HiJack logia onko mitään?

Tässä Antivirin antamat raportit:
ensin yksi ja perässä toinen.
Noi on nyt siellä Quarantine välilehdellä.
En voi tehdä sitä "add suspicious file to quarantine" tai siis sitä ei kai tarvii tehä koska nehän lienee jo siellä?


AntiVir PersonalEdition Classic
Report file date: 9. tammikuuta 2007 18:00

Scanning for 621088 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: TEIKARI

Version information:
BUILD.DAT : 217 12749 Bytes 5.12.2006 17:00:00
AVSCAN.EXE : 7.0.3.4 208936 Bytes 8.1.2007 21:15:45
AVSCAN.DLL : 7.0.3.1 35880 Bytes 5.12.2006 15:00:22
LUKE.DLL : 7.0.3.2 143400 Bytes 31.10.2006 15:07:46
LUKERES.DLL : 7.0.2.0 9256 Bytes 5.12.2006 15:00:22
ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 31.5.2006 14:30:06
ANTIVIR1.VDF : 6.36.1.24 2212864 Bytes 14.11.2006 08:12:08
ANTIVIR2.VDF : 6.37.0.114 874496 Bytes 7.1.2007 21:15:46
ANTIVIR3.VDF : 6.37.0.123 31744 Bytes 8.1.2007 21:15:46
AVEWIN32.DLL : 7.3.0.21 1999360 Bytes 8.1.2007 21:15:46
AVPREF.DLL : 7.0.2.0 23592 Bytes 3.11.2006 09:53:44
AVREP.DLL : 6.37.0.119 1052712 Bytes 8.1.2007 21:15:46
AVRPBASE.DLL : 7.0.0.0 2162728 Bytes 30.3.2006 07:43:31
AVPACK32.DLL : 7.2.0.5 368680 Bytes 23.10.2006 14:21:31
AVREG.DLL : 7.0.1.1 30760 Bytes 23.10.2006 09:52:27
NETNT.DLL : No Information!
RCIMAGE.DLL : 7.0.1.3 2097192 Bytes 8.11.2006 11:26:26
RCTEXT.DLL : 7.0.12.1 77864 Bytes 5.12.2006 15:00:21

Configuration settings for the scan:
Jobname..........................: Local Hard Disks
Configuration file...............: C:\Program Files\AntiVir PersonalEdition Classic\alldiscs.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Expanded search settings.........: 0x00001000

Start of the scan: 9. tammikuuta 2007 18:00

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Modules have been scanned
Scan process 'jucheck.exe' - '1' Modules have been scanned
Scan process 'FxSvr2.exe' - '1' Modules have been scanned
Scan process 'NkvMon.exe' - '1' Modules have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Modules have been scanned
Scan process 'backWeb-8876480.exe' - '1' Modules have been scanned
Scan process 'msnmsgr.exe' - '1' Modules have been scanned
Scan process 'ctfmon.exe' - '1' Modules have been scanned
Scan process 'avgnt.exe' - '1' Modules have been scanned
Scan process 'zlclient.exe' - '0' Modules have been scanned
Scan process 'qttask.exe' - '1' Modules have been scanned
Scan process 'jusched.exe' - '1' Modules have been scanned
Scan process 'LogiTray.exe' - '1' Modules have been scanned
Scan process 'LVCOMSX.EXE' - '1' Modules have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Modules have been scanned
Scan process 'hpcdtray.exe' - '1' Modules have been scanned
Scan process 'explorer.exe' - '1' Modules have been scanned
Scan process 'winlogon.exe' - '1' Modules have been scanned
Scan process 'csrss.exe' - '1' Modules have been scanned
Scan process 'firefox.exe' - '1' Modules have been scanned
Scan process 'guardgui.exe' - '1' Modules have been scanned
Scan process 'SpybotSD.exe' - '1' Modules have been scanned
Scan process 'jucheck.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'msnmsgr.exe' - '1' Modules have been scanned
Scan process 'FxSvr2.exe' - '1' Modules have been scanned
Scan process 'NkvMon.exe' - '1' Modules have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Modules have been scanned
Scan process 'backWeb-8876480.exe' - '1' Modules have been scanned
Scan process 'msmsgs.exe' - '1' Modules have been scanned
Scan process 'ctfmon.exe' - '1' Modules have been scanned
Scan process 'avgnt.exe' - '1' Modules have been scanned
Scan process 'zlclient.exe' - '0' Modules have been scanned
Scan process 'qttask.exe' - '1' Modules have been scanned
Scan process 'jusched.exe' - '1' Modules have been scanned
Scan process 'LogiTray.exe' - '1' Modules have been scanned
Scan process 'LVCOMSX.EXE' - '1' Modules have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Modules have been scanned
Scan process 'hpcdtray.exe' - '1' Modules have been scanned
Scan process 'explorer.exe' - '1' Modules have been scanned
Scan process 'winlogon.exe' - '1' Modules have been scanned
Scan process 'csrss.exe' - '1' Modules have been scanned
Scan process 'jucheck.exe' - '1' Modules have been scanned
Scan process 'alg.exe' - '1' Modules have been scanned
Scan process 'FxSvr2.exe' - '1' Modules have been scanned
Scan process 'WindowsSearchIndexer.exe' - '1' Modules have been scanned
Scan process 'WindowsSearch.exe' - '1' Modules have been scanned
Scan process 'NkvMon.exe' - '1' Modules have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Modules have been scanned
Scan process 'backWeb-8876480.exe' - '1' Modules have been scanned
Scan process 'ctfmon.exe' - '1' Modules have been scanned
Scan process 'avgnt.exe' - '1' Modules have been scanned
Scan process 'zlclient.exe' - '0' Modules have been scanned
Scan process 'qttask.exe' - '1' Modules have been scanned
Scan process 'jusched.exe' - '1' Modules have been scanned
Scan process 'LogiTray.exe' - '1' Modules have been scanned
Scan process 'LVCOMSX.EXE' - '1' Modules have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Modules have been scanned
Scan process 'hpcdtray.exe' - '1' Modules have been scanned
Scan process 'wdfmgr.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'guard.exe' - '1' Modules have been scanned
Scan process 'avguard.exe' - '1' Modules have been scanned
Scan process 'sched.exe' - '1' Modules have been scanned
Scan process 'explorer.exe' - '1' Modules have been scanned
Scan process 'spoolsv.exe' - '1' Modules have been scanned
Scan process 'vsmon.exe' - '0' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'lsass.exe' - '1' Modules have been scanned
Scan process 'services.exe' - '1' Modules have been scanned
Scan process 'winlogon.exe' - '1' Modules have been scanned
Scan process 'csrss.exe' - '1' Modules have been scanned
Scan process 'smss.exe' - '1' Modules have been scanned
73 processes with 73 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( 23 files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{4E9D00AD-B013-47D0-8722-19127AD687D8}\RP562\A0059720.exe
[DETECTION] Is the Trojan horse TR/StartPage.1.1.B
C:\System Volume Information\_restore{4E9D00AD-B013-47D0-8722-19127AD687D8}\RP562\A0059725.exe
[DETECTION] Is the Trojan horse TR/StartPage.1.1.B


End of the scan: 9. tammikuuta 2007 20:17
Used time: 2:17:09 min

The scan has been done completely.

5276 Scanning directories
231619 Files were scanned
2 viruses and/or unwanted programs were found
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
231617 Files not concerned
5756 Archives were scanned
3 Warnings
3 Notes


Tässä tämä toinen:



AntiVir PersonalEdition Classic
Report file date: 9. tammikuuta 2007 07:55

Scanning for 621088 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: Isäntä
Computer name: TEIKARI

Version information:
BUILD.DAT : 217 12749 Bytes 5.12.2006 17:00:00
AVSCAN.EXE : 7.0.3.4 208936 Bytes 8.1.2007 21:15:45
AVSCAN.DLL : 7.0.3.1 35880 Bytes 5.12.2006 15:00:22
LUKE.DLL : 7.0.3.2 143400 Bytes 31.10.2006 15:07:46
LUKERES.DLL : 7.0.2.0 9256 Bytes 5.12.2006 15:00:22
ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 31.5.2006 14:30:06
ANTIVIR1.VDF : 6.36.1.24 2212864 Bytes 14.11.2006 08:12:08
ANTIVIR2.VDF : 6.37.0.114 874496 Bytes 7.1.2007 21:15:46
ANTIVIR3.VDF : 6.37.0.123 31744 Bytes 8.1.2007 21:15:46
AVEWIN32.DLL : 7.3.0.21 1999360 Bytes 8.1.2007 21:15:46
AVPREF.DLL : 7.0.2.0 23592 Bytes 3.11.2006 09:53:44
AVREP.DLL : 6.37.0.119 1052712 Bytes 8.1.2007 21:15:46
AVRPBASE.DLL : 7.0.0.0 2162728 Bytes 30.3.2006 07:43:31
AVPACK32.DLL : 7.2.0.5 368680 Bytes 23.10.2006 14:21:31
AVREG.DLL : 7.0.1.1 30760 Bytes 23.10.2006 09:52:27
NETNT.DLL : No Information!
RCIMAGE.DLL : 7.0.1.3 2097192 Bytes 8.11.2006 11:26:26
RCTEXT.DLL : 7.0.12.1 77864 Bytes 5.12.2006 15:00:21

Configuration settings for the scan:
Jobname..........................: Local Hard Disks
Configuration file...............: C:\Program Files\AntiVir PersonalEdition Classic\alldiscs.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Expanded search settings.........: 0x00001000

Start of the scan: 9. tammikuuta 2007 07:55

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Modules have been scanned
Scan process 'avcenter.exe' - '1' Modules have been scanned
Scan process 'WindowsSearchFilter.exe' - '1' Modules have been scanned
Scan process 'wuauclt.exe' - '1' Modules have been scanned
Scan process 'alg.exe' - '1' Modules have been scanned
Scan process 'FxSvr2.exe' - '1' Modules have been scanned
Scan process 'WindowsSearchIndexer.exe' - '1' Modules have been scanned
Scan process 'WindowsSearch.exe' - '1' Modules have been scanned
Scan process 'NkvMon.exe' - '1' Modules have been scanned
Scan process 'reader_sl.exe' - '1' Modules have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Modules have been scanned
Scan process 'backWeb-8876480.exe' - '1' Modules have been scanned
Scan process 'ctfmon.exe' - '1' Modules have been scanned
Scan process 'avgnt.exe' - '1' Modules have been scanned
Scan process 'zlclient.exe' - '0' Modules have been scanned
Scan process 'qttask.exe' - '1' Modules have been scanned
Scan process 'jusched.exe' - '1' Modules have been scanned
Scan process 'LogiTray.exe' - '1' Modules have been scanned
Scan process 'LVCOMSX.EXE' - '1' Modules have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Modules have been scanned
Scan process 'hpcdtray.exe' - '1' Modules have been scanned
Scan process 'wdfmgr.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'guard.exe' - '1' Modules have been scanned
Scan process 'avguard.exe' - '1' Modules have been scanned
Scan process 'sched.exe' - '1' Modules have been scanned
Scan process 'explorer.exe' - '1' Modules have been scanned
Scan process 'spoolsv.exe' - '1' Modules have been scanned
Scan process 'vsmon.exe' - '0' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'lsass.exe' - '1' Modules have been scanned
Scan process 'services.exe' - '1' Modules have been scanned
Scan process 'winlogon.exe' - '1' Modules have been scanned
Scan process 'csrss.exe' - '1' Modules have been scanned
Scan process 'smss.exe' - '1' Modules have been scanned
37 processes with 37 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( 27 files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\Isäntä\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count3.jar-a5399d2-241660fa.zip
[DETECTION] Contains signature of the Java virus JAVA/Bytverify.2.A
[INFO] The file was moved to '46184712.qua'!
C:\Documents and Settings\Isäntä\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\counter.jpg-301c72d2-619f9e91.zip
[DETECTION] Contains signature of the Java virus JAVA/ClassLdr.I.2
[INFO] The file was moved to '46184713.qua'!
C:\Documents and Settings\Isäntä\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\counter.jpg-5c868ee8-1ab4d58f.zip
[DETECTION] Contains signature of the Java virus JAVA/ClassLdr.I.2
[INFO] The file was moved to '47967580.qua'!
C:\Documents and Settings\Isäntä\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\counter.jpg-5c868ee8-5d47e727.zip
[DETECTION] Contains signature of the Java virus JAVA/ClassLdr.I.2
[INFO] The file was moved to '46184715.qua'!
C:\Documents and Settings\Isäntä\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\counter.jpg-5c868ee8-7d1a7640.zip
[DETECTION] Contains signature of the Java virus JAVA/ClassLdr.I.2
[INFO] The file was moved to '46184714.qua'!
C:\Documents and Settings\Isäntä\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-1109b54b-43c3be66.zip
[DETECTION] Contains signature of the Java virus JAVA/Byteverify.G.3
[INFO] The file was moved to '4619470b.qua'!
C:\Documents and Settings\Isäntä\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-5d45dd39-4d3e7f0f.zip
[DETECTION] Contains signature of the Java virus JAVA/Byteverify.G.3
[INFO] The file was moved to '4794b760.qua'!
C:\Documents and Settings\Isäntä\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jrl.jar-70b9958a-172c524d.zip
[DETECTION] Contains signature of the Java virus JAVA/Byteverify.G.3
[INFO] The file was moved to '460f471d.qua'!
C:\Documents and Settings\Isäntä\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv410.jar-67ccc02a-36328735.zip
[DETECTION] Is the Trojan horse TR/Forten.Java.2
[INFO] The file was moved to '46044729.qua'!
C:\Documents and Settings\Isäntä\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv428.jar-69f254d1-67370668.zip
[DETECTION] Is the Trojan horse TR/Forten.Java.2
[INFO] The file was moved to '4789b746.qua'!
C:\Documents and Settings\Isäntä\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-16042425-1f932853.zip
[DETECTION] Contains signature of the Java virus JAVA/ClassLoade.U.4
[INFO] The file was moved to '46114720.qua'!
C:\Documents and Settings\Isäntä\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-2449939e-78aa635a.zip
[DETECTION] Contains signature of the Java virus JAVA/ClassLoade.U.4
[INFO] The file was moved to '479cb74d.qua'!
C:\Documents and Settings\Isäntä\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-473001be-5a832870.zip
[DETECTION] Contains signature of the Java virus JAVA/ClassLoade.U.4
[INFO] The file was moved to '46114722.qua'!
C:\Documents and Settings\Isäntä\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-473001be-5efc75c0.zip
[DETECTION] Contains signature of the Java virus JAVA/ClassLoade.U.4
[INFO] The file was moved to '479cb74f.qua'!
C:\Documents and Settings\Teemu\Local Settings\Temp\MessengerCache\he05ic KilflXlfVE6u4LvaPVPY=
[DETECTION] Is the Trojan horse TR/Spy.Banker.vk.1
[INFO] The file was moved to '45d34b97.qua'!
C:\RECYCLER\S-1-5-21-73586283-362288127-839522115-1003\Dc2.exe
[DETECTION] Is the Trojan horse TR/StartPage.1.1.B
[INFO] The file was moved to '45d54f94.qua'!
C:\WINDOWS\system32\mscornet.exe
[DETECTION] Is the Trojan horse TR/StartPage.1.1.B
[INFO] The file was moved to '46065299.qua'!


End of the scan: 9. tammikuuta 2007 10:30
Used time: 2:34:33 min

The scan has been done completely.

4970 Scanning directories
185764 Files were scanned
17 viruses and/or unwanted programs were found
0 files were deleted
0 files were repaired
17 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
185747 Files not concerned
5382 Archives were scanned
3 Warnings
0 Notes

Poista lisää poista sovelutuksesta

Starware349

scannaa hjt:llä merkkaa paina Fix checked

R3 - URLSearchHook: {1A03F196-9617-4CA0-842B-A83CEECB022B} - - (no file)
O3 - Toolbar: Starware349 - {9FB3908C-6565-4CB0-95F8-E9F85258723C} - C:\Program Files\Starware349\bin\Starware349.dll (file missing)
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

Käynnistä > suorita kirjoita allaa olevat jokaisen rivin jälkeen paina enter

sc stop SNDSrvc
sc delete SNDSrvc
sc stop LiveUpdate
sc delete LiveUpdate

Poista vikassiedossa
C:\Program Files\>>>>> Starware349