en saa spyfalconia poistettua!
Logfile of HijackThis v1.99.1
Scan saved at 1:36:34, on 3.3.2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\AVGFRE~1\avgupsvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Super Ad Blocker\SABSVC.EXE
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Hercules 3DTweaker\H3dTweaker.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\NetLimiter\NetLimiter.exe
C:\Program Files\ZoneAlarm\zlclient.exe
C:\Program Files\Hercules 3DTweaker\D3D3DTwkAnim.exe
C:\PROGRA~1\AVGFRE~1\avgcc.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Super Ad Blocker\SAdBlock.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - C:\Program Files\Super Ad Blocker\SABBHO.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Super Ad Blocker Toolbar - {B4B3001E-0F56-4E51-8250-BDE11547EC55} - C:\Program Files\Super Ad Blocker\sabtb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Hercules 3DTweaker 3.0] C:\Program Files\Hercules 3DTweaker\H3dTweaker.exe -hide
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [SuperAdBlocker] C:\Program Files\Super Ad Blocker\SAdBlock.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/pestscan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140636894281
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1140638131890
O20 - Winlogon Notify: SABWinLogon - C:\Program Files\Super Ad Blocker\SABWINLO.DLL
O20 - Winlogon Notify: wincqt32 - wincqt32.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGFRE~1\avgupsvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Super Ad Blocker Service (SABSVC) - SuperAdBlocker.com - C:\Program Files\Super Ad Blocker\SABSVC.EXE
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
Logfile of HijackThis v1.99.1
Scan saved at 1:36:34, on 3.3.2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\AVGFRE~1\avgupsvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Super Ad Blocker\SABSVC.EXE
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Hercules 3DTweaker\H3dTweaker.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\NetLimiter\NetLimiter.exe
C:\Program Files\ZoneAlarm\zlclient.exe
C:\Program Files\Hercules 3DTweaker\D3D3DTwkAnim.exe
C:\PROGRA~1\AVGFRE~1\avgcc.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Super Ad Blocker\SAdBlock.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - C:\Program Files\Super Ad Blocker\SABBHO.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Super Ad Blocker Toolbar - {B4B3001E-0F56-4E51-8250-BDE11547EC55} - C:\Program Files\Super Ad Blocker\sabtb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Hercules 3DTweaker 3.0] C:\Program Files\Hercules 3DTweaker\H3dTweaker.exe -hide
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [SuperAdBlocker] C:\Program Files\Super Ad Blocker\SAdBlock.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/pestscan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140636894281
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1140638131890
O20 - Winlogon Notify: SABWinLogon - C:\Program Files\Super Ad Blocker\SABWINLO.DLL
O20 - Winlogon Notify: wincqt32 - wincqt32.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGFRE~1\avgupsvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Super Ad Blocker Service (SABSVC) - SuperAdBlocker.com - C:\Program Files\Super Ad Blocker\SABSVC.EXE
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
Vastaukset 14
Vanhimmat
* Lataa smitrem työpöydälle
http://noahdfear.geekstogo.com/click counter/click.php?id=1
Tuplaklikkaa sitä ja Start niin saat smitrem kansion työpöydälle .
* Tallenna FixSF.reg työpöydälle
http://www.bleepingcomputer.com/files/reg/FixSF.reg
Tuplaklikkaa sitä ja vastaa myöntävästi.
* Käynnistä sitten kone vikasietotilassa(F8 käynnistyksen yhteydessä).
*Avaa Hijackthis ja fixaa nämä (do a system scan only, merkkaa ja paina fix checked):
O20 - Winlogon Notify: wincqt32 - wincqt32.dll (file missing)
*Päivitä ewido, älä skannaa vielä.
* Poista ohjauspaneelista(lisää/poista sovellus)
- SpyFalcon
ja jos se käskee\vaatii käynnistään koneen uudestan älä käynnistä.
* Sitten poista:
C:\Program\SpyFalcon (voi olla että ei löydy enää)
C:\Windows\System32\dxmpp.dll
wincqt32.dll (on esim. c:\windows\system32-hakemistossa)
* Sen jälkeen avaa smitrem kansio ja tuplaklikkaa RunThis.bat ja seuraa ohjeita.
*Skannaa ewidolla, anna poistaa mitä löytää ja tallenna raportti.
*Käynnistä kone uudelleen, lähetä uusi HjT-loki, ewidon raportti ja c:\smitfiles.txt-tiedoston sisältö.
tehty mutta ei auttanut. noita ei muuten löytynyt poistettavaksi:
C:\Windows\System32\dxmpp.dll
wincqt32.dll (on esim. c:\windows\system32-hakemistossa)
pistän tähän kaikki raportit.
Logfile of HijackThis v1.99.1
Scan saved at 11:06:06, on 3.3.2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\AVGFRE~1\avgupsvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Super Ad Blocker\SABSVC.EXE
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\mobsync.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Hercules 3DTweaker\H3dTweaker.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\NetLimiter\NetLimiter.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\ZoneAlarm\zlclient.exe
C:\PROGRA~1\AVGFRE~1\avgcc.exe
C:\WINNT\system32\internat.exe
C:\PROGRA~1\ICQ\ICQ.exe
C:\Program Files\Super Ad Blocker\SAdBlock.exe
C:\Program Files\Adobe Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hercules 3DTweaker\D3D3DTwkAnim.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - C:\Program Files\Super Ad Blocker\SABBHO.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Super Ad Blocker Toolbar - {B4B3001E-0F56-4E51-8250-BDE11547EC55} - C:\Program Files\Super Ad Blocker\sabtb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Hercules 3DTweaker 3.0] C:\Program Files\Hercules 3DTweaker\H3dTweaker.exe -hide
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SpyFalcon] C:\Program Files\SpyFalcon\SpyFalcon.exe /h
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [SuperAdBlocker] C:\Program Files\Super Ad Blocker\SAdBlock.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/pestscan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140636894281
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1140638131890
O20 - Winlogon Notify: SABWinLogon - C:\Program Files\Super Ad Blocker\SABWINLO.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGFRE~1\avgupsvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Super Ad Blocker Service (SABSVC) - SuperAdBlocker.com - C:\Program Files\Super Ad Blocker\SABSVC.EXE
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 11:00:33, 3.3.2006
+ Report-Checksum: C541A259
+ Scan result:
No infected objects found.
::Report End
smitRem © log file
version 2.8
by noahdfear
Microsoft Windows 2000 [Version 5.00.2195]
The current date is: pe 03.03.2006
The current time is: 10:54:12,82
Running from
C:\Documents and Settings\Jan-Erik H„nninen\Desktop\smitrem\smitRem
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Pre-run SharedTask Export
(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com
Registry Pseudo-Format Mode (Not a valid reg file):
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D}"="Prestige Software"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D}\InProcServer32]
@="C:\WINNT\system32\ginuerep.dll"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
checking for ShudderLTD key
ShudderLTD key not present!
checking for PSGuard.com key
PSGuard.com key not present!
checking for WinHound.com key
WinHound.com key not present!
spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Existing Pre-run Files
~~~ Program Files ~~~
~~~ Shortcuts ~~~
~~~ Favorites ~~~
~~~ system32 folder ~~~
~~~ Icons in System32 ~~~
~~~ Windows directory ~~~
~~~ Drive root ~~~
~~~ Miscellaneous Files/folders ~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 580 'explorer.exe'
Starting registry repairs
Registry repairs complete
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SharedTask Export after registry fix
(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com
Registry Pseudo-Format Mode (Not a valid reg file):
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D}"="Prestige Software"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D}\InProcServer32]
@="C:\WINNT\system32\ginuerep.dll"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Deleting files
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Remaining Post-run Files
~~~ Program Files ~~~
~~~ Shortcuts ~~~
~~~ Favorites ~~~
~~~ system32 folder ~~~
~~~ Icons in System32 ~~~
~~~ Windows directory ~~~
~~~ Drive root ~~~
~~~ Miscellaneous Files/folders ~~~
~~~ Wininet.dll ~~~
CLEAN! :)
Ajoithan sen smitremin nimenomaan vikasietotilassa?
Jos, niin sitten tee näin:
Hae -> http://www.sysinternals.com/files/procexpnt.zip
Pura se omaan kansioon ja sitten avaa
Sitte ylhäältä View ja katao, että siellä on täpit näissä kohissa
Show processes from all users.
Show Lower Pane
Lower Pane View DLL's
Sitte siitä ikkunasta klikkaa Explorer.exe-kohtaa
Sitte ylhäältä File > Save As > ja säästät sen ja sitte pistä tänne se logi,niin katotaan jos siinä näky jotain.
En huomannutkaan, että sulla on windows c:\winnt-hakemistossa.
Katso, löydätkö -> C:\Winnt\System32\dxmpp.dll
Jos löydät, niin yritä tehdä uudelleen sen ekan ohjeen mukaan (niin että poistat -> C:\Winnt\System32\dxmpp.dll)
Process PID CPU Description Company Name
System Idle Process 0 98.46
Interrupts n/a Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 8
SMSS.EXE 216 Windows NT Session Manager Microsoft Corporation
CSRSS.EXE 240 Client Server Runtime Process Microsoft Corporation
WINLOGON.EXE 264 Windows NT Logon Application Microsoft Corporation
SERVICES.EXE 296 Services and Controller app Microsoft Corporation
ati2evxx.exe 424 ATI External Event Utility EXE Module ATI Technologies Inc.
svchost.exe 516 Generic Host Process for Win32 Services Microsoft Corporation
spoolsv.exe 548 Spooler SubSystem App Microsoft Corporation
avgamsvr.exe 596 AVG Alert Manager GRISOFT, s.r.o.
avgupsvc.exe 624 AVG Update Service GRISOFT, s.r.o.
svchost.exe 644 Generic Host Process for Win32 Services Microsoft Corporation
ewidoctrl.exe 664 ewido control ewido networks
ewidoguard.exe 724 guard ewido networks
regsvc.exe 764 Remote Registry Service Microsoft Corporation
mstask.exe 776 Task Scheduler Engine Microsoft Corporation
vsmon.exe 904 TrueVector Service Zone Labs, LLC
WinMgmt.exe 976 Windows Management Instrumentation Microsoft Corporation
svchost.exe 988 Generic Host Process for Win32 Services Microsoft Corporation
LSASS.EXE 308 LSA Executable and Server DLL (Export Version) Microsoft Corporation
ati2evxx.exe 1164 ATI External Event Utility EXE Module ATI Technologies Inc.
explorer.exe 1220 Windows Explorer Microsoft Corporation
CLI.exe 1304 CLI Application (Command Line Interface) ATI Technologies Inc.
CLI.exe 1784 CLI Application (Command Line Interface) ATI Technologies Inc.
CLI.exe 1792 CLI Application (Command Line Interface) ATI Technologies Inc.
H3DTweaker.exe 1316 Hercules® 3DTweaker 3.0 LE Hercules®
D3D3DTwkAnim.ex 1432
NvMixerTray.exe 1372 NVIDIA nForce Mixer Tray Application NVIDIA Corporation
daemon.exe 1412 Virtual DAEMON Manager DT Soft Ltd.
NetLimiter.exe 1384 NetLimiter LockTime
zlclient.exe 1440 Zone Labs Client Zone Labs, LLC
avgcc.exe 896 AVG Control Center GRISOFT, s.r.o.
internat.exe 1460 Keyboard Language Indicator Applet Microsoft Corporation
IEXPLORE.EXE 652 Internet Explorer Microsoft Corporation
procexp.exe 2036 1.54 Sysinternals Process Explorer Sysinternals
EM_EXEC.EXE 1380 Logitech Events Handler Application Logitech Inc.
Process: explorer.exe Pid: 1220
Name Description Company Name Version
aclayers.dll Windows 2000 Shim Accessory DLL Microsoft Corporation 5.00.2195.6717
activeds.dll ADs Router Layer DLL Microsoft Corporation 5.00.2195.6601
adsldpc.dll ADs LDAP Provider C DLL Microsoft Corporation 5.00.2195.6993
ADVAPI32.DLL Advanced Windows 32 Base API Microsoft Corporation 5.00.2195.7038
atl.dll ATL Module for Windows NT (Unicode) Microsoft Corporation 3.00.9435.0000
avifil32.dll Microsoft AVI File support library Microsoft Corporation 5.00.2195.6612
batmeter.dll Battery Meter Helper DLL Microsoft Corporation 5.00.3502.6601
browselc.dll Shell Browser UI Library Microsoft Corporation 6.00.2800.1106
BROWSEUI.DLL Shell Browser UI Library Microsoft Corporation 6.00.2800.1692
cfgmgr32.dll Configuration Manager Forwarder DLL Microsoft Corporation 5.00.2134.0001
clbcatq.dll Microsoft Corporation 2000.02.3529.0000
comctl32.dll Common Controls Library Microsoft Corporation 5.81.4916.0400
COMDLG32.DLL Common Dialogs DLL Microsoft Corporation 5.00.3700.6693
CRYPT32.DLL Crypto API32 Microsoft Corporation 5.131.2195.6926
cscdll.dll Offline Network Agent Microsoft Corporation 5.00.2195.6713
cscui.dll Client Side Caching UI Microsoft Corporation 5.00.2195.6705
ctype.nls
dnsapi.dll DNS Client API DLL Microsoft Corporation 5.00.2195.7003
docprop2.dll DocProp2 Microsoft Corporation 5.00.2178.0001
dsquery.dll Directory Service Find Microsoft Corporation 5.00.2195.6622
dsuiext.dll Directory Service Common UI Microsoft Corporation 5.00.2195.6611
explorer.exe Windows Explorer Microsoft Corporation 5.00.3700.6690
faxshell.dll Fax Tiff Data Column Provider Microsoft Corporation 5.00.2134.0001
GDI32.DLL GDI Client DLL Microsoft Corporation 5.00.2195.7073
ginuerep.dll
imgutil.dll IE plugin image decoder support DLL Microsoft Corporation 6.00.2800.1106
imm32.dll Windows 2000 IMM32 API Client DLL Microsoft Corporation 5.00.2195.6655
index.dat
index.dat
index.dat
index.dat
indicdll.dll Keyboard Language Indicator Shell Hook Extension Microsoft Corporation 5.00.2920.0000
jscript.dll Microsoft (r) JScript Microsoft Corporation 5.06.0000.8513
KERNEL32.DLL Windows NT BASE API Client DLL Microsoft Corporation 5.00.2195.7006
LGMSGHK.DLL Logitech Message Hook Library Logitech Inc. 1.01.0000.0000
LgWndHk.dll Logitech Call Window Hook Library Logitech Inc. 9.79.0025.0001
linkinfo.dll Windows Volume Tracking Microsoft Corporation 5.00.2195.7069
locale.nls
lz32.dll LZ Expand/Compress API DLL Microsoft Corporation 5.00.2195.6611
mlang.dll Multi Language Support DLL Microsoft Corporation 6.00.2800.1106
mpr.dll Multiple Provider Router DLL Microsoft Corporation 5.00.2195.6824
msacm32.dll Microsoft ACM Audio Filter Microsoft Corporation 5.00.2134.0001
msacm32.drv Microsoft Sound Mapper Microsoft Corporation 5.00.2134.0001
msasn1.dll ASN.1 Runtime APIs Microsoft Corporation 5.00.2195.6905
MSHTML.DLL Microsoft (R) HTML Viewer Microsoft Corporation 6.00.2800.1528
mshtmled.dll Microsoft (R) HTML Editing Component Microsoft Corporation 6.00.2800.1106
msi.dll Windows Installer Microsoft Corporation 3.01.4000.2435
msls31.dll Microsoft Line Services library file Microsoft Corporation 3.10.0337.0000
MSOHEV.DLL Microsoft Office 2003 component Microsoft Corporation 11.00.5510.0000
mstask.dll Task Scheduler interface DLL Microsoft Corporation 4.71.2195.6972
msvcp60.dll Microsoft (R) C Runtime Library Microsoft Corporation 6.00.8972.0000
msvcr71.dll Microsoft® C Runtime Library Microsoft Corporation 7.10.3052.0004
msvcrt.dll Microsoft (R) C Runtime Library Microsoft Corporation 6.01.9844.0000
msvfw32.dll Microsoft Video for Windows DLL Microsoft Corporation 5.00.2195.6612
msxml3.dll MSXML 3.0 SP 5 Microsoft Corporation 8.50.2162.0000
msxml3r.dll XML Resources Microsoft Corporation 8.20.8730.0001
mydocs.dll My Documents Folder UI Microsoft Corporation 5.00.3502.6601
NETAPI32.DLL Net Win32 API DLL Microsoft Corporation 5.00.2195.7038
netrap.dll Net Remote Admin Protocol DLL Microsoft Corporation 5.00.2134.0001
netshell.dll Network Connections Shell Microsoft Corporation 5.00.2195.6604
netui0.dll NT LM UI Common Code - GUI Classes Microsoft Corporation 5.00.2195.6601
netui1.dll NT LM UI Common Code - Networking classes Microsoft Corporation 5.00.2134.0001
NTDLL.DLL NT Layer DLL Microsoft Corporation 5.00.2195.7006
ntdsapi.dll NT5DS Microsoft Corporation 5.00.2195.6666
NTLANMAN.DLL Microsoft® Lan Manager Microsoft Corporation 5.00.2195.6824
ntshrui.dll Shell extensions for sharing Microsoft Corporation 5.00.2134.0001
OLE32.DLL Microsoft OLE for Windows Microsoft Corporation 5.00.2195.7059
OLEAUT32.DLL Microsoft Corporation 2.40.4522.0000
PASHLEXT.DLL PA Shell Extensions ConeXware, Inc. 8.06.0000.0000
pdfshell.dll PDF Shell Extension Adobe Systems, Inc. 7.00.0000.0000
powrprof.dll Power Profile Helper DLL Microsoft Corporation 5.00.3502.6601
query.dll Content Index Utility DLL Microsoft Corporation 5.00.2195.7016
rpcrt4.dll Remote Procedure Call Runtime Microsoft Corporation 5.00.2195.7020
samlib.dll SAM Library DLL Microsoft Corporation 5.00.2195.6944
secur32.dll Security Support Provider Interface Microsoft Corporation 5.00.2195.6695
SETUPAPI.DLL Windows Setup API Microsoft Corporation 5.00.2195.6622
shdoclc.dll Shell Doc Object and Control Library Microsoft Corporation 6.00.2800.1106
SHDOCVW.DLL Shell Doc Object and Control Library Microsoft Corporation 6.00.2800.1762
SHELL32.DLL Windows Shell Common Dll Microsoft Corporation 5.00.3900.7071
SHELL32.DLL Windows Shell Common Dll Microsoft Corporation 5.00.3900.7071
shellhook.dll 1.00.0000.0001
shim.dll Shim Engine DLL Microsoft Corporation 5.00.2195.6717
shlwapi.dll Shell Light-weight Utility Library Microsoft Corporation 6.00.2800.1740
sortkey.nls
sorttbls.nls
STDOLE2.TLB Microsoft Corporation 2.40.4522.0000
stobject.dll Systray shell service object Microsoft Corporation 5.00.2195.6601
unicode.nls
URLMON.DLL OLE32 Extensions for Win32 Microsoft Corporation 6.00.2800.1525
USER32.DLL Windows 2000 USER API Client DLL Microsoft Corporation 5.00.2195.7032
USERENV.DLL Userenv Microsoft Corporation 5.00.2195.7002
usp10.dll Uniscribe Unicode script processor Microsoft Corporation 1.325.2195.6692
wdmaud.drv WDM Audio driver mapper Microsoft Corporation 5.00.2195.6673
webcheck.dll Web Site Monitor Microsoft Corporation 6.00.2800.1106
webvw.dll Shell WebView Content & Control Library Microsoft Corporation 5.00.3900.7069
webvw.dll Shell WebView Content & Control Library Microsoft Corporation 5.00.3900.7069
version.dll Version Checking and File Installation Libraries Microsoft Corporation 5.00.2195.6623
winhttp.dll Windows HTTP Services Microsoft Corporation 5.01.2600.1557
WININET.DLL Internet Extensions for Win32 Microsoft Corporation 6.00.2800.1525
winmm.dll MCI API DLL Microsoft Corporation 5.00.2161.0001
WINSPOOL.DRV Windows Spooler Driver Microsoft Corporation 5.00.2195.6659
WLDAP32.DLL Win32 LDAP API DLL Microsoft Corporation 5.00.2195.7017
ws2_32.dll Windows Socket 2.0 32-Bit DLL Microsoft Corporation 5.00.2195.6601
ws2help.dll Windows Socket 2.0 Helper for Windows NT Microsoft Corporation 5.00.2134.0001
wsock32.dll Windows Socket 32-Bit DLL Microsoft Corporation 5.00.2195.6603
Tarkista tämä -> C:\Winnt\System32\ginuerep.dll
täällä -> http://virusscan.jotti.org ja lähetä tulokset tänne
Service load: 0% 100%
File: ginuerep.dll
Status: POSSIBLY INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) (Note: this file was only classified as malware by scanners known to generate more false positives than the average scanner. Do not consider these results definately accurate. Also, because of this, results of this scan will not be recorded in the database.)
MD5 c4b6379aae1a52b403086593289416f3
Packers detected: -
Scanner results
AntiVir Found Trojan/FakeAlert.AA
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found nothing
Taitaapi tuo dll aiheuttaa spyfalconin poisto-ongelman. On ilmeisesti uusi variantti siitä.
Tee vie tämä:
Hae täältä -> http://www.billsway.com/vbspage/ registry search tool ja tee haku "ginuerep.dll":llä. Jos antivirus herjaa, anna ajaa.
Lähetä registry searchin tulokset.
REGEDIT4
; RegSrch.vbs © Bill James
; Registry search results for string "ginuerep.dll" 3.3.2006 12:15:10
; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)
[HKEY_USERS\S-1-5-21-343818398-162531612-682003330-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"c"="C:\\WINNT\\system32\\ginuerep.dll"
[HKEY_USERS\S-1-5-21-343818398-162531612-682003330-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\dll]
"a"="C:\\WINNT\\system32\\ginuerep.dll"
[HKEY_USERS\S-1-5-21-343818398-162531612-682003330-1000\Software\Classes\CLSID\{C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D}\InProcServer32]
@="C:\\WINNT\\system32\\ginuerep.dll"
[HKEY_USERS\S-1-5-21-343818398-162531612-682003330-1000_Classes\CLSID\{C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D}\InProcServer32]
@="C:\\WINNT\\system32\\ginuerep.dll"
* Tallenna FixSF.reg työpöydälle
http://www.bleepingcomputer.com/files/reg/FixSF.reg
Tuplaklikkaa sitä ja vastaa myöntävästi.
* Avaa Hijackthis ja fixaa nämä (do a system scan only, merkkaa ja paina fix checked):
O4 - HKLM\..\Run: [SpyFalcon] C:\Program Files\SpyFalcon\SpyFalcon.exe /h
* Poista ohjauspaneelista(lisää/poista sovellus)
- SpyFalcon
ja jos se käskee\vaatii käynnistään koneen uudestaan älä käynnistä.
* Sitten poista:
C:\Program Files\==>SpyFalcon Paste from Clipboard
Valitse "All Files".Sen jälkeen paina Delete (punainen, jossa on valkonen X)
Vastaa myöntävästi kysymyksiin ja jos kone ei itestään käynnisty uudestaan,niin käynnistä se.
Lähetä sen jälkeen uus Hijack-logi.
nyt varmaan hävis spyfalcon ei ole ainakaan vielä ilmestyny. voiko noi killboxit ja kaikki muut ohjelmat poistaa koneelta?
Logfile of HijackThis v1.99.1
Scan saved at 12:37:41, on 3.3.2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\AVGFRE~1\avgupsvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Hercules 3DTweaker\H3dTweaker.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\PROGRA~1\ICQ\ICQ.exe
C:\Program Files\NetLimiter\NetLimiter.exe
C:\Program Files\ZoneAlarm\zlclient.exe
C:\PROGRA~1\AVGFRE~1\avgcc.exe
C:\Program Files\Hercules 3DTweaker\D3D3DTwkAnim.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Adobe Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telkku.com/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Hercules 3DTweaker 3.0] C:\Program Files\Hercules 3DTweaker\H3dTweaker.exe -hide
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/pestscan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140636894281
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1140638131890
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGFRE~1\avgupsvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
Hieno juttu :)
Voit poistaa
Tee vielä tämä:
Tallenna alla oleva juttu muistioon nimellä fix.reg (tallennusmuoto kaikki tiedostot) ja tuplaklikkaa sitä.
REGEDIT4
[-HKEY_USERS\S-1-5-21-343818398-162531612-682003330-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"c"="C:\\WINNT\\system32\\ginuerep.dll"
[-HKEY_USERS\S-1-5-21-343818398-162531612-682003330-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\dll]
"a"="C:\\WINNT\\system32\\ginuerep.dll"
[-HKEY_USERS\S-1-5-21-343818398-162531612-682003330-1000\Software\Classes\CLSID\{C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D}\InProcServer32]
@="C:\\WINNT\\system32\\ginuerep.dll"
[-HKEY_USERS\S-1-5-21-343818398-162531612-682003330-1000_Classes\CLSID\{C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D}\InProcServer32]
@="C:\\WINNT\\system32\\ginuerep.dll"
Putsataan sun rekisteri vielä :)
joo tein ton viel, kiitoksia oikein paljon!
Olepa hyvä :)