Mulle tulee sillon tällöin virusvaroituksia ja pop-uppeja jotka varoittavat viruksista. Konetta on ajettu ja scannailtu ewidolla, ad-awarella, Norman virus controllilla ja spybotilla. Kaikki olen poistanut ja ad-aware löysi jonkun kriittisen jutun ja spybot löytää aina jonkun Zlob.Downloaderin... apua tarvittais
-------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 16:29:47, on 15.6.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Norman\Bin\Zanda.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\CNAB4RPK.EXE
C:\Norman\Nvc\bin\nvcoas.exe
C:\Norman\bin\NJEEVES.EXE
C:\Norman\Nvc\BIN\nipsvc.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Norman\bin\ZLH.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\bcab7ba7.exe
C:\program files\steam\steam.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Samurize\Client.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Norman\Nvc\BIN\NVCOD.EXE
C:\Documents and Settings\Mikko V\Työpöytä\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Nothing - {686a161d-5bd1-4999-8832-6393f41e564c} - C:\WINDOWS\system32\hp100.tmp
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\urqqnkj.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [bcab7ba7.exe] C:\WINDOWS\system32\bcab7ba7.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [bcab7ba7.exe] C:\Documents and Settings\Mikko V\Local Settings\Application Data\bcab7ba7.exe
O4 - Startup: Client Default.lnk = C:\Program Files\Samurize\Client.exe
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: urqqnkj - C:\WINDOWS\SYSTEM32\urqqnkj.dll
O20 - Winlogon Notify: winhdn32 - C:\WINDOWS\SYSTEM32\winhdn32.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
-------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 16:29:47, on 15.6.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Norman\Bin\Zanda.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\CNAB4RPK.EXE
C:\Norman\Nvc\bin\nvcoas.exe
C:\Norman\bin\NJEEVES.EXE
C:\Norman\Nvc\BIN\nipsvc.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Norman\bin\ZLH.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\bcab7ba7.exe
C:\program files\steam\steam.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Samurize\Client.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Norman\Nvc\BIN\NVCOD.EXE
C:\Documents and Settings\Mikko V\Työpöytä\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Nothing - {686a161d-5bd1-4999-8832-6393f41e564c} - C:\WINDOWS\system32\hp100.tmp
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\urqqnkj.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [bcab7ba7.exe] C:\WINDOWS\system32\bcab7ba7.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [bcab7ba7.exe] C:\Documents and Settings\Mikko V\Local Settings\Application Data\bcab7ba7.exe
O4 - Startup: Client Default.lnk = C:\Program Files\Samurize\Client.exe
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: urqqnkj - C:\WINDOWS\SYSTEM32\urqqnkj.dll
O20 - Winlogon Notify: winhdn32 - C:\WINDOWS\SYSTEM32\winhdn32.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
Vastaukset 24
Vanhimmat
haittaohjelmat, odota hetki.
Aloitetaan tällä:
Hae VundoFix.exe -> http://www.atribune.org/ccount/click.php?id=4 ja tallenna työpöydälle
[*]Tuplaklikkaa VundoFix.exe
[*]Klikkaa Scan for Vundo
[*]Kun skanni on valmis, klikkaa Remove Vundo -nappulaa
[*]Kun kysytään, haluatko poistaa tiedostot, vastaa YES
[*]Kun klikkaat yes, työpöytä häviää, kun Vundon poisto alkaa.
[*]Kun se on valmis, fixi ilmoittaa, että kone sammutetaan. Klikkaa ok.
[*]Käynnistä kone uudelleen
[*]Lähetä C:\vundofix.txt-tiedoston sisältö ja uusi HiJackThis-loki
VundoFix V4.2.84
Checking Java version...
Java version is 1.5.0.6
Scan started at 17:02:05 15.6.2006
Listing files found while scanning....
C:\WINDOWS\system32\urqqnkj.dll
VundoFix V4.2.84
Checking Java version...
Java version is 1.5.0.6
Scan started at 17:06:57 15.6.2006
Listing files found while scanning....
C:\WINDOWS\system32\urqqnkj.dll
Attempting to delete C:\WINDOWS\system32\urqqnkj.dll
C:\WINDOWS\system32\urqqnkj.dll Could not be deleted.
Performing Repairs to the registry.
Done!
-------------------------
Logfile of HijackThis v1.99.1
Scan saved at 17:16:23, on 15.6.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Norman\bin\ZLH.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Norman\Bin\Zanda.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\bcab7ba7.exe
C:\program files\steam\steam.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\CNAB4RPK.EXE
C:\Program Files\Samurize\Client.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Norman\bin\NJEEVES.EXE
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Norman\Nvc\BIN\nipsvc.exe
C:\Norman\Nvc\bin\nvcoas.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Norman\Nvc\bin\cclaw.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Mikko V\Työpöytä\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Nothing - {686a161d-5bd1-4999-8832-6393f41e564c} - C:\WINDOWS\system32\hp100.tmp
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [bcab7ba7.exe] C:\WINDOWS\system32\bcab7ba7.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [bcab7ba7.exe] C:\Documents and Settings\Mikko V\Local Settings\Application Data\bcab7ba7.exe
O4 - Startup: Client Default.lnk = C:\Program Files\Samurize\Client.exe
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: winhdn32 - C:\WINDOWS\SYSTEM32\winhdn32.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
Lataa SmitfraudFix (c) S!Ri
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:
Avaa SmitfraudFix-kansio ja tuplaklikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita tämän tekstitiedoston sisältö viestiketjuusi.
SmitFraudFix v2.60
Scan done at 17:37:27,35, to 15.06.2006
Run from C:\Documents and Settings\Mikko V\Ty”p”yt„\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
Fix ran in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
C:\WINDOWS\system32\atmclk.exe FOUND !
C:\WINDOWS\system32\dcomcfg.exe FOUND !
C:\WINDOWS\system32\hp???.tmp FOUND !
C:\WINDOWS\system32\hp????.tmp FOUND !
C:\WINDOWS\system32\ld????.tmp FOUND !
C:\WINDOWS\system32\ot.ico FOUND !
C:\WINDOWS\system32\regperf.exe FOUND !
C:\WINDOWS\system32\simpole.tlb FOUND !
C:\WINDOWS\system32\1024\ FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Mikko V\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\MIKKOV~1\Suosikit
C:\DOCUME~1\MIKKOV~1\Suosikit\Antivirus Test Online.url FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5aaf6542-f4ba-4df4-873d-4902ecbe794c}"="antitragus"
Siirrä HjT omaan hakemistoon -> C:\hjt
Fixaa HjT:llä (do a system scan only, merkkaa ja paina fix checked):
O4 - HKLM\..\Run: [bcab7ba7.exe] C:\WINDOWS\system32\bcab7ba7.exe
O4 - HKCU\..\Run: [bcab7ba7.exe] C:\Documents and Settings\Mikko V\Local Settings\Application Data\bcab7ba7.exe
O20 - Winlogon Notify: winhdn32 - C:\WINDOWS\SYSTEM32\winhdn32.dll
Hae,asenna ja päivitä ewido -> http://keskustelu.afterdawn.com/thread_view.cfm/269186
Printtaa ohjeet ulos.
Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.
Poista, jos löytyy:
C:\WINDOWS\system32\bcab7ba7.exe
C:\Documents and Settings\Mikko V\Local Settings\Application Data\bcab7ba7.exe
C:\WINDOWS\SYSTEM32\winhdn32.dll
Avaa [b]SmitfraudFix[/b]-kansio ja tuplaklikkaa [b]smitfraudfix.cmd[/b]
Valitse optio #2 - [b]Clean[/b] kirjoittamalla [b]2[/b] ja painamalla "[b]Enter[/b]" poistaaksesi tarttuneet tiedostot.
Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla [b]Y[/b] ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.
Työkalu tarkistaa jos [b]wininet.dll[/b] on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla [b]Y[/b] ja painamalla "Enter".
Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
Raportti löytyy paikalliselta levyltäsi, useimmiten [b]C:\rapport.txt.[/b]
Skannaa ewidolla, anna poistaa mitä löytää ja tallenna raportti.
Lähetä sen sisältö,uusi HjT-loki ja ewidon raportti tänne.
Siis miten pääsen vikasieto tilaan?
* Sulje kaikki ohjelmat.
* Klikkaa käynnistä -> suorita -> msconfig ja OK
* Valitse BOOT.INI-välilehti, merkkaa "/SAFEBOOT"-valinta, ja sitten klikkaa OK ja käynnistä kone uudelleen sitä pyydettäessä
* Tietokone käynnistyy vikasietotilaan
* Tee vikasietotilassa pyydetyt toimenpiteet.
* Kun olet valmis, mene uudelleen msconfigiin kuten edellä ja ota valinta pois BOOT.INI-välilehdeltä "/SAFEBOOT"-kohdasta ja paina OK, jolloin koneesi käynnistyy normaalisti.
smitraudin raportti
SmitFraudFix v2.60
Scan done at 21:13:51,59, to 15.06.2006
Run from C:\Documents and Settings\Mikko V\Ty”p”yt„\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
Fix ran in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
Logfile of HijackThis v1.99.1
Scan saved at 22:11:25, on 15.6.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Norman\bin\ZLH.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\program files\steam\steam.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Samurize\Client.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Norman\Bin\Zanda.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\system32\CNAB4RPK.EXE
C:\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Norman\bin\NJEEVES.EXE
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Norman\Nvc\BIN\nipsvc.exe
C:\Norman\Nvc\bin\nvcoas.exe
C:\WINDOWS\System32\alg.exe
C:\Norman\Nvc\bin\cclaw.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpywareQuake.com] C:\Program Files\SpywareQuake.com\Spyware-Quake.exe /h
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [bcab7ba7.exe] C:\WINDOWS\system32\bcab7ba7.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Client Default.lnk = C:\Program Files\Samurize\Client.exe
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: winhdn32 - winhdn32.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
-----------------------------------------
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
Created on: 22:10:51, 15.6.2006
Report-Checksum: 128E7F82
Scan result:
C:\Documents and Settings\Anni\Local Settings\Temporary Internet Files\Content.IE5\89INWP6J\Scripts[1].js -> Adware.MediaMotor : Cleaned with backup
C:\Documents and Settings\Anni\Local Settings\Temporary Internet Files\Content.IE5\S78RGLGX\ControllerScripts[2].js -> Adware.MediaMotor : Cleaned with backup
C:\Documents and Settings\Jaakko\Local Settings\Application Data\bcab7ba7.exe -> Downloader.Obfuscated.a : Cleaned with backup
:mozilla.106:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup
:mozilla.107:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.108:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.109:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.110:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.111:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.112:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.113:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.130:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.131:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.132:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.133:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.140:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.143:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.144:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.145:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.146:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.147:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.150:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
:mozilla.151:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
:mozilla.157:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.158:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.159:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.160:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.165:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.166:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.167:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.183:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.184:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.186:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.199:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
:mozilla.200:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
:mozilla.218:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.219:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.220:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.221:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.222:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.223:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.224:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.225:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.226:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.227:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.228:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.229:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.230:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.231:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.232:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.233:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.234:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.235:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.236:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.237:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.238:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.239:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.246:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.247:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.248:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.249:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.335:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned with backup
:mozilla.350:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Ivwbox : Cleaned with backup
:mozilla.402:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.410:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.415:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.439:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Paycounter : Cleaned with backup
:mozilla.440:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Paycounter : Cleaned with backup
:mozilla.453:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.461:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.476:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.477:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.478:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.479:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.480:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.482:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
:mozilla.494:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.495:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.496:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.497:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.520:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.521:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.522:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.523:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.524:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.525:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.526:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.527:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.528:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.529:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.530:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.531:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.539:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.540:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.553:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.554:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.555:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.556:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.557:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.558:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Trafic : Cleaned with backup
:mozilla.559:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.571:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup
:mozilla.633:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup
:mozilla.634:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup
:mozilla.642:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.643:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.644:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.645:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.646:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.648:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Cqcounter : Cleaned with backup
:mozilla.649:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Cqcounter : Cleaned with backup
:mozilla.659:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.660:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.661:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.664:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned with backup
:mozilla.686:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup
:mozilla.738:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.739:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.740:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.741:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.751:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup
:mozilla.759:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.760:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.852:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup
:mozilla.853:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup
:mozilla.854:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup
:mozilla.855:C:\Documents and Settings\Mikko V\Application Data\Mozilla\Firefox\Profiles\q12mfj9z.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup
C:\Documents and Settings\Mikko V\Local Settings\Application Data\bcab7ba7.exe -> Downloader.Obfuscated.a : Cleaned with backup
C:\Documents and Settings\Mikko V\Local Settings\Temporary Internet Files\Content.IE5\1DT87LI5\remote_load[1].js -> Adware.MediaMotor : Cleaned with backup
C:\Documents and Settings\Mikko V\Local Settings\Temporary Internet Files\Content.IE5\2DBC5C7M\wlzip32[1].exe -> Downloader.Obfuscated.a : Cleaned with backup
C:\Documents and Settings\Mikko V\Local Settings\Temporary Internet Files\Content.IE5\POCR5XKP\WinAntiVirusPro2006FreeInstall[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.j : Cleaned with backup
C:\Documents and Settings\Tiina\Local Settings\Application Data\bcab7ba7.exe -> Downloader.Obfuscated.a : Cleaned with backup
C:\WINDOWS\system32\__delete_on_reboot__winhdn32.dll -> Trojan.Agent.vg : Cleaned with backup
C:\WINDOWS\Temp\win11B.tmp.exe -> Downloader.Obfuscated.a : Cleaned with backup
::Report End
--------------------------
Onko jotain vielä korjattavana vai onko hyvä?
optio 1 vielä
Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla Enter; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita tämän tekstitiedoston sisältö viestiketjuusi.
O4 - HKLM\..\Run: [SpywareQuake.com] C:\Program Files\SpywareQuake.com\Spyware-Quake.exe /h
O4 - HKLM\..\Run: [bcab7ba7.exe] C:\WINDOWS\system32\bcab7ba7.exe
O20 - Winlogon Notify: winhdn32 - winhdn32.dll (file missing)
Käynnistä uudelleen, lähetä uusi HjT-loki ja smitfraufixin raportti optiolla #1
SmitFraudFix v2.60
Scan done at 12:39:15,70, pe 16.06.2006
Run from C:\Documents and Settings\Mikko V\Ty”p”yt„\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
Fix ran in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Mikko V\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\MIKKOV~1\Suosikit
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
---------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 12:40:10, on 16.6.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Norman\bin\ZLH.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\program files\steam\steam.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Norman\Bin\Zanda.exe
C:\Program Files\Samurize\Client.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\system32\CNAB4RPK.EXE
C:\Norman\Nvc\BIN\NIP.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Norman\Nvc\BIN\nipsvc.exe
C:\Norman\bin\NJEEVES.EXE
C:\Norman\Nvc\bin\nvcoas.exe
C:\WINDOWS\System32\alg.exe
C:\Norman\Nvc\bin\cclaw.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Client Default.lnk = C:\Program Files\Samurize\Client.exe
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
--------------------------
joko nyt on kunnossa :D
Katso, löytyykö tuota vielä -> C:\WINDOWS\system32\urqqnkj.dll
tuolta paikasta vai scannaanko jollain ohjelmalla?
sieltä c aseman kansiosta löytyi mitä sille tehdään ja missä tilassa?
[*]Tuplaklikkaa VundoFix.exe
[*] Merkkaa boxi "Run VundoFix as a task."
[*] Saat viestin jossa lukee "vundofix will close and re-open in a minute or less." Klikkaa OK
[*] Kun VundoFix aukeaa , klikkaa hiiren oikealla valkoista boxia ja klikkaa add more files
[*] Kopioi/liitä tämä ylimpään boxiin
C:\WINDOWS\system32\urqqnkj.dll
[*] Klikkaa Add Files ja klikkaa Close Window
[*]Klikkaa Scan for Vundo
[*]Kun skanni on valmis, klikkaa Remove Vundo -nappulaa
[*]Kun kysytään, haluatko poistaa tiedostot, vastaa YES
[*]Kun klikkaat yes, työpöytä häviää, kun Vundon poisto alkaa.
[*]Kun se on valmis, fixi ilmoittaa, että kone sammutetaan. Klikkaa ok.
[*]Käynnistä kone uudelleen
[*]Lähetä C:\vundofix.txt-tiedoston sisältö ja uusi HiJackThis-loki
scanni kestää tuleeko siihen alas teksti scan finished tai sinnepäin?
Ei sen kovin kauaa pitäisi kestää :)
vundo sanoi ettei löytänyt mitään poistettavaa,eikä poistanut mitään.... eikä raporttia löydy...
Logfile of HijackThis v1.99.1
Scan saved at 13:31:53, on 16.6.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Norman\Bin\Zanda.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Norman\bin\ZLH.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\program files\steam\steam.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\CNAB4RPK.EXE
C:\Program Files\Samurize\Client.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Norman\Nvc\bin\nvcoas.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Norman\bin\NJEEVES.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Norman\Nvc\BIN\nipsvc.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\System32\alg.exe
C:\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Client Default.lnk = C:\Program Files\Samurize\Client.exe
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
1. [b]Lataa[/b] http://swandog46.geekstogo.com/avenger.zip
The Avenger (c)työpöydällesi.
[*]Klikkaa Avenger.zip filua avataksesi sen.
[*]Pura [b]Avenger.exe[/b] työpöydällesi.
2. Kopioi kaikki teksti alapuolella tyhjälle muistiolle:
Files to delete:
C:\WINDOWS\system32\urqqnkj.dll
Huomaa: yläpuolella oleva skripti on luotu erityisesti tälle käyttäjälle. Jos et ole tämä henkilö, ÄLÄ seuraa näitä ohjeita koska ne voisivat pilata koneesi toimintoja.
3. Nyt, [b]aukaise The Avenger[/b] tupla-klikkaamalla sen kuvaketta pöydälläsi.
[*]"[b]Script file to execute[/b]" alapuolelta valitse "[b]Input Script Manually[/b]".
[*]Nyt klikkaa [b]suurennuslasin kuvaa[/b] joka avaa uuden ikkunan nimeltä "[b]View/edit script[/b]".
[*] Liitä se teksti jonka kopioit muistioon, tähän ikkunaan.
[*] Klikkaa [b]Done[/b].
[*] Nyt klikkaa [b]vihreää valoa[/b] aloittaaksesi skriptin.
[*] Klikkaa "[b]Yes[/b]" kun tulee kaksi varoitusboksia.
[b]Avenger tekee automaattisesti seuraavat[/b]:
[*] [b][u]Käynnistää koneesi[/u][/b]. (Tapauksissa joissa skripti sisältää "[b]Drivers to Unload[/b]" -komennon, Avenger [b]käynnistää koneesi [u]kaksi kertaa[/u].[/b])
[*] Käynnistyksen yhteydessä, se lyhyesti avaa mustan [b]komentoikkunan[/b] työpöydällesi, tämä on normaalia.
[*] Käynnistyksen jälkeen, [b][u]se luo lokitiedoston[/u][/b] jonka pitäisi aueta Avengerin tekojen tuloksena. Tämän lokin tiedostopolku on [b]C:\avenger.txt[/b]
[*] Avenger on myös [b][u]tehnyt varmuuskopion kaikista tiedostoista jne.. jotka pyysit sen poistaa[/u][/b], ja on pakannut ja siirtänyt ne zip filuihin polussa [b]C:\avenger\backup.zip[/b].
5. [b]Kopioi ja liitä[/b] kaikki sisältö tiedostosta [b]avenger.txt[/b] vastaukseesi
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\hvbhnnrn
*******************
Script file located at: \??\C:\Program Files\gaduosxk.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
File C:\WINDOWS\system32\urqqnkj.dll deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
------------------
mitä niille varmuuskopioille tehdään?
Nyt on hyvä :) Sen varmuuskopion voi poistaa.
Ja kiitokset kaikille ketkä autto koneen siivoomisessa