No, mikähän mahtais olla, kun usein www -sivua avattaessa aukeaa google, jossa aina erilaisia hakuja tahtomatta.
Myöskään koulun (microsoft) sähköposti ei toimi kunnolla, ei voi kenellekään mitään lähettää.
Auttakaa.. ei spybot poistanut tätä ongelmaa.
Myöskään koulun (microsoft) sähköposti ei toimi kunnolla, ei voi kenellekään mitään lähettää.
Auttakaa.. ei spybot poistanut tätä ongelmaa.
Vastaukset 23
Vanhimmat
Logfile of HijackThis v1.99.1
Scan saved at 21:16:17, on 7.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\TW-IA300C ADSL\CnxDslTb.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\IE Doctor\IEDoctor.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\program files\softwin\bitdefender9\bdnagent.exe
C:\program files\softwin\bitdefender9\bdswitch.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\EasyAlarm\EasyAlarm.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
c:\program files\softwin\bitdefender9\bdmcon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\uusixp\Työpöytä\VIRUSTORJUNTA\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\system32\ipv6mons.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: AdSwpr - {FCADDC14-BD46-408A-9842-CDBE1C6D37EB} - C:\PROGRA~1\IEDOCT~1\adflr.dll
O3 - Toolbar: &IE Doctor Bar - {123249EB-F891-44C4-946F-450064F9080E} - C:\PROGRA~1\IEDOCT~1\IEDrBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [IE Doctor] C:\Program Files\IE Doctor\IEDoctor.exe /min
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "c:\program files\softwin\bitdefender9\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "c:\program files\softwin\bitdefender9\bdswitch.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EasyAlarm] C:\Program Files\EasyAlarm\EasyAlarm.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155284987217
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {CT id=e codeBase=http://www.www2.p0rt2.com/files/epl29bf2.cab classid=clsid:33331111-1111-1111-1111-615111193427} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{C2107109-1AA3-467B-AD3E-E69EE4579D2D}: NameServer = 212.50.211.242 212.50.192.226
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: pcl - {182D0C85-206F-4103-B4FA-DCC1FB0A0A44} - E:\Inventor10\Inventor Professional 10\Bin\HSPCLPRO10.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Tutkin logisi, olen hjt-koulussa ja ohjeeni tarkistetaan, siksi kestää vähän pitempään.
Palaan mahdollisimman pian.
Olet saanut activeX:n mukana siivottavaa, troijalaiseksi mainitaan.
Sullahan näyttää olevan tuo ewido jo koneellasi, päivitä se ,
tässä ohjeet:
# Käynnistä Ewido Anti-Spyware.
# Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
* Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
# Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
# Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
# Sitten "Reports" valikon alta:
* Laita täppi kohtaan "Automatically generate report after every scan"
* Ota täppi pois kohdasta"Only if threats were found"
ÄLÄ skannaa vielä.
En tunne tuota Bitdefenderin versiota, onko siinä myös palomuuri?
Jos on siinä tapauksessa sulla on kaksi muuria, koska Zonealarm näkyy myös.
Poista toinen niistä käytöstä.
Käynnistä HJT ja klikkaa Do a system scan only, merkkaa nämä rivit:
O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\system32\ipv6mons.dll
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O16 - DPF: {CT id=e codeBase=http://www.www2.p0rt2.com/files/epl29bf2.cab classid=clsid:33331111-1111-1111-1111-615111193427} -
Sulje muut ohjelmaikkunat, klikkaa Fix checked.
Käynnistä koneesi vikasietotilaan naputtelemalla käynnistyksen alkaessa F8-nappulaa.
HUOM! Älä käytä muita ohjelmia Ewidon skannauksen aikana, tämä saattaa häiritä skannausta.
* Kun vikasietotilassa, käynnistä Ewido Anti-Spyware.
* Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
* Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
* Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
* Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
* Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
* Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
* Sulje ohjelma, käynnistä kone normaalisti ja lähetä Ewidon raportti sekä uusi Hijackthisin logi viestiketjuusi.
Hei Axel.S, koneeltasi löytynyt tiedosto,
C:\WINDOWS\system32\ipv6mons.dll on salasanojen varasteluun erikoistunut troijalainen.
Jos olet käsitellyt luottokorttitietojasi esim. nettiostojen yhteydessä, ota yhteys luottokorttiyhtiöösi ja kerro tilanteesta.
Vaihda kaikki salasanasi, tärkeimmät esim. pankkiyhteyteen liittyvät, vaihda heti joltain puhtaalta koneelta, vaikkei
omaa konettasi olisikaan vielä siivottu.
...onkos tämä joku SpyAxelin testiloki?! =)
Norman menny kouluun? ...ei kannata, jos olet sama Norman, niin osaat kyllä hommas ilman mitään koulujaki!
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
Created on: 3:10:53, 8.11.2006
Report-Checksum: 48E60586
Scan result:
:mozilla.8:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup
:mozilla.9:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup
:mozilla.18:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.19:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.20:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.21:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.22:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.23:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.24:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.25:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.26:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.27:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.28:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.29:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.30:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.31:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.32:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.33:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.80:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Paycounter : Cleaned with backup
:mozilla.108:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Cqcounter : Cleaned with backup
:mozilla.114:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.127:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.128:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.129:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.130:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.131:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.132:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.133:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.134:C:\Documents and Settings\uusixp\Application Data\Mozilla\Firefox\Profiles\6ai4gcyb.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
C:\Documents and Settings\uusixp\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\uusixp\Cookies\uusixp@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned with backup
C:\Documents and Settings\uusixp\Cookies\uusixp@adjuggler[2].txt -> TrackingCookie.Adjuggler : Cleaned with backup
C:\Documents and Settings\uusixp\Cookies\[email protected][2].txt -> TrackingCookie.Sexcounter : Cleaned with backup
C:\Documents and Settings\uusixp\Cookies\[email protected][2].txt -> TrackingCookie.Clickzs : Cleaned with backup
C:\Documents and Settings\uusixp\Cookies\[email protected][2].txt -> TrackingCookie.Adjuggler : Cleaned with backup
C:\WINDOWS\system32\lvljzbsb.hbz -> Hijacker.Small.js : Cleaned with backup
C:\WINDOWS\system32\wbiladua.rll -> Hijacker.Small.js : Cleaned with backup
::Report End
Logfile of HijackThis v1.99.1
Scan saved at 19:03:13, on 8.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\TW-IA300C ADSL\CnxDslTb.exe
C:\Program Files\IE Doctor\IEDoctor.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\program files\softwin\bitdefender9\bdnagent.exe
C:\program files\softwin\bitdefender9\bdswitch.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\EasyAlarm\EasyAlarm.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
c:\program files\softwin\bitdefender9\bdmcon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Documents and Settings\uusixp\Työpöytä\VIRUSTORJUNTA\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &IE Doctor Bar - {123249EB-F891-44C4-946F-450064F9080E} - C:\PROGRA~1\IEDOCT~1\IEDrBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [IE Doctor] C:\Program Files\IE Doctor\IEDoctor.exe /min
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "c:\program files\softwin\bitdefender9\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "c:\program files\softwin\bitdefender9\bdswitch.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EasyAlarm] C:\Program Files\EasyAlarm\EasyAlarm.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155284987217
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C2107109-1AA3-467B-AD3E-E69EE4579D2D}: NameServer = 212.50.211.242 212.50.192.226
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: pcl - {182D0C85-206F-4103-B4FA-DCC1FB0A0A44} - E:\Inventor10\Inventor Professional 10\Bin\HSPCLPRO10.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Printtaa nämä ohjeet tai tallenna tekstitiedostona työpöydälle, et voi pitää selainta auki joka vaiheessa.
Okei, ewidolla ei näkynyt mitään pahempaa ja logikin näyttää melko siistiltä.
Sulla on noita IE:n suojauksia IEDoctor muiden muassa. Ilmeisesti ohjelmistosi vaatii IE:n käyttöä.
Onko tuo Bitdefender palomuurillinen versio ja oletko ottanut sen käyttöön.
Zonealarmin kanssa yhteiskäyttö saattaa aiheuttaa jommankumman toimintaan häiriöitä, jotka ei välttämättä käyttäjälle näy.
Ekassa logissasi oli tuo poistettava tiedosto, mutta lataa ensin tuolta
eScan, asenna ja päivitä se tapa2:lla, ÄLÄ scannaa vielä:
http://koti.mbnet.fi/pattaya1/escanmwav.htm
Lue sivun ohjeet huolellisesti ja noudata annettuja ohjeita.
Kun olet saanut sen päivitettyä, sulje se ja käynnistä
koneesi vikasietotilaan näin:
Sammuta ensin ja käynnistä uudelleen, käynnistyksen alussa naputtele F8, saat eteesi valikon josta nuolinäppäimillä valitset Vikasietotila, vahvista valinta.
Kun windows on käynnistynyt vikasietotilaan, käynnistä eScan ja suorita sillä ohjeiden mukaisesti kaikien kiintolevyjen skannaus, kaikki tiedostot mukana.
Skannaus kestää kovalevyjen koosta ja tiedostojen määrästä riippuen tunnin-kaksi.
Lähetä sitten siihen alaikkunaan tulevat tiedot viestisi mukana, mutta ennen sitä tee seuraavasti:
* Avaa HiJackThis
* Klikkaa "Configure" valintaa oikealla alhaalla
* Klikkaa "Misc Tools"
* Klikkaa valintaa "Delete File on Reboot"
* Navigoi tämä filu - C:\WINDOWS\system32\ipv6mons.dll (jos löytyy enää)
* Tupla-klikkaa kyseistä filua.
* HijackThis kysyy haluatko käynnistää uudelleen. Klikkaa "Yes".
Kun koneesi on käynnistynyt uudelleen, skannaa uusi HJT-logi ja liitä sen mukaan ne eScanin alaikkunan löydökset.
hu Nov 09 20:47:44 2006 => Total Number of Files Scanned: 221661
Thu Nov 09 20:47:44 2006 => Total Number of Virus(es) Found: 58
Thu Nov 09 20:47:44 2006 => Total Number of Disinfected Files: 0
Thu Nov 09 20:47:44 2006 => Total Number of Files Renamed: 4
Thu Nov 09 20:47:44 2006 => Total Number of Deleted Files: 50
Thu Nov 09 20:47:44 2006 => Total Number of Errors: 27
Thu Nov 09 20:47:44 2006 => Time Elapsed: 04:08:43
Thu Nov 09 20:47:45 2006 => Virus Database Date: 2006/11/09
Thu Nov 09 20:47:45 2006 => Virus Database Count: 239531
Thu Nov 09 20:47:45 2006 => Scan Completed.
Moi. Laskutoimituksen jälkeen jää neljä virusluokkaan kuuluva jäljelle, niissäkin on neljä liikaa :)
Kokeiles ajaa Kasperskyn onlinescan, toimii vain IExplorerilla ja sallittava ActiveX tuolta sivulta.
http://www.kaspersky.com/virusscanner
Ja logit voit lähettää tuohon osoitteeseen:
http://pastebin.ca/
Myös se eScanin login siitä alaikkunasta (jos on vielä tallella).
Siellä on kaksi mahdollisuutta, joko liittää login teksti isompaan ruutuun tai sitten uploadata tiedostona.
Helpoin ehkä maalata logitekstit ja liittää.
Laita alempana olevaan name-ruutuun nimimerkkisi ja kun olet klikannut submit post-painiketta saat eteesi ikkunan, jossa on ko. linkki.
Kopioi se tänne, niin pääsen katsomaan tuloksia.
Moi. Jos et ole vielä ehtinyt tehdä, niin
tässä olis ohje tuon onlinescannin tekoon:
Skannaa koneesi Kaspersky Online Skannerilla http://www.kaspersky.com/downloads/kws/kavwebscan.html
Sinulta kysytään sallitko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
* Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
* Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
* Klikkaa nyt asetuksia, Scan Settings
* Tarkista asetuksista, että seuraavat ovat valittuina:
o Scan using the following Anti-Virus database:
Extended (Jos valittavissa, muuten valitse Standard)
o Scan Options:
Scan Archives
Scan Mail Bases
* Klikkaa OK
* Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
* Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
* Klikkaa nyt Save as Text-painiketta.
* Tallenna tiedosto työpöydällesi.
* Kopioi ja Liitä tiedoston sisältö seuraavaan vastaukseesi.
Otitko varoituksen huomioon niiden salasanojen osalta?
Useimmiten väärinkäytöksen uhreja löytyy rapakon takaa, mutta voi se onnistua täkäläisillekin.
Otin toki asian varovaisesti, tärkeitä salasanoja ei ole juurikaan, muutaman olen vaihtanut.
tosin joskus 3-4 viikkoa sitten ostin luottokortilla bitdefenderin.
Scannasin koko koneen tänään illasta valitsemalla "My computer", mutta tulisiko siis toisella tapaa scannata, valitsemalla esim. "My Email"
tässä tulokset:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, November 10, 2006 11:00:42 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 10/11/2006
Kaspersky Anti-Virus database records: 226764
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
H:\
Scan Statistics:
Total number of scanned objects: 218603
Number of viruses found: 1
Number of infected objects: 2 / 0
Number of suspicious objects: 0
Duration of the scan process: 04:58:48
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\uusixp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Temp\ICD2.tmp\start.INF Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Temp\JET4.tmp Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Temp\Sivuhistoria\History.IE5\MSHist012006111020061111\index.dat Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Temp\~DF4655.tmp Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\uusixp\ntuser.dat Object is locked skipped
C:\Documents and Settings\uusixp\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\uusixp\Työpöytä\alexin kansio\DC tiedostot\SolidWorks v2005 keygen by ZENiTH..exe.exe Object is locked skipped
C:\Documents and Settings\uusixp\Työpöytä\Uusi Microsoft Word -asiakirja.doc Object is locked skipped
C:\Documents and Settings\uusixp\Työpöytä\VIRUSTORJUNTA\backups\backup-20061108-003242-443.dll Infected: Trojan-Spy.Win32.BZub.fh skipped
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\master.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\mastlog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\model.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\modellog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\tempdb.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\templog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\LOG\ERRORLOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{820E9BDB-CB57-41E7-B4F9-7BBF9F7C322E}\RP607\A0210293.exe.mwt Object is locked skipped
C:\System Volume Information\_restore{820E9BDB-CB57-41E7-B4F9-7BBF9F7C322E}\RP607\A0210294.exe.mwt Object is locked skipped
C:\System Volume Information\_restore{820E9BDB-CB57-41E7-B4F9-7BBF9F7C322E}\RP607\A0210295.dll Object is locked skipped
C:\System Volume Information\_restore{820E9BDB-CB57-41E7-B4F9-7BBF9F7C322E}\RP645\A0236841.dll Infected: Trojan-Spy.Win32.BZub.fh skipped
C:\System Volume Information\_restore{820E9BDB-CB57-41E7-B4F9-7BBF9F7C322E}\RP646\A0237197.exe Object is locked skipped
C:\System Volume Information\_restore{820E9BDB-CB57-41E7-B4F9-7BBF9F7C322E}\RP647\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\SS-89L2HSWMSF3N.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\CnxDslWz.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\rdruafdz.exe Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_71c.dat Object is locked skipped
C:\WINDOWS\Temp\tmp0000236a\tmp00000000 Object is locked skipped
C:\WINDOWS\Temp\ZLT076c2.TMP Object is locked skipped
C:\WINDOWS\Temp\ZLT076c5.TMP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
Scan process completed.
Taidan aamusta scannata Kaspersky online scannerilla Extended -scan settingsillä.
Laitan aamupäivästä kunhan kerkeän jaksan toisen tuloksen.
Muuten, jostain syystä takkuilee välillä pirusti, kun on 4-5 tai enemmän sivua/kansioita auki kerrallaan. Ei ole ennen tehnyt, vasta nyt ihan parin päivän sisällä. Silloin suorittimen käyttöaste nousee 90-100%:siin.
Ok, tee niin ja lähetä jossain välissä uusi Hijackthis-logi, niin nähdään mitä on muuttunut.
En pääse vastaamaan kuin vasta sunnuntai-iltapäivänä seuraavaksi.
Tässä kaspersky online scannerilla extended toiminnolla scannattu:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, November 12, 2006 4:23:40 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 11/11/2006
Kaspersky Anti-Virus database records: 240751
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
H:\
Scan Statistics:
Total number of scanned objects: 219084
Number of viruses found: 6
Number of infected objects: 13 / 0
Number of suspicious objects: 0
Duration of the scan process: 04:57:45
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\uusixp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_219.wmdb Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Sivuhistoria\History.IE5\MSHist012006111120061112\index.dat Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Temp\ICD2.tmp\start.INF Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Temp\Perflib_Perfdata_25dc.dat Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Temp\Perflib_Perfdata_5cc.dat Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Temp\Sivuhistoria\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\uusixp\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\uusixp\ntuser.dat Object is locked skipped
C:\Documents and Settings\uusixp\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\uusixp\Työpöytä\alexin kansio\DC tiedostot\SolidWorks v2005 keygen by ZENiTH..exe.exe Object is locked skipped
C:\Documents and Settings\uusixp\Työpöytä\alexin kansio\Ohjelmat\GDiVXZen1.0.exe/data0012/data0001.cab/Save.exe Infected: not-a-virus:AdWare.Win32.SaveNow.af skipped
C:\Documents and Settings\uusixp\Työpöytä\alexin kansio\Ohjelmat\GDiVXZen1.0.exe/data0012/data0001.cab/SaveUninst.exe Infected: not-a-virus:AdWare.Win32.SaveNow.bl skipped
C:\Documents and Settings\uusixp\Työpöytä\alexin kansio\Ohjelmat\GDiVXZen1.0.exe/data0012/data0001.cab/Weather/Weather.exe Infected: not-a-virus:AdWare.Win32.SaveNow.m skipped
C:\Documents and Settings\uusixp\Työpöytä\alexin kansio\Ohjelmat\GDiVXZen1.0.exe/data0012/data0001.cab/Weather/Uninst.exe Infected: not-a-virus:AdWare.Win32.SaveNow.m skipped
C:\Documents and Settings\uusixp\Työpöytä\alexin kansio\Ohjelmat\GDiVXZen1.0.exe/data0012/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.m skipped
C:\Documents and Settings\uusixp\Työpöytä\alexin kansio\Ohjelmat\GDiVXZen1.0.exe/data0012 Infected: not-a-virus:AdWare.Win32.SaveNow.m skipped
C:\Documents and Settings\uusixp\Työpöytä\alexin kansio\Ohjelmat\GDiVXZen1.0.exe/data0015 Infected: not-a-virus:AdWare.Win32.NewDotNet.d skipped
C:\Documents and Settings\uusixp\Työpöytä\alexin kansio\Ohjelmat\GDiVXZen1.0.exe NSIS: infected - 7 skipped
C:\Documents and Settings\uusixp\Työpöytä\VIRUSTORJUNTA\backups\backup-20061108-003242-443.dll Infected: Trojan-Spy.Win32.BZub.fh skipped
C:\Documents and Settings\uusixp\Työpöytä\VIRUSTORJUNTA\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\uusixp\Työpöytä\VIRUSTORJUNTA\SmitfraudFix.zip/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\uusixp\Työpöytä\VIRUSTORJUNTA\SmitfraudFix.zip ZIP: infected - 1 skipped
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\master.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\mastlog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\model.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\modellog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\tempdb.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\templog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\LOG\ERRORLOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{820E9BDB-CB57-41E7-B4F9-7BBF9F7C322E}\RP607\A0210293.exe.mwt Object is locked skipped
C:\System Volume Information\_restore{820E9BDB-CB57-41E7-B4F9-7BBF9F7C322E}\RP607\A0210294.exe.mwt Object is locked skipped
C:\System Volume Information\_restore{820E9BDB-CB57-41E7-B4F9-7BBF9F7C322E}\RP607\A0210295.dll Object is locked skipped
C:\System Volume Information\_restore{820E9BDB-CB57-41E7-B4F9-7BBF9F7C322E}\RP645\A0236841.dll Infected: Trojan-Spy.Win32.BZub.fh skipped
C:\System Volume Information\_restore{820E9BDB-CB57-41E7-B4F9-7BBF9F7C322E}\RP646\A0237197.exe Object is locked skipped
C:\System Volume Information\_restore{820E9BDB-CB57-41E7-B4F9-7BBF9F7C322E}\RP648\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\SS-89L2HSWMSF3N.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{349600C2-C8EB-43AA-890C-54B11091A40D}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CnxDslWz.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\rdruafdz.exe Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_730.dat Object is locked skipped
C:\WINDOWS\Temp\tmp00000a2e\tmp00000000 Object is locked skipped
C:\WINDOWS\Temp\ZLT0534d.TMP Object is locked skipped
C:\WINDOWS\Temp\ZLT05350.TMP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\_restore{820E9BDB-CB57-41E7-B4F9-7BBF9F7C322E}\RP648\change.log Object is locked skipped
Scan process completed.
Logfile of HijackThis v1.99.1
Scan saved at 14:26:04, on 12.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\TW-IA300C ADSL\CnxDslTb.exe
C:\Program Files\IE Doctor\IEDoctor.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\program files\softwin\bitdefender9\bdnagent.exe
C:\program files\softwin\bitdefender9\bdswitch.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\EasyAlarm\EasyAlarm.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
c:\program files\softwin\bitdefender9\bdmcon.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\KASPER~1\MWAVSCAN.COM
C:\KASPER~1\kavss.exe
C:\Documents and Settings\uusixp\Työpöytä\VIRUSTORJUNTA\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &IE Doctor Bar - {123249EB-F891-44C4-946F-450064F9080E} - C:\PROGRA~1\IEDOCT~1\IEDrBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [IE Doctor] C:\Program Files\IE Doctor\IEDoctor.exe /min
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "c:\program files\softwin\bitdefender9\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "c:\program files\softwin\bitdefender9\bdswitch.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EasyAlarm] C:\Program Files\EasyAlarm\EasyAlarm.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155284987217
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C2107109-1AA3-467B-AD3E-E69EE4579D2D}: NameServer = 212.50.211.242 212.50.192.226
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: pcl - {182D0C85-206F-4103-B4FA-DCC1FB0A0A44} - E:\Inventor10\Inventor Professional 10\Bin\HSPCLPRO10.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Laitoin just uudelleen scannaamaan eScanin, niin yritän kopioda alaruudun uudelleen tiedot tänne sitten.
Hyvä, ootellaan sen eScanin tulos ja kerron sitten. Alkaa näyttää jo paremmalta.
File C:\Documents and Settings\uusixp\Työpöytä\alexin kansio\Ohjelmat\GDiVXZen1.0.exe tagged as not-a-virus:AdWare.Win32.SaveNow.af. No Action Taken.
File C:\Documents and Settings\uusixp\Työpöytä\VIRUSTORJUNTA\SmitfraudFix\Reboot.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
File C:\Documents and Settings\uusixp\Työpöytä\VIRUSTORJUNTA\SmitfraudFix.zip tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
Mene Ohjauspaneeliin, avaa Lisää tai poista sovelluksia,
etsi seuraavan nimisiä ohjelmia, jos löytyy , Poista
SaveNow
Näitä ei löytynyt:
SaveNow
Minusta ongelmat alkaa olla ohi, paitsi liian suuri kuorma. Turhia ohjelmia vois sammutella pois ja käynnistää vasta tarvittaessa.
Kerään listaa noista ja laitan sulle tulemaan.
Päätät sitten itse mitkä ovat tärkeitä tai tarvitaan jatkuvasti käynnistymään windowsin mukana. Iso osa ohjelmista käynnistyy tarvittaessa nopeasti, ettei niiden tarvi olla valmiina käynnissä resursseja syömässä.
Yhtä vaihtoakin suosittelisin, poista tuo IEDoctor ja asenna tilalle Spywareblaster.
http://koti.mbnet.fi/pattaya1/spywareblaster.htm
Tässä vähän listaa noista käynnissä olevista.
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
Ellet käytä tuota HP:n cd:n etiketinpoltto-ohjlemaa jatkuvasti, voit ohjelman asetuksista tai msconfigista jättää sen pois automaattisesti käynnistyvistä.
Ensisijaisena pitäisin ohjelman omista asetuksista säätämistä, mutta ellei sieltä löydy, niin käyttöjärjestelmä hoitaa msconfigin kautta.
Msconfigiin pääset klikkaamalla Käynnistä, Suorita.. , kirjoita riville msconfig ja paina Enter.
avautuvasta ikkunasta valitse Käynnistys-välilehti, ota siellä ruksi pois halutun rivin edestä.
Kun olet muutokset tehnyt, klikkaa Käytä ja vielä OK sulkeaksesi sovelluksen.
Uudelleenkäynnistyksen jälkeen tulee ilmoitusruutu,jossa kerrotaan että käytät Valikoivaa käynnistystapaa.
Laita ruksi siihen ruutuun, ettei ruutua enää näytetä ja OK.
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
SQL-sovellus, oletan, että käytät tuota koneella työskennellessäsi, ellet, tee kuten edellä.
Jatkossa sama menetelmä näissä seuraavissakin.
.
C:\WINDOWS\system32\pctspk.exe
Kuuluu puhelinmodeemin kaiutinkäyttöön , löytämieni nettisivujen perusteella. Raporttien perusteella saattaa syödä resursseja runsaastikin.
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
Oma valinta, jos olet todennut hyväksi; nythän sulla on myös tuo AVG-Anti-Spyware
käytettävissä.
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\SOUNDMAN.EXE
Äänikortin asetuksien säätämistä varten.
C:\Program Files\IE Doctor\IEDoctor.exe
Oma valinta, ehdotin spywareblasteria tilalle, se ei käytä resusseja, suojaa muuten.
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
Voinee käynnistää tarvitessa, kaukosäätimen sovellus.
C:\Program Files\QuickTime\qttask.exe
Applen Quicktime videotoistoon.
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
iTunesin apuohjelmia iPodin käytössä tarpeellisia.
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
Sulla käynnistyy kaksi "Meseä", toinen kai joutaa pois?
C:\Program Files\EasyAlarm\EasyAlarm.exe
Joku muistuttaja?
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
Omassa koneessa nuo OpenOfficen pikakäynnistyssovellukset syö muistia
16 megaa.
C:\Program Files\Internet Explorer\IEXPLORE.EXE
Oliko tämä muuten vain auki, vai käytätkö vakituisesti?
Vähennät riskejä saada tartunta, käyttämällä vaihtoehtoselaimia(Firefox/Opera)
C:\Program Files\Windows Media Player\wmplayer.exe
Noista harkintasi mukaan poistelemalla, koneesi kuorma kevenee huomattavasti.