Heips... Mulla on käyny tosi paha ongelma... Pistin MSN messengerissä viestin kaverille ja sit se tapahtu: joku prosessi laitto mesen käyntii ja lähetti jokaiselle online -tilassa olevalle tämän viestin: http://10990.kit.carpediem.fr/Sexypics.exe
samalla mulle aukes joku huumori flash-video...!
Eikö ollukki hyvä tarina? :S Täs logi... smitfraudin tein ja just nyt escan mwav on päivittämässä...
Logfile of HijackThis v1.99.1
Scan saved at 22:28:15, on 7.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\DOCUME~1\Katma\LOCALS~1\Temp\Rar$EX00.860\Resolution Changer\Resolution.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\cmd.exe
c:\kaspersky\kavupd.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2649FD68-F414-41A0-B02D-36DA6CF808F1} - C:\Program Files\Outlook Express\mefo.dll (file missing)
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_38.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [windows] c:\\windows_e51.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uTorrent\utorrent.exe"
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?9e4267ad95934afca68898294cee2494
O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?9e4267ad95934afca68898294cee2494
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160743556578
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: dxclib303562752.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - Unknown owner - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe (file missing)
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
samalla mulle aukes joku huumori flash-video...!
Eikö ollukki hyvä tarina? :S Täs logi... smitfraudin tein ja just nyt escan mwav on päivittämässä...
Logfile of HijackThis v1.99.1
Scan saved at 22:28:15, on 7.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\DOCUME~1\Katma\LOCALS~1\Temp\Rar$EX00.860\Resolution Changer\Resolution.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\cmd.exe
c:\kaspersky\kavupd.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2649FD68-F414-41A0-B02D-36DA6CF808F1} - C:\Program Files\Outlook Express\mefo.dll (file missing)
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_38.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [windows] c:\\windows_e51.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uTorrent\utorrent.exe"
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?9e4267ad95934afca68898294cee2494
O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?9e4267ad95934afca68898294cee2494
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160743556578
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: dxclib303562752.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - Unknown owner - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe (file missing)
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
Vastaukset 30
Vanhimmat
Näillä eväillä ekaks.
Ensin lataa LSPfix.exe sopivaan sijaintiin (kuten C:\Program Files\LSPFix tai vaikkapa työpöydälle). ÄLÄ aja tätä ohjelmaa vielä. Tätä tulee käyttää VAIN jos internetyhteys häviää NewDotNetin poiston jäljiltä.
NewDotNetin poisto:
Käynnistä > Ohjauspaneeli > Lisää/Poista sovellus ja hävitä seuraava jos näkyy;
New.Net Applications tai New.Net Domains (Mitä vain mikä sanoo New.Net)
Jos Lisää/Poista sovelluksessa ei ole New.Net listattu, toimi näin.
Varmista että anti-virus ja anti-spyware ohjelmat ovat suljettuna poiston ajan.
Lataa http://www.new.net/support/NNuninstall.exe
* Tallenna se työpöydällesi.
* Tupla-klikkaa NNuninstall.exe filua.
* Ohjelma kysyy haluatko poistaa kaikki New.Netin nimet ja osat.
* Klikkaa Yes.
* Klikkaa poiston jälkeen OK.
* Käynnistä kone uudelleen ("Yes - Restart now") ellei jäänyt mitään muuta kesken, jos jäi, jätä kone päälle ("No - I will restart later).
Jos poisto ei onnistu ja virustorjuntaohjelma(t) estävät poisto-ohjelman ajon kokonaan tai
osittain, tee näin: Irrota koneen verkko- tai modeemijohto koneesta siten, ettei sillä
ole yhteyttä internettiin. Sulje tämän jälkeen virustorjuntaohjelma(t) ja aja
NNuninstall.exe. Laita tämän jälkeen virustorjuntaohjelma(t) takaisin päälle ja
vasta sitten kytke verkko- tai modeemijohto takaisin koneeseen.
Tyhjennä roskakori.
JOS menetät nettiyhteytesi kun olet New.Netin poistanut, tupla-klikkaa LSPFix.exe jonka latasit aiemmin. Rastita "I know what I'm doing" valinta. Näet kaksi paneelia; Jos on jotain listattu "Remove" paneeliin oikealla puolella, anna sen olla ja klikkaa "Finish>>". Seuraavaksi käynnistä uudelleen ja netin pitäisi toimia hyvin. Jos mitään ei ole listattu "Remove" paneeliin, ÄLÄ tee MITÄÄN - sulje LSPFix. Tule joltain toiselta koneelta hakemaan lisää neuvoa. (Tämä on vain varotoimenpide, useimmiten netti pysyy ihan kunnossa
lataa http://noahdfear.geekstogo.com/click counter/click.ph p?id=9
* Tallenna tiedosto työpöydällesi.
* Tupla-klikkaa sitä, ja sitten klikkaa Start purkaaksesi sen sisällöt omaan kansioonsa.
* Avaa uusi kansio ja tupla-klikkaa RunThis.bat tiedoston ajaaksesi työkalun.
* Seuraa ohjeita ja postita new.net.txt tiedoston sisältö seuraavaan postiisi.
Lähetä myös uus HJT logi kun oot tehny tuon.
joo... ny pääsin tähä normaalitilaan sen vikasietotilan sijaan... se nnuninstall ei auennu vaikka kuinka rämppäs! mut muute meni iha hyvi... ja nyt huomaisn, et mese avautuu itestää ja menee päällimmäiseks itestään
Logfile of HijackThis v1.99.1
Scan saved at 14:19:21, on 8.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\program files\msn messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\msrg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\{68F9D26D-0823-1035-1107-030309090166}\Update.exe
C:\Documents and Settings\Admin\loadadv642.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\msasvc.exe
c:\kybrdff_e52.exe
C:\WINDOWS\system32\wininet.exe
C:\WINDOWS\system32\taskmgr.exe
c:\windows_e52.exe
C:\WINDOWS\T01JU1RBSkE\command.exe
C:\Program Files\Network Monitor\netmon.exe
c:\DXC9.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ipwins\ipwins.exe
C:\windows\explorer.exe
C:\WINDOWS\system32\wininet.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hjt\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_22.dll
O2 - BHO: (no name) - {5DC1764B-44A0-43FC-92D4-05335515E55E} - C:\Program Files\Outlook Express\mefo.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKLM\..\Run: [windows] c:\\windows_e51.exe
O4 - HKLM\..\Run: [defender] c:\\dfndrff_e52.exe
O4 - HKLM\..\Run: [keyboard] c:\\kybrdff_e52.exe
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\program files\msn messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160743556578
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: dxclib303562752.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: SysRun - {D7FFD784-5276-42D1-887B-00267870A4C7} - C:\WINDOWS\system32\svshost.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\T01JU1RBSkE\command.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
poista lisää poista sovelutuksesta
DeluxeCommunications
NewDotNet
Deskbar
Network Monitor
scannaa hjt:llä merkkaa paina Fix checked
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_22.dll
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
Mene käynnistä -> suorita -> kirjoita luukkuun ala olevat ja jokaisen rivin jälkeen paina ok
sc stop "Network Monitor"
sc deklete "Network Monitor"
sitten lataa
Lataa SmitfraudFix (c) S!Ri http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:
Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita tämän tekstitiedoston sisältö viestiketjuusi.
Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.
ja laita uusi hjt loki ja smitfraudfix raportti
lisää poista sovelutuksesta
ipwins
sc delete "Network Monitor"
SmitFraudFix v2.119
Scan done at 15:37:25,82, ke 08.11.2006
Run from C:\Documents and Settings\Admin\Local Settings\Temp\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» C:\
C:\drsmartload?.exe FOUND !
C:\drsmartload??.exe FOUND !
C:\drsmartload???.exe FOUND !
C:\drsmartload????.exe FOUND !
C:\uniq FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
C:\WINDOWS\keyboard1.dat FOUND !
C:\WINDOWS\teller2.chk FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Admin
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Admin\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Admin\Suosikit
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="sockspy.dll"
»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32
pe386 detected, use a Rootkit scanner
»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
Logfile of HijackThis v1.99.1
Scan saved at 15:38:51, on 8.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\{68F9D26D-0823-1035-1107-030309090166}\Update.exe
C:\WINDOWS\system32\msasvc.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\T01JU1RBSkE\command.exe
C:\windows\explorer.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
c:\program files\softwin\bitdefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\hjt\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5DC1764B-44A0-43FC-92D4-05335515E55E} - C:\Program Files\Outlook Express\mefo.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [windows] c:\\windows_e51.exe
O4 - HKLM\..\Run: [defender] c:\\dfndrff_e52.exe
O4 - HKLM\..\Run: [keyboard] c:\\kybrdff_e52.exe
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\RunOnce: [AntiRK] "C:\Program Files\Softwin\BitDefender10\TaskSys.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\program files\msn messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160743556578
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: SysRun - {D7FFD784-5276-42D1-887B-00267870A4C7} - C:\WINDOWS\system32\svshost.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\T01JU1RBSkE\command.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
ps. bitdefender ilmotti jotain "bitdefender registry error" ja "error fixed" kun poistelin niitä lisää ja poista sovellutuksii...
Deskbar ei löytyny
Printtaa ohjeet ulos.
Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.
Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.
Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.
Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".
Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.
Varoitus : Ajamalla optio 2:n EI-tarttuneessa tietokoneessa, poistaa sinun työpöytäsi taustakuvan.
scannaa hjt:llä merkkaa paina fix checked
R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
O2 - BHO: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
sitten sulla näyttää olevan vielä ewido
poista se lisää poista sovelutuksesta
lataa tuosta uusi
Ohje AVG Anti-Spyware 7.5:n käyttöön
Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis työkalun toimintaa.
Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta
Lataa AVG Anti-Spyware 7.5 http://www.ewido.net/en/download/
ja tallenna ohjelma työpöydällesi.
• Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
• Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
• Käynnistä AVG Anti-Spyware.
• Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
• Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
• Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
• Sitten "Reports" valikon alta:
o Laita täppi kohtaan "Automatically generate report after every scan"
o Ota täppi pois kohdasta"Only if threats were found"
• Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
• "Resident shield is", muuta tila active:sta inactive:ksi
• Sulje ohjelma, ÄLÄ skannaa vielä.
Käynnistä koneesi vikasietotilaan, Ohje!
HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.
• Kun vikasietotilassa, käynnistä AVG Anti-Spyware.
• Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
• Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
• Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
• Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
• Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
• Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
• Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.
ja laita uusi hjt-loki
onks toi ewidon linkki nyt varmasti oikea?
siis ton avg:n
7.5.0.50 versiolta
...nyt mulla meni aivot sekasi mut olkoon... luulin et se ois ollu ewidon linkki :P
Fuusiot nekin on kanssa aika ihmeelisiä asioita. ;)
SmitFraudFix v2.120
Scan done at 15:05:46,48, pe 10.11.2006
Run from C:\Documents and Settings\Admin\Local Settings\Temp\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Admin
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Admin\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Admin\Suosikit
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="sockspy.dll"
»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32
pe386 detected, use a Rootkit scanner
»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
=laitoin ihan varalta...=
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
Created at: 19:40:19 8.11.2006
Scan result:
C:\HJT\backups\backup-20061108-153549-916.dll -> Adware.NewDotNet : No action taken.
C:\Lataukset\lovedesign(2).exe -> Backdoor.Agent.aim : No action taken.
C:\Lataukset\lovedesign.exe -> Backdoor.Agent.aim : No action taken.
C:\Documents and Settings\Omistaja\Local Settings\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\Cache\5739E768d01 -> Dialer.CapreDeam.r : No action taken.
C:\drsmartload.exe -> Downloader.Adload.nad : No action taken.
C:\Lataukset\E-ASW.v400172.incl.ptch._.sn(2).rar/Patch.exe -> Not-A-Virus.Hacktool.Crack : No action taken.
C:\Lataukset\E-ASW.v400172.incl.ptch._.sn.rar/Patch.exe -> Not-A-Virus.Hacktool.Crack : No action taken.
C:\Lataukset\E-ASW.v400172.incl.ptch._.sn\Patch.exe -> Not-A-Virus.Hacktool.Crack : No action taken.
:mozilla.235:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.245:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.246:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.247:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.248:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.249:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.250:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.341:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.831:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.162:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.164:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.29:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.30:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.44:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.62:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.660:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Adjuggler : No action taken.
:mozilla.661:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Adjuggler : No action taken.
:mozilla.662:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Adjuggler : No action taken.
:mozilla.214:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Adtech : No action taken.
:mozilla.220:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Adtech : No action taken.
:mozilla.239:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.240:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.241:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.242:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.243:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.119:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Atdmt : No action taken.
:mozilla.369:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Bluestreak : No action taken.
:mozilla.257:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Burstnet : No action taken.
:mozilla.258:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Burstnet : No action taken.
:mozilla.259:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Burstnet : No action taken.
:mozilla.47:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.48:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.49:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.50:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.51:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.52:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.53:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.814:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Clickbank : No action taken.
:mozilla.457:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.458:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.459:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.460:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.461:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.465:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.858:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.733:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Comclick : No action taken.
:mozilla.734:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Comclick : No action taken.
:mozilla.735:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Comclick : No action taken.
:mozilla.16:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken.
:mozilla.816:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Euroclick : No action taken.
:mozilla.225:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.226:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.227:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.244:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.496:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.498:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.499:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.500:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.501:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.636:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.637:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.638:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.639:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.36:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.40:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.41:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.42:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.43:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.45:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.46:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.852:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Gamershell : No action taken.
:mozilla.853:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Gamershell : No action taken.
:mozilla.854:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Gamershell : No action taken.
:mozilla.855:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Gamershell : No action taken.
:mozilla.856:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Gamershell : No action taken.
:mozilla.408:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Googleadservices : No action taken.
:mozilla.584:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Googleadservices : No action taken.
:mozilla.870:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Googleadservices : No action taken.
:mozilla.199:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.200:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.202:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.452:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.679:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.759:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.843:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.879:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.898:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.134:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Hotlog : No action taken.
:mozilla.502:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Itrack : No action taken.
:mozilla.570:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.571:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.572:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.602:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.603:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.480:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Masterstats : No action taken.
:mozilla.451:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken.
:mozilla.301:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Onestat : No action taken.
:mozilla.302:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Onestat : No action taken.
:mozilla.303:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Onestat : No action taken.
:mozilla.304:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Onestat : No action taken.
:mozilla.65:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Overture : No action taken.
:mozilla.770:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.771:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.772:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.773:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.310:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Qksrv : No action taken.
:mozilla.313:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Qksrv : No action taken.
:mozilla.267:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken.
:mozilla.268:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken.
:mozilla.832:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.833:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.834:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.835:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.836:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.360:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Revenue : No action taken.
:mozilla.361:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Revenue : No action taken.
:mozilla.261:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.262:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.263:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.264:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.265:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.266:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.818:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.819:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.504:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Sexlist : No action taken.
:mozilla.505:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Sexlist : No action taken.
:mozilla.497:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Sitestat : No action taken.
:mozilla.668:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Sitestat : No action taken.
:mozilla.669:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Sitestat : No action taken.
:mozilla.922:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Smartadserver : No action taken.
:mozilla.549:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Spylog : No action taken.
:mozilla.27:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.28:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.31:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.32:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.33:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.34:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.35:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.37:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.38:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.39:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.255:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.256:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.710:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Targetnet : No action taken.
:mozilla.215:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.216:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.217:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.218:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.219:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.652:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Trafic : No action taken.
:mozilla.105:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.108:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.653:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Valuead : No action taken.
:mozilla.654:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Valuead : No action taken.
:mozilla.655:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Valuead : No action taken.
:mozilla.63:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Valueclick : No action taken.
:mozilla.596:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Webtrendslive : No action taken.
:mozilla.172:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Yadro : No action taken.
:mozilla.88:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.89:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.90:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.91:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.92:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.93:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.75:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Zedo : No action taken.
:mozilla.76:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Zedo : No action taken.
:mozilla.77:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Zedo : No action taken.
:mozilla.78:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Zedo : No action taken.
:mozilla.79:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Zedo : No action taken.
:mozilla.80:C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\ro3paqrg.default\cookies.txt -> TrackingCookie.Zedo : No action taken.
C:\Documents and Settings\Katma\Omat tiedostot\Downloads\The Sims 2 Pets FULL CRACK.REL.rar/The Sims 2 Pets FULL CRACK.REL\setup.exe -> Trojan.Agent.wl : No action taken.
C:\ihky.exe -> Trojan.ProcKill.DJ : No action taken.
C:\kdsprpod.exe -> Trojan.ProcKill.DJ : No action taken.
::Report end
Printtaa ohjeet ulos.
Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.
Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.
Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.
Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".
Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg
scannaa
jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl A.
Kopioi rivit komennolla Ctrl C.
Liitä rivit komennolla Ctrl V.
Laita virus log tänne.
ota ikkunan ylälaidasta Työkalut > asetukset > Tietosuoja
tyhjennä:
sivuhistoria
evästeet
lataukset
väliaikaset tiedostot
todennetut istunnot
viel se hjt logi...
Logfile of HijackThis v1.99.1
Scan saved at 20:34:45, on 10.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\FRAPS\FRAPS.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Xfire\xfire.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\DOCUME~1\Omistaja\LOCALS~1\Temp\fsbwih.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\taskmgr.exe
C:\hjt\hijackthis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [windows] C:\\windows_e53.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [defender] c:\\dfndrff_e54.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?22b983df77b5474aa79a363d7972d1eb
O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?22b983df77b5474aa79a363d7972d1eb
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160743556578
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: winstart - winstart.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: SysRun - {D7FFD784-5276-42D1-887B-00267870A4C7} - C:\WINDOWS\system32\svshost.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\T01JU1RBSkE\command.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
scannaa hjt:llä merkkaa paina Fix checked
O4 - HKLM\..\Run: [defender] c:\\dfndrff_e54.exe
O4 - HKLM\..\Run: [windows] C:\\windows_e53.exe
...ja hjt logi?
Logfile of HijackThis v1.99.1
Scan saved at 12:21:31, on 11.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\windows_e53.exe
C:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\SONERA~1\ANTI-S~1\fsaw.exe
C:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
C:\WINDOWS\system32\ctfmon.exe
C:\FRAPS\FRAPS.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
c:\kybrdff_e54.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
c:\nwnmff_e54.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Xfire\xfire.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
C:\hjt\hijackthis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [Arovax Shield] C:\Program Files\Arovax Shield\ArovaxShield.exe -tray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?22b983df77b5474aa79a363d7972d1eb
O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?22b983df77b5474aa79a363d7972d1eb
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160743556578
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: winstart - winstart.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: SysRun - {D7FFD784-5276-42D1-887B-00267870A4C7} - C:\WINDOWS\system32\svshost.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\T01JU1RBSkE\command.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - Unknown owner - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe (file missing)
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O20 - Winlogon Notify: winstart - winstart.dll (file missing)
1. Lataa combofix.exe http://download.bleepingcomputer.com/sUBs/combofix.exe
tiedosto työpöydällesi.
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
ei tuottanut logia, vaan käynnisti koneen automaattisesti uudelleen...?
Logfile of HijackThis v1.99.1
Scan saved at 20:16:24, on 11.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
C:\WINDOWS\system32\ctfmon.exe
C:\FRAPS\FRAPS.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\Arovax Shield\ArovaxShield.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Xfire\xfire.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\svchost.exe
C:\hjt\hijackthis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [Arovax Shield] C:\Program Files\Arovax Shield\ArovaxShield.exe -tray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?22b983df77b5474aa79a363d7972d1eb
O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?22b983df77b5474aa79a363d7972d1eb
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by122fd.bay122.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160743556578
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: SysRun - {D7FFD784-5276-42D1-887B-00267870A4C7} - C:\WINDOWS\system32\svshost.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - Unknown owner - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe (file missing)
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Combofix.txt
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
jos ei ole niin fixsaa pois
yritelly, mut se tulee aina... kaiketi IE on hijackattu? noo... käytän aina mozillaa...
Omistaja - 06-11-11 17:20:50,23 Service Pack 2
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Omistaja"
((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log )))))))))))))))))))))))))))))))))))))))))))))))))
C:\Documents and Settings\Admin\Application Data\Dxcknwrd.dll
C:\Documents and Settings\Katma\Application Data\Dxccwrd.dll
C:\Documents and Settings\Katma\Application Data\Dxcknwrd.dll
* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\teller2.chk
C:\deskbar_e53.exe
C:\kybrdff_e52.exe
C:\kybrdff_e53.exe
C:\kybrdff_e54.exe
C:\MTE3NDI6ODoxNgnew.exe
C:\nwnmff_e53.exe
C:\nwnmff_e54.exe
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\476H27AZ\dfndrff_e_uit[1].exe
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\OF6VAPA1\kybrdff_e[1].exe
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\G7OB4ZO1\MTE3NDI6ODoxNg[1].exe
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\G7OB4ZO1\nwnmff_e[1].exe
C:\ac3_0010.exe
C:\RDFX4.exe
C:\WINDOWS\wallpap.exe
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Program Files\Deskbar
C:\Program Files\Inetget2
C:\Program Files\network monitor
C:\Program Files\Common Files\{68F9D26D-0823-1035-1107-030309090166}
C:\WINDOWS\T01JU1RBSkE
((((((((((((((((((((((((((((((( Files Created from 2006-10-11 to 2006-11-11 ))))))))))))))))))))))))))))))))))
2006-11-11 12:06 20,480 --a------ C:\mc44a54.exe
2006-11-10 20:14 1,121,056 --a------ C:\Documents and Settings\Omistaja\Strings.dll
2006-11-10 17:51 15,440 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2006-11-10 16:53 70,224 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2006-11-10 16:53 33,840 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2006-11-09 20:15 20,480 --a------ C:\mc44a53.exe
2006-11-09 15:38 434,176 --a------ C:\windows_e53.exe
2006-11-09 15:38 19,456 --a------ C:\DXC9.exe
2006-11-08 18:48 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-11-08 14:11 143,360 --a------ C:\yz02.exe
2006-11-08 14:11 110,592 --a------ C:\WINDOWS\v1201.exe
2006-11-08 14:10 5,632 --a------ C:\lgtwq.exe
2006-11-08 14:10 430,080 --a------ C:\windows_e52.exe
2006-11-08 14:10 1,465 --a------ C:\vylc.exe
2006-11-08 14:10 1,024 --a------ C:\wrwhiem.exe
2006-11-08 14:10 1,024 --a------ C:\kdsprpod.exe
2006-11-08 14:10 1,024 --a------ C:\ihky.exe
2006-11-07 22:13 4,010 --a------ C:\WINDOWS\system32\tmp.reg
2006-11-07 21:56 8,464 --a------ C:\WINDOWS\system32\sporder.dll
2006-11-07 21:56 50,688 --a-s---- C:\WINDOWS\NDNuninstall6_38.exe
2006-11-03 19:25 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
2006-10-30 17:40 2,944 --a------ C:\WINDOWS\system32\drivers\msmpu401.sys
2006-10-30 17:40 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2006-10-29 16:29 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2006-10-29 16:29 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
2006-10-29 16:29 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
2006-10-29 16:29 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
2006-10-29 16:29 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
2006-10-29 16:29 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
2006-10-29 16:29 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
2006-10-29 16:29 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
2006-10-22 18:30 569,344 -ra------ C:\WINDOWS\system32\imagr5.dll
2006-10-22 18:30 544,768 -ra------ C:\WINDOWS\system32\imagx5.dll
2006-10-22 18:30 38,912 -ra------ C:\WINDOWS\system32\picn20.dll
2006-10-22 18:30 283,920 -ra------ C:\WINDOWS\system32\ImagXpr5.dll
2006-10-22 18:30 155,648 -ra------ C:\WINDOWS\system32\NeroCheck.exe
2006-10-22 12:10 51,120 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2006-10-22 12:10 21,744 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys
2006-10-22 12:10 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2006-10-22 12:09 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2006-10-22 12:09 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2006-10-22 12:09 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2006-10-22 12:09 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2006-10-22 12:09 306,688 --a------ C:\WINDOWS\IsUninst.exe
2006-10-22 12:09 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2006-10-22 12:09 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2006-10-22 11:30 50,688 --a------ C:\WINDOWS\system32\wbhelp2.dll
2006-10-22 11:30 38,784 --a------ C:\WINDOWS\system32\drivers\sbpd.sys
2006-10-17 14:27 86,016 --a------ C:\WINDOWS\unvise32.exe
2006-10-14 15:02 218,112 --a------ C:\HijackThis.exe
2006-10-14 13:58 14,848 --a------ C:\WINDOWS\system32\BASSMOD.dll
2006-10-14 12:54 127,208 --a------ C:\WINDOWS\system32\mucltui.dll
2006-10-13 15:41 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2006-10-13 15:41 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2006-10-13 15:20 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2006-10-13 13:53 118,842 -r------- C:\WINDOWS\bwUnin-6.3.2.116-4436233L.exe
2006-10-13 12:30 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2006-10-13 12:30 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2006-10-13 12:30 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
[color=red][b]Rootkit driver pe386 is present. A rootkit scan is required[/b][/color]
2006-11-11 17:22 -------- d-------- C:\Program Files\Common Files
2006-11-11 17:17 -------- d-------- C:\Program Files\Mozilla Firefox
2006-11-11 17:00 1120 --a------ C:\Documents and Settings\Omistaja\Application Data\wklnhst.dat
2006-11-11 16:43 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Xfire
2006-11-11 16:36 -------- d-------- C:\Program Files\Microsoft Works
2006-11-11 16:36 -------- d-------- C:\Program Files\Microsoft Picture It! 9
2006-11-11 16:36 -------- d-------- C:\Program Files\Messenger
2006-11-11 16:36 -------- d-------- C:\Program Files\MagicISO
2006-11-11 16:36 -------- d-------- C:\Program Files\LimeWire
2006-11-11 16:36 -------- d-------- C:\Program Files\GameSpy Arcade
2006-11-11 16:36 -------- d-------- C:\Program Files\DAP
2006-11-11 16:12 -------- d---s---- C:\Documents and Settings\Omistaja\Application Data\Microsoft
2006-11-11 15:14 -------- d-------- C:\Program Files\LIUtilities
2006-11-11 15:14 -------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2006-11-11 15:13 -------- d-------- C:\Program Files\Uniblue
2006-11-10 21:17 -------- d-------- C:\Program Files\Arovax Shield
2006-11-10 20:30 -------- d-------- C:\Program Files\Windows Live Safety Center
2006-11-10 20:28 -------- d-------- C:\Program Files\MSN Messenger
2006-11-10 20:14 -------- d-------- C:\Program Files\Microsoft Games
2006-11-10 19:51 -------- d-------- C:\Program Files\GlobFX Technologies
2006-11-10 18:53 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Hamachi
2006-11-10 17:51 -------- d-------- C:\Program Files\Hamachi
2006-11-10 16:53 -------- d-------- C:\Program Files\Sonera Tietoturva
2006-11-09 18:35 -------- d-------- C:\Program Files\MoparScape
2006-11-09 16:22 -------- d-------- C:\Program Files\BPK
2006-11-09 15:24 -------- d---s---- C:\Program Files\Xfire
2006-11-08 19:54 3466 --a------ C:\Program Files\uninstal.log
2006-11-08 19:40 -------- d-------- C:\Program Files\Outlook Express
2006-11-08 18:58 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-11-08 18:47 -------- d-------- C:\Program Files\Grisoft
2006-11-08 15:48 -------- d-------- C:\Program Files\Softwin
2006-11-07 20:45 -------- d-------- C:\Program Files\EasyPHP1-8
2006-11-07 19:55 -------- d-------- C:\Program Files\eMule
2006-11-07 18:45 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Adobe
2006-11-07 17:07 62360 --a------ C:\Documents and Settings\Omistaja\Application Data\GDIPFONTCACHEV1.DAT
2006-11-07 15:41 -------- d-------- C:\Program Files\ResizeIt!
2006-11-07 15:33 -------- d-------- C:\Program Files\Windows Live Toolbar
2006-11-06 20:52 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\uTorrent
2006-11-06 20:08 -------- d-------- C:\Program Files\vcmm
2006-11-06 19:45 -------- d-------- C:\Program Files\TGTSoft
2006-11-06 14:46 -------- d-------- C:\Program Files\Common Files\EasyInfo
2006-11-06 14:39 -------- d-------- C:\Program Files\EA GAMES
2006-11-03 19:16 -------- d-------- C:\Program Files\CyberLink
2006-11-03 19:15 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-11-02 17:49 -------- d-------- C:\Program Files\Bitsum Technologies
2006-11-02 17:43 -------- d-------- C:\Program Files\Google
2006-11-02 17:26 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Google
2006-10-31 13:44 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-10-30 18:50 -------- d-------- C:\Program Files\Hide IP Platinum
2006-10-30 17:57 -------- d-------- C:\Program Files\SwiftSwitch
2006-10-29 12:58 -------- d-------- C:\Program Files\Microsoft Encarta
2006-10-29 12:53 -------- d-------- C:\Program Files\Microsoft AutoRoute
2006-10-29 12:49 -------- d-------- C:\Program Files\Microsoft Office
2006-10-29 12:49 -------- d-------- C:\Program Files\Common Files\Designer
2006-10-29 12:43 -------- d-------- C:\Program Files\Microsoft Works Suite 2004
2006-10-27 19:44 -------- d-------- C:\Program Files\TextPad 4
2006-10-27 19:44 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\TextPad
2006-10-27 17:37 -------- d-------- C:\Program Files\Common Files\Macromedia Shared
2006-10-27 17:37 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Macromedia
2006-10-27 17:31 -------- d-------- C:\Program Files\Macromedia
2006-10-27 16:01 -------- d-------- C:\Program Files\Extension Changer
2006-10-27 13:14 -------- d-------- C:\Program Files\Rockstar Games
2006-10-26 17:33 -------- d-------- C:\Program Files\WinPassword
2006-10-26 10:52 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\HP
2006-10-25 12:45 139264 --a------ C:\WINDOWS\system32\hpzjrd01.dll
2006-10-22 18:30 -------- d-------- C:\Program Files\Common Files\Ahead
2006-10-22 18:30 -------- d-------- C:\Program Files\Ahead
2006-10-22 12:15 -------- d-------- C:\Program Files\Common Files\Sonic Shared
2006-10-22 12:14 -------- d-------- C:\Program Files\Common Files\HP
2006-10-22 12:12 -------- d-------- C:\Program Files\HP
2006-10-22 12:12 -------- d-------- C:\Program Files\Hewlett-Packard
2006-10-22 12:11 -------- d-------- C:\Program Files\Common Files\Hewlett-Packard
2006-10-22 10:21 -------- d-------- C:\Program Files\Microsoft Plus! Dancer LE
2006-10-22 10:20 -------- d-------- C:\Program Files\XoftSpy
2006-10-22 10:20 -------- d-------- C:\Program Files\Warez
2006-10-22 10:20 -------- d-------- C:\Program Files\Spyware Doctor
2006-10-22 10:20 -------- d-------- C:\Program Files\Registry Mechanic
2006-10-22 10:20 -------- d-------- C:\Program Files\Password Creator 2.2
2006-10-22 10:20 -------- d-------- C:\Program Files\Dealio
2006-10-22 10:20 -------- d-------- C:\Program Files\dcplusplus
2006-10-22 10:20 -------- d-------- C:\Program Files\DC
2006-10-21 21:45 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Pirates Of The Caribbean(2)
2006-10-21 20:04 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\PC Tools
2006-10-21 19:45 0 --------- C:\autoexec.bat
2006-10-21 19:41 -------- d-------- C:\Program Files\Common Files\Download Manager
2006-10-21 19:35 -------- d-------- C:\Program Files\Lavalys
2006-10-19 16:58 -------- d-------- C:\Program Files\Microsoft Plus! Digital Media Edition
2006-10-17 18:10 -------- d-------- C:\Program Files\Cain
2006-10-17 14:49 -------- d-------- C:\Program Files\uTorrent
2006-10-14 22:07 -------- d-------- C:\Program Files\WinZip
2006-10-14 22:03 -------- d-------- C:\Program Files\Universal Extractor
2006-10-14 21:50 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-10-14 18:39 -------- d-------- C:\Program Files\Java
2006-10-14 18:32 -------- d-------- C:\Program Files\Windows Media Player
2006-10-14 16:23 -------- d-------- C:\Program Files\Common Files\Java
2006-10-14 16:22 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Sun
2006-10-14 16:21 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\LimeWire
2006-10-14 14:18 -------- d-------- C:\Program Files\QuickTime
2006-10-14 14:17 -------- d-------- C:\Program Files\Apple Software Update
2006-10-14 13:59 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\pe explorer
2006-10-14 13:58 -------- d-------- C:\Program Files\PE Explorer
2006-10-14 13:55 -------- d-------- C:\Program Files\Common Files\Adobe
2006-10-14 13:54 869 --a------ C:\Documents and Settings\Omistaja\Application Data\AdobeDLM.log
2006-10-14 13:54 0 --a------ C:\Documents and Settings\Omistaja\Application Data\dm.ini
2006-10-14 13:54 -------- d-------- C:\Program Files\Adobe
2006-10-13 18:52 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Help
2006-10-13 18:04 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\F-Secure
2006-10-13 15:24 12528 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2006-10-13 15:13 -------- d-------- C:\Program Files\Activision
2006-10-13 15:11 -------- d-------- C:\Program Files\Internet Explorer
2006-10-13 15:09 -------- d-------- C:\Program Files\Common Files\System
2006-10-13 15:03 -------- d-------- C:\Program Files\MSXML 4.0
2006-10-13 14:36 -------- d-------- C:\Program Files\WinRAR
2006-10-13 14:36 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\ispnews
2006-10-13 14:16 -------- d-------- C:\Program Files\7-Zip
2006-10-13 13:49 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Talkback
2006-10-13 13:49 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Mozilla
2006-10-09 11:11 62 --ahs---- C:\Documents and Settings\Omistaja\Application Data\desktop.ini
2006-10-09 11:11 -------- d-------- C:\Program Files\Common Files\SpeechEngines
2006-10-09 11:11 -------- d-------- C:\Program Files\Common Files\ODBC
2006-10-09 09:38 -------- d-------- C:\Program Files\ATI Technologies
2006-10-09 09:10 -------- d--h----- C:\Program Files\Uninstall Information
2006-10-09 09:10 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Identities
2006-10-09 08:44 -------- d-------- C:\Program Files\xerox
2006-10-09 08:44 -------- d-------- C:\Program Files\microsoft frontpage
2006-10-09 08:42 0 -rahs---- C:\MSDOS.SYS
2006-10-09 08:42 0 -rahs---- C:\IO.SYS
2006-10-09 08:42 0 --a------ C:\CONFIG.SYS
2006-10-09 08:41 -------- d--h----- C:\Program Files\WindowsUpdate
2006-10-09 08:40 -------- d-------- C:\Program Files\Online Services
2006-10-09 08:40 -------- d-------- C:\Program Files\NetMeeting
2006-10-09 08:40 -------- d-------- C:\Program Files\Movie Maker
2006-10-09 08:40 -------- d-------- C:\Program Files\Common Files\Services
2006-10-09 08:40 -------- d-------- C:\Program Files\Common Files\MSSoap
2006-10-09 08:39 -------- d-------- C:\Program Files\ComPlus Applications
2006-10-09 08:38 -------- d-------- C:\Program Files\Windows NT
2006-10-09 08:38 -------- d-------- C:\Program Files\MSN Gaming Zone
2006-09-13 07:03 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-09-12 16:51 1245184 --a------ C:\WINDOWS\system32\msxml4.dll
2006-08-25 17:49 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-21 14:26 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 11:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-16 13:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Fraps"="C:\\FRAPS\\FRAPS.EXE"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"STYLEXP"="C:\\Program Files\\TGTSoft\\StyleXP\\StyleXP.exe -Hide"
"Uniblue SpeedUpMyPC"=""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SoundMan"="SOUNDMAN.EXE"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\\Program Files\\Google\\Gmail Notifier\\gnotify.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"NeroCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe"
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"LanguageShortcut"="\"C:\\Program Files\\CyberLink\\PowerDVD\\Language\\Language.exe\""
"BDAgent"="\"C:\\Program Files\\Softwin\\BitDefender10\\bdagent.exe\""
"!AVG Anti-Spyware"="\"C:\\program files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"F-Secure Manager"="\"C:\\Program Files\\Sonera Tietoturva\\Common\\FSM32.EXE\" /splash"
"F-Secure TNB"="\"C:\\Program Files\\Sonera Tietoturva\\TNB\\TNBUtil.exe\" /CHECKALL /WAITFORSW"
"F-Secure Startup Wizard"="\"C:\\Program Files\\Sonera Tietoturva\\FSGUI\\FSSW.EXE\" /reboot"
"News Service"="\"C:\\Program Files\\Sonera Tietoturva\\FSGUI\\ispnews.exe\""
"Arovax Shield"="C:\\Program Files\\Arovax Shield\\ArovaxShield.exe -tray"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"DisableTaskMgr"=dword:00000000
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
"SysRun"="{D7FFD784-5276-42D1-887B-00267870A4C7}"
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winstart
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
backup-20061111-122121-829
O4 - HKLM\..\Run: [keyboard] c:\\kybrdff_e54.exe
backup-20061111-122121-625
O4 - HKLM\..\Run: [windows] C:\\windows_e53.exe
backup-20061111-122121-802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
backup-20061111-122121-551
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
backup-20061111-122121-377
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
backup-20061111-122121-156
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
backup-20061111-122121-584
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
backup-20061110-203440-549
O4 - HKLM\..\Run: [bpk] C:\program files\BPK\bpk.exe
backup-20061108-153549-347
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
backup-20061108-153549-312
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
backup-20061108-153549-137
R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
backup-20061108-153549-126
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
backup-20061108-153549-916
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_22.dll
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Scheduled scanning task.job
C:\WINDOWS\tasks\Tarkistetaan Windows Live -ty”kalurivin p„ivitykset.job
Completion time: 06-11-11 19:11:13.46
C:\ComboFix.txt ... 06-11-11 19:11
->Lataa smitrem työpöydälle
http://noahdfear.geekstogo.com/click counter/click.php?id=1
Tuplaklikkaa sitä ja Start, niin saat smitrem kansion työpöydälle .
Käynnistä kone vikasietotilassa(F8 käynnistyksen yhteydessä
Sen jälkeen avaa smitrem-kansio ja tuplaklikkaa RunThis.bat ja seuraa ohjeita.
Tämän jälkeen scannaa ja putsaa Ewidolla säästä logi.
Käynnistä sitten normaalisti ja lähetä uus Hijack logi,Ewidon logi ja C:\smitfiles.txt logi foorumille.
on vähä kiirettä elämässä... laitan login ja smitin myöhemmin... sori täst
itelläkin.