jotain mainos juttuu popuppii kokoajan
Logfile of HijackThis v1.99.1
Scan saved at 19:00:51, on 13.7.2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\System32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program\Alwil Software\Avast4\aswUpdSv.exe
D:\Program\Alwil Software\Avast4\ashServ.exe
D:\Program\Sunbelt Software\Personal Firewall\kpf4ss.exe
D:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\System32\svchost.exe
D:\Program\Sunbelt Software\Personal Firewall\kpf4gui.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
C:\Program\D-Tools\daemon.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program\ALWILS~1\Avast4\ashDisp.exe
D:\Program\MSN Messenger\MsnMsgr.Exe
C:\Program\BitComet\BitComet.exe
C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
D:\Program\Alwil Software\Avast4\ashMaiSv.exe
D:\Program\Alwil Software\Avast4\ashWebSv.exe
D:\Program\Sunbelt Software\Personal Firewall\kpf4gui.exe
D:\WINDOWS\System32\ctfmon.exe
C:\hiijakk\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - D:\WINDOWS\system32\ljjhecc.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Microsoft Internet Explorer] D:\WINDOWS\System32\iexplore.exe
O4 - HKLM\..\Run: [avast!] D:\Program\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitComet] "C:\Program\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program\MICROS~1\Office10\EXCEL.EXE/3000
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148841499968
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\Program\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: ljjhecc - D:\WINDOWS\SYSTEM32\ljjhecc.dll
O20 - Winlogon Notify: Shell Extensions - D:\WINDOWS\system32\n6n6lg5s16.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - D:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Program\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - D:\Program\Sunbelt Software\Personal Firewall\kpf4ss.exe
Logfile of HijackThis v1.99.1
Scan saved at 19:00:51, on 13.7.2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\System32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program\Alwil Software\Avast4\aswUpdSv.exe
D:\Program\Alwil Software\Avast4\ashServ.exe
D:\Program\Sunbelt Software\Personal Firewall\kpf4ss.exe
D:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\System32\svchost.exe
D:\Program\Sunbelt Software\Personal Firewall\kpf4gui.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
C:\Program\D-Tools\daemon.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program\ALWILS~1\Avast4\ashDisp.exe
D:\Program\MSN Messenger\MsnMsgr.Exe
C:\Program\BitComet\BitComet.exe
C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
D:\Program\Alwil Software\Avast4\ashMaiSv.exe
D:\Program\Alwil Software\Avast4\ashWebSv.exe
D:\Program\Sunbelt Software\Personal Firewall\kpf4gui.exe
D:\WINDOWS\System32\ctfmon.exe
C:\hiijakk\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - D:\WINDOWS\system32\ljjhecc.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Microsoft Internet Explorer] D:\WINDOWS\System32\iexplore.exe
O4 - HKLM\..\Run: [avast!] D:\Program\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitComet] "C:\Program\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program\MICROS~1\Office10\EXCEL.EXE/3000
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148841499968
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\Program\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: ljjhecc - D:\WINDOWS\SYSTEM32\ljjhecc.dll
O20 - Winlogon Notify: Shell Extensions - D:\WINDOWS\system32\n6n6lg5s16.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - D:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Program\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - D:\Program\Sunbelt Software\Personal Firewall\kpf4ss.exe
Vastaukset 1
Vanhimmat
Lataa http://www.atribune.org/ccount/click.php?id=4 työpöydällesi.
# Tupla-klikkaa VundoFix.exe ajaaksesi työkalun.
# Rastita Run VundoFix as a task valinta.
# Klikkaa Scan for Vundo nappia.
# Kun skannaus on valmis, klikkaa Remove Vundo nappia.
# Saat viestin joka kysyy haluatko poistaa tiedostot, klikkaa YES.
# Kun klikkaat yes, työpöytäsi muuttuu tyhjäksi kun Vundofix alkaa poistamaan tartuntaa.
# Kun valmis, työkalu ilmoittaa sulkevansa koneesi, klikkaa OK.
# Käynnistä koneesi uudelleen.
# Postita C:\vundofix.txt lokin sisältö ja tuore HijackThis loki.