Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    Zipp

    Moi,

    Kone on juntturassa eikä välillä saa auki ollenkaan ilman chkdiskiä, käynnistää uudelleen juuri ennen tervetuloa ikkunaa.
    F-secure on alkanut kyselemään lupaa lähes joka ohjelman käynnistyksessä millähän sen saisi rauhoittumaan?
    Tässä yksi esimerkki, eikä tällaista ole ennemmin esiintynyt
    http://koti.mbnet.fi/justina/fsecure.JPG

    Ja vaikka minkä ohjelman aukaisee, f-secure kysyy lupaa sille nettiin pääsystä.

    eScan löysi hp/bin kansiosta KillWind.exen, ei toimenpiteitä.
    Lueskelin eri palstoilta ja on vissiin jokin Hp:n oma juttu, mutta ei oikein selvinnyt kannattaako poistaa vai ei.

    Hjt logissa ihmetyttää kun näyttää olevan Backweb 2005 ja 2006?

    Löytyisikö tästä mitään putsattavaa?

    Logfile of HijackThis v1.99.1
    Scan saved at 8:51:13, on 28.9.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\windows\system\hpsysdrv.exe
    C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
    C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
    C:\Program Files\Weather Watcher\ww.exe
    C:\Program Files\HP\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\HP\Digital Imaging\bin\hpoevm08.exe
    C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
    C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
    C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
    C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\HJT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q404&bd=pavilion&pf=desktop
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q404&bd=pavilion&pf=desktop
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q404&bd=pavilion&pf=desktop
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q404&bd=pavilion&pf=desktop
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q404&bd=pavilion&pf=desktop
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: HP-näkymä - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
    O4 - HKCU\..\Run: [WeatherWatcher] C:\Program Files\Weather Watcher\ww.exe
    O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\PCHButton.exe
    O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: &Google-haku - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Käännä englanninkielinen sana - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Linkit taaksepäin - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Samankaltaisia sivuja - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Save Flash - res://C:\Program Files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll/210
    O8 - Extra context menu item: Välimuistissa oleva kuvakaappaus sivusta - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Flash - {43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA} - C:\Program Files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll (HKCU)
    O10 - Broken Internet access because of LSP provider 'winsflt.dll' missing
    O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
    O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.6.0.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1133865138109
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9A8DA514-85C6-41E1-BD9C-B02C8DC6949F}: NameServer = 192.168.1.1
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Sovelluskerroksen yhdyskäytäväpalvelu (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
    O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    9590
    Äänestä

    Muut lukivat myös

    Vastaukset 9

    Vanhimmat

    1. Lataa combofix.exe http://download.bleepingcomputer.com/sUBs/combofix.exe tiedosto työpöydällesi.
    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    Äänestä

    • Olisi combofix logi

      HP_Omistaja - 06-09-28 11:13:44,03 Service Pack 2
      ComboFix 06.09.28 - Running from: "C:\Documents and Settings\HP_Omistaja\Ty”p”yt„"

      ((((((((((((((((((((((((((((((( Files Created from 2006-08-28 to 2006-09-28 ))))))))))))))))))))))))))))))))))


      2006-09-23   10:31   0   --a------   C:\WINDOWS\system32\serauth2.dll
      2006-09-23   10:31   0   --a------   C:\WINDOWS\system32\serauth1.dll
      2006-09-23   10:31   0   --a------   C:\WINDOWS\system32\nsprs.dll
      2006-09-23   10:21   73   --a------   C:\WINDOWS\system32\ssprs.dll
      2006-09-23   10:21   205   --a------   C:\WINDOWS\system32\lsprst7.dll
      2006-09-23   10:21   1,025   --a------   C:\WINDOWS\system32\sysprs7.dll
      2006-09-23   10:21   1,025   --a------   C:\WINDOWS\system32\clauth2.dll
      2006-09-23   10:21   1,025   --a------   C:\WINDOWS\system32\clauth1.dll
      2006-09-18   22:07   54,784   --a------   C:\WINDOWS\system32\Inetwh32.dll
      2006-09-18   22:07   47,104   --a------   C:\WINDOWS\system32\Wh2Robo.dll
      2006-09-18   22:07   317,952   --a------   C:\WINDOWS\system32\Roboex32.dll
      2006-09-15   08:53   77,824   --a------   C:\WINDOWS\system32\fmcodec.DLL


      (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


      2006-09-28 07:55   --------   d--------   C:\Program Files\Mozilla Thunderbird
      2006-09-28 07:10   --------   d--------   C:\Program Files\Mozilla Firefox
      2006-09-24 18:30   --------   d--------   C:\Program Files\Java
      2006-09-23 10:45   --------   d--------   C:\Program Files\SPSSEval
      2006-09-23 10:42   --------   d--------   C:\Program Files\Sonic RecordNow!
      2006-09-23 10:37   --------   d--------   C:\Program Files\DAMN NFO Viewer
      2006-09-23 10:11   --------   d--------   C:\Program Files\Astonsoft
      2006-09-23 10:08   --------   d---s----   C:\Documents and Settings\HP_Omistaja\Application Data\Microsoft
      2006-09-23 10:07   --------   d--------   C:\Program Files\IrfanView
      2006-09-23 10:05   --------   d--------   C:\Program Files\Right Hemisphere
      2006-09-23 10:05   --------   d--------   C:\Program Files\Adobe
      2006-09-21 13:49   --------   d--------   C:\Program Files\Common Files\System
      2006-09-21 08:14   --------   d--------   C:\Documents and Settings\HP_Omistaja\Application Data\Download Manager
      2006-09-20 23:32   --------   d--------   C:\Program Files\Paint Shop Pro 6
      2006-09-17 18:28   --------   d--------   C:\Documents and Settings\HP_Omistaja\Application Data\OpenOffice.org2
      2006-09-17 16:02   --------   d--------   C:\Documents and Settings\HP_Omistaja\Application Data\Skype
      2006-09-15 08:53   --------   d--------   C:\Program Files\Fox Magic
      2006-08-30 23:56   --------   d--------   C:\Program Files\SpywareBlaster
      2006-08-27 17:43   --------   d--------   C:\Program Files\Weather Watcher
      2006-08-21 15:26   16896   --a------   C:\WINDOWS\system32\fltlib.dll
      2006-08-21 12:14   23040   --a------   C:\WINDOWS\system32\fltmc.exe
      2006-08-21 12:14   128896   --a------   C:\WINDOWS\system32\drivers\fltmgr.sys
      2006-08-15 22:47   --------   d--------   C:\Program Files\Internet Explorer
      2006-08-11 00:54   --------   d--------   C:\Documents and Settings\HP_Omistaja\Application Data\Adobe
      2006-08-05 14:53   39936   --a------   C:\WINDOWS\system32\rshx32_p.dll
      2006-07-27 16:26   679424   --a------   C:\WINDOWS\system32\inetcomm.dll
      2006-07-21 11:28   72704   --a------   C:\WINDOWS\system32\hlink.dll


      (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

      *Note* empty entries are not shown

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "WeatherWatcher"="C:\\Program Files\\Weather Watcher\\ww.exe"
      "Acme.PCHButton"="C:\\PROGRA~1\\HELPAN~1\\Pavilion\\XPHWWBF4\\plugin\\bin\\PCHButton.exe"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "hpsysdrv"="c:\\windows\\system\\hpsysdrv.exe"
      "F-Secure TNB"="\"C:\\Program Files\\F-Secure Internet Security\\TNB\\TNBUtil.exe\" /CHECKALL /WAITFORSW"
      "F-Secure Startup Wizard"="\"C:\\Program Files\\F-Secure Internet Security\\FSGUI\\FSSW.EXE\" /reboot"
      "F-Secure Manager"="\"C:\\Program Files\\F-Secure Internet Security\\Common\\FSM32.EXE\" /splash"
      "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
      "Installed"="1"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
      "NoChange"="1"
      "Installed"="1"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
      "Installed"="1"

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
      "DeskHtmlVersion"=dword:00000110
      "DeskHtmlMinorVersion"=dword:00000005
      "Settings"=dword:00000001
      "GeneralFlags"=dword:00000004

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
      "Source"="About:Home"
      "SubscribedURL"="About:Home"
      "FriendlyName"="Nykyinen kotisivu"
      "Flags"=dword:00000002
      "Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
      00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
      "CurrentState"=dword:40000004
      "OriginalStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\
      00,00,04,00,00,40
      "RestoredStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\
      00,00,01,00,00,00

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
      "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
      "NoDriveTypeAutoRun"=dword:00000091

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
      "dontdisplaylastusername"=dword:00000000
      "legalnoticecaption"=""
      "legalnoticetext"=""
      "shutdownwithoutlogon"=dword:00000001
      "undockwithoutlogon"=dword:00000001

      [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
      "NoDriveTypeAutoRun"=dword:00000091

      [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
      "NoDriveTypeAutoRun"=dword:00000091

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
      "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
      "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
      "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
      "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Acrobat Assistant.lnk]
      "path"="C:\\Documents and Settings\\All Users\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\Acrobat Assistant.lnk"
      "backup"="C:\\WINDOWS\\pss\\Acrobat Assistant.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Distillr\\acrotray.exe "
      "item"="Acrobat Assistant"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Adobe Acrobat Speed Launcher.lnk]
      "path"="C:\\Documents and Settings\\All Users\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\Adobe Acrobat Speed Launcher.lnk"
      "backup"="C:\\WINDOWS\\pss\\Adobe Acrobat Speed Launcher.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\WINDOWS\\Installer\\{AC76BA86-1033-0000-7760-000000000002}\\SC_Acrobat.exe "
      "item"="Adobe Acrobat Speed Launcher"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Adobe Reader Speed Launch.lnk]
      "path"="C:\\Documents and Settings\\All Users\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\Adobe Reader Speed Launch.lnk"
      "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\PROGRA~1\\Adobe\\ACROBA~2.0\\Reader\\READER~1.EXE "
      "item"="Adobe Reader Speed Launch"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^HP Digital Imaging Monitor.lnk]
      "path"="C:\\Documents and Settings\\All Users\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\HP Digital Imaging Monitor.lnk"
      "backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqtra08.exe "
      "item"="HP Digital Imaging Monitor"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Microsoft Office.lnk]
      "path"="C:\\Documents and Settings\\All Users\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\Microsoft Office.lnk"
      "backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\PROGRA~1\\MICROS~2\\Office\\OSA9.EXE -b -l"
      "item"="Microsoft Office"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Symantec Fax Starter Edition Port.lnk]
      "path"="C:\\Documents and Settings\\All Users\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\Symantec Fax Starter Edition Port.lnk"
      "backup"="C:\\WINDOWS\\pss\\Symantec Fax Starter Edition Port.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\PROGRA~1\\MICROS~2\\Office\\1035\\OLFSNT40.EXE "
      "item"="Symantec Fax Starter Edition Port"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^HP_Omistaja^Käynnistä-valikko^Ohjelmat^Käynnistys^Adobe Gamma.lnk]
      "path"="C:\\Documents and Settings\\HP_Omistaja\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\Adobe Gamma.lnk"
      "backup"="C:\\WINDOWS\\pss\\Adobe Gamma.lnkStartup"
      "location"="Startup"
      "command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "
      "item"="Adobe Gamma"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^HP_Omistaja^Käynnistä-valikko^Ohjelmat^Käynnistys^OpenOffice.org 2.0.lnk]
      "path"="C:\\Documents and Settings\\HP_Omistaja\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\OpenOffice.org 2.0.lnk"
      "backup"="C:\\WINDOWS\\pss\\OpenOffice.org 2.0.lnkStartup"
      "location"="Startup"
      "command"="C:\\PROGRA~1\\OPENOF~1.0\\program\\QUICKS~1.EXE "
      "item"="OpenOffice.org 2.0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Acme.PCHButton]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="PCHButton"
      "hkey"="HKCU"
      "command"="C:\\PROGRA~1\\HELPAN~1\\Pavilion\\XPHWWBF4\\plugin\\bin\\PCHButton.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Acrobat Assistant 7.0]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="Acrotray"
      "hkey"="HKLM"
      "command"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Distillr\\Acrotray.exe\""
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Active Desktop Calendar]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="ADC"
      "hkey"="HKCU"
      "command"="C:\\Program Files\\XemiComputers\\Active Desktop Calendar\\ADC.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\AGRSMMSG]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="AGRSMMSG"
      "hkey"="HKLM"
      "command"="AGRSMMSG.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ATIPTA]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="atiptaxx"
      "hkey"="HKLM"
      "command"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\GhostStartTrayApp]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="GhostStartTrayApp"
      "hkey"="HKLM"
      "command"="C:\\Program Files\\Symantec\\Norton Ghost 2003\\GhostStartTrayApp.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\iTunesHelper]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="iTunesHelper"
      "hkey"="HKLM"
      "command"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\KBD]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="KBD"
      "hkey"="HKLM"
      "command"="C:\\HP\\KBD\\KBD.EXE"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\MsnMsgr]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="MsnMsgr"
      "hkey"="HKCU"
      "command"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\NBJ]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="NBJ"
      "hkey"="HKCU"
      "command"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\""
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\NeroFilterCheck]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="NeroCheck"
      "hkey"="HKLM"
      "command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\PS2]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="ps2"
      "hkey"="HKLM"
      "command"="C:\\WINDOWS\\system32\\ps2.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\QuickTime Task]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="qttask"
      "hkey"="HKLM"
      "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Recguard]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="RECGUARD"
      "hkey"="HKLM"
      "command"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SiS Windows KeyHook]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="keyhook"
      "hkey"="HKLM"
      "command"="C:\\WINDOWS\\System32\\keyhook.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Skype]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="Skype"
      "hkey"="HKCU"
      "command"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Sonic RecordNow!]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="Skype"
      "hkey"="HKCU"
      "command"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SunJavaUpdateSched]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="jusched"
      "hkey"="HKLM"
      "command"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
      "inimapping"="0"


      HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
      securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


      Contents of the 'Scheduled Tasks' folder
      C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1100 series#1133881755.job
      C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1100 series#1133928615.job

      Completion time: Thu 28.09.2006 11:14:21.39
      ComboFix.txt
      ComboFix2.txt

      Äänestä

    • Justiina-70 kirjoitti:

      Olisi combofix logi

      HP_Omistaja - 06-09-28 11:13:44,03 Service Pack 2
      ComboFix 06.09.28 - Running from: "C:\Documents and Settings\HP_Omistaja\Ty”p”yt„"

      ((((((((((((((((((((((((((((((( Files Created from 2006-08-28 to 2006-09-28 ))))))))))))))))))))))))))))))))))


      2006-09-23   10:31   0   --a------   C:\WINDOWS\system32\serauth2.dll
      2006-09-23   10:31   0   --a------   C:\WINDOWS\system32\serauth1.dll
      2006-09-23   10:31   0   --a------   C:\WINDOWS\system32\nsprs.dll
      2006-09-23   10:21   73   --a------   C:\WINDOWS\system32\ssprs.dll
      2006-09-23   10:21   205   --a------   C:\WINDOWS\system32\lsprst7.dll
      2006-09-23   10:21   1,025   --a------   C:\WINDOWS\system32\sysprs7.dll
      2006-09-23   10:21   1,025   --a------   C:\WINDOWS\system32\clauth2.dll
      2006-09-23   10:21   1,025   --a------   C:\WINDOWS\system32\clauth1.dll
      2006-09-18   22:07   54,784   --a------   C:\WINDOWS\system32\Inetwh32.dll
      2006-09-18   22:07   47,104   --a------   C:\WINDOWS\system32\Wh2Robo.dll
      2006-09-18   22:07   317,952   --a------   C:\WINDOWS\system32\Roboex32.dll
      2006-09-15   08:53   77,824   --a------   C:\WINDOWS\system32\fmcodec.DLL


      (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


      2006-09-28 07:55   --------   d--------   C:\Program Files\Mozilla Thunderbird
      2006-09-28 07:10   --------   d--------   C:\Program Files\Mozilla Firefox
      2006-09-24 18:30   --------   d--------   C:\Program Files\Java
      2006-09-23 10:45   --------   d--------   C:\Program Files\SPSSEval
      2006-09-23 10:42   --------   d--------   C:\Program Files\Sonic RecordNow!
      2006-09-23 10:37   --------   d--------   C:\Program Files\DAMN NFO Viewer
      2006-09-23 10:11   --------   d--------   C:\Program Files\Astonsoft
      2006-09-23 10:08   --------   d---s----   C:\Documents and Settings\HP_Omistaja\Application Data\Microsoft
      2006-09-23 10:07   --------   d--------   C:\Program Files\IrfanView
      2006-09-23 10:05   --------   d--------   C:\Program Files\Right Hemisphere
      2006-09-23 10:05   --------   d--------   C:\Program Files\Adobe
      2006-09-21 13:49   --------   d--------   C:\Program Files\Common Files\System
      2006-09-21 08:14   --------   d--------   C:\Documents and Settings\HP_Omistaja\Application Data\Download Manager
      2006-09-20 23:32   --------   d--------   C:\Program Files\Paint Shop Pro 6
      2006-09-17 18:28   --------   d--------   C:\Documents and Settings\HP_Omistaja\Application Data\OpenOffice.org2
      2006-09-17 16:02   --------   d--------   C:\Documents and Settings\HP_Omistaja\Application Data\Skype
      2006-09-15 08:53   --------   d--------   C:\Program Files\Fox Magic
      2006-08-30 23:56   --------   d--------   C:\Program Files\SpywareBlaster
      2006-08-27 17:43   --------   d--------   C:\Program Files\Weather Watcher
      2006-08-21 15:26   16896   --a------   C:\WINDOWS\system32\fltlib.dll
      2006-08-21 12:14   23040   --a------   C:\WINDOWS\system32\fltmc.exe
      2006-08-21 12:14   128896   --a------   C:\WINDOWS\system32\drivers\fltmgr.sys
      2006-08-15 22:47   --------   d--------   C:\Program Files\Internet Explorer
      2006-08-11 00:54   --------   d--------   C:\Documents and Settings\HP_Omistaja\Application Data\Adobe
      2006-08-05 14:53   39936   --a------   C:\WINDOWS\system32\rshx32_p.dll
      2006-07-27 16:26   679424   --a------   C:\WINDOWS\system32\inetcomm.dll
      2006-07-21 11:28   72704   --a------   C:\WINDOWS\system32\hlink.dll


      (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

      *Note* empty entries are not shown

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "WeatherWatcher"="C:\\Program Files\\Weather Watcher\\ww.exe"
      "Acme.PCHButton"="C:\\PROGRA~1\\HELPAN~1\\Pavilion\\XPHWWBF4\\plugin\\bin\\PCHButton.exe"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "hpsysdrv"="c:\\windows\\system\\hpsysdrv.exe"
      "F-Secure TNB"="\"C:\\Program Files\\F-Secure Internet Security\\TNB\\TNBUtil.exe\" /CHECKALL /WAITFORSW"
      "F-Secure Startup Wizard"="\"C:\\Program Files\\F-Secure Internet Security\\FSGUI\\FSSW.EXE\" /reboot"
      "F-Secure Manager"="\"C:\\Program Files\\F-Secure Internet Security\\Common\\FSM32.EXE\" /splash"
      "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
      "Installed"="1"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
      "NoChange"="1"
      "Installed"="1"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
      "Installed"="1"

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
      "DeskHtmlVersion"=dword:00000110
      "DeskHtmlMinorVersion"=dword:00000005
      "Settings"=dword:00000001
      "GeneralFlags"=dword:00000004

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
      "Source"="About:Home"
      "SubscribedURL"="About:Home"
      "FriendlyName"="Nykyinen kotisivu"
      "Flags"=dword:00000002
      "Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
      00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
      "CurrentState"=dword:40000004
      "OriginalStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\
      00,00,04,00,00,40
      "RestoredStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\
      00,00,01,00,00,00

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
      "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
      "NoDriveTypeAutoRun"=dword:00000091

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
      "dontdisplaylastusername"=dword:00000000
      "legalnoticecaption"=""
      "legalnoticetext"=""
      "shutdownwithoutlogon"=dword:00000001
      "undockwithoutlogon"=dword:00000001

      [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
      "NoDriveTypeAutoRun"=dword:00000091

      [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
      "NoDriveTypeAutoRun"=dword:00000091

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
      "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
      "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
      "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
      "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Acrobat Assistant.lnk]
      "path"="C:\\Documents and Settings\\All Users\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\Acrobat Assistant.lnk"
      "backup"="C:\\WINDOWS\\pss\\Acrobat Assistant.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Distillr\\acrotray.exe "
      "item"="Acrobat Assistant"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Adobe Acrobat Speed Launcher.lnk]
      "path"="C:\\Documents and Settings\\All Users\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\Adobe Acrobat Speed Launcher.lnk"
      "backup"="C:\\WINDOWS\\pss\\Adobe Acrobat Speed Launcher.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\WINDOWS\\Installer\\{AC76BA86-1033-0000-7760-000000000002}\\SC_Acrobat.exe "
      "item"="Adobe Acrobat Speed Launcher"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Adobe Reader Speed Launch.lnk]
      "path"="C:\\Documents and Settings\\All Users\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\Adobe Reader Speed Launch.lnk"
      "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\PROGRA~1\\Adobe\\ACROBA~2.0\\Reader\\READER~1.EXE "
      "item"="Adobe Reader Speed Launch"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^HP Digital Imaging Monitor.lnk]
      "path"="C:\\Documents and Settings\\All Users\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\HP Digital Imaging Monitor.lnk"
      "backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqtra08.exe "
      "item"="HP Digital Imaging Monitor"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Microsoft Office.lnk]
      "path"="C:\\Documents and Settings\\All Users\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\Microsoft Office.lnk"
      "backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\PROGRA~1\\MICROS~2\\Office\\OSA9.EXE -b -l"
      "item"="Microsoft Office"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Symantec Fax Starter Edition Port.lnk]
      "path"="C:\\Documents and Settings\\All Users\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\Symantec Fax Starter Edition Port.lnk"
      "backup"="C:\\WINDOWS\\pss\\Symantec Fax Starter Edition Port.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\PROGRA~1\\MICROS~2\\Office\\1035\\OLFSNT40.EXE "
      "item"="Symantec Fax Starter Edition Port"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^HP_Omistaja^Käynnistä-valikko^Ohjelmat^Käynnistys^Adobe Gamma.lnk]
      "path"="C:\\Documents and Settings\\HP_Omistaja\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\Adobe Gamma.lnk"
      "backup"="C:\\WINDOWS\\pss\\Adobe Gamma.lnkStartup"
      "location"="Startup"
      "command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "
      "item"="Adobe Gamma"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^HP_Omistaja^Käynnistä-valikko^Ohjelmat^Käynnistys^OpenOffice.org 2.0.lnk]
      "path"="C:\\Documents and Settings\\HP_Omistaja\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\OpenOffice.org 2.0.lnk"
      "backup"="C:\\WINDOWS\\pss\\OpenOffice.org 2.0.lnkStartup"
      "location"="Startup"
      "command"="C:\\PROGRA~1\\OPENOF~1.0\\program\\QUICKS~1.EXE "
      "item"="OpenOffice.org 2.0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Acme.PCHButton]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="PCHButton"
      "hkey"="HKCU"
      "command"="C:\\PROGRA~1\\HELPAN~1\\Pavilion\\XPHWWBF4\\plugin\\bin\\PCHButton.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Acrobat Assistant 7.0]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="Acrotray"
      "hkey"="HKLM"
      "command"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Distillr\\Acrotray.exe\""
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Active Desktop Calendar]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="ADC"
      "hkey"="HKCU"
      "command"="C:\\Program Files\\XemiComputers\\Active Desktop Calendar\\ADC.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\AGRSMMSG]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="AGRSMMSG"
      "hkey"="HKLM"
      "command"="AGRSMMSG.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ATIPTA]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="atiptaxx"
      "hkey"="HKLM"
      "command"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\GhostStartTrayApp]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="GhostStartTrayApp"
      "hkey"="HKLM"
      "command"="C:\\Program Files\\Symantec\\Norton Ghost 2003\\GhostStartTrayApp.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\iTunesHelper]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="iTunesHelper"
      "hkey"="HKLM"
      "command"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\KBD]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="KBD"
      "hkey"="HKLM"
      "command"="C:\\HP\\KBD\\KBD.EXE"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\MsnMsgr]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="MsnMsgr"
      "hkey"="HKCU"
      "command"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\NBJ]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="NBJ"
      "hkey"="HKCU"
      "command"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\""
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\NeroFilterCheck]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="NeroCheck"
      "hkey"="HKLM"
      "command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\PS2]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="ps2"
      "hkey"="HKLM"
      "command"="C:\\WINDOWS\\system32\\ps2.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\QuickTime Task]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="qttask"
      "hkey"="HKLM"
      "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Recguard]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="RECGUARD"
      "hkey"="HKLM"
      "command"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SiS Windows KeyHook]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="keyhook"
      "hkey"="HKLM"
      "command"="C:\\WINDOWS\\System32\\keyhook.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Skype]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="Skype"
      "hkey"="HKCU"
      "command"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Sonic RecordNow!]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="Skype"
      "hkey"="HKCU"
      "command"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SunJavaUpdateSched]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="jusched"
      "hkey"="HKLM"
      "command"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
      "inimapping"="0"


      HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
      securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


      Contents of the 'Scheduled Tasks' folder
      C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1100 series#1133881755.job
      C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1100 series#1133928615.job

      Completion time: Thu 28.09.2006 11:14:21.39
      ComboFix.txt
      ComboFix2.txt

      ajeles vielä escan ... joudun tästä lähtemään reisuun. Onpahan dokumentiä sitten valmiiksi.

      Lataa tuolta
      http://koti.mbnet.fi/pattaya1/escanmwav.htm

      asenna, päivitä tapa2, laita täpit merkkauksien mukaan.

      Scannaa

      jos alaikkunaan virukset tulee jotain laita loki tänne.
      kopioi se näin:

      Käytä komentoa Ctrl A.
      Kopioi rivit komennolla Ctrl C.
      Liitä rivit komennolla Ctrl V.

      Äänestä

    f-securen uudelleen asennus ?

    Äänestä

    en nää logissa mitään ja mulla ei ole koskaan ollu securee,mutta eikö siinä voi pistää säännöt ku se kyselee .
    Scannaa tuo tuola ja ilmoita tulos

    C:\WINDOWS\system32\fmcodec.DLL

    http://www.virustotal.com/en/indexf.html

    ja toi KillWind.exe on visiin hp:n omia juttuja eli antaaa olla

    Äänestä

    • Olipas siellä ruuhkaa, skannaus pysähtyi jostakin syystä, mutta ei kait siellä mitään näiden tulosten perusteella ole sitten?

      Juu, täytyy tuota f-securea katsella mikä sitä riivaa kun kaikki ohjelmat ovat ottamassa yhteyttä nettiin.

      Tattista!

      STATUS: STOPPED
      Service is stopped in this moments. Scanning of your sample has not been finalized and results has been lost. If you wish to scan it, please send it again.

      Antivirus   Version   Update   Result
      AntiVir   7.2.0.18   09.28.2006   no virus found
      Authentium   4.93.8   09.28.2006   no virus found
      Avast   4.7.892.0   09.27.2006   no virus found
      AVG   386   09.27.2006   no virus found
      BitDefender   7.2   09.28.2006   no virus found
      CAT-QuickHeal   8.00   09.28.2006   no virus found
      ClamAV   devel-20060426   09.28.2006   no virus found
      eTrust-InoculateIT   23.73.7   09.28.2006   no virus found
      eTrust-Vet   30.3.3104   09.28.2006   no virus found
      DrWeb   4.33   09.28.2006   no virus found
      Ewido   4.0   09.28.2006   no virus found
      Fortinet   2.82.0.0   09.28.2006   no virus found
      F-Prot   3.16f   09.28.2006   no virus found
      F-Prot4   4.2.1.29   09.28.2006   no virus found
      Ikarus   0.2.65.0   09.28.2006   no virus found
      Kaspersky   4.0.2.24   09.28.2006   no virus found
      McAfee   4862   09.28.2006   no virus found
      Microsoft   1.1603   09.28.2006   no virus found
      NOD32v2   1.1781   09.28.2006   no virus found
      Norman   5.80.02   09.28.2006   no virus found
      Panda   9.0.0.4   09.27.2006   no virus found

      Aditional Information
      File size: 77824 bytes
      MD5: 5c8874ee321f4623fff7a1315039ddbc
      SHA1: d6931f0240d577dd439a0d92095f1c7609f584bc

      Äänestä

    • Justiina-70 kirjoitti:

      Olipas siellä ruuhkaa, skannaus pysähtyi jostakin syystä, mutta ei kait siellä mitään näiden tulosten perusteella ole sitten?

      Juu, täytyy tuota f-securea katsella mikä sitä riivaa kun kaikki ohjelmat ovat ottamassa yhteyttä nettiin.

      Tattista!

      STATUS: STOPPED
      Service is stopped in this moments. Scanning of your sample has not been finalized and results has been lost. If you wish to scan it, please send it again.

      Antivirus   Version   Update   Result
      AntiVir   7.2.0.18   09.28.2006   no virus found
      Authentium   4.93.8   09.28.2006   no virus found
      Avast   4.7.892.0   09.27.2006   no virus found
      AVG   386   09.27.2006   no virus found
      BitDefender   7.2   09.28.2006   no virus found
      CAT-QuickHeal   8.00   09.28.2006   no virus found
      ClamAV   devel-20060426   09.28.2006   no virus found
      eTrust-InoculateIT   23.73.7   09.28.2006   no virus found
      eTrust-Vet   30.3.3104   09.28.2006   no virus found
      DrWeb   4.33   09.28.2006   no virus found
      Ewido   4.0   09.28.2006   no virus found
      Fortinet   2.82.0.0   09.28.2006   no virus found
      F-Prot   3.16f   09.28.2006   no virus found
      F-Prot4   4.2.1.29   09.28.2006   no virus found
      Ikarus   0.2.65.0   09.28.2006   no virus found
      Kaspersky   4.0.2.24   09.28.2006   no virus found
      McAfee   4862   09.28.2006   no virus found
      Microsoft   1.1603   09.28.2006   no virus found
      NOD32v2   1.1781   09.28.2006   no virus found
      Norman   5.80.02   09.28.2006   no virus found
      Panda   9.0.0.4   09.27.2006   no virus found

      Aditional Information
      File size: 77824 bytes
      MD5: 5c8874ee321f4623fff7a1315039ddbc
      SHA1: d6931f0240d577dd439a0d92095f1c7609f584bc

      justiina täti Se on Puhas ;)

      Äänestä

    • Justiina-70 kirjoitti:

      Olipas siellä ruuhkaa, skannaus pysähtyi jostakin syystä, mutta ei kait siellä mitään näiden tulosten perusteella ole sitten?

      Juu, täytyy tuota f-securea katsella mikä sitä riivaa kun kaikki ohjelmat ovat ottamassa yhteyttä nettiin.

      Tattista!

      STATUS: STOPPED
      Service is stopped in this moments. Scanning of your sample has not been finalized and results has been lost. If you wish to scan it, please send it again.

      Antivirus   Version   Update   Result
      AntiVir   7.2.0.18   09.28.2006   no virus found
      Authentium   4.93.8   09.28.2006   no virus found
      Avast   4.7.892.0   09.27.2006   no virus found
      AVG   386   09.27.2006   no virus found
      BitDefender   7.2   09.28.2006   no virus found
      CAT-QuickHeal   8.00   09.28.2006   no virus found
      ClamAV   devel-20060426   09.28.2006   no virus found
      eTrust-InoculateIT   23.73.7   09.28.2006   no virus found
      eTrust-Vet   30.3.3104   09.28.2006   no virus found
      DrWeb   4.33   09.28.2006   no virus found
      Ewido   4.0   09.28.2006   no virus found
      Fortinet   2.82.0.0   09.28.2006   no virus found
      F-Prot   3.16f   09.28.2006   no virus found
      F-Prot4   4.2.1.29   09.28.2006   no virus found
      Ikarus   0.2.65.0   09.28.2006   no virus found
      Kaspersky   4.0.2.24   09.28.2006   no virus found
      McAfee   4862   09.28.2006   no virus found
      Microsoft   1.1603   09.28.2006   no virus found
      NOD32v2   1.1781   09.28.2006   no virus found
      Norman   5.80.02   09.28.2006   no virus found
      Panda   9.0.0.4   09.27.2006   no virus found

      Aditional Information
      File size: 77824 bytes
      MD5: 5c8874ee321f4623fff7a1315039ddbc
      SHA1: d6931f0240d577dd439a0d92095f1c7609f584bc

      tästä hjt:stä

      salli sen tehdä se.

      Äänestä

    • Poistelen vain kirjoitti:

      tästä hjt:stä

      salli sen tehdä se.

      joo, jos tarkoitit tuota kuvaa minkä linkitin, niin sitä kyselin kun vaikka mitä meinaa tehdä, F-secure kyselee lupaa.
      Ihan sama minkä ohjelman käynnistää tai yrittää suorittaa jotakin, jokaisesta tulee kyselyä joko nettiin tai sallitaanko toisen sovelluksen aukaista toista sovellusta.

      Siis jos avaan vaikka Excelin eikä ole aikomustakaan sillä ottaa nettiin yhteyttä, F-secure on kärppänä kysymässä sille lupaa päästä nettiin kuitenkin.

      Nyt olen sitten vaan sallinut tai en ja laittanut täppiä ettei kysele enää, mutta onhan noita sovelluksia riesaksi asti kun jokaisessa täytyy jatkuvasti sallia tai kieltää.
      En tiedä mikä sille on tullut kun kyselee, mutta täytyy tutkia tarkemmin kun on aikaa.

      Ja moro vaan sinne ylemmäksi :o)
      Sekä kiitokset kaikille.

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    Justiina-70 kirjoitti:

    Moi,

    Kone on juntturassa eikä välillä saa auki ollenkaan ilman chkdiskiä, käynnistää uudelleen juuri ennen tervetuloa ikkunaa.
    F-secure on alkanut kyselemään lupaa lähes joka ohjelman käynnistyksessä millähän sen saisi rauhoittumaan?
    Tässä yksi esimerkki, eikä tällaista ole ennemmin esiintynyt
    http://koti.mbnet.fi/justina/fsecure.JPG

    Ja vaikka minkä ohjelman aukaisee, f-secure kysyy lupaa sille nettiin pääsystä.

    eScan löysi hp/bin kansiosta KillWind.exen, ei toimenpiteitä.
    Lueskelin eri palstoilta ja on vissiin jokin Hp:n oma juttu, mutta ei oikein selvinnyt kannattaako poistaa vai ei.

    Hjt logissa ihmetyttää kun näyttää olevan Backweb 2005 ja 2006?

    Löytyisikö tästä mitään putsattavaa?

    Logfile of HijackThis v1.99.1
    Scan saved at 8:51:13, on 28.9.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\windows\system\hpsysdrv.exe
    C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
    C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
    C:\Program Files\Weather Watcher\ww.exe
    C:\Program Files\HP\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\HP\Digital Imaging\bin\hpoevm08.exe
    C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
    C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
    C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
    C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\HJT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q404&bd=pavilion&pf=desktop
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q404&bd=pavilion&pf=desktop
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q404&bd=pavilion&pf=desktop
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q404&bd=pavilion&pf=desktop
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q404&bd=pavilion&pf=desktop
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: HP-näkymä - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
    O4 - HKCU\..\Run: [WeatherWatcher] C:\Program Files\Weather Watcher\ww.exe
    O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\PCHButton.exe
    O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: &Google-haku - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Käännä englanninkielinen sana - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Linkit taaksepäin - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Samankaltaisia sivuja - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Save Flash - res://C:\Program Files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll/210
    O8 - Extra context menu item: Välimuistissa oleva kuvakaappaus sivusta - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Flash - {43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA} - C:\Program Files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll (HKCU)
    O10 - Broken Internet access because of LSP provider 'winsflt.dll' missing
    O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
    O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.6.0.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1133865138109
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9A8DA514-85C6-41E1-BD9C-B02C8DC6949F}: NameServer = 192.168.1.1
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Sovelluskerroksen yhdyskäytäväpalvelu (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
    O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu