Taustakuva kadoksissa

newuser

2006-05-19 23:29:08

Taustakuva katosi ja tilalle tuli valkoinen html-sivu. Välillä myös selain siirtyy "väärille" sivuille. Ei taida kaikki olla kunnossa?
Voisiko joku ystävällisesti vilkaista oheista logia?

Logfile of HijackThis v1.99.1
Scan saved at 11:10:51 PM, on 5/19/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\keyhook.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\koti\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yle.fi/uutiset/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google-haku - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Käännä englanninkielinen sana - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Linkit taaksepäin - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Samankaltaisia sivuja - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Välimuistissa oleva kuvakaappaus sivusta - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{06904226-2DDE-4C6D-9E55-DC6A702DD9F4}: NameServer = 85.255.114.54,85.255.112.26
O17 - HKLM\System\CCS\Services\Tcpip\..\{EADB2BFB-743E-4000-93DB-F9BE6EED5603}: NameServer = 85.255.114.54,85.255.112.26
O17 - HKLM\System\CS1\Services\Tcpip\..\{06904226-2DDE-4C6D-9E55-DC6A702DD9F4}: NameServer = 85.255.114.54,85.255.112.26
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

187

Äänestä

Vastaukset

Fixaaja
2006-05-20 11:53:18
Ja sen kylkiäisenä Raze varmaankin.

Fixaa nämä (do a system scan only, merkkaa ja paina fix checked):

O1 - Hosts: localhost 127.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{06904226-2DDE-4C6D-9E55-DC6A702DD9F4}: NameServer = 85.255.114.54,85.255.112.26
O17 - HKLM\System\CCS\Services\Tcpip\..\{EADB2BFB-743E-4000-93DB-F9BE6EED5603}: NameServer = 85.255.114.54,85.255.112.26
O17 - HKLM\System\CS1\Services\Tcpip\..\{06904226-2DDE-4C6D-9E55-DC6A702DD9F4}: NameServer = 85.255.114.54,85.255.112.26

Hae fixwareout -> http://downloads.subratam.org/Fixwareout.exe
Tallenna johonkin hakemistoon ja käynnistä se. Seuraa ohjeita, käynnistä kone uudestaan kun fixi pyytää sitä.

Hae,asenna ja päivitä ewido -> http://keskustelu.afterdawn.com/thread_view.cfm/269186

Käynnistä vikasietotilaan (F8 käynnistyksen yhteydessä)

Skannaa ewidolla, anna poistaa mitä löytää ja tallenna raportti.

Käynnistä uudelleen ja lähetä ewidon raportti, uusi HjT-loki ja C:\fixwareout\report.txt-tiedoston sisältö tänne.
- newuser
  2006-05-21 18:10:19
  Paljon kiitoksia ohjeista. Näkyvät ongelmat ainakin katosivat. Tässä vielä logit.
  
  Logfile of HijackThis v1.99.1
  Scan saved at 5:10:10 PM, on 5/21/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Acer\eManager\anbmServ.exe
  C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
  C:\Program Files\ewido anti-malware\ewidoctrl.exe
  C:\Program Files\ewido anti-malware\ewidoguard.exe
  C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
  C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
  C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
  C:\Program Files\F-Secure\Common\FSMA32.EXE
  C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
  C:\Program Files\F-Secure\Common\FSMB32.EXE
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\F-Secure\Common\FCH32.EXE
  C:\Program Files\F-Secure\Common\FAMEH32.EXE
  C:\Program Files\F-Secure\Common\FNRB32.EXE
  C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
  C:\Program Files\F-Secure\Common\FIH32.EXE
  C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\AGRSMMSG.exe
  C:\WINDOWS\system32\Rundll32.exe
  C:\WINDOWS\system32\keyhook.exe
  C:\Program Files\Arcade\PCMService.exe
  C:\Program Files\Launch Manager\QtZgAcer.EXE
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\F-Secure\Common\FSM32.EXE
  C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
  C:\Program Files\Microsoft IntelliPoint\point32.exe
  C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
  C:\Program Files\Winamp\winampa.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\acer\eRecovery\Monitor.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Documents and Settings\koti\Desktop\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O4 - HKLM\..\Run: [LaunchApp] Alaunch
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
  O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
  O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
  O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
  O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
  O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
  O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O8 - Extra context menu item: &Google-haku - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: &Käännä englanninkielinen sana - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
  O8 - Extra context menu item: Linkit taaksepäin - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Samankaltaisia sivuja - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Välimuistissa oleva kuvakaappaus sivusta - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
  O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
  O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
  O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
  O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
  O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
  O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
  O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  
  ---------------------------------
  
  Fixwareout ver 1.003
  Last edited 04/26/2006
  Post this report in the forums please
  
  Reg Entries that were deleted
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\repiwoh
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ypszr
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\daolnwodi
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\putesprpgd
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\lavinraCputeS
  ...
  
  Microsoft (R) Windows Script Host Version 5.6
  Random Runs removed from HKLM
  ...
  
  PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
  Example ipsec6.exe is lagitamate
  
  »»»»» Search by size and names...
  C:\WINDOWS\SYSTEM32\IPSEC6.EXE
  
  »»»»» Misc files
  
  »»»»» Checking for older varients covered by the Rem3 tool
  
  »»»»»
  Search five digit cs, dm and jb files
  This WILL/CAN also list Legit Files, Submit them at Virustotal
  
  --------------------------------------------------------
  ewido anti-malware - Scan report
  ---------------------------------------------------------
  
  Created on:         5:04:01 PM, 5/21/2006
  Report-Checksum:      6AFFDFA2
  
  Scan result:
  
     C:\WINDOWS\system32\howiper.0xe -> Trojan.Small.gq : Cleaned with backup
     C:\WINDOWS\system32\rzspy.exe -> Adware.Raze : Cleaned with backup
     C:\WINDOWS\system32\IDOWNLOAD.0XE -> Downloader.Small.buy : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\koti@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\[email protected][2].txt -> TrackingCookie.2o7 : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\koti@adtech[2].txt -> TrackingCookie.Adtech : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\koti@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\koti@paypopup[1].txt -> TrackingCookie.Paypopup : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\koti@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\koti@com[1].txt -> TrackingCookie.Com : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\admin2@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\admin2@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\admin2@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\admin2@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\[email protected][2].txt -> TrackingCookie.Falkag : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\admin2@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\admin2@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\admin2@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup
     C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP235\A0036730.0XE -> Downloader.Small.buy : Cleaned with backup
     C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP235\A0036744.exe -> Trojan.Small.gq : Cleaned with backup
     C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP235\A0036785.dll -> Adware.Altnet : Cleaned with backup
     C:\Recycled\Dc59.exe -> Adware.Casino : Cleaned with backup
  
  ::Report End
- Fixaaja
  2006-05-21 18:51:50
  newuser kirjoitti:
  Paljon kiitoksia ohjeista. Näkyvät ongelmat ainakin katosivat. Tässä vielä logit.
  
  Logfile of HijackThis v1.99.1
  Scan saved at 5:10:10 PM, on 5/21/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Acer\eManager\anbmServ.exe
  C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
  C:\Program Files\ewido anti-malware\ewidoctrl.exe
  C:\Program Files\ewido anti-malware\ewidoguard.exe
  C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
  C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
  C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
  C:\Program Files\F-Secure\Common\FSMA32.EXE
  C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
  C:\Program Files\F-Secure\Common\FSMB32.EXE
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\F-Secure\Common\FCH32.EXE
  C:\Program Files\F-Secure\Common\FAMEH32.EXE
  C:\Program Files\F-Secure\Common\FNRB32.EXE
  C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
  C:\Program Files\F-Secure\Common\FIH32.EXE
  C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\AGRSMMSG.exe
  C:\WINDOWS\system32\Rundll32.exe
  C:\WINDOWS\system32\keyhook.exe
  C:\Program Files\Arcade\PCMService.exe
  C:\Program Files\Launch Manager\QtZgAcer.EXE
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\F-Secure\Common\FSM32.EXE
  C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
  C:\Program Files\Microsoft IntelliPoint\point32.exe
  C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
  C:\Program Files\Winamp\winampa.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\acer\eRecovery\Monitor.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Documents and Settings\koti\Desktop\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O4 - HKLM\..\Run: [LaunchApp] Alaunch
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
  O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
  O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
  O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
  O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
  O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
  O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O8 - Extra context menu item: &Google-haku - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: &Käännä englanninkielinen sana - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
  O8 - Extra context menu item: Linkit taaksepäin - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Samankaltaisia sivuja - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Välimuistissa oleva kuvakaappaus sivusta - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
  O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
  O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
  O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
  O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
  O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
  O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
  O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  
  ---------------------------------
  
  Fixwareout ver 1.003
  Last edited 04/26/2006
  Post this report in the forums please
  
  Reg Entries that were deleted
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\repiwoh
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ypszr
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\daolnwodi
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\putesprpgd
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\lavinraCputeS
  ...
  
  Microsoft (R) Windows Script Host Version 5.6
  Random Runs removed from HKLM
  ...
  
  PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
  Example ipsec6.exe is lagitamate
  
  »»»»» Search by size and names...
  C:\WINDOWS\SYSTEM32\IPSEC6.EXE
  
  »»»»» Misc files
  
  »»»»» Checking for older varients covered by the Rem3 tool
  
  »»»»»
  Search five digit cs, dm and jb files
  This WILL/CAN also list Legit Files, Submit them at Virustotal
  
  --------------------------------------------------------
  ewido anti-malware - Scan report
  ---------------------------------------------------------
  
  Created on:         5:04:01 PM, 5/21/2006
  Report-Checksum:      6AFFDFA2
  
  Scan result:
  
     C:\WINDOWS\system32\howiper.0xe -> Trojan.Small.gq : Cleaned with backup
     C:\WINDOWS\system32\rzspy.exe -> Adware.Raze : Cleaned with backup
     C:\WINDOWS\system32\IDOWNLOAD.0XE -> Downloader.Small.buy : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\koti@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\[email protected][2].txt -> TrackingCookie.2o7 : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\koti@adtech[2].txt -> TrackingCookie.Adtech : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\koti@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\koti@paypopup[1].txt -> TrackingCookie.Paypopup : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\koti@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup
     C:\Documents and Settings\koti\Cookies\koti@com[1].txt -> TrackingCookie.Com : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\admin2@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\admin2@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\admin2@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\admin2@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\[email protected][2].txt -> TrackingCookie.Falkag : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\admin2@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\admin2@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
     C:\Documents and Settings\admin2\Cookies\admin2@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup
     C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP235\A0036730.0XE -> Downloader.Small.buy : Cleaned with backup
     C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP235\A0036744.exe -> Trojan.Small.gq : Cleaned with backup
     C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP235\A0036785.dll -> Adware.Altnet : Cleaned with backup
     C:\Recycled\Dc59.exe -> Adware.Casino : Cleaned with backup
  
  ::Report End
  Puhdasta tuli :)

Ketjusta on poistettu 0 sääntöjenvastaista viestiä.

Takaisin ylös

Luetuimmat keskustelut

Näin Enter-napilla tehdään miljardi euroa - Helsingissä
"Ei se nyt niin kovin ihmeelliseltä näytä. Tavallinen nappi, musta muovinpala, joka kököttää parikymppiä maksavan mustan
26.02.2026 18:09Maailman menoa
20
18844
Minulla ei ole ketään muita
Enkä halua ketään muita kuin sinut.
26.02.2026 02:35Ikävä
69
5805
4,5 promillee
Aika rajut lukemat joku eilen puhaltanut.
26.02.2026 13:34Suomussalmi
24
5377
Perussuomalaiset kirjoittaa vain positiivisista uutisista
Ei tarvitse palstaa paljon seurata, kun sen huomaa. Joka ainoa positiivinen uutinen Suomen taloudesta tai ylipäätään, ni
27.02.2026 13:07Maailman menoa
41
5271
Jätä minut rauhaan
En pidä sinusta. Lopeta seuraaminen. Älä tulkitse keskustelutaitoa tai ystävällisyyttä miksikään sellaiseksi mitä ne eiv
26.02.2026 08:44Ikävä
38
5114
Ben Z: "SDP ei ole ollut 50 vuoteen näin huolissaan velasta"
"– Olen ollut eduskunnassa noin 50 vuotta, eikä SDP ole koskaan ollut niin huolissaan velasta kuin nyt. Se on tietysti h
26.02.2026 18:04Maailman menoa
83
5020
Harmittaako sinua yhtään?
Tuntuuko pahalta ollenkaan?
26.02.2026 02:54Ikävä
62
4533
Voiku saisi sen sun
Rakkauden kokea. Tykkään susta niin paljon edelleen.
26.02.2026 19:08Ikävä
43
4207
Mitä luulet, miten Martina Aitolehti pärjää Erikoisjoukoissa?
Kohujulkkis, yrittäjä ja hyvinvointivalmentaja Martina Aitolehti on mukana Erikoisjoukot-realityssä. Erikoisjoukot on
26.02.2026 09:12Suomalaiset julkkikset
54
3515
Olitpa ikävän
Kylmä eilen. Miksi ihmeessä?
26.02.2026 05:34Ikävä
49
3185

Taustakuva kadoksissa

Vastaukset

newuser kirjoitti:

Luetuimmat keskustelut

Näin Enter-napilla tehdään miljardi euroa - Helsingissä

Minulla ei ole ketään muita

4,5 promillee

Perussuomalaiset kirjoittaa vain positiivisista uutisista

Jätä minut rauhaan

Ben Z: "SDP ei ole ollut 50 vuoteen näin huolissaan velasta"

Harmittaako sinua yhtään?

Voiku saisi sen sun

Mitä luulet, miten Martina Aitolehti pärjää Erikoisjoukoissa?

Olitpa ikävän

Kuka on UMK-suosikkisi? UMK26 paljastuksia lauantai 28.2.

L/over ja Jani Volanen! Minkä arvosanan 4-10 annat roolityöstä?

Maaliskuussa alkavat pakolliset velvoittavat työtarjoukset?

TTK:n jättänyt Vappu Pimiä rehellisenä MasterChef-kuvauksista: "Höh..."

Miehet ja huoli syntyvyydestä

Mitä luulet, miten Martina Aitolehti pärjää Erikoisjoukoissa?

Tätä et näe tv:ssä: Atte Kilpinen napauttaa negatiivisesta palautteesta

Kouluruokailu

Onko hyvä näin? The Summit Suomi -realityssä on aivan tavallisia suomalaisia, ei julkkiksia

Dannyn, 83, seuralainen, "ex-assistentti" Helmi Loukasmäki jo 25 vuotta!