Kone sammu äskettäin kaks kertaa ja käynnistyi uudelleen peräkkäin ihan yhtäkkiä.. Spybot löysi Zlob.Downloader joku tollane mut kumminki ja sit Smitfraud-C Toolbar888... Ei suostu poistamaan. Löytyykös mitään logista.. Skannasin ton SmitfraudFIX, mutta mitää ei siitä löytynyt ku seurasin noita muit ohjeita miten se skannataa ja poistetaan uhat jne..
Logfile of HijackThis v1.99.1
Scan saved at 17:46:36, on 8.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\DrVirus\DrVirus.exe
C:\PROGRA~1\MESSEN~1\Msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C004DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Seram Web - {CC17CB93-633F-407d-98F8-25DE790608BD} - C:\Program Files\Sunda Systems\Seram Web\webtra2.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [DrVirus] "C:\Program Files\DrVirus\DrVirus.exe" -sh
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\Msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1157447193453
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1157999201750
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
O23 - Service: Norton AntiVirus -ohjelman automaattinen suojaus (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Logfile of HijackThis v1.99.1
Scan saved at 17:46:36, on 8.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\DrVirus\DrVirus.exe
C:\PROGRA~1\MESSEN~1\Msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C004DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Seram Web - {CC17CB93-633F-407d-98F8-25DE790608BD} - C:\Program Files\Sunda Systems\Seram Web\webtra2.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [DrVirus] "C:\Program Files\DrVirus\DrVirus.exe" -sh
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\Msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1157447193453
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1157999201750
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
O23 - Service: Norton AntiVirus -ohjelman automaattinen suojaus (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Vastaukset 22
Vanhimmat
scannaa hjt:llä merkkaa paina Fix checked
O2 - BHO: (no name) - {C004DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
mikähän versio tämä on SmitfraudFIX,
laita se raportti tänne
SmitFraudFix v2.119
Scan done at 18:04:48,65, ke 08.11.2006
Run from C:\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Omistaja
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Omistaja\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="wbsys.dll"
»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32
pe386 detected, use a Rootkit scanner
»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
Printtaa ohjeet ulos.
Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.
Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.
Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.
Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".
Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.
Varoitus : Ajamalla optio 2:n EI-tarttuneessa tietokoneessa, poistaa sinun työpöytäsi taustakuvan.
aja siellä vikasiedossa
AVG Anti-Spyware tallenna raportti
----------------------------------------------
Lataa GMER http://www.gmer.net/gmer.zip ja tallenna se työpöydällesi:
• Pura se työpöydälle ja tuplaklikkaa tiedostoa GMER.exe
• Klikkaa rootkit-välilehteä ja sitten klikkaa scan.
• Älä rastita "Show All" boksia skannauksen aikana!
• Kun skannaus on valmis, klikkaa Copy.
• Tämä kopioi lokin leikepöydälle (voit tallentaa lokin varmuuden vuoksi tekstitiedostoon).
• Liitä loki sitten viestiketjuusi.
--------------------------------------
Tää kone ei suostu skannaa tai siis suostuu mut heti sit melkein sammuu ja käynnistyy uudelleen.En voi skannata oikeen millään torjuntaohjelmalla kun tää heti sammuu.. Mikä avuksi? Sain ton login tost Smitfraudist..
SmitFraudFix v2.119
Scan done at 18:55:20,20, ke 08.11.2006
Run from C:\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
AVG spyware ei löytänyt mitään..
tuntuis olevan lämpövika noin aluksi.
Toimiiko powerin tuuletin ja prosesorin?
Ei oo siel mitää vikaa, ku ei ole kauheen kauaa ku ne on putsattu! ja toi ongelma tuli yhtäkkiä.. Ja kone taas äsken sammu kun oli virus skannaus päällä.. Mikähä tässä on.. Ei tää sammu sillo jos on joku spyware juttu.. Nortonkin pitää aina kun kone on käynnistynyt niin pistää itse päälle!
1. Lataa combofix.exe http://download.bleepingcomputer.com/sUBs/combofix.exe
tiedosto työpöydällesi.
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
meneekös tuo lävitse
Omistaja - 06-11-08 19:46:05,12 Service Pack 2
ComboFix 06.10.19 - Running from: "C:\Program Files\Mozilla Firefox"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\Program Files\Common Files\{309E508C-07DA-1035-0915-050504050166}
C:\Program Files\Common Files\{409E508C-07DA-1035-0915-050504050166}
((((((((((((((((((((((((((((((( Files Created from 2006-10-08 to 2006-11-08 ))))))))))))))))))))))))))))))))))
2006-11-08 19:03 80 --a------ C:\WINDOWS\gmer_uninstall.cmd
2006-11-08 19:03 569,344 --a------ C:\gmer.exe
2006-11-08 16:18 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-11-07 16:02 7,035 --a------ C:\Documents and Settings\Omistaja\silver.exe
2006-11-04 19:29 73,728 --a------ C:\Documents and Settings\Omistaja\tt.exe
2006-11-04 17:41 36,864 --a------ C:\WINDOWS\system32\NliaControlRes.dll
2006-11-03 20:57 2,688 --a------ C:\WINDOWS\system32\tmp.reg
2006-11-03 20:56 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-11-03 20:56 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-11-03 20:56 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-10-30 07:16 155,648 --a------ C:\WINDOWS\system32\DrVirusR.exe
2006-10-29 09:44 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2006-10-29 09:44 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2006-10-29 09:44 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2006-10-27 15:09 6,049,280 --------- C:\WINDOWS\system32\ieframe.dll
2006-10-27 15:09 50,688 --------- C:\WINDOWS\system32\msfeedsbs.dll
2006-10-27 15:09 458,752 --------- C:\WINDOWS\system32\msfeeds.dll
2006-10-27 15:09 180,736 --------- C:\WINDOWS\system32\ieui.dll
2006-10-25 14:38 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll
2006-10-25 14:38 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
2006-10-25 14:38 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2006-10-25 14:38 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2006-10-24 18:02 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2006-10-24 18:02 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2006-10-22 12:45 91,904 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2006-10-22 12:45 124,016 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2006-10-17 13:05 206,336 --------- C:\WINDOWS\system32\WinFXDocObj.exe
2006-10-17 12:58 61,952 --------- C:\WINDOWS\system32\icardie.dll
2006-10-17 12:58 12,288 --------- C:\WINDOWS\system32\msfeedssync.exe
2006-10-17 12:57 266,752 --------- C:\WINDOWS\system32\iertutil.dll
2006-10-17 12:27 380,928 --------- C:\WINDOWS\system32\ieapfltr.dll
2006-10-13 11:30 668,976 --a------ C:\WINDOWS\system32\OGACheckControl.DLL
2006-10-08 08:42 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll
2006-10-08 08:42 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2006-10-08 08:42 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2006-10-08 07:18 53,248 --a------ C:\WINDOWS\system32\Process.exe
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
[color=red][b]Rootkit driver pe386 is present. A rootkit scan is required[/b][/color]
2006-11-08 19:46 -------- d-------- C:\Program Files\InterMute
2006-11-08 19:46 -------- d-------- C:\Program Files\Common Files\Symantec Shared
2006-11-08 19:46 -------- d-------- C:\Program Files\Common Files
2006-11-08 19:46 -------- d-------- C:\Program Files\a-squared Free
2006-11-08 19:45 -------- d-------- C:\Program Files\Mozilla Firefox
2006-11-08 19:37 -------- d-------- C:\Program Files\XoftSpySE
2006-11-08 18:30 -------- d-------- C:\Program Files\Windows Live Safety Center
2006-11-08 18:19 -------- d-------- C:\Program Files\DC
2006-11-08 17:25 -------- d-------- C:\Program Files\MSN Messenger
2006-11-08 16:18 -------- d-------- C:\Program Files\Grisoft
2006-11-07 16:07 -------- d-------- C:\Program Files\Internet Explorer
2006-11-06 19:53 -------- d-------- C:\Program Files\Common Files\System
2006-11-06 19:50 -------- d-------- C:\Program Files\WinRAR
2006-11-06 15:37 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\AdobeUM
2006-11-05 11:54 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Adobe
2006-11-05 10:39 -------- d-------- C:\Program Files\MSXML 4.0
2006-11-04 22:05 -------- d-------- C:\Program Files\Jasc Software Inc
2006-11-04 22:05 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Jasc Software Inc
2006-11-04 17:47 -------- d-------- C:\Program Files\NLIA
2006-11-04 16:17 -------- d-------- C:\Program Files\Common Files\PCSuite
2006-11-04 16:17 -------- d-------- C:\Program Files\Common Files\Nokia
2006-11-04 15:54 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-11-04 15:54 -------- d-------- C:\Program Files\Google
2006-11-04 15:54 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Google
2006-11-04 10:29 1039 --a------ C:\Documents and Settings\Omistaja\Application Data\AdobeDLM.log
2006-11-04 10:26 -------- d-------- C:\Program Files\Common Files\Adobe
2006-11-04 10:23 0 --a------ C:\Documents and Settings\Omistaja\Application Data\dm.ini
2006-11-04 10:23 -------- d-------- C:\Program Files\Adobe
2006-11-03 19:54 -------- d-------- C:\Program Files\CCleaner
2006-11-03 16:28 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\OfficeUpdate12
2006-11-03 16:04 -------- d-------- C:\Program Files\Winamp
2006-11-01 17:20 -------- d-------- C:\Program Files\Windows Media Player
2006-11-01 16:01 -------- d-------- C:\Program Files\Java
2006-11-01 07:23 -------- d-------- C:\Program Files\Logitech
2006-10-29 16:50 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Talkback
2006-10-28 07:24 28672 --a------ C:\WINDOWS\system32\drivers\CO_Mon.sys
2006-10-27 15:09 413696 --a------ C:\WINDOWS\system32\vbscript.dll
2006-10-27 15:09 231424 --a------ C:\WINDOWS\system32\webcheck.dll
2006-10-27 15:09 156160 --a------ C:\WINDOWS\system32\msls31.dll
2006-10-27 02:44 71680 --a------ C:\WINDOWS\system32\admparse.dll
2006-10-27 02:44 55296 --a------ C:\WINDOWS\system32\iesetup.dll
2006-10-27 02:44 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe
2006-10-27 02:44 43008 --a------ C:\WINDOWS\system32\iernonce.dll
2006-10-27 02:44 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll
2006-10-27 02:44 229376 --a------ C:\WINDOWS\system32\ieaksie.dll
2006-10-27 02:44 152064 --a------ C:\WINDOWS\system32\ieakeng.dll
2006-10-27 02:44 13312 --a------ C:\WINDOWS\system32\ieudinit.exe
2006-10-27 02:44 123904 --a------ C:\WINDOWS\system32\advpack.dll
2006-10-27 02:42 161792 --a------ C:\WINDOWS\system32\ieakui.dll
2006-10-25 14:39 -------- d-------- C:\Program Files\Windows Defender
2006-10-23 16:45 -------- d-------- C:\Program Files\Apple Software Update
2006-10-22 19:46 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2006-10-22 15:30 -------- d-------- C:\Program Files\Norton Internet Security
2006-10-22 13:10 -------- d-------- C:\Program Files\Symantec
2006-10-22 13:01 -------- d-------- C:\Program Files\SymNetDrv
2006-10-17 13:06 78336 --a------ C:\WINDOWS\system32\ieencode.dll
2006-10-17 13:05 40960 --a------ C:\WINDOWS\system32\licmgr10.dll
2006-10-17 13:05 105984 --a------ C:\WINDOWS\system32\url.dll
2006-10-17 13:04 101376 --a------ C:\WINDOWS\system32\occache.dll
2006-10-17 13:03 17408 --a------ C:\WINDOWS\system32\corpol.dll
2006-10-17 12:57 36352 --a------ C:\WINDOWS\system32\imgutil.dll
2006-10-17 12:56 45568 --a------ C:\WINDOWS\system32\mshta.exe
2006-10-17 12:28 48128 --a------ C:\WINDOWS\system32\mshtmler.dll
2006-10-11 18:26 58880 --a------ C:\WINDOWS\system32\pnrpnsp.dll
2006-10-11 18:26 553984 --a------ C:\WINDOWS\system32\p2psvc.dll
2006-10-11 18:26 313344 --a------ C:\WINDOWS\system32\p2pgraph.dll
2006-10-11 18:26 153088 --a------ C:\WINDOWS\system32\p2p.dll
2006-10-11 18:26 116224 --a------ C:\WINDOWS\system32\p2pnetsh.dll
2006-10-11 18:26 104960 --a------ C:\WINDOWS\system32\p2pgasvc.dll
2006-10-09 18:00 -------- d---s---- C:\Documents and Settings\Omistaja\Application Data\Microsoft
2006-10-09 15:28 -------- d-------- C:\Program Files\FBM Software
2006-10-09 06:49 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\DivX
2006-10-08 19:17 -------- d-------- C:\Program Files\PennyHorse
2006-10-08 16:06 -------- d-------- C:\Program Files\DivX
2006-10-07 21:06 -------- d-------- C:\Program Files\Windows Installer Clean Up
2006-10-07 21:01 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\PEX
2006-10-07 20:50 -------- d-------- C:\Program Files\Lavasoft
2006-10-07 20:50 -------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2006-10-07 20:50 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Lavasoft
2006-10-07 20:27 -------- d-------- C:\Program Files\MSECACHE
2006-10-07 15:18 -------- d-------- C:\Program Files\Common Files\Softwin
2006-10-07 06:10 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\SUPERAntiSpyware.com
2006-10-02 21:04 806912 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2006-10-02 21:04 806912 --a------ C:\WINDOWS\system32\divx_xx07.dll
2006-10-02 21:04 790528 --a------ C:\WINDOWS\system32\divx_xx11.dll
2006-10-02 21:04 635486 --a------ C:\WINDOWS\system32\DivX.dll
2006-10-02 19:50 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\F-Secure
2006-10-02 06:37 -------- d-------- C:\Program Files\Messenger Plus! Live
2006-09-30 11:34 131072 --a------ C:\WINDOWS\system32\datestamp.dll
2006-09-30 11:11 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Help
2006-09-30 09:18 524288 --a------ C:\WINDOWS\opuc.dll
2006-09-30 07:39 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Uniblue
2006-09-29 07:19 118784 -r------- C:\WINDOWS\bwUnin-7.2.0.157-8876480SL.exe
2006-09-26 14:38 -------- d-------- C:\Program Files\UPHClean
2006-09-18 14:37 -------- d-------- C:\Program Files\directx
2006-09-18 14:37 -------- d-------- C:\Program Files\Common Files\FotoWire
2006-09-18 14:37 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\FotoWire
2006-09-18 14:33 -------- d-------- C:\Program Files\Common Files\Logitech
2006-09-17 16:11 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Ahead
2006-09-17 14:56 -------- d-------- C:\Program Files\Ahead
2006-09-16 12:34 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Atari
2006-09-16 08:14 -------- d-------- C:\Program Files\Common Files\PocketSoft
2006-09-16 08:10 -------- d-------- C:\Program Files\Atari
2006-09-16 08:09 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-09-16 07:54 -------- d-------- C:\Program Files\CCP
2006-09-14 15:56 -------- d-------- C:\Program Files\Infogrames
2006-09-14 14:39 -------- d-------- C:\Program Files\Nokia
2006-09-13 15:29 -------- d-------- C:\Program Files\QuickTime
2006-09-13 15:29 -------- d-------- C:\Program Files\iTunes
2006-09-13 15:29 -------- d-------- C:\Program Files\iPod
2006-09-13 15:29 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Apple Computer
2006-09-13 07:03 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-09-13 06:25 -------- d-------- C:\Program Files\Sunda Systems
2006-09-12 19:42 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Mozilla
2006-09-12 19:02 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Datalayer
2006-09-12 19:01 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Nokia
2006-09-12 17:51 1245184 --a------ C:\WINDOWS\system32\msxml4.dll
2006-09-12 17:25 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-09-12 06:19 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Macromedia
2006-09-11 16:05 82380 --a------ C:\WINDOWS\system32\drivers\AFS2K.SYS
2006-09-11 15:53 -------- d-------- C:\Program Files\Hewlett-Packard
2006-09-11 15:22 -------- d-------- C:\Program Files\Common Files\Hewlett-Packard
2006-09-11 15:22 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Share-to-Web-latauskansio
2006-09-11 15:20 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\PC Suite
2006-09-11 15:15 -------- d-------- C:\Program Files\DIFX
2006-09-11 14:51 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Sun
2006-09-11 06:58 -------- d-------- C:\Program Files\Microsoft Laskin
2006-09-11 06:56 -------- d-------- C:\Program Files\Common Files\Designer
2006-09-11 06:53 -------- d-------- C:\Program Files\Microsoft Office
2006-09-11 06:53 -------- d-------- C:\Program Files\microsoft frontpage
2006-09-11 06:53 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Microsoft Web Folders
2006-09-11 06:30 -------- d-------- C:\Program Files\Stardock
2006-09-11 06:21 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Windows Live Safety Center
2006-09-10 20:59 -------- d-------- C:\Program Files\Common Files\EPSON
2006-09-10 20:50 -------- d-------- C:\Program Files\Windows Media Connect 2
2006-09-10 20:37 -------- d-------- C:\Documents and Settings\Omistaja\Application Data\Symantec
2006-09-06 17:43 22752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-09-05 11:40 62 --ahs---- C:\Documents and Settings\Omistaja\Application Data\desktop.ini
2006-09-05 08:52 0 -rahs---- C:\MSDOS.SYS
2006-09-05 08:52 0 -rahs---- C:\IO.SYS
2006-09-05 08:52 0 --a------ C:\CONFIG.SYS
2006-09-05 08:52 0 --------- C:\AUTOEXEC.BAT
2006-08-25 17:49 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-25 05:47 115880 --------- C:\WINDOWS\system32\pxinsi64.exe
2006-08-21 14:26 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 11:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-16 13:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll
2006-08-11 19:35 108544 --------- C:\WINDOWS\system32\pxcpyi64.exe
2006-08-11 01:03 73728 --a------ C:\WINDOWS\system32\dpl100.dll
2006-08-11 01:03 196608 --a------ C:\WINDOWS\system32\dtu100.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\PROGRA~1\\MESSEN~1\\Msmsgs.exe\" /background"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"URLLSTCK.exe"="C:\\Program Files\\Norton Internet Security\\UrlLstCk.exe"
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"SpybotSnD"="\"C:\\Program Files\\Spybot - Search & Destroy\\SpybotSD.exe\" /autocheck"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e2,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e1,03,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e1,03,\
00,00,01,00,00,00
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\Norton AntiVirus - Tarkista tietokone.job
C:\WINDOWS\tasks\XoftSpySE.job
Completion time: 06-11-08 19:47:18.31
C:\ComboFix.txt ... 06-11-08 19:47
Tuosta HJT logista se No name plaa plaa, ei poistu. Se tulee koko ajan uudestaan! Onko se jokin vahingollinen tiedosto vai voiko se jäädä sinne?
http://www.castlecops.com/tk30584-ToolBar888_888Bar.html
olekos poistanut lisää poista sovellutuksesta
ToolBar888 tai 888Bar
Sitä ei oo siellä.. oisin sen poistanu kyl jos ois ollu.. Mut toi Spybot löytää sen mut ei poista sitä.. Kuten zlob.downloaderinki.. mites ne vois poistaa?
sitten hajetaan lisää jos löytyy
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg
scannaa
jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl A.
Kopioi rivit komennolla Ctrl C.
Liitä rivit komennolla Ctrl V.
Laita virus log tänne.
sulla on tuo ccleaner koneella ajas se ennen escanin latausta
puhdistaja ja virheet
AVG Anti-Spyware Guard vahti päällä
• Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
• "Resident shield is", muuta tila active:sta inactive:ksi
Ei auttanut tuokaan.. Tuo toolbar888 ei lähe millään spyware ohjelmalla millä skannaan! enkä voi pistää viirustarkastustakaa ettei kone sammu. Sit toi zlob.downloader on kans... mitähä tässä ny vois tehdä.?
Jos menis örkki helppoon, laita escani vaikka iexplore.exeks!
nimeä hijack.exe uudeleen skanneriksi
ja laita uusi loki
Toimii, vaikka nimi olis tutkain.exe
Alunperinhän se on mwavscan.com
Ei maksa mitään kokeilla totakin.
C:\Program Files\DrVirus\---> DrVirus.exe
En voi kyl vielkää skannata tota escanillakaa ku se pistää koneen käynnistyy uudelleen! eikä millään muullakaan ohjelmalla..
Formatoi se kone.
örkki on
http://www.pandasoftware.com/virus_info/encyclopedia/overview.aspx?lst=vis&idvirus=121661
vaikka sulla on norton,spybot,avg ,winows defender
onko vähän liikaa tavaraa ja sen takis nuo pöpöt pääsee koneelle.Tuo norton internet security hoitaa noi kaikki tehtävät,tiedoksi vaan.noi paljon erillaisia ohjelmia niin pakostikin tulee ristiriitoja
Toi DrVirus.exe löytyy tuon baglen sammuttamien ohjelmien listasta, siksi se on googlen löytämien sivujen listassa.
Muuta selitystä tuohon löytöösi en keksi, etkä kai sinäkään...
Tässä tuo osa listaa antamastasi linkistä:
"D
DefWatch.exe, DNSCACHE.exe, DOORS.exe, DrVirus.exe, drwadins.exe, drweb32w.exe, drwebnet.exe, drwebscd.exe, DRWEBUPW.exe, dvpapi.exe, dvpinit.exe.
"