Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    ongelma!

    Juu eli seuraavanlaista ongelmaa on ollut jo jonkin aikaa: Noin 1-3 tunnin välein nettini katkeaa ja joudun yhdistämään uudelleen. Yhdistämisen jälkeen aukeaa internet private zone ikkuna jossa lukee italiaksi jtn :o Välillä myös ilmestyy smart link pikakuvake(kuvakkeessa liikennevalot). Olen kokeillut monia eri tapoja poistaa tätä ongelmaa, mutta mikään ei ole auttanut. Joten voisitteko te auttaa? :)

    Logfile of HijackThis v1.99.1
    Scan saved at 13:41:19, on 5.4.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Norman\bin\ZLH.EXE
    C:\ATI-CPanel\atiptaxx.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\D-Tools\daemon.exe
    C:\Program Files\Daily Weather Forecast\weather.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\Norman\Npf\BIN\NPFSVICE.EXE
    C:\Norman\bin\ZANDA.EXE
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\NORMAN\Nvc\BIN\nvcoas.exe
    C:\Norman\bin\NJEEVES.EXE
    C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\Nvc\BIN\NIP.EXE
    C:\NORMAN\Nvc\BIN\nipsvc.exe
    C:\Norman\Npf\BIN\npfmsg2.exe
    C:\WINDOWS\System32\alg.exe
    C:\Norman\Nvc\bin\cclaw.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Winamp\winamp.exe
    C:\Documents and Settings\Niki\Työpöytä\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.skymasters.biz?4289
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O1 - Hosts: 62.142.248.5 advert-web.runescape.com
    O1 - Hosts: 213.239.0.226 crackspider.com
    O1 - Hosts: 213.239.0.226 www.crackspider.com
    O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
    O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll (file missing)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: Search Bar - {0A8CE102-FA03-4612-9BEE-7FE5452F4CB1} - C:\WINDOWS\system32\srchbar.dll (file missing)
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll",run
    O4 - HKLM\..\Run: [SurfBuddy] rundll32 "C:\Program Files\SurfBuddy\sbuddy.dll",run
    O4 - HKLM\..\Run: [Daily Weather Forecast] C:\Program Files\Daily Weather Forecast\weather.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll",run
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
    O15 - Trusted Zone: www.archiviosex.net
    O15 - Trusted Zone: www.redfunny.com
    O15 - Trusted Zone: www.skymasters.biz
    O17 - HKLM\System\CCS\Services\Tcpip\..\{73E5139F-E8F9-48C5-A7CE-27903536B7D6}: NameServer = 193.210.19.19 193.210.18.18
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Filter: text/html - {F3E54A9D-B2B4-4ADF-A2F9-A46414069D50} - C:\Documents and Settings\Niki\Local Settings\Application Data\microsoft\internet explorer\V0.35.dat
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Npf\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\bin\ZANDA.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
    6364
    Äänestä

    Muut lukivat myös

    Vastaukset 6

    Vanhimmat

    Mä voin kattoo tän, vastaan kohta

    Äänestä

    Nyt tulee pitkä ohje, tallenna tai tulosta se ja noudata sitä tarkasti!

    Lataa Ewido
    http://keskustelu.afterdawn.com/thread_view.cfm/269186
    asenna ja päivitä, ei tartte skannata veilä

    Lataa Smitrem työpöydälle
    http://noahdfear.geekstogo.com/click counter/click.php?id=1
    Tuplaklikkaa sitä ja Start, niin saat smitrem kansion työpöydälle.

    Ohjauspaneelin lisää / poista sovelluksilla poista seuraavat tai näihin viittaavat:

    WebSpecials
    Daily Weather Forecast
    SurfBuddy

    Seuraavaksi sulje kaikki ikkunat, avaa HijackThis, paina do a system scan only ja merkkaa nämä:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.skymasters.biz?4289
    O1 - Hosts: 62.142.248.5 advert-web.runescape.com
    O1 - Hosts: 213.239.0.226 crackspider.com
    O1 - Hosts: 213.239.0.226 www.crackspider.com
    O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
    O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll (file missing)
    O3 - Toolbar: Search Bar - {0A8CE102-FA03-4612-9BEE-7FE5452F4CB1} - C:\WINDOWS\system32\srchbar.dll (file missing)
    O4 - HKLM\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll",run
    O4 - HKLM\..\Run: [SurfBuddy] rundll32 "C:\Program Files\SurfBuddy\sbuddy.dll",run
    O4 - HKLM\..\Run: [Daily Weather Forecast] C:\Program Files\Daily Weather Forecast\weather.exe
    O4 - HKCU\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll",run
    O15 - Trusted Zone: www.archiviosex.net
    O15 - Trusted Zone: www.redfunny.com
    O15 - Trusted Zone: www.skymasters.biz
    O18 - Filter: text/html - {F3E54A9D-B2B4-4ADF-A2F9-A46414069D50} - C:\Documents and Settings\Niki\Local Settings\Application Data\microsoft\internet explorer\V0.35.dat

    Ja paina Fix cheked

    Käynnistä kone vikasietotilassa näpyttämällä F8 käynnistyksen yhteydessä
    http://www.pchell.com/support/safemode.shtml

    Siellä avaa smitrem kansio ja tuplaklikkaa RunThis.bat ja seuraa ohjeita.

    Työkalun jälkeen laita piilotiedostot näkyville:

    * Klikkaa Käynnistä.
    * Avaa Oma Tietokone.
    * Valitse Työkalut ylämenusta ja klikkaa Kansion asetukset.
    * Valitse Näytä välilehti.
    * Piilotiedostot/kansiot kohdalla valitse Näytä piilotetut tiedostot ja kansiot.
    * Poista rasti ruudusta -> Piilota suojatut käyttöjärjestelmätiedostot
    * Klikkaa Kyllä varmistaaksesi muutokset.
    * Klikkaa OK.

    Sen jälkeen vieläkin vikasietotilassa poista seuraavat tiedostot tai kansiot mikäli löytyy:

    Tiedostot:
    C:\WINDOWS\system\->AcsProxy.lib
    C:\WINDOWS\system\->chat.dat
    C:\WINDOWS\system\->ezines.dat
    C:\WINDOWS\system\->home.dat
    C:\WINDOWS\system\->paysites.dat
    C:\WINDOWS\system\->pics.dat
    C:\WINDOWS\system\->srchbar.dll.manifest
    C:\WINDOWS\system\->videos.dat

    Yllä olevat ovat JOKO C:\WINDOWS\system TAI C:\WINDOWS\system32 kansiossa tai sitten ei missään

    C:\Documents and Settings\Niki\Local Settings\Application Data\microsoft\internet explorer\->V0.35.dat
    C:\WINDOWS\->localNRD.dll
    C:\WINDOWS\system32\->srchbar.dll

    Kansiot:
    C:\Program Files\->WebSpecials
    C:\Program Files\->SurfBuddy
    C:\Program Files\->Daily Weather Forecast

    Poistojen jälkeen laita piilotiedostot pois näkyvistä ja aja ewidolla full system scan ohjeiden mukaisesti ja tallenna sen raportti.

    Nyt voit vihdoinkin käynnistää tietokoneesi normaalisti uudelleen jotta pääsisit takaisin normaalitilaan. Normaalitilassa lähetä uusi HijackThis loki, C:\smitfiles.txt sisältö sekä ewidon raportti.

    Äänestä

    • Eli tein niinkuin käskit.
      Tässä uusi loki:

      Logfile of HijackThis v1.99.1
      Scan saved at 20:29:58, on 5.4.2006
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\ewido anti-malware\ewidoctrl.exe
      C:\Program Files\ewido anti-malware\ewidoguard.exe
      C:\WINDOWS\Explorer.EXE
      C:\Norman\Npf\BIN\NPFSVICE.EXE
      C:\Norman\bin\ZANDA.EXE
      C:\WINDOWS\system32\slserv.exe
      C:\WINDOWS\System32\snmp.exe
      C:\WINDOWS\System32\wdfmgr.exe
      C:\NORMAN\Nvc\BIN\nvcoas.exe
      C:\Norman\bin\NJEEVES.EXE
      C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      C:\NORMAN\Nvc\BIN\nipsvc.exe
      C:\WINDOWS\System32\alg.exe
      C:\WINDOWS\System32\wbem\wmiprvse.exe
      C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      C:\Norman\bin\ZLH.EXE
      C:\ATI-CPanel\atiptaxx.exe
      C:\WINDOWS\SOUNDMAN.EXE
      C:\Program Files\Winamp\winampa.exe
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\Norman\Nvc\bin\cclaw.exe
      C:\Program Files\D-Tools\daemon.exe
      C:\Norman\Npf\BIN\npfmsg2.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\Documents and Settings\Niki\Työpöytä\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.fi/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
      O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
      O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
      O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
      O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
      O17 - HKLM\System\CCS\Services\Tcpip\..\{73E5139F-E8F9-48C5-A7CE-27903536B7D6}: NameServer = 193.210.19.19 193.210.18.18
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O18 - Filter: text/html - {F3E54A9D-B2B4-4ADF-A2F9-A46414069D50} - C:\Documents and Settings\Niki\Local Settings\Application Data\microsoft\internet explorer\V0.35.dat
      O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
      O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
      O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Npf\BIN\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\bin\ZANDA.EXE
      O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe



      Tässä smitfiles:

      smitRem © log file
      version 2.8

      by noahdfear


      Microsoft Windows XP [versio 5.1.2600]

      Running from
      C:\Documents and Settings\Niki\Ty”p”yt„\smitRem

      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      Pre-run SharedTask Export

      (GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
      Copyright(C) 2006 BleepingComputer.com

      Registry Pseudo-Format Mode (Not a valid reg file):

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
      "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
      "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
      @="%SystemRoot%\System32\browseui.dll"


      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
      @="%SystemRoot%\System32\browseui.dll"


      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      checking for ShudderLTD key

      ShudderLTD key not present!

      checking for PSGuard.com key


      PSGuard.com key not present!


      checking for WinHound.com key


      WinHound.com key not present!

      spyaxe uninstaller NOT present
      Winhound uninstaller NOT present
      SpywareStrike uninstaller NOT present

      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      Existing Pre-run Files


      ~~~ Program Files ~~~



      ~~~ Shortcuts ~~~

      Install.dat


      ~~~ Favorites ~~~



      ~~~ system32 folder ~~~



      ~~~ Icons in System32 ~~~



      ~~~ Windows directory ~~~



      ~~~ Drive root ~~~

      winstall.exe

      ~~~ Miscellaneous Files/folders ~~~




      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
      Copyright(C) 2002-2003 [email protected]
      Killing PID 752 'explorer.exe'
      Killing PID 752 'explorer.exe'

      Starting registry repairs

      Registry repairs complete

      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      SharedTask Export after registry fix

      (GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
      Copyright(C) 2006 BleepingComputer.com

      Registry Pseudo-Format Mode (Not a valid reg file):

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
      "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
      "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
      @="%SystemRoot%\System32\browseui.dll"


      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
      @="%SystemRoot%\System32\browseui.dll"


      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      Deleting files

      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      Remaining Post-run Files


      ~~~ Program Files ~~~



      ~~~ Shortcuts ~~~



      ~~~ Favorites ~~~



      ~~~ system32 folder ~~~



      ~~~ Icons in System32 ~~~



      ~~~ Windows directory ~~~



      ~~~ Drive root ~~~


      ~~~ Miscellaneous Files/folders ~~~


      ~~~ Wininet.dll ~~~

      CLEAN! :)


      Ja tässä ewidon raportti:

      ---------------------------------------------------------
      ewido anti-malware - Scan report
      ---------------------------------------------------------

      + Created on:         20:25:13, 5.4.2006
      + Report-Checksum:      23071105

      + Scan result:

         HKLM\SOFTWARE\180solutions -> Adware.180Solutions : Cleaned with backup
         HKLM\SOFTWARE\Classes\ImgConv.clsImgConv -> Adware.WebRebates : Cleaned with backup
         HKLM\SOFTWARE\Classes\ImgConv.clsImgConv\Clsid -> Adware.WebRebates : Cleaned with backup
         HKLM\SOFTWARE\Classes\LocalNRDDll.LocalNRDDllObj -> Adware.BetterInternet : Cleaned with backup
         HKLM\SOFTWARE\Classes\LocalNRDDll.LocalNRDDllObj\CLSID -> Adware.BetterInternet : Cleaned with backup
         HKLM\SOFTWARE\Classes\LocalNRDDll.LocalNRDDllObj\CurVer -> Adware.BetterInternet : Cleaned with backup
         HKLM\SOFTWARE\Classes\LocalNRDDll.LocalNRDDllObj.1 -> Adware.BetterInternet : Cleaned with backup
         HKLM\SOFTWARE\Classes\WinAdCtlX.Installer -> Adware.BlazeFind : Cleaned with backup
         HKLM\SOFTWARE\Classes\WinAdCtlX.Installer\CLSID -> Adware.BlazeFind : Cleaned with backup
         HKLM\SOFTWARE\Classes\WinAdToolsX.Installer -> Adware.BlazeFind : Cleaned with backup
         HKLM\SOFTWARE\Classes\WinAdToolsX.Installer\CLSID -> Adware.BlazeFind : Cleaned with backup
         HKLM\SOFTWARE\Classes\WinStatX.Installer -> Adware.WinTaskAd : Cleaned with backup
         HKLM\SOFTWARE\Classes\WinStatX.Installer\CLSID -> Adware.WinTaskAd : Cleaned with backup
         HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup
         HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Relevancy -> Adware.SearchRelevancy : Cleaned with backup
         HKLM\SOFTWARE\SearchRelevancy -> Adware.SearchRelevancy : Cleaned with backup
         HKLM\SOFTWARE\SearchRelevancy\Update -> Adware.SearchRelevancy : Cleaned with backup
         :mozilla.15:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
         :mozilla.16:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
         :mozilla.17:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
         :mozilla.18:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
         :mozilla.19:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
         :mozilla.36:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
         :mozilla.37:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
         :mozilla.63:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
         :mozilla.64:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
         :mozilla.77:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
         :mozilla.78:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
         :mozilla.79:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
         :mozilla.80:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
         :mozilla.81:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.82:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.83:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.84:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.85:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.86:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.87:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.88:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.90:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
         :mozilla.91:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.92:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
         :mozilla.93:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
         :mozilla.95:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned with backup
         :mozilla.96:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned with backup
         :mozilla.97:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned with backup
         :mozilla.98:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned with backup
         :mozilla.100:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
         :mozilla.101:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
         :mozilla.102:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
         :mozilla.103:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
         :mozilla.104:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
         :mozilla.105:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
         :mozilla.106:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
         :mozilla.127:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
         :mozilla.128:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
         :mozilla.129:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
         :mozilla.130:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
         :mozilla.131:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
         :mozilla.146:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup
         :mozilla.147:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
         :mozilla.148:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
         :mozilla.149:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
         :mozilla.150:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
         :mozilla.151:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
         :mozilla.174:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned with backup
         :mozilla.191:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Paycounter : Cleaned with backup
         :mozilla.192:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
         :mozilla.205:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Spylog : Cleaned with backup
         :mozilla.208:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafic : Cleaned with backup
         :mozilla.210:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned with backup
         :mozilla.211:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned with backup
         :mozilla.217:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup
         :mozilla.245:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup
         C:\Documents and Settings\Niki\Cookies\[email protected][2].txt -> TrackingCookie.2o7 : Cleaned with backup
         C:\Documents and Settings\Niki\Cookies\[email protected][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
         C:\Documents and Settings\Niki\Cookies\[email protected][1].txt -> TrackingCookie.Euroclick : Cleaned with backup
         C:\Documents and Settings\Niki\Cookies\niki@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup
         C:\Documents and Settings\Niki\Cookies\[email protected][1].txt -> TrackingCookie.Masterstats : Cleaned with backup
         C:\Documents and Settings\Niki\Cookies\niki@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned with backup
         C:\Documents and Settings\Niki\Cookies\niki@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergströ[email protected][1].txt -> TrackingCookie.Falkag : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergström@adtech[2].txt -> TrackingCookie.Adtech : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergströ[email protected][1].txt -> TrackingCookie.Falkag : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergström@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergström@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergström@gator[1].txt -> TrackingCookie.Gator : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergströ[email protected][2].txt -> TrackingCookie.Itrack : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergström@targetnet[1].txt -> TrackingCookie.Targetnet : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergströ[email protected][1].txt -> TrackingCookie.Burstbeacon : Cleaned with backup
         C:\ied_s7m.cab/ied.exe -> Downloader.Mediket.c : Cleaned with backup
         C:\Program Files\SideFind -> Adware.SideFind : Cleaned with backup
         C:\Program Files\SideFind\update -> Adware.SideFind : Cleaned with backup
         C:\WINDOWS\neti.dll -> Logger.Spung.a : Cleaned without backup
         C:\WINDOWS\system32\PreInstaller_p1.exe -> Downloader.Keenval.o : Cleaned with backup
         C:\x.cab/vbsys2.dll -> Hijacker.Agent.ac : Error during cleaning


      ::Report End

      Äänestä

    • kmo kirjoitti:

      Eli tein niinkuin käskit.
      Tässä uusi loki:

      Logfile of HijackThis v1.99.1
      Scan saved at 20:29:58, on 5.4.2006
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\ewido anti-malware\ewidoctrl.exe
      C:\Program Files\ewido anti-malware\ewidoguard.exe
      C:\WINDOWS\Explorer.EXE
      C:\Norman\Npf\BIN\NPFSVICE.EXE
      C:\Norman\bin\ZANDA.EXE
      C:\WINDOWS\system32\slserv.exe
      C:\WINDOWS\System32\snmp.exe
      C:\WINDOWS\System32\wdfmgr.exe
      C:\NORMAN\Nvc\BIN\nvcoas.exe
      C:\Norman\bin\NJEEVES.EXE
      C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      C:\NORMAN\Nvc\BIN\nipsvc.exe
      C:\WINDOWS\System32\alg.exe
      C:\WINDOWS\System32\wbem\wmiprvse.exe
      C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      C:\Norman\bin\ZLH.EXE
      C:\ATI-CPanel\atiptaxx.exe
      C:\WINDOWS\SOUNDMAN.EXE
      C:\Program Files\Winamp\winampa.exe
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\Norman\Nvc\bin\cclaw.exe
      C:\Program Files\D-Tools\daemon.exe
      C:\Norman\Npf\BIN\npfmsg2.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\Documents and Settings\Niki\Työpöytä\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.fi/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
      O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
      O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
      O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
      O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
      O17 - HKLM\System\CCS\Services\Tcpip\..\{73E5139F-E8F9-48C5-A7CE-27903536B7D6}: NameServer = 193.210.19.19 193.210.18.18
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O18 - Filter: text/html - {F3E54A9D-B2B4-4ADF-A2F9-A46414069D50} - C:\Documents and Settings\Niki\Local Settings\Application Data\microsoft\internet explorer\V0.35.dat
      O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
      O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
      O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Npf\BIN\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\bin\ZANDA.EXE
      O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe



      Tässä smitfiles:

      smitRem © log file
      version 2.8

      by noahdfear


      Microsoft Windows XP [versio 5.1.2600]

      Running from
      C:\Documents and Settings\Niki\Ty”p”yt„\smitRem

      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      Pre-run SharedTask Export

      (GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
      Copyright(C) 2006 BleepingComputer.com

      Registry Pseudo-Format Mode (Not a valid reg file):

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
      "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
      "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
      @="%SystemRoot%\System32\browseui.dll"


      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
      @="%SystemRoot%\System32\browseui.dll"


      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      checking for ShudderLTD key

      ShudderLTD key not present!

      checking for PSGuard.com key


      PSGuard.com key not present!


      checking for WinHound.com key


      WinHound.com key not present!

      spyaxe uninstaller NOT present
      Winhound uninstaller NOT present
      SpywareStrike uninstaller NOT present

      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      Existing Pre-run Files


      ~~~ Program Files ~~~



      ~~~ Shortcuts ~~~

      Install.dat


      ~~~ Favorites ~~~



      ~~~ system32 folder ~~~



      ~~~ Icons in System32 ~~~



      ~~~ Windows directory ~~~



      ~~~ Drive root ~~~

      winstall.exe

      ~~~ Miscellaneous Files/folders ~~~




      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
      Copyright(C) 2002-2003 [email protected]
      Killing PID 752 'explorer.exe'
      Killing PID 752 'explorer.exe'

      Starting registry repairs

      Registry repairs complete

      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      SharedTask Export after registry fix

      (GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
      Copyright(C) 2006 BleepingComputer.com

      Registry Pseudo-Format Mode (Not a valid reg file):

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
      "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
      "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
      @="%SystemRoot%\System32\browseui.dll"


      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
      @="%SystemRoot%\System32\browseui.dll"


      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      Deleting files

      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      Remaining Post-run Files


      ~~~ Program Files ~~~



      ~~~ Shortcuts ~~~



      ~~~ Favorites ~~~



      ~~~ system32 folder ~~~



      ~~~ Icons in System32 ~~~



      ~~~ Windows directory ~~~



      ~~~ Drive root ~~~


      ~~~ Miscellaneous Files/folders ~~~


      ~~~ Wininet.dll ~~~

      CLEAN! :)


      Ja tässä ewidon raportti:

      ---------------------------------------------------------
      ewido anti-malware - Scan report
      ---------------------------------------------------------

      + Created on:         20:25:13, 5.4.2006
      + Report-Checksum:      23071105

      + Scan result:

         HKLM\SOFTWARE\180solutions -> Adware.180Solutions : Cleaned with backup
         HKLM\SOFTWARE\Classes\ImgConv.clsImgConv -> Adware.WebRebates : Cleaned with backup
         HKLM\SOFTWARE\Classes\ImgConv.clsImgConv\Clsid -> Adware.WebRebates : Cleaned with backup
         HKLM\SOFTWARE\Classes\LocalNRDDll.LocalNRDDllObj -> Adware.BetterInternet : Cleaned with backup
         HKLM\SOFTWARE\Classes\LocalNRDDll.LocalNRDDllObj\CLSID -> Adware.BetterInternet : Cleaned with backup
         HKLM\SOFTWARE\Classes\LocalNRDDll.LocalNRDDllObj\CurVer -> Adware.BetterInternet : Cleaned with backup
         HKLM\SOFTWARE\Classes\LocalNRDDll.LocalNRDDllObj.1 -> Adware.BetterInternet : Cleaned with backup
         HKLM\SOFTWARE\Classes\WinAdCtlX.Installer -> Adware.BlazeFind : Cleaned with backup
         HKLM\SOFTWARE\Classes\WinAdCtlX.Installer\CLSID -> Adware.BlazeFind : Cleaned with backup
         HKLM\SOFTWARE\Classes\WinAdToolsX.Installer -> Adware.BlazeFind : Cleaned with backup
         HKLM\SOFTWARE\Classes\WinAdToolsX.Installer\CLSID -> Adware.BlazeFind : Cleaned with backup
         HKLM\SOFTWARE\Classes\WinStatX.Installer -> Adware.WinTaskAd : Cleaned with backup
         HKLM\SOFTWARE\Classes\WinStatX.Installer\CLSID -> Adware.WinTaskAd : Cleaned with backup
         HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup
         HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Relevancy -> Adware.SearchRelevancy : Cleaned with backup
         HKLM\SOFTWARE\SearchRelevancy -> Adware.SearchRelevancy : Cleaned with backup
         HKLM\SOFTWARE\SearchRelevancy\Update -> Adware.SearchRelevancy : Cleaned with backup
         :mozilla.15:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
         :mozilla.16:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
         :mozilla.17:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
         :mozilla.18:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
         :mozilla.19:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
         :mozilla.36:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
         :mozilla.37:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
         :mozilla.63:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
         :mozilla.64:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
         :mozilla.77:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
         :mozilla.78:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
         :mozilla.79:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
         :mozilla.80:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
         :mozilla.81:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.82:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.83:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.84:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.85:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.86:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.87:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.88:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.90:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
         :mozilla.91:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
         :mozilla.92:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
         :mozilla.93:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
         :mozilla.95:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned with backup
         :mozilla.96:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned with backup
         :mozilla.97:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned with backup
         :mozilla.98:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned with backup
         :mozilla.100:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
         :mozilla.101:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
         :mozilla.102:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
         :mozilla.103:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
         :mozilla.104:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
         :mozilla.105:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
         :mozilla.106:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
         :mozilla.127:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
         :mozilla.128:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
         :mozilla.129:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
         :mozilla.130:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
         :mozilla.131:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
         :mozilla.146:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup
         :mozilla.147:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
         :mozilla.148:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
         :mozilla.149:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
         :mozilla.150:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
         :mozilla.151:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
         :mozilla.174:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned with backup
         :mozilla.191:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Paycounter : Cleaned with backup
         :mozilla.192:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
         :mozilla.205:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Spylog : Cleaned with backup
         :mozilla.208:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Trafic : Cleaned with backup
         :mozilla.210:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned with backup
         :mozilla.211:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned with backup
         :mozilla.217:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup
         :mozilla.245:C:\Documents and Settings\Niki\Application Data\Mozilla\Firefox\Profiles\9sni9x5s.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup
         C:\Documents and Settings\Niki\Cookies\[email protected][2].txt -> TrackingCookie.2o7 : Cleaned with backup
         C:\Documents and Settings\Niki\Cookies\[email protected][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
         C:\Documents and Settings\Niki\Cookies\[email protected][1].txt -> TrackingCookie.Euroclick : Cleaned with backup
         C:\Documents and Settings\Niki\Cookies\niki@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup
         C:\Documents and Settings\Niki\Cookies\[email protected][1].txt -> TrackingCookie.Masterstats : Cleaned with backup
         C:\Documents and Settings\Niki\Cookies\niki@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned with backup
         C:\Documents and Settings\Niki\Cookies\niki@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergströ[email protected][1].txt -> TrackingCookie.Falkag : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergström@adtech[2].txt -> TrackingCookie.Adtech : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergströ[email protected][1].txt -> TrackingCookie.Falkag : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergström@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergström@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergström@gator[1].txt -> TrackingCookie.Gator : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergströ[email protected][2].txt -> TrackingCookie.Itrack : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergström@targetnet[1].txt -> TrackingCookie.Targetnet : Cleaned with backup
         C:\Documents and Settings\Niki Bergström\Cookies\niki bergströ[email protected][1].txt -> TrackingCookie.Burstbeacon : Cleaned with backup
         C:\ied_s7m.cab/ied.exe -> Downloader.Mediket.c : Cleaned with backup
         C:\Program Files\SideFind -> Adware.SideFind : Cleaned with backup
         C:\Program Files\SideFind\update -> Adware.SideFind : Cleaned with backup
         C:\WINDOWS\neti.dll -> Logger.Spung.a : Cleaned without backup
         C:\WINDOWS\system32\PreInstaller_p1.exe -> Downloader.Keenval.o : Cleaned with backup
         C:\x.cab/vbsys2.dll -> Hijacker.Agent.ac : Error during cleaning


      ::Report End

      Se meni aika hyvin.
      Fiksaa vielä Hjt:llä tämä:
      O18 - Filter: text/html - {F3E54A9D-B2B4-4ADF-A2F9-A46414069D50} - C:\Documents and Settings\Niki\Local Settings\Application Data\microsoft\internet explorer\V0.35.dat

      Poista myös nämä (vikasietotilassa ja piilotiedostot näkyvillä jos ei muuten lähde)
      C:\->x.cab>>>V0.35.dat

      Äänestä

    • Jurppis kirjoitti:

      Se meni aika hyvin.
      Fiksaa vielä Hjt:llä tämä:
      O18 - Filter: text/html - {F3E54A9D-B2B4-4ADF-A2F9-A46414069D50} - C:\Documents and Settings\Niki\Local Settings\Application Data\microsoft\internet explorer\V0.35.dat

      Poista myös nämä (vikasietotilassa ja piilotiedostot näkyvillä jos ei muuten lähde)
      C:\->x.cab>>>V0.35.dat

      Eli näillä näkymin taisi temppusi auttaa ongelmaan. Kiitos siitä :) On se hyvä kun jotkut ihmiset vielä viitsivät auttaa pulaan joutunutta. Ilmoittelen mikäli ongelma palaa.
      -kiitos

      Äänestä

    • kmo kirjoitti:

      Eli näillä näkymin taisi temppusi auttaa ongelmaan. Kiitos siitä :) On se hyvä kun jotkut ihmiset vielä viitsivät auttaa pulaan joutunutta. Ilmoittelen mikäli ongelma palaa.
      -kiitos

      Hienoa että toimii taas, ilmottele tosiaan jos tulee vielä jotain ongelmia :)

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    kmo kirjoitti:

    Juu eli seuraavanlaista ongelmaa on ollut jo jonkin aikaa: Noin 1-3 tunnin välein nettini katkeaa ja joudun yhdistämään uudelleen. Yhdistämisen jälkeen aukeaa internet private zone ikkuna jossa lukee italiaksi jtn :o Välillä myös ilmestyy smart link pikakuvake(kuvakkeessa liikennevalot). Olen kokeillut monia eri tapoja poistaa tätä ongelmaa, mutta mikään ei ole auttanut. Joten voisitteko te auttaa? :)

    Logfile of HijackThis v1.99.1
    Scan saved at 13:41:19, on 5.4.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Norman\bin\ZLH.EXE
    C:\ATI-CPanel\atiptaxx.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\D-Tools\daemon.exe
    C:\Program Files\Daily Weather Forecast\weather.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\Norman\Npf\BIN\NPFSVICE.EXE
    C:\Norman\bin\ZANDA.EXE
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\NORMAN\Nvc\BIN\nvcoas.exe
    C:\Norman\bin\NJEEVES.EXE
    C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\Nvc\BIN\NIP.EXE
    C:\NORMAN\Nvc\BIN\nipsvc.exe
    C:\Norman\Npf\BIN\npfmsg2.exe
    C:\WINDOWS\System32\alg.exe
    C:\Norman\Nvc\bin\cclaw.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Winamp\winamp.exe
    C:\Documents and Settings\Niki\Työpöytä\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.skymasters.biz?4289
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O1 - Hosts: 62.142.248.5 advert-web.runescape.com
    O1 - Hosts: 213.239.0.226 crackspider.com
    O1 - Hosts: 213.239.0.226 www.crackspider.com
    O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
    O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll (file missing)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: Search Bar - {0A8CE102-FA03-4612-9BEE-7FE5452F4CB1} - C:\WINDOWS\system32\srchbar.dll (file missing)
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll",run
    O4 - HKLM\..\Run: [SurfBuddy] rundll32 "C:\Program Files\SurfBuddy\sbuddy.dll",run
    O4 - HKLM\..\Run: [Daily Weather Forecast] C:\Program Files\Daily Weather Forecast\weather.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll",run
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
    O15 - Trusted Zone: www.archiviosex.net
    O15 - Trusted Zone: www.redfunny.com
    O15 - Trusted Zone: www.skymasters.biz
    O17 - HKLM\System\CCS\Services\Tcpip\..\{73E5139F-E8F9-48C5-A7CE-27903536B7D6}: NameServer = 193.210.19.19 193.210.18.18
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Filter: text/html - {F3E54A9D-B2B4-4ADF-A2F9-A46414069D50} - C:\Documents and Settings\Niki\Local Settings\Application Data\microsoft\internet explorer\V0.35.dat
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Npf\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\bin\ZANDA.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu