APUA!
Tietokoneellani on joku häikkä, Virus!? Järjestelmä on bugittanut ja jumittunut viime aikoina pahasti, eikä viimeyönä suostunut sulkemaan itseään normaalisti vaan jouduin sulkemaan koneesta. Internet sivuilla ollesani saattaa joskus ilman varoitusta sulkea ikkunat (esim. runescape yleisesti kun sisarukset pelaavat). Tämän lisäksi eilen näytölle ilmaantuiteksti: Your computer is infected whit Virus tjsp. Tein testin AVG Antivirus 6.0 ohjelmalla, mutta kertoi että ei ole virusta. Käynnistäessäni AVG Antiviruksen se tyrkyttää uutta versiota, mutta en jostain syystä pysty ladata sitä. Onko siis tästä vanhasta kulunut Best before päivät? Kannattaako vaihtaa? Viimeaikoina tullut pari-kolme virusta! Tietokoneessa on Ad-Adware, palomuuri ja Spybot. Äsken joku ErrorSafe ikkuna tuli jossa luki että järjestelmässä on pahoita virheitä jotka saattavat aiheuttaa pysyviä ongelmia tai ihmeellisiä järjestelmän kaatumista ja tilttaamista. Asensin ohjelman ja testissä se sano että joku 11k vakavaa virhettä,
halusin rekisteröityä, mutta maksaakin 35€, ErrorSafe kuulema suojaa vieläkin konetta vaikka en ole rekistöröinyt. Lisäksi Internet-Yhteys on tullut jonkun verran hitaammaksi.
Miten menetellä? Ad-Adware ilmoitti että tietokoneessa on joku juttu, mutta voimakkuus kuulema Low. Asennanko jonkun ohjelman sen poistoon? Minkän, nykyyän kaikki maksaa!? Tarvitsen kuumeisesti apuanne. Toivottavasti kuuluu vastakaikua pikaisesti.
Toisella foorumilla yksi kaveri neuvoi latamaan HijackThis ohjelman, mutta vasta sitten kun tiedän miten menetellä sen kanssa. Hän sanoi näin:
"Ja sanon vielä kerran ÄLÄ käytä sitä ilman, että saat neuvoja mitä sillä kannattaa poistaa. Tuolta Suomi24-palstalta saat varmasti apua (kuten minäkin sain), joten sinne kannattaa äskeinen postisi laittaa ja osaavat varmasti auttaa minua paremmin ja neuvoa mitä kannattaa tehdä ja mitä ei."
Joten voitteko te opastaa minua käyttämään tuota ja kertoa mitä kannattaa poistaa ja mitä ei.
Suuret kiitokset etukäteen vastanneille!
P.S Käynnistä --> Apuohjelmat valikossa on järjestelmän palauttaminen eli joku backup = Jos tulee virus pistän jonkun toisen päivän esim. 1.9 sen jälkeen kaikki on ennallaan jos tuona päivänä ei ollut viruksia. Teenkö nytkin näin, voiko tätä käyttää loputtomiin? Onko haittavaikutuksia?
Arvostan tosi korkealle niitä jotka viitsivät auttaa minua omien (mahdollisten) ongelmien lisäksi. Turhan usein kuulee sanottavan: "Mitäs hajotit, kärsi seurauksista"
Kiitos.
Tietokoneellani on joku häikkä, Virus!? Järjestelmä on bugittanut ja jumittunut viime aikoina pahasti, eikä viimeyönä suostunut sulkemaan itseään normaalisti vaan jouduin sulkemaan koneesta. Internet sivuilla ollesani saattaa joskus ilman varoitusta sulkea ikkunat (esim. runescape yleisesti kun sisarukset pelaavat). Tämän lisäksi eilen näytölle ilmaantuiteksti: Your computer is infected whit Virus tjsp. Tein testin AVG Antivirus 6.0 ohjelmalla, mutta kertoi että ei ole virusta. Käynnistäessäni AVG Antiviruksen se tyrkyttää uutta versiota, mutta en jostain syystä pysty ladata sitä. Onko siis tästä vanhasta kulunut Best before päivät? Kannattaako vaihtaa? Viimeaikoina tullut pari-kolme virusta! Tietokoneessa on Ad-Adware, palomuuri ja Spybot. Äsken joku ErrorSafe ikkuna tuli jossa luki että järjestelmässä on pahoita virheitä jotka saattavat aiheuttaa pysyviä ongelmia tai ihmeellisiä järjestelmän kaatumista ja tilttaamista. Asensin ohjelman ja testissä se sano että joku 11k vakavaa virhettä,
halusin rekisteröityä, mutta maksaakin 35€, ErrorSafe kuulema suojaa vieläkin konetta vaikka en ole rekistöröinyt. Lisäksi Internet-Yhteys on tullut jonkun verran hitaammaksi.
Miten menetellä? Ad-Adware ilmoitti että tietokoneessa on joku juttu, mutta voimakkuus kuulema Low. Asennanko jonkun ohjelman sen poistoon? Minkän, nykyyän kaikki maksaa!? Tarvitsen kuumeisesti apuanne. Toivottavasti kuuluu vastakaikua pikaisesti.
Toisella foorumilla yksi kaveri neuvoi latamaan HijackThis ohjelman, mutta vasta sitten kun tiedän miten menetellä sen kanssa. Hän sanoi näin:
"Ja sanon vielä kerran ÄLÄ käytä sitä ilman, että saat neuvoja mitä sillä kannattaa poistaa. Tuolta Suomi24-palstalta saat varmasti apua (kuten minäkin sain), joten sinne kannattaa äskeinen postisi laittaa ja osaavat varmasti auttaa minua paremmin ja neuvoa mitä kannattaa tehdä ja mitä ei."
Joten voitteko te opastaa minua käyttämään tuota ja kertoa mitä kannattaa poistaa ja mitä ei.
Suuret kiitokset etukäteen vastanneille!
P.S Käynnistä --> Apuohjelmat valikossa on järjestelmän palauttaminen eli joku backup = Jos tulee virus pistän jonkun toisen päivän esim. 1.9 sen jälkeen kaikki on ennallaan jos tuona päivänä ei ollut viruksia. Teenkö nytkin näin, voiko tätä käyttää loputtomiin? Onko haittavaikutuksia?
Arvostan tosi korkealle niitä jotka viitsivät auttaa minua omien (mahdollisten) ongelmien lisäksi. Turhan usein kuulee sanottavan: "Mitäs hajotit, kärsi seurauksista"
Kiitos.
Vastaukset 56
Vanhimmat
Lataa http://koti.mbnet.fi/pattaya1/lataus/hijackthis_self.exe
asenna
naputtele numerojärjestyksessä
1.Unzip
2.OK
3.Close
Paina nappia Do a system scan and save a logfile
Laita ponnahtava muistio tänne ( Hjt-loki )
Tsekkasin ohjeet tuohon HajickThis ohjelmaan. Siellä luki että se on voimakas ohjelma, jolla saa paljon tuhoa aikaan jos käyttää väärin. Kaverikin sanoi että kannattaa kysyä neuvoa asiantuntijalta ennen kun käytät sitä. Nyt pelottaa, kun tuo vaikuttaa vähän monimutkaiselta. Olen vasta 13-vuotias ja enkku sujuu jotenkuten joten voin tehdä vahingossa jotain väärin.
Olenko ymmärtänyt kuitenkin oikein: Kun lataan ohjelman, skannaan. Sitten lähetän sen lokin tänne ja te sanotte mitä pitää poistaa? En siis voi tehdä tuhoa muuten kuin jos poistan jonkun ohjelman jota ei pidä? Eli sen käyttö pitäis olla melko turvallista?
scannaa vain ja laita se ponnahtava muistio tänne. ( hjt-loki )
Okei, okei. Ja sä oot asiantuntija, vai mitä? ;)
Tarkoitin kysyä onko sulla perushommat hallussa et voin tarvittaessa kysyä.
vain se hjt-loki kokonaisena tänne. eli se muistio.
Logfile of HijackThis v1.99.1
Scan saved at 13:34:51, on 18.10.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\hbt\Dialers\Blondes\Blondes.exe
C:\windows\system32\dxvid.exe
C:\program files\common files\system\dfb70b19.exe
C:\program files\siteicons\dialers\dluxve\dluxve.exe
C:\windows\system32\gdimx.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Error Safe Free\ers.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Blondes] C:\Program Files\hbt\Dialers\Blondes\Blondes.exe /dontdial
O4 - HKLM\..\Run: [wsg32] wsg32.exe
O4 - HKLM\..\Run: [dxvid] c:\windows\system32\dxvid.exe /nocomm
O4 - HKLM\..\Run: [MPlay64] c:\program files\common files\system\dfb70b19.exe /noerrorinfo
O4 - HKLM\..\Run: [dluxve] c:\program files\siteicons\dialers\dluxve\dluxve.exe /nocomm
O4 - HKLM\..\Run: [gdimx] c:\windows\system32\gdimx.exe /nocomm
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Error Safe] C:\Program Files\Error Safe Free\ers.exe /scan
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\\Steam.exe -silent
O4 - HKCU\..\Run: [Error Safe] "C:\Program Files\Error Safe Free\ers.exe" /min
O4 - Startup: .protected
O4 - Startup: PalNetaware.lnk = C:\Paltalk\puninstall.exe
O4 - Global Startup: .protected
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F5131C24-E56D-11CF-B78A-444553540000} (Ikonic Menu Control) - http://activex.microsoft.com/controls/iptdweb/ikcntrls.cab
O16 - DPF: {F5820AD3-9B20-423E-B2AA-7AF2B4055746} (CRegistryDownload Class) - http://download.paltalk.com/download/0.x/regdload.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG6 Service (AvgServ) - GRISOFT(c) SOFTWARE s.r.o - C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Poista kaikki javat lisää poista sovellutuksesta
Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
Lataa tuolta uusi java
http://java.sun.com/javase/downloads/index.jsp
Java Runtime Environment (JRE) 5.0 Update 9
lisää poista sovelutuksesta
Error Safe
scannaa hjt:llä merkkaa ja paina Fix checked
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [dxvid] c:\windows\system32\dxvid.exe /nocomm
O4 - HKLM\..\Run: [MPlay64] c:\program files\common files\system\dfb70b19.exe /noerrorinfo
O4 - HKLM\..\Run: [Error Safe] C:\Program Files\Error Safe Free\ers.exe /scan
O4 - HKCU\..\Run: [Error Safe] "C:\Program Files\Error Safe Free\ers.exe" /min
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
mene vikasiettotilaan
sammuta ja käynnistä
käynnistyksenyhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina Enter ja uudelleen Enter OK
poista kansio
C:\Program Files\====> Error Safe Free
Miten sinne mentiin? Tietokone on kyl ollut vikasietotilassa, mutta en muista miten siihen mennään.
Mene vikasietotilaan
sammuta ja käynnistä
käynnistyksenyhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina Enter ja uudelleen Enter OK
Okei. Thänks.
Entäs tuo Java, katoin vähän noita muita viestejä ja huomasin et sanoit usealle että poistaa javan ja lataa uusi. Mitä eroa niillä on? Onko tossa mun javassa viruksia? Kiitos vielä.
että javan kautta ei tule pahempaa örkkiä.
lävitse.
ja laita sitten se uusi hjt-loki
Lataa http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Pura sisältö (kansio nimeltä SmitfraudFix työpöydällesi:
Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla Enter; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita tämän tekstitiedoston sisältö viestiketjuusi.
Huomaa: process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.
File C:\WINDOWS\g4225203.dll infected by "Trojan-Downloader.Win32.Delf.amb" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SexShows.exe tagged as not-a-virus:Porn-Dialer.Win32.Generic. No Action Taken.
File C:\WINDOWS\system32\ddccc.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.cq. No Action Taken.
File C:\WINDOWS\system32\winjgf32(2).dll infected by "Packed.Win32.Klone.g" Virus. Action Taken: File Renamed.
Toi toka tiedosto ei sit liity mitenkää muhu ;)
Vikasietotilassa en löydä C asemalta sitä.
Ja sit tota Errorsafe scan juttuu ei ollu.
Logfile of HijackThis v1.99.1
Scan saved at 21:11:33, on 18.10.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\hbt\Dialers\Blondes\Blondes.exe
C:\program files\siteicons\dialers\dluxve\dluxve.exe
C:\windows\system32\gdimx.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Blondes] C:\Program Files\hbt\Dialers\Blondes\Blondes.exe /dontdial
O4 - HKLM\..\Run: [dluxve] c:\program files\siteicons\dialers\dluxve\dluxve.exe /nocomm
O4 - HKLM\..\Run: [gdimx] c:\windows\system32\gdimx.exe /nocomm
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\\Steam.exe -silent
O4 - Startup: .protected
O4 - Startup: PalNetaware.lnk = C:\Paltalk\puninstall.exe
O4 - Global Startup: .protected
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F5131C24-E56D-11CF-B78A-444553540000} (Ikonic Menu Control) - http://activex.microsoft.com/controls/iptdweb/ikcntrls.cab
O16 - DPF: {F5820AD3-9B20-423E-B2AA-7AF2B4055746} (CRegistryDownload Class) - http://download.paltalk.com/download/0.x/regdload.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG6 Service (AvgServ) - GRISOFT(c) SOFTWARE s.r.o - C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
noilla sivuilla ei parane käydä tulee pöpöjä
scannaa hjt:llä merkkaa paina fix checked
O4 - HKLM\..\Run: [Blondes] C:\Program Files\hbt\Dialers\Blondes\Blondes.exe /dontdial
poista vikasiedossa
C:\WINDOWS\--> g4225203.dll SexShows.exe hbt
Ne on meiän perheen vanhimmat jotka tuol käy ;)
Teeksmä ton jutun minkä sä lähetit aikasemmin nyt vai myöhemmin?
sitten jatkat mitä et ole tehnyt.
Menemäänn vikasietotilaan. eikä suostu sammumaan kunnolla, vaa pitää koneesta sammuttaa eikä pysty näytöltä.
lataa ccleaner
http://www.download.fi/tyopoytaohjelmat/haittaohjelmien_poisto/ccleaner.cfm
asenna
aja Puhdistaja > tutki > aja ccleaner
aja virheet > etsi rekisteri virheitä > korjaa valitut rekisteri virheet > siten se omapäätös seuraavan kohdalla > ja se korjaus
sitten sammuta ja käynnistä
http://keskustelu.suomi24.fi/show.fcgi?category=108&conference=4500000000000628&posting=22000000020536405
Joo, mut siinä SmitfraudFix kansios ei oo sitä SmitfraudFix.jtn. siel on vain Smitfraudfix Windows Komentosarja ja kun klikkaan sitä tulee vain musta juttu ja menee pois.
Ajoin Ccleanerin ja tuli hemmetisti virheitä. No pistin Aja Cleaner ja se sanoi että ne poistuu kokonaan tietokoneelta. Joukossa oli RealOnePlayer, uskallanko poistaa?
taida olla enään koneella.
Poista vain.
Miten niin ei ole? Mutta siis kannattaa poistaa kaikki mitä sieltä löytyy?
hjt - loki
Logfile of HijackThis v1.99.1
Scan saved at 19:40:32, on 19.10.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\ATI-CPanel\atiptaxx.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\program files\siteicons\dialers\dluxve\dluxve.exe
C:\windows\system32\gdimx.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [dluxve] c:\program files\siteicons\dialers\dluxve\dluxve.exe /nocomm
O4 - HKLM\..\Run: [gdimx] c:\windows\system32\gdimx.exe /nocomm
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [Blondes] C:\Program Files\hbt\Dialers\Blondes\Blondes.exe /dontdial
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\\Steam.exe -silent
O4 - Startup: .protected
O4 - Startup: PalNetaware.lnk = C:\Paltalk\puninstall.exe
O4 - Global Startup: .protected
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F5131C24-E56D-11CF-B78A-444553540000} (Ikonic Menu Control) - http://activex.microsoft.com/controls/iptdweb/ikcntrls.cab
O16 - DPF: {F5820AD3-9B20-423E-B2AA-7AF2B4055746} (CRegistryDownload Class) - http://download.paltalk.com/download/0.x/regdload.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG6 Service (AvgServ) - GRISOFT(c) SOFTWARE s.r.o - C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta
Lataa http://www.ewido.net/en/download/ ja tallenna ohjelma työpöydällesi.
• Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
• Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
• Käynnistä Ewido Anti-Spyware.
• Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
• Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
• Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
• Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
• Sitten "Reports" valikon alta:
• Laita täppi kohtaan "Automatically generate report after every scan"
• Ota täppi pois kohdasta"Only if threats were found"
• Sulje ohjelma, ÄLÄ skannaa vielä.
Käynnistä koneesi vikasietotilaan
sammuta ja käynnistä
käynnistyksenyhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina Enter ja uudelleen Enter OK
HUOM! Älä käytä muita ohjelmia Ewidon skannauksen aikana, tämä saattaa häiritä skannausta.
• Kun vikasietotilassa, käynnistä Ewido Anti-Spyware.
• Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
• Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
• Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
• Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
• Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
• Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
• Sulje ohjelma, käynnistä kone normaalisti ja lähetä Ewidon raportti viestikejuusi.
Tein prikulleen niinkuin sanoit!
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
Created at: 15:22:47 20.10.2006
Scan result:
C:\Program Files\AntivirusGolden -> Adware.AntiVirusGolden : Cleaned with backup (quarantined).
C:\Program Files\AntivirusGolden\AntivirusGolden.url -> Adware.AntiVirusGolden : Cleaned with backup (quarantined).
C:\Program Files\AntivirusGolden\Logs -> Adware.AntiVirusGolden : Cleaned with backup (quarantined).
C:\Program Files\AntivirusGolden\Logs\scan_log_07302006-132441.html -> Adware.AntiVirusGolden : Cleaned with backup (quarantined).
C:\Program Files\AntivirusGolden\Logs\scan_log_07302006-140234.html -> Adware.AntiVirusGolden : Cleaned with backup (quarantined).
C:\Program Files\AntivirusGolden\Logs\scan_log_07312006-082234.html -> Adware.AntiVirusGolden : Cleaned with backup (quarantined).
C:\Program Files\AntivirusGolden\db.dat -> Adware.AntiVirusGolden : Cleaned with backup (quarantined).
C:\Program Files\AntivirusGolden\generalConfig.xml -> Adware.AntiVirusGolden : Cleaned with backup (quarantined).
C:\Program Files\AntivirusGolden\monitorConfig.xml -> Adware.AntiVirusGolden : Cleaned with backup (quarantined).
C:\Program Files\AntivirusGolden\scannerConfig.xml -> Adware.AntiVirusGolden : Cleaned with backup (quarantined).
C:\Program Files\AntivirusGolden\usageStats.xml -> Adware.AntiVirusGolden : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Bargain Buddy -> Adware.BargainBuddy : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\WinTaskAdX.Installer -> Adware.BlazeFind : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\WinTaskAdX.Installer\CLSID -> Adware.BlazeFind : Cleaned with backup (quarantined).
C:\Program Files\BraveSentry -> Adware.Bravesentry : Cleaned with backup (quarantined).
C:\Program Files\BraveSentry\BraveSentry0.bs -> Adware.Bravesentry : Cleaned with backup (quarantined).
C:\Program Files\BraveSentry\BraveSentry1.bs -> Adware.Bravesentry : Cleaned with backup (quarantined).
HKLM\SOFTWARE\KMiNT21 -> Adware.DesktopSpyAgent : Cleaned with backup (quarantined).
HKLM\SOFTWARE\KMiNT21\GoldenKeylogger -> Adware.DesktopSpyAgent : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Activate.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\AE_CD_Cr.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\AReadr4.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\AReadr5.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\ASDSEEpv.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\ASPack.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\BDelphi5.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\Babylon.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\CBuildr5.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\CCGA.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\CManager.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\CatchUp.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\CuteFTP4.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\CuteHTML.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\DAcceler.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\DiscJug.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\ECDCreat4.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\FFTsks.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\Far.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\FlashFXP.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\FrntPage.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\FrontPEx.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\FtpEXP.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\FtpVoya.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\GetRight.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\GoZilla.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\GravMRU.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\H_TxtPad.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\HomeSite.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\HotDogPr.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\IconExtr.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\ImgReady3.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\InsShExp.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\JASC_P_P.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\KaZaA.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\LView.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\MMUnDisk.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\MM_CON.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\MPImaGal.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\MPaint.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\MPicPub.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\MSExplorer.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\MSRegEdit.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\MSWMP.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\MSWordPad.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\MSoffice.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\MacDir.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\MacDrWea.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\MicAng.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\MicDes.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\Morpheus.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\NTBackup.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\Nero.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\NetShow.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\PHPCoder.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\PhotShel.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\PowerZIP.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\RapidBr.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\RealAuPl.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\RealDown.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\SL_BlWin.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\SecurCRT.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\SmartClr.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\Sonique.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\StuffIt.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\TelepPro.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\UGifAnim.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\UMedStud.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\UPhImpV.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\UPhotoEx.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\UVidStud.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\UltraEd.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\VNC.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\WebFeret.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\WebReap.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\WinACE.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\WinGate.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\WinRAR.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\WinZIP.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\WiseInst.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\YahooPl.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\ZipMagic.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Appbase\iMesh.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\ScanReport.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\Schedule.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\UDC2006.xml -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\UDC6.url -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\UDCShell.xml -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\UninstallPage.html -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\bnlink.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\img -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\img\button.gif -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\img\button2.gif -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\img\header.gif -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\img\logo.gif -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\img\spacer.gif -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\img\top1.jpg -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\img\top2.jpg -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\img\top_line.gif -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\lapv.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\license.rtf -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\manual.url -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\pv.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\readme.rtf -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\sr.log -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\support.url -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\unins000.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\up.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\update.log -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\updater.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\DriveCleaner 2006 Free\vbpv.dat -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173364.exe -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173366.exe -> Adware.DriveCleaner : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ISTactivex.dll -> Adware.ISTBar : Cleaned with backup (quarantined).
C:\Program Files\Power Scan -> Adware.PowerScan : Cleaned with backup (quarantined).
C:\Program Files\SearchRelevant\SearchRelevant.dll -> Adware.Relevance : Cleaned with backup (quarantined).
C:\Program Files\DSPlayer_v0.888_free_ad_supported\DSplayer_WhenUSave_InstallerInstRe.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\DSPlayer_v0.888_free_ad_supported\SetupInst.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP981\A0189508.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\WINDOWS\Downloaded Program Files\webdlg32.dll -> Adware.SBSoft : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173421.dll -> Adware.SearchAssistant : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173423.dll -> Adware.SearchAssistant : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173424.dll -> Adware.SearchAssistant : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173508.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173422.dll -> Adware.Spysheriff : Cleaned with backup (quarantined).
C:\Program Files\SpyQuake2.com -> Adware.SpywareQuake : Cleaned with backup (quarantined).
C:\Program Files\SpyQuake2.com\SpyQuake2.com.url -> Adware.SpywareQuake : Cleaned with backup (quarantined).
C:\Program Files\SpyQuake2.com\blacklist.txt -> Adware.SpywareQuake : Cleaned with backup (quarantined).
C:\Program Files\SpyQuake2.com\ref.dat -> Adware.SpywareQuake : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173512.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\djtopr1150.exe -> Adware.WebRebates : Cleaned with backup (quarantined).
C:\temp\WebRebates_Auto_InstallSilent_Euro.exe -> Adware.WebRebates : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup (quarantined).
C:\Program Files\Windows AdControl\WinAdShift.dll -> Adware.WinAD : Cleaned with backup (quarantined).
C:\temp\WinCtlAdInstPack.exe -> Adware.WinAD : Cleaned with backup (quarantined).
C:\temp\WinTaskAdInstPack.exe -> Adware.WinAD : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006 -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\ASupdater.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\AWBase -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\AWBase\database -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\AWBase\database\enemies.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\AWBase\vbpv.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\BkSites.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\FWSvc(2).exe -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\License.rtf -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\PGBase -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\PGBase\vbpv.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\PGupdater.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\RulSrv(2).dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\UBUpdater.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\UninstallPage.html -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\WinAV.xml -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\alerts.txt -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\avcom.log -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\bnlink.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\bpupdater.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\history.db -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\img -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\img\button.gif -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\img\button2.gif -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\img\header.gif -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\img\logo.gif -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\img\spacer.gif -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\img\top1.jpg -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\img\top2.jpg -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\img\top_line.gif -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\index.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\lapv.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\online.url -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\phigh.bin -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\plugins -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\plugins\.UA27215.DLL.UQvNUR -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\plugins\.UADAILY.DLL.SrUTf8 -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\plugins\NEWVIR.DAT -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\plugins\vbpv.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\pmedium.bin -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\prc.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\prerules.xml -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\programs.bin -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\ps.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\pv.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\res -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\res\Register.gif -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\res\cross.gif -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\res\wa6p.gif -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\settings.bin -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\st.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\support.url -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\traffic.txt -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\unins000.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\up.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\updater.dat -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\worldmap.swf -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173447.sys -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173448.sys -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173449.exe -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173458.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173464.exe -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173470.exe -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173472.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\Windows TaskAd -> Adware.WinTaskAd : Cleaned with backup (quarantined).
C:\Program Files\Windows TaskAd\WinProject.dll -> Adware.WinTaskAd : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\YSBactivex.Installer -> Adware.YourSiteBar : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\YSBactivex.Installer\CLSID -> Adware.YourSiteBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP985\A0196879.exe -> Dialer.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-3209661291-2546901333-765719832-1005\Software\Siteicons -> Dialer.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-3209661291-2546901333-765719832-1005\Software\Siteicons\Dialers -> Dialer.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-3209661291-2546901333-765719832-1005\Software\Siteicons\Dialers\dluxve -> Dialer.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-3209661291-2546901333-765719832-1005\Software\Siteicons\gdimx -> Dialer.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP985\A0196909.exe -> Downloader.Agent.alr : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_204.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_37C.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_524.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_5B0.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_6E8.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_6F4.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_700.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_760.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_80.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_884.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_88C.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_898.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_8D4.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_900.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_99C.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_9A0.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_9DC.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_B0.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_BFC.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temporary Internet Files\Content.IE5\H9VPGFVA\mplay64[2].exe -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_230.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_3F8.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_400.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_470.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_60C.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_6B0.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_6B4.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_6B8.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_6BC.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_6C0.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_6C4.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_6D4.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_6DC.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_6E4.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_750.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_7B0.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_818.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_850.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_8A4.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_988.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_A90.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_AFC.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_D5C.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_D7C.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_DD4.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_F04.tmp -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\Program Files\Common Files\System\mplay64.exe -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173672.exe -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP924\A0175182.exe -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP924\A0175209.exe -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP925\A0175240.exe -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP926\A0175343.exe -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP927\A0175380.exe -> Downloader.Agent.wp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173315.dll -> Downloader.Delf.amb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP984\A0193851.dll -> Downloader.Delf.amb : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_384.tmp -> Downloader.Dluca : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_39C.tmp -> Downloader.Dluca : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_428.tmp -> Downloader.Dluca : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_6C8.tmp -> Downloader.Dluca : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_6CC.tmp -> Downloader.Dluca : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_6F0.tmp -> Downloader.Dluca : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\qdelwbi.tmp -> Downloader.Dluca : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173673.exe -> Downloader.Dluca.cc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP917\A0174860.exe -> Downloader.Dluca.cc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP927\A0175406.exe -> Downloader.Dluca.cc : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_184.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_1F4.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_508.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_574.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_5B4.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_64C.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_680.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_6D8.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_6E0.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_6EC.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_76C.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_7F4.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_83C.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_854.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_86C.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_87C.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_8B0.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_8C0.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_960.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_98.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_9C4.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_BE4.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\ERMIN\Local Settings\Temp\lf_C74.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_1EC.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_3FC.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_45C.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_494.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_608.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_698.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_6A0.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_6A4.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_6AC.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_72C.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_748.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_7A0.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_85C.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_884.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_888.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_92C.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_E34.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_E8C.tmp -> Downloader.Dluca.ci : Cleaned with backup (quarantined).
C:\Documents and Settings\NERMINA\Local Settings\Temp\lf_A24.tmp -> Downloader.Dluca.cp : Cleaned with backup (quarantined).
C:\Documents and Settings\NERMINA\Local Settings\Temporary Internet Files\Content.IE5\GHMJCXQV\mplay64[1].exe -> Downloader.Dluca.cp : Cleaned with backup (quarantined).
C:\Documents and Settings\NERMINA\Local Settings\Temporary Internet Files\Content.IE5\GHMJCXQV\mplay64[2].exe -> Downloader.Dluca.cp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_920.tmp -> Downloader.Dluca.cp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_9BC.tmp -> Downloader.Dluca.cp : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\lf_CDC.tmp -> Downloader.Dluca.cp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP936\A0175681.exe -> Downloader.Dluca.cp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP937\A0175728.exe -> Downloader.Dluca.cp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP938\A0175748.exe -> Downloader.Dluca.cp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP939\A0175800.exe -> Downloader.Dluca.cp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP940\A0175814.exe -> Downloader.Dluca.cp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP941\A0175850.exe -> Downloader.Dluca.cp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP942\A0175893.exe -> Downloader.Dluca.cs : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP947\A0176057.exe -> Downloader.Dluca.cs : Cleaned with backup (quarantined).
C:\WINDOWS\Downloaded Program Files\ysbactivex.dll -> Downloader.IstBar : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\iinstall.VIR -> Downloader.IstBar.pe : Cleaned with backup (quarantined).
C:\Documents and Settings\SULEIMAN ZEC\Local Settings\Temp\winCE.tmp.exe -> Downloader.Obfuscated.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP914\A0173258.exe -> Downloader.Obfuscated.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP914\A0173274.exe -> Downloader.Obfuscated.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP914\A0173295.exe -> Downloader.Obfuscated.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173332.exe -> Downloader.Obfuscated.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173511.exe -> Downloader.Obfuscated.a : Cleaned with backup (quarantined).
C:\HJT\backups\backup-20061018-202525-438.dll -> Downloader.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP914\A0173254.exe -> Downloader.Zlob.abc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP914\A0173271.exe -> Downloader.Zlob.abc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP914\A0173292.exe -> Downloader.Zlob.abc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173334.exe -> Downloader.Zlob.abc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173506.exe -> Downloader.Zlob.abc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173503.exe -> Downloader.Zlob.acr : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP914\A0173255.dll -> Downloader.Zlob.adp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP914\A0173272.dll -> Downloader.Zlob.adp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP914\A0173293.dll -> Downloader.Zlob.adp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173335.dll -> Downloader.Zlob.adp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173504.exe -> Downloader.Zlob.ul : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP914\A0173236.exe -> Dropper.Agent.asl : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173513.exe -> Dropper.Agent.asl : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173475.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173501.dll -> Not-A-Virus.Hoax.Win32.Renos.dw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173502.dll -> Not-A-Virus.Hoax.Win32.Renos.dw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP914\A0173221.exe -> Not-A-Virus.Monitor.Win32.GoldenKeylogger.126 : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173738.exe -> Not-A-Virus.Monitor.Win32.GoldenKeylogger.126 : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP914\A0173222.exe -> Not-A-Virus.Monitor.Win32.GoldenKeylogger.130 : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP914\A0173224.dll -> Not-A-Virus.Monitor.Win32.GoldenKeylogger.130 : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173739.exe -> Not-A-Virus.Monitor.Win32.GoldenKeylogger.130 : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173741.dll -> Not-A-Virus.Monitor.Win32.GoldenKeylogger.130 : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP914\A0173223.dll -> Not-A-Virus.Monitor.Win32.GoldenKeylogger.150 : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{A74FE8B1-8508-4747-A4BD-E7F9C7F594A2}\RP915\A0173740.dll -> Not-A-Virus.Monitor.Win32.GoldenKeylogger.150 : Cleaned with backup (quarantined).
:mozilla.129:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.130:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.131:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.132:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.133:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.134:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.135:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.136:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.137:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.138:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.139:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.140:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.141:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.142:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.143:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.144:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.145:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.146:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.147:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.187:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.188:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.189:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.190:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.191:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.192:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.193:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.194:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.208:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.287:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.301:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.304:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.644:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.755:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.793:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\ERMIN\Cookies\ermin@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\ERMIN\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\ERMIN\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman [email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman [email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman [email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman [email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.512:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.513:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.515:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman zec@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman [email protected][1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman [email protected][1].txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.700:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.701:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman [email protected][2].txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.127:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.128:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.174:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.175:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\ERMIN\Cookies\ermin@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\NERMINA\Cookies\nermina@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman zec@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.149:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.150:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.151:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.152:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.392:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.393:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.394:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.395:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.396:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\ERMIN\Cookies\ermin@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\NERMINA\Cookies\nermina@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman zec@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.773:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Adviva : Cleaned.
:mozilla.229:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.396:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\ERMIN\Cookies\ermin@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.380:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\ERMIN\Cookies\ermin@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\ERMIN\Cookies\[email protected][2].txt -> TrackingCookie.Bpath : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman [email protected][1].txt -> TrackingCookie.Burstbeacon : Cleaned.
:mozilla.398:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.433:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.434:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\ERMIN\Cookies\ermin@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman zec@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman [email protected][2].txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.29:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.406:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.407:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.408:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.409:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\ERMIN\Cookies\ermin@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.387:C:\Documents and Settings\ERMIN\Application Data\Mozilla\Firefox\Profiles\xsmc4w15.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.669:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\ERMIN\Cookies\ermin@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman zec@com[2].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\ERMIN\Cookies\ermin@commissionpartner[1].txt -> TrackingCookie.Commissionpartner : Cleaned.
:mozilla.258:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned.
:mozilla.15:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman [email protected][1].txt -> TrackingCookie.Enhance : Cleaned.
:mozilla.839:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Estat : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman zec@estat[1].txt -> TrackingCookie.Estat : Cleaned.
C:\Documents and Settings\SULEIMAN ZEC\Cookies\suleiman [email protected][2].txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.367:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.369:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.370:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.746:C:\Documents and Settings\SULEIMAN ZEC\Application Data\Mozilla\Firefox\Profiles\hc8ouii5.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
P.S Käynnistä --> Apuohjelmat valikossa on järjestelmän palauttaminen eli joku backup = Jos tulee virus pistän jonkun toisen päivän esim. 1.9 sen jälkeen kaikki on ennallaan jos tuona päivänä ei ollut viruksia. Teenkö nytkin näin, voiko tätä käyttää loputtomiin? Onko haittavaikutuksia?
Arvostan tosi korkealle niitä jotka viitsivät auttaa minua omien (mahdollisten) ongelmien lisäksi. Turhan usein kuulee sanottavan: "Mitäs hajotit, kärsi seurauksista"
Sillä kone on niin saastunut että siellä
järjestelmän palautuksestakin löytyy varmaan pöpöjä.
>>>>> halusin rekisteröityä, mutta maksaakin 35€, ErrorSafe
sitä pitää lyhentää.
klikkaa työkalut > asetukset > välilehti Tietosuoja > tyhjennä seuraavat lista alla
Sivuhistoria
Lomaketiedostot
latauslista
Evästeet
Väliaikaistiedosatot
seuraava vaihe
Klikkaa käynnistä nappia
Oma Tietokone hiiren oikealla napilla
Valitse ominaisuudet
Välilehti järjestelmän palauttaminen
Laita ruksi eteen Poista järjestelmän palauttaminen käytöstä
Käytä ja ok
Sammuta ja käynnistä kone
Laita järjestelmän palautus takaisin päälle ottamalla ruksin pois edestä
Poista järjestelmän palauttaminen käytöstä
Käytä ja Ok
kolmas vaihe
Tätä onkin jo kokeiltu mutta ei ole toiminut yritetääs uudestaan
Lataa http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Pura sisältö (kansio nimeltä SmitfraudFix työpöydällesi:
Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla Enter; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita tämän tekstitiedoston sisältö viestiketjuusi.
Huomaa: process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.
neljäs vaihe
Onkos tämä mennyt lävitse
lataa http://www.atribune.org/ccount/click.php?id=4
Työpöydällesi
# Tupla-klikkaa VundoFix.exe ajaaksesi sen.
# Klikkaa Scan for Vundo valintaa.
# Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
# Sinulta kysytään haluatko poistaa filut - klikkaa YES.
# Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
# Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
# Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.
Siis tyhjennänkö sivuhistorian, välimuistin ja poistan evästeet?
Ja tuossa smitfraudfixissä ei ole smitfraudfix.cem vaan vain Smitfraudfix ja siellä alla lukee Windows komentosarja. Kun klikkaan sitä tulee vain musta laatikko ja menee pois
klikkaa sitä kansioo ja purakaikki.
sitten siellä tulee toinen kansio avaa se ja
Smitfraudfix tuplalikkaat. siten se 1 ja enter
-Latasin smitfraudfixin
- Avasin kansion
- Valitsin Pura kaikki
- Eteen ilmestyi toinen kansio
- Tuplaklikkasin sitä
- Eteen ilmestyi tämmöinen näkymä
- http://img241.imageshack.us/my.php?image=smitfraudfixml1.png
- Kun klikkaan tuota smitfraudfixiä, ilmestyy musta laatikkoo ja menee pois.
puretulta.
oikein purettu se näyttää tältä.
http://siri.urz.free.fr/Fix/SmitfraudFix_En.php
poista nyt kaikki
smitfraudfix kansiot työpöydältä
sitten lataat uudestaan
Lataa http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Pura sisältö:(kansio nimeltä SmitfraudFix työpöydällesi: Tuplalikkaa SmitfraudFix kansioo sitten tulee näkyviin kansio klikkaa sitä kerran valitse sitten purakaikki
Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla Enter; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita tämän tekstitiedoston sisältö viestiketjuusi.
Huomaa: process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.
Parasta luovuttaa kun en osaa
Lataa FIXPATH2.ZIP -> http://internet.cybermesa.com/~bstewart/files/fixpath2.zip. Pura se hakemistoon C:\FIXPATH2.
Ohjelman ajo:
* Käynnistä -> suorita -> cmd -> ok
Kirjoita cd C:\
Pitäisi tulla C:\>
Kirjoita: cd FIXPATH2
Pitäisi tulla : C:\>fixpath2
Kirjoita FIXPATH.EXE
* Klikkaa Yes.
* Käynnistä kone uudelleen
Smitfraudfixii uudestaan.
Siis mihin mä kirjoitan cd C:/
tuon zipin
Katso että se kansio on tuolla.
C:\FIXPATH2.
Ohjelman ajo:
* Käynnistä -> suorita -> cmd -> ok
aukeaa musta taulu kirjoitele siihen nuo tuossa järjestyksesä
Kirjoita cd C:\ ---> paina enter
Kirjoita: cd FIXPATH2 ----> paina enter fixpath2
Kirjoita FIXPATH.EXE ---> paina enter paina enter
Kun teen ton kaiken tulee the direction of (jotain) have found in Path. Suljenko nyt?
niinkuin ohjeessa oli.
jos sait niin sammuta ja käynnistä.
ja kokeile SmitfraudFixsii
Smitfraudfix
1. Tallennan Levylle SmitfraudFixin
2. Ilmestyy työpöydälle.
3. Tuplaklikkaan sitä
4. Ilmestyy Kansio jossa lukee smitfraudfix
5. Klikkaan sitä kerran
9. Ilmestyy jotain reebotteja restarteja, yms.
6. Puran kaikki tiedostot
7. Ilmestyy uusi kansio, jossa lukee smitfraudfix
8. Klikkaan sitä
9. Tulos on yritys hyvä kymmenen:
http://img247.imageshack.us/my.php?image=smitfraudiijafixiipw9.png
loki
Logfile of HijackThis v1.99.1
Scan saved at 18:26:22, on 23.10.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\program files\siteicons\dialers\dluxve\dluxve.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [dluxve] c:\program files\siteicons\dialers\dluxve\dluxve.exe /nocomm
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\\Steam.exe -silent
O4 - Startup: .protected
O4 - Startup: PalNetaware.lnk = C:\Paltalk\puninstall.exe
O4 - Global Startup: .protected
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F5131C24-E56D-11CF-B78A-444553540000} (Ikonic Menu Control) - http://activex.microsoft.com/controls/iptdweb/ikcntrls.cab
O16 - DPF: {F5820AD3-9B20-423E-B2AA-7AF2B4055746} (CRegistryDownload Class) - http://download.paltalk.com/download/0.x/regdload.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG6 Service (AvgServ) - GRISOFT(c) SOFTWARE s.r.o - C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
scannaa hjt:llä merkkaa ja paina Fix checked
O4 - Startup: .protected
O4 - Global Startup: .protected
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader .cab
sulla tulee formatointi pian eteen jos SmitfraudFix ei lähe pelaamaan
En pystyy poistaa noit 04 Startuppej.
tämä niihin pystyisi
Lataa http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Pura sisältö (kansio nimeltä SmitfraudFix työpöydällesi:
Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla Enter; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita tämän tekstitiedoston sisältö viestiketjuusi.
Huomaa: process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.
katotaas tuolla
Lataa Findlop by Metallica
http://metallica.geekstogo.com/findlop.zip
pura zippi, tuplaklikkaa findlop.bat
loki on täällä -> C:\findlop.txt
[TRACE] Enumerating jobs and queues
1. Lataa combofix.exe http://download.bleepingcomputer.com/sUBs/combofix.exe tiedosto työpöydällesi.
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
SULEIMAN ZEC - 06-10-24 16:12:40,54 Service Pack 2
ComboFix 06.10.19 - Running from: "C:\Documents and Settings\SULEIMAN ZEC\Ty”p”yt„"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\Program Files\Ipwins
((((((((((((((((((((((((((((((( Files Created from 2006-09-24 to 2006-10-24 ))))))))))))))))))))))))))))))))))
2006-10-20 12:04 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-10-17 17:54 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2006-09-26 15:31 271,360 -ra------ C:\WINDOWS\system32\drivers\LV302AV.SYS
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-10-24 15:10 -------- d-------- C:\Program Files\Mozilla Firefox
2006-10-22 10:40 -------- d-------- C:\Program Files\siteicons
2006-10-21 18:50 -------- d-------- C:\Program Files\Common Files
2006-10-20 15:21 -------- d-------- C:\Program Files\Windows AdControl
2006-10-20 12:04 -------- d-------- C:\Program Files\Grisoft
2006-10-19 12:54 -------- d-------- C:\Program Files\CCleaner
2006-10-18 20:04 -------- d-------- C:\Program Files\Java
2006-10-18 20:03 -------- d-------- C:\Program Files\netbeans-5.0
2006-10-18 19:59 -------- d-------- C:\Program Files\Common Files\Java
2006-10-18 19:55 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-10-18 08:41 -------- d-------- C:\Program Files\Common Files\System
2006-10-13 17:25 -------- d-------- C:\Program Files\AntiVir PersonalEdition Classic
2006-10-04 13:27 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-10-04 13:27 -------- d-------- C:\Program Files\Ubi Soft
2006-09-28 21:17 -------- d-------- C:\Program Files\MSN Messenger
2006-09-28 11:20 55439 --a------ C:\Documents and Settings\SULEIMAN ZEC\Application Data\PatchUpdate_HP_CounterReport_Update_HPSU.log
2006-09-28 11:05 2180 --a------ C:\Documents and Settings\SULEIMAN ZEC\Application Data\HPSU_48BitScanUpdate.log
2006-09-28 11:01 5701 --a------ C:\Documents and Settings\SULEIMAN ZEC\Application Data\GdiplusUpgrade_MSIApproach_Wrapper.log
2006-09-28 10:59 136285 --a------ C:\Documents and Settings\SULEIMAN ZEC\Application Data\Update_HP_RedboxHprblog_HPSU.log
2006-09-28 10:53 139264 --a------ C:\WINDOWS\system32\hpzjrd01.dll
2006-09-26 16:29 468 --a------ C:\Documents and Settings\SULEIMAN ZEC\Application Data\Hewlett-PackardHP PSC 1400 series1159280678_PROTOCOL.log
2006-09-26 16:29 394 --a------ C:\Documents and Settings\SULEIMAN ZEC\Application Data\Hewlett-PackardHP PSC 1400 series1159280678_UI.log
2006-09-26 16:29 0 --a------ C:\Documents and Settings\SULEIMAN ZEC\Application Data\Hewlett-PackardHP PSC 1400 series1159280678_API.log
2006-09-26 16:29 -------- d-------- C:\Documents and Settings\SULEIMAN ZEC\Application Data\HP
2006-09-26 16:24 -------- d-------- C:\Program Files\HP
2006-09-26 16:24 -------- d-------- C:\Program Files\Common Files\HP
2006-09-26 16:22 -------- d-------- C:\Program Files\Hewlett-Packard
2006-09-24 12:57 -------- d-------- C:\Program Files\DSPlayer_v0.888_free_ad_supported
2006-09-24 12:22 -------- d-------- C:\Program Files\Times
2006-09-24 11:40 -------- d-------- C:\Documents and Settings\SULEIMAN ZEC\Application Data\Help
2006-09-23 14:27 -------- d-------- C:\Program Files\Common Files\Adobe
2006-09-23 14:27 -------- d-------- C:\Program Files\Adobe
2006-09-23 14:27 -------- d-------- C:\Documents and Settings\SULEIMAN ZEC\Application Data\InterTrust
2006-09-22 16:00 -------- d-------- C:\Program Files\CyberLink
2006-09-15 18:05 -------- d-------- C:\Program Files\HT Ratings
2006-09-15 18:02 73216 --a------ C:\WINDOWS\ST6UNST.EXE
2006-09-15 18:02 249856 --------- C:\WINDOWS\Setup1.exe
2006-09-13 07:03 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-09-11 19:38 -------- d-------- C:\Program Files\GIMP-2.0
2006-09-11 16:39 -------- d-------- C:\Program Files\Common Files\GTK
2006-08-25 17:49 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-21 14:26 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 11:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-16 13:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll
2006-07-31 08:28 206497 ---hs---- C:\WINDOWS\system32\cccdd.bak2
2006-07-30 04:29 207365 ---hs---- C:\WINDOWS\system32\cccdd.bak1
2006-07-29 19:32 48936 --a------ C:\WINDOWS\system32\sirenacm.dll
2006-07-29 16:28 573492 ---hs---- C:\WINDOWS\system32\ddccc.dll
2006-07-27 15:26 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Steam"="C:\\Program Files\\Valve\\Steam\\\\Steam.exe -silent"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ATIModeChange"="Ati2mdxx.exe"
"Wizard"=hex(2):00
"ATIPTA"="C:\\ATI-CPanel\\atiptaxx.exe"
"SoundMan"="SOUNDMAN.EXE"
"NeroCheck"="C:\\WINDOWS\\System32\\\\NeroCheck.exe"
"InCD"="C:\\Program Files\\Ahead\\InCD\\InCD.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"AVG_CC"="C:\\PROGRA~1\\Grisoft\\AVG6\\avgcc32.exe /STARTUP"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"dluxve"="c:\\program files\\siteicons\\dialers\\dluxve\\dluxve.exe /nocomm"
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"LanguageShortcut"="\"C:\\Program Files\\CyberLink\\PowerDVD\\Language\\Language.exe\""
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e2,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
backup-20061023-191708-193
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
backup-20061023-191707-360
O4 - Startup: .protected
backup-20061023-191708-413
O4 - Global Startup: .protected
backup-20061018-214440-326
O4 - HKLM\..\Run: [Blondes] C:\Program Files\hbt\Dialers\Blondes\Blondes.exe /dontdial
backup-20061018-202525-438
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
backup-20061018-202525-624
O4 - HKCU\..\Run: [Error Safe] "C:\Program Files\Error Safe Free\ers.exe" /min
backup-20061018-202525-449
O4 - HKLM\..\Run: [dxvid] c:\windows\system32\dxvid.exe /nocomm
backup-20061018-202525-229
O4 - HKLM\..\Run: [MPlay64] c:\program files\common files\system\dfb70b19.exe /noerrorinfo
backup-20061018-202525-125
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
Completion time: 06-10-24 16:16:52.09
C:\ComboFix.txt ... 06-10-24 16:16
mitä se nyt näyttää.
Logfile of HijackThis v1.99.1
Scan saved at 20:02:54, on 24.10.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\program files\siteicons\dialers\dluxve\dluxve.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Real\RealOne Player\RealPlay.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [dluxve] c:\program files\siteicons\dialers\dluxve\dluxve.exe /nocomm
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\\Steam.exe -silent
O4 - Startup: .protected
O4 - Startup: PalNetaware.lnk = C:\Paltalk\puninstall.exe
O4 - Global Startup: .protected
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F5131C24-E56D-11CF-B78A-444553540000} (Ikonic Menu Control) - http://activex.microsoft.com/controls/iptdweb/ikcntrls.cab
O16 - DPF: {F5820AD3-9B20-423E-B2AA-7AF2B4055746} (CRegistryDownload Class) - http://download.paltalk.com/download/0.x/regdload.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG6 Service (AvgServ) - GRISOFT(c) SOFTWARE s.r.o - C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe