corporation

Process: explorer.exe Pid: 1808

Name   Description   Company Name   Version
acgenral.dll   Windows Compatibility DLL   Microsoft Corporation   5.01.2600.2180
actxprxy.dll   ActiveX Interface Marshaling Library   Microsoft Corporation   6.00.2900.2180
advapi32.dll   Windows 32 -pohjainen lisä-API   Microsoft Corporation   5.01.2600.2180
apphelp.dll   Application Compatibility Client Library   Microsoft Corporation   5.01.2600.2180
atl.dll   ATL Module for Windows XP (Unicode)   Microsoft Corporation   3.05.2284.0000
batmeter.dll   Battery Meter Helper -kirjasto (DLL)   Microsoft Corporation   6.00.2900.2180
browselc.dll   Liittymäselaimen käyttöliittymäkirjasto   Microsoft Corporation   6.00.2900.2180
browseui.dll   Liittymäselaimen käyttöliittymäkirjasto   Microsoft Corporation   6.00.2900.2802
clbcatq.dll      Microsoft Corporation   2001.12.4414.0258
comctl32.dll   User Experience Controls Library   Microsoft Corporation   6.00.2900.2180
comctl32.dll   Common Controls Library   Microsoft Corporation   5.82.2900.2180
comdlg32.dll   Yleisten valintaikkunoiden dll-tiedosto   Microsoft Corporation   6.00.2900.2180
comres.dll      Microsoft Corporation   2001.12.4414.0258
credui.dll   Credential Manager User Interface   Microsoft Corporation   5.01.2600.2180
crypt32.dll   Crypto API32   Microsoft Corporation   5.131.2600.2180
cryptui.dll   Microsoft Luottamusliittymän tarjoaja   Microsoft Corporation   5.131.2600.2180
cscdll.dll   Offline-verkkoagentti   Microsoft Corporation   5.01.2600.2180
cscui.dll   Asiakkaan puskurointiliittymä   Microsoft Corporation   5.01.2600.2180
ctype.nls         
davclnt.dll   Web DAV Client DLL   Microsoft Corporation   5.01.2600.2180
dnsapi.dll   DNS Client API DLL   Microsoft Corporation   5.01.2600.2180
drprov.dll   Microsoft Terminal Server Network Provider   Microsoft Corporation   5.01.2600.2180
explorer.exe   Resurssienhallinta   Microsoft Corporation   6.00.2900.2180
gdi32.dll   GDI Client DLL   Microsoft Corporation   5.01.2600.2818
imagehlp.dll   Windows NT Image Helper   Microsoft Corporation   5.01.2600.2180
index.dat         
index.dat         
index.dat         
iphlpapi.dll   IP Helper API   Microsoft Corporation   5.01.2600.2180
jscript.dll   Microsoft (r) JScript   Microsoft Corporation   5.06.0000.8820
kernel32.dll   Windows NT BASE APIn asiakas-DLL   Microsoft Corporation   5.01.2600.2180
linkinfo.dll   Windows Volume Tracking   Microsoft Corporation   5.01.2600.2180
locale.nls         
lpk.dll   Language Pack   Microsoft Corporation   5.01.2600.2180
midimap.dll   Microsoft MIDI-kartoitin   Microsoft Corporation   5.01.2600.2180
mlang.dll   Multi Language Support DLL   Microsoft Corporation   6.00.2900.2180
mpr.dll   Monipalvelureititin-DLL   Microsoft Corporation   5.01.2600.2180
msacm32.dll   Microsoft ACM Audio Filter   Microsoft Corporation   5.01.2600.2180
msacm32.drv   Microsoft Sound Mapper   Microsoft Corporation   5.01.2600.0000
msasn1.dll   ASN.1 Runtime APIs   Microsoft Corporation   5.01.2600.2180
mscoree.dll   Microsoft .NET Runtime Execution Engine   Microsoft Corporation   1.01.4322.0573
msgina.dll   Windows NT -kirjaus GINA DLL   Microsoft Corporation   5.01.2600.2180
msi.dll   Windows Installer   Microsoft Corporation   3.01.4000.2435
msimg32.dll   GDIEXT Client DLL   Microsoft Corporation   5.01.2600.2180
mstask.dll   Tehtävien ajoituksen liittymä-DLL   Microsoft Corporation   5.01.2600.2180
msvcr71.dll   Microsoft® C Runtime Library   Microsoft Corporation   7.10.3052.0004
msvcrt.dll   Windows NT CRT DLL   Microsoft Corporation   7.00.2600.2180
msxml3.dll   MSXML 3.0 SP 5   Microsoft Corporation   8.50.2162.0000
msxml3r.dll   XML Resources   Microsoft Corporation   8.20.8730.0001
netapi32.dll   Net Win32 API DLL   Microsoft Corporation   5.01.2600.2180
netrap.dll   Net Remote Admin Protocol DLL   Microsoft Corporation   5.01.2600.2180
netshell.dll   Network Connections Shell   Microsoft Corporation   5.01.2600.2180
netui0.dll   NT LM UI Common Code - GUI-luokat   Microsoft Corporation   5.01.2600.2180
netui1.dll   NT LM UI Common Code - Networking classes   Microsoft Corporation   5.01.2600.2180
ntdll.dll   NT Layer -kirjasto (DLL)   Microsoft Corporation   5.01.2600.2180
ntdsapi.dll   NT5DS   Microsoft Corporation   5.01.2600.2180
ntlanman.dll   Microsoft® Lan Manager   Microsoft Corporation   5.01.2600.2180
ntshrui.dll   Liittymälaajennus jakamista varten   Microsoft Corporation   5.01.2600.2180
odbc32.dll   Microsoft Data Access - ODBC Driver Manager   Microsoft Corporation   3.525.1117.0000
odbcint.dll   Microsoft Data Access - ODBC-resurssit   Microsoft Corporation   3.525.1117.0000
ole32.dll   Microsoft OLE Windowsia varten   Microsoft Corporation   5.01.2600.2665
oleaut32.dll      Microsoft Corporation   5.01.2600.2180
pdfshell.dll   PDF Shell Extension   Adobe Systems, Inc.   7.00.0000.0000
powrprof.dll   Power Profile Helper DLL   Microsoft Corporation   6.00.2900.2180
R00000000000c.clb         
rpcrt4.dll   Remote Procedure Call Runtime   Microsoft Corporation   5.01.2600.2180
rsaenh.dll   Microsoft Enhanced Cryptographic Provider   Microsoft Corporation   5.01.2600.2161
rtutils.dll   Routing Utilities   Microsoft Corporation   5.01.2600.2180
samlib.dll   SAM Library DLL   Microsoft Corporation   5.01.2600.2180
secur32.dll   Security Support Provider Interface   Microsoft Corporation   5.01.2600.2180
setupapi.dll   Windows Setup API   Microsoft Corporation   5.01.2600.2180
sfc_os.dll   Windows-tiedostonsuojaus   Microsoft Corporation   5.01.2600.2180
shdocvw.dll   Shell Doc -objekti ja Control-kirjasto   Microsoft Corporation   6.00.2900.2805
shell32.dll   Windows-käyttöliittymän yleinen DLL   Microsoft Corporation   6.00.2900.2620
shfusion.dll   Microsoft COM Runtime Fusion Assembly Viewer   Microsoft Corporation   1.01.4322.0573
shimeng.dll   Shim Engine DLL   Microsoft Corporation   5.01.2600.2180
shlwapi.dll   Shell Light-weight Utility Library   Microsoft Corporation   6.00.2900.2781
sortkey.nls         
sorttbls.nls         
stobject.dll   Systray shell -palvelun objekti   Microsoft Corporation   5.01.2600.2180
sxs.dll   Fusion 2.5   Microsoft Corporation   5.01.2600.2180
themeui.dll   Windows Theme API   Microsoft Corporation   6.00.2900.2180
unicode.nls         
urlmon.dll   OLE32-laajennukset Win32:ta varten   Microsoft Corporation   6.00.2900.2790
user32.dll   Windows XP USER API Client DLL   Microsoft Corporation   5.01.2600.2622
userenv.dll   Userenv   Microsoft Corporation   5.01.2600.2180
usp10.dll   Uniscribe Unicode script processor   Microsoft Corporation   1.420.2600.2180
uxtheme.dll   Microsoft UxTheme Library   Microsoft Corporation   6.00.2900.2180
wdmaud.drv   WDM Audio driver mapper   Microsoft Corporation   5.01.2600.2180
webcheck.dll   Web-sivuston valvonta   Microsoft Corporation   6.00.2900.2180
version.dll   Version Checking and File Installation Libraries   Microsoft Corporation   5.01.2600.2180
winhttp.dll   Windows HTTP Services   Microsoft Corporation   5.01.2600.2180
wininet.dll   Internet-laajennus Win32:ta varten   Microsoft Corporation   6.00.2900.2781
winmm.dll   MCI API DLL   Microsoft Corporation   5.01.2600.2180
winsta.dll   Winstation Library   Microsoft Corporation   5.01.2600.2180
wintrust.dll   Microsoft Trust Verification APIt   Microsoft Corporation   5.131.2600.2180
wldap32.dll   Win32 Ldap API dll   Microsoft Corporation   5.01.2600.2180
ws2_32.dll   Windows Socket 2.0 32-Bit DLL   Microsoft Corporation   5.01.2600.2180
ws2help.dll   Windows NT:n Windows Socket 2.0 Helper   Microsoft Corporation   5.01.2600.2180
wsock32.dll   Windows Socketin 32-bittinen DLL-tiedosto   Microsoft Corporation   5.01.2600.2180
wtsapi32.dll   Windows Terminal Server SDK APIs   Microsoft Corporation   5.01.2600.2180
wuapi.dll   Windows Update Client API   Microsoft Corporation   5.08.0000.2469
xpsp2res.dll   Service Pack 2 -viestit   Microsoft Corporation   5.01.2600.2180
zipfldr.dll   Pakatut kansiot   Microsoft Corporation   6.00.2900.2180

Jaska4 kirjoitti:

En oikein tuota vikasietotilaa ymmärrä, kun painan käynnistyksen yhteydessä F8, niin tulee kolme vaihtoehtoa, eli miten haluat boottauksen käynnistyvän.

Tässä kuitenkin yksi listaus lisää


PID   CPU   Description   Company Name
0   88.57      
n/a      Hardware Interrupts   
n/a      Deferred Procedure Calls   
4         
420      Windows NT:n istunnonhallinta   Microsoft Corporation
476   1.43   Client Server Runtime Process   Microsoft Corporation
500      Windows NT -kirjaus   Microsoft Corporation
544   1.43   Palvelu- ja ohjainohjelma   Microsoft Corporation
704      Generic Host Process for Win32 Services   Microsoft Corporation
188      HP OfficeJet COM Event Manager   Hewlett-Packard Co.
2444      HP OfficeJet Status   Hewlett-Packard Co.
752      Generic Host Process for Win32 Services   Microsoft Corporation
816      Generic Host Process for Win32 Services   Microsoft Corporation
1732      Windows Security Center Notification App   Microsoft Corporation
876      Generic Host Process for Win32 Services   Microsoft Corporation
936      Generic Host Process for Win32 Services   Microsoft Corporation
1132      Spooler SubSystem App   Microsoft Corporation
1312      Generic Host Process for Win32 Services   Microsoft Corporation
1356      Windows User Mode Driver Manager   Microsoft Corporation
1408      Virtual CD v4.3 SDK - Security Service   H H Software GmbH
1708      PML Driver   HP
1800      Application Layer Gateway Service   Microsoft Corporation
556      LSA Shell (Export Version)   Microsoft Corporation
3100         
1808   1.43   Resurssienhallinta   Microsoft Corporation

Process: explorer.exe Pid: 1808

Name   Description   Company Name   Version
acgenral.dll   Windows Compatibility DLL   Microsoft Corporation   5.01.2600.2180
actxprxy.dll   ActiveX Interface Marshaling Library   Microsoft Corporation   6.00.2900.2180
advapi32.dll   Windows 32 -pohjainen lisä-API   Microsoft Corporation   5.01.2600.2180
apphelp.dll   Application Compatibility Client Library   Microsoft Corporation   5.01.2600.2180
atl.dll   ATL Module for Windows XP (Unicode)   Microsoft Corporation   3.05.2284.0000
batmeter.dll   Battery Meter Helper -kirjasto (DLL)   Microsoft Corporation   6.00.2900.2180
browselc.dll   Liittymäselaimen käyttöliittymäkirjasto   Microsoft Corporation   6.00.2900.2180
browseui.dll   Liittymäselaimen käyttöliittymäkirjasto   Microsoft Corporation   6.00.2900.2802
clbcatq.dll      Microsoft Corporation   2001.12.4414.0258
comctl32.dll   User Experience Controls Library   Microsoft Corporation   6.00.2900.2180
comctl32.dll   Common Controls Library   Microsoft Corporation   5.82.2900.2180
comdlg32.dll   Yleisten valintaikkunoiden dll-tiedosto   Microsoft Corporation   6.00.2900.2180
comres.dll      Microsoft Corporation   2001.12.4414.0258
credui.dll   Credential Manager User Interface   Microsoft Corporation   5.01.2600.2180
crypt32.dll   Crypto API32   Microsoft Corporation   5.131.2600.2180
cryptui.dll   Microsoft Luottamusliittymän tarjoaja   Microsoft Corporation   5.131.2600.2180
cscdll.dll   Offline-verkkoagentti   Microsoft Corporation   5.01.2600.2180
cscui.dll   Asiakkaan puskurointiliittymä   Microsoft Corporation   5.01.2600.2180
ctype.nls         
davclnt.dll   Web DAV Client DLL   Microsoft Corporation   5.01.2600.2180
dnsapi.dll   DNS Client API DLL   Microsoft Corporation   5.01.2600.2180
drprov.dll   Microsoft Terminal Server Network Provider   Microsoft Corporation   5.01.2600.2180
explorer.exe   Resurssienhallinta   Microsoft Corporation   6.00.2900.2180
gdi32.dll   GDI Client DLL   Microsoft Corporation   5.01.2600.2818
imagehlp.dll   Windows NT Image Helper   Microsoft Corporation   5.01.2600.2180
index.dat         
index.dat         
index.dat         
iphlpapi.dll   IP Helper API   Microsoft Corporation   5.01.2600.2180
jscript.dll   Microsoft (r) JScript   Microsoft Corporation   5.06.0000.8820
kernel32.dll   Windows NT BASE APIn asiakas-DLL   Microsoft Corporation   5.01.2600.2180
linkinfo.dll   Windows Volume Tracking   Microsoft Corporation   5.01.2600.2180
locale.nls         
lpk.dll   Language Pack   Microsoft Corporation   5.01.2600.2180
midimap.dll   Microsoft MIDI-kartoitin   Microsoft Corporation   5.01.2600.2180
mlang.dll   Multi Language Support DLL   Microsoft Corporation   6.00.2900.2180
mpr.dll   Monipalvelureititin-DLL   Microsoft Corporation   5.01.2600.2180
msacm32.dll   Microsoft ACM Audio Filter   Microsoft Corporation   5.01.2600.2180
msacm32.drv   Microsoft Sound Mapper   Microsoft Corporation   5.01.2600.0000
msasn1.dll   ASN.1 Runtime APIs   Microsoft Corporation   5.01.2600.2180
mscoree.dll   Microsoft .NET Runtime Execution Engine   Microsoft Corporation   1.01.4322.0573
msgina.dll   Windows NT -kirjaus GINA DLL   Microsoft Corporation   5.01.2600.2180
msi.dll   Windows Installer   Microsoft Corporation   3.01.4000.2435
msimg32.dll   GDIEXT Client DLL   Microsoft Corporation   5.01.2600.2180
mstask.dll   Tehtävien ajoituksen liittymä-DLL   Microsoft Corporation   5.01.2600.2180
msvcr71.dll   Microsoft® C Runtime Library   Microsoft Corporation   7.10.3052.0004
msvcrt.dll   Windows NT CRT DLL   Microsoft Corporation   7.00.2600.2180
msxml3.dll   MSXML 3.0 SP 5   Microsoft Corporation   8.50.2162.0000
msxml3r.dll   XML Resources   Microsoft Corporation   8.20.8730.0001
netapi32.dll   Net Win32 API DLL   Microsoft Corporation   5.01.2600.2180
netrap.dll   Net Remote Admin Protocol DLL   Microsoft Corporation   5.01.2600.2180
netshell.dll   Network Connections Shell   Microsoft Corporation   5.01.2600.2180
netui0.dll   NT LM UI Common Code - GUI-luokat   Microsoft Corporation   5.01.2600.2180
netui1.dll   NT LM UI Common Code - Networking classes   Microsoft Corporation   5.01.2600.2180
ntdll.dll   NT Layer -kirjasto (DLL)   Microsoft Corporation   5.01.2600.2180
ntdsapi.dll   NT5DS   Microsoft Corporation   5.01.2600.2180
ntlanman.dll   Microsoft® Lan Manager   Microsoft Corporation   5.01.2600.2180
ntshrui.dll   Liittymälaajennus jakamista varten   Microsoft Corporation   5.01.2600.2180
odbc32.dll   Microsoft Data Access - ODBC Driver Manager   Microsoft Corporation   3.525.1117.0000
odbcint.dll   Microsoft Data Access - ODBC-resurssit   Microsoft Corporation   3.525.1117.0000
ole32.dll   Microsoft OLE Windowsia varten   Microsoft Corporation   5.01.2600.2665
oleaut32.dll      Microsoft Corporation   5.01.2600.2180
pdfshell.dll   PDF Shell Extension   Adobe Systems, Inc.   7.00.0000.0000
powrprof.dll   Power Profile Helper DLL   Microsoft Corporation   6.00.2900.2180
R00000000000c.clb         
rpcrt4.dll   Remote Procedure Call Runtime   Microsoft Corporation   5.01.2600.2180
rsaenh.dll   Microsoft Enhanced Cryptographic Provider   Microsoft Corporation   5.01.2600.2161
rtutils.dll   Routing Utilities   Microsoft Corporation   5.01.2600.2180
samlib.dll   SAM Library DLL   Microsoft Corporation   5.01.2600.2180
secur32.dll   Security Support Provider Interface   Microsoft Corporation   5.01.2600.2180
setupapi.dll   Windows Setup API   Microsoft Corporation   5.01.2600.2180
sfc_os.dll   Windows-tiedostonsuojaus   Microsoft Corporation   5.01.2600.2180
shdocvw.dll   Shell Doc -objekti ja Control-kirjasto   Microsoft Corporation   6.00.2900.2805
shell32.dll   Windows-käyttöliittymän yleinen DLL   Microsoft Corporation   6.00.2900.2620
shfusion.dll   Microsoft COM Runtime Fusion Assembly Viewer   Microsoft Corporation   1.01.4322.0573
shimeng.dll   Shim Engine DLL   Microsoft Corporation   5.01.2600.2180
shlwapi.dll   Shell Light-weight Utility Library   Microsoft Corporation   6.00.2900.2781
sortkey.nls         
sorttbls.nls         
stobject.dll   Systray shell -palvelun objekti   Microsoft Corporation   5.01.2600.2180
sxs.dll   Fusion 2.5   Microsoft Corporation   5.01.2600.2180
themeui.dll   Windows Theme API   Microsoft Corporation   6.00.2900.2180
unicode.nls         
urlmon.dll   OLE32-laajennukset Win32:ta varten   Microsoft Corporation   6.00.2900.2790
user32.dll   Windows XP USER API Client DLL   Microsoft Corporation   5.01.2600.2622
userenv.dll   Userenv   Microsoft Corporation   5.01.2600.2180
usp10.dll   Uniscribe Unicode script processor   Microsoft Corporation   1.420.2600.2180
uxtheme.dll   Microsoft UxTheme Library   Microsoft Corporation   6.00.2900.2180
wdmaud.drv   WDM Audio driver mapper   Microsoft Corporation   5.01.2600.2180
webcheck.dll   Web-sivuston valvonta   Microsoft Corporation   6.00.2900.2180
version.dll   Version Checking and File Installation Libraries   Microsoft Corporation   5.01.2600.2180
winhttp.dll   Windows HTTP Services   Microsoft Corporation   5.01.2600.2180
wininet.dll   Internet-laajennus Win32:ta varten   Microsoft Corporation   6.00.2900.2781
winmm.dll   MCI API DLL   Microsoft Corporation   5.01.2600.2180
winsta.dll   Winstation Library   Microsoft Corporation   5.01.2600.2180
wintrust.dll   Microsoft Trust Verification APIt   Microsoft Corporation   5.131.2600.2180
wldap32.dll   Win32 Ldap API dll   Microsoft Corporation   5.01.2600.2180
ws2_32.dll   Windows Socket 2.0 32-Bit DLL   Microsoft Corporation   5.01.2600.2180
ws2help.dll   Windows NT:n Windows Socket 2.0 Helper   Microsoft Corporation   5.01.2600.2180
wsock32.dll   Windows Socketin 32-bittinen DLL-tiedosto   Microsoft Corporation   5.01.2600.2180
wtsapi32.dll   Windows Terminal Server SDK APIs   Microsoft Corporation   5.01.2600.2180
wuapi.dll   Windows Update Client API   Microsoft Corporation   5.08.0000.2469
xpsp2res.dll   Service Pack 2 -viestit   Microsoft Corporation   5.01.2600.2180
zipfldr.dll   Pakatut kansiot   Microsoft Corporation   6.00.2900.2180

Lue lisää

Toi logi on mielestäni ok.

Smitrem pitää ajaa vikasietotilassa, muuten se ei toimi täysin. Eli valitse valikosta "vikasietotila" (safe mode)

Käynnistä killbox.
Kopioi toi rivi sinne.

C:\WINDOWS\system32\mssearchnet.exe

Laita merkki "delete on reboot".

Paina nappia hiirellä joka on punainen ja siinä valkoinen ruksi.
Vastaa "yes" Kysymyksiin .
Sammuta ja käynnistä kone, jos se ei sitä tehnyt.
Käynnistä kone suoraan vikasietotilaan ja aja smithrem.

Käynistä normaalisti ja uudet smitrem ja hijack logit.

juggis kirjoitti:

Toi logi on mielestäni ok.

Smitrem pitää ajaa vikasietotilassa, muuten se ei toimi täysin. Eli valitse valikosta "vikasietotila" (safe mode)

Käynnistä killbox.
Kopioi toi rivi sinne.

C:\WINDOWS\system32\mssearchnet.exe

Laita merkki "delete on reboot".

Paina nappia hiirellä joka on punainen ja siinä valkoinen ruksi.
Vastaa "yes" Kysymyksiin .
Sammuta ja käynnistä kone, jos se ei sitä tehnyt.
Käynnistä kone suoraan vikasietotilaan ja aja smithrem.

Käynistä normaalisti ja uudet smitrem ja hijack logit.

Lue lisää

Tuo Killbox näyttäisi poistaneen mssearcnetin, sitä ei näy tehtävänhallinnassa enää. Pääsin muuten vasta sen käytön jälkeen tuonne vikasietotilaan, en aikaisemmin. Suuret kiitokset avusta! (pornon katselua en kuitenkaan lopeta!)



smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [versio 5.1.2600]

Running from
C:\Documents and Settings\Henry\Ty”p”yt„\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~

SpywareStrike


~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

replmap.dll
1024 dir
msvol.tlb
ld****.tmp
ncompat.tlb
mscornet.exe
hp***.tmp


~~~ Icons in System32 ~~~

ts.ico
ot.ico


~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1920 'explorer.exe'
Killing PID 1920 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Logfile of HijackThis v1.99.1
Scan saved at 8:31:30, on 9.2.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\mo09\firefox.exe
C:\Documents and Settings\Henry\Työpöytä\HijackThis.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fin.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://google/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - Startup: Mozilla Firefox.lnk = C:\Program Files\mo09\firefox.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fin.htm
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

Jaska4 kirjoitti:

Tuo Killbox näyttäisi poistaneen mssearcnetin, sitä ei näy tehtävänhallinnassa enää. Pääsin muuten vasta sen käytön jälkeen tuonne vikasietotilaan, en aikaisemmin. Suuret kiitokset avusta! (pornon katselua en kuitenkaan lopeta!)



smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [versio 5.1.2600]

Running from
C:\Documents and Settings\Henry\Ty”p”yt„\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~

SpywareStrike


~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

replmap.dll
1024 dir
msvol.tlb
ld****.tmp
ncompat.tlb
mscornet.exe
hp***.tmp


~~~ Icons in System32 ~~~

ts.ico
ot.ico


~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1920 'explorer.exe'
Killing PID 1920 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Logfile of HijackThis v1.99.1
Scan saved at 8:31:30, on 9.2.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\mo09\firefox.exe
C:\Documents and Settings\Henry\Työpöytä\HijackThis.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fin.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://google/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - Startup: Mozilla Firefox.lnk = C:\Program Files\mo09\firefox.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fin.htm
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

Lue lisää

Vieläkään täydellinen.

Jaska4 kirjoitti:

Tuo Killbox näyttäisi poistaneen mssearcnetin, sitä ei näy tehtävänhallinnassa enää. Pääsin muuten vasta sen käytön jälkeen tuonne vikasietotilaan, en aikaisemmin. Suuret kiitokset avusta! (pornon katselua en kuitenkaan lopeta!)



smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [versio 5.1.2600]

Running from
C:\Documents and Settings\Henry\Ty”p”yt„\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~

SpywareStrike


~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

replmap.dll
1024 dir
msvol.tlb
ld****.tmp
ncompat.tlb
mscornet.exe
hp***.tmp


~~~ Icons in System32 ~~~

ts.ico
ot.ico


~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1920 'explorer.exe'
Killing PID 1920 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Logfile of HijackThis v1.99.1
Scan saved at 8:31:30, on 9.2.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\mo09\firefox.exe
C:\Documents and Settings\Henry\Työpöytä\HijackThis.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fin.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://google/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - Startup: Mozilla Firefox.lnk = C:\Program Files\mo09\firefox.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fin.htm
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

Lue lisää

http://www.ewido.net/en/download/

asenna ja päivitä

tuossa olis evidon asenukseen ja scannaukseeen ohjeita
Asennuksen ja päivityksen jälkeen valitse vasemmalta scanner => Settings => tarkista,että jokaisessa kohdassa on ruksi paikallaan ja muuta kohdassa What to scan? täppi kohtaan Scan every file.Paina OK.

Tämän jälkeen vasta valitse kohta Complete System Scan ja scannaus alkaa. Jos tulee ilmoitus Infected object found! Tarkista,että kohdassa Create encrypted backup in the quarantine on ruksi ja laita ruksi itse kohtaan Perform action with all infections. Kohdassa Perform action: on oletuksena Remove. Suosittelen jättämään sen paikalleen vaikka sieltä voi myös valita None. Paina OK. Scannauksen päätyttyä voit tallentaa raportin teksti muodossa.


aja se sitten vikasietotilassa ja laita se txt tiedosto tänne.

Jaska4 kirjoitti:

Tuo Killbox näyttäisi poistaneen mssearcnetin, sitä ei näy tehtävänhallinnassa enää. Pääsin muuten vasta sen käytön jälkeen tuonne vikasietotilaan, en aikaisemmin. Suuret kiitokset avusta! (pornon katselua en kuitenkaan lopeta!)



smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [versio 5.1.2600]

Running from
C:\Documents and Settings\Henry\Ty”p”yt„\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~

SpywareStrike


~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

replmap.dll
1024 dir
msvol.tlb
ld****.tmp
ncompat.tlb
mscornet.exe
hp***.tmp


~~~ Icons in System32 ~~~

ts.ico
ot.ico


~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1920 'explorer.exe'
Killing PID 1920 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Logfile of HijackThis v1.99.1
Scan saved at 8:31:30, on 9.2.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\mo09\firefox.exe
C:\Documents and Settings\Henry\Työpöytä\HijackThis.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fin.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://google/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - Startup: Mozilla Firefox.lnk = C:\Program Files\mo09\firefox.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fin.htm
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

Lue lisää

smitrem loki oli vieläkin vajaa. Hyvä jos silti parani. Lataappas koneellesi vielä palomuuri ja virustorjunta-ohjelma. Tuolta löydät linkkejä :
http://koti.mbnet.fi/pattaya1/muut_ilmaisohjelmat.htm