Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    Voisiko joku vilkaista logini?

    Elikkäs tälläinen tapaus?

    Sit vielä jos joku osais neuvoa miten poistetaan win-spy "ohjelma"

    Logfile of HijackThis v1.99.1
    Scan saved at 14:00:57, on 3.2.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Eset\nod32krn.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Eset\nod32kui.exe
    C:\Program Files\D-Tools\daemon.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\WINDOWS\display\smss.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\taskmgr.exe
    C:\lsass.exe
    C:\WINDOWS\msn64.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\TechniSat DVB\bin\Server4PC.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\DOCUME~1\Ojala\LOCALS~1\Temp\Rar$EX00.437\HijackThis.exe
    C:\Program Files\Webroot\Spy Sweeper\SSU.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] "C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" -startup
    O4 - HKLM\..\Run: [DHCP] C:\WINDOWS\display\smss.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [lsass] C:\lsass.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\RunOnce: [SpySweeperUninstallSurvey] http://products.webroot.com/disp0201.php?pc=64021&rc=3601&ps=T&oc=33&mjv=5&mnv=0&bld=1608&cd=&dcc=&drc=&mo=&sid=&lang=en&loc=FIN&opi=2&omj=5&omn=1&rsc=
    O4 - Global Startup: Server4PC.lnk = C:\Program Files\TechniSat DVB\bin\Server4PC.exe
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    101381
    Äänestä

    Muut lukivat myös

    Vastaukset 10

    Vanhimmat

    Tarkastan login. Varmistan ensin ohjeet opettajillani, ja yritän palata mahdollisimman pian asiaan.

    Äänestä

    Onko koneella palomuuria käytössä? Windowsin oma muuri?

    ***
    Lataa SDFix by AndyManchesta http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
    ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:

    * Käynnistä tietokone
    * Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
    * Seuraavaksi pitäisi ilmestyä valikko
    * Valitse valikosta vikasietotila.


    * Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix.exe) työpöydälle. Tuplakilikkaa työpöydälle ilmestynyttä sdfix.exe tiedostoa. Tiedosto purkaantuu ja asentaa itsensä siihen levyasemaan, minne on käyttöjärjestelmä on asennettu ja juureen ilmestyy kansio SDFix, ESIM C:\SDFix
    * Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    * Paina Y käynnistääksesi skriptin.
    * Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    * Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    * Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    * Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    * Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    * Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.



    ***
    1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
    http://download.bleepingcomputer.com/sUBs/combofix.exe
    http://www.techsupportforum.com/sectools/combofix.exe

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    ***
    Koneella on backdoor tartunta, joten suosittelen, että vaihdat kaikki tärkeät salasanasi heti puhdistuksen jälkeen.
    Jos mahdollista, älä käytä konetta asiointiin ja sähköpostiin, ennenkuin se on kunnossa.

    ***
    Lähetä SDFixin Report.txt, C:\combofix.txt sekä uusi hijack logi

    Äänestä

    • Jeps elikkäs tässäpä olis nää logit..


      SDFix: Version 1.63

      su 04.02.2007 - 2:05:42,39

      Microsoft Windows XP [versio 5.1.2600]

      Running From: C:\SDFix

      Safe Mode:
      Checking Services:

      Name:

      Path:


      Restoring Windows Registry Entries
      Restoring Default Hosts File


      Rebooting...

      Normal Mode:
      Checking Files:

      Below files will be copied to Backups folder then removed:

      C:\lsass.exe - Deleted



      ADS Check:

      C:\WINDOWS\system32
      No streams found.

      Final Check:

      Remaining Services:
      ------------------


      Authorized Application Key Export:

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
      "C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:µTorrent"
      "C:\\Program Files\\TechniSat DVB\\bin\\Server4PC.exe"="C:\\Program Files\\TechniSat DVB\\bin\\Server4PC.exe:*:Enabled:Server4PC"
      "C:\\Program Files\\RevConnect\\DCPlusPlus.exe"="C:\\Program Files\\RevConnect\\DCPlusPlus.exe:*:Enabled:DC++"
      "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
      "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
      "E:\\PELIT\\Savagee\\silverback.exe"="E:\\PELIT\\Savagee\\silverback.exe:*:Enabled:silverback"
      "C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
      "E:\\PELIT\\Half-Life 2\\hl2.exe"="E:\\PELIT\\Half-Life 2\\hl2.exe:*:Enabled:hl2"
      "M:\\wowi\\Burning Crusade Closed Beta\\WoW-2.0.3-enGB-downloader.exe"="M:\\wowi\\Burning Crusade Closed Beta\\WoW-2.0.3-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
      "E:\\PELIT\\SoF2\\SoF2MP.exe"="E:\\PELIT\\SoF2\\SoF2MP.exe:*:Enabled:SoF2MP"
      "M:\\wowi\\World Of Warcraft Burning Crusade (beta)\\Patch\\WoW-2.0.0.6052-to-2.0.1.6082-enGB-downloader.exe"="M:\\wowi\\World Of Warcraft Burning Crusade (beta)\\Patch\\WoW-2.0.0.6052-to-2.0.1.6082-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
      "M:\\wowi\\World Of Warcraft Burning Crusade (beta)\\Patch\\WoW-2.0.0-enGB-downloader.exe"="M:\\wowi\\World Of Warcraft Burning Crusade (beta)\\Patch\\WoW-2.0.0-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
      "C:\\Program Files\\AtomFTP\\AtomFTP.exe"="C:\\Program Files\\AtomFTP\\AtomFTP.exe:*:Enabled:AtomFTP - http://pelu.jns.fi/~akarttun/atomftp"
      "C:\\Documents and Settings\\Ojala\\Työpöytä\\WowExpansionMaster_1024_2100_B_English-avi-downloader.exe"="C:\\Documents and Settings\\Ojala\\Työpöytä\\WowExpansionMaster_1024_2100_B_English-avi-downloader.exe:*:Enabled:Blizzard Downloader"
      "C:\\Documents and Settings\\Ojala\\Local Settings\\Temporary Internet Files\\Content.IE5\\4HIJ0DUJ\\WoW-enGB-Installer-downloader[1].exe"="C:\\Documents and Settings\\Ojala\\Local Settings\\Temporary Internet Files\\Content.IE5\\4HIJ0DUJ\\WoW-enGB-Installer-downloader[1].exe:*:Enabled:Blizzard Downloader"
      "C:\\Documents and Settings\\Ojala\\Omat tiedostot\\FuriouZ Autominer\\FuriouZ Autominer.exe"="C:\\Documents and Settings\\Ojala\\Omat tiedostot\\FuriouZ Autominer\\FuriouZ Autominer.exe:*:Enabled:C:\\Documents and Settings\\Ojala\\Omat tiedostot\\FuriouZ Autominer\\FuriouZ Autominer.exe"
      "C:\\lsass.exe"="C:\\lsass.exe:*:Enabled:C:\\lsass.exe"
      "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
      "D:\\Torrentit\\autot\\Happycracker Cheat Pack V6.1\\Other Cheating Programs\\RS Account Hack\\RS Account Hack.exe"="D:\\Torrentit\\autot\\Happycracker Cheat Pack V6.1\\Other Cheating Programs\\RS Account Hack\\RS Account Hack.exe:*:Disabled:RS Account Hack"
      "C:\\WINDOWS\\system32\\java.exe"="C:\\WINDOWS\\system32\\java.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
      "C:\\Program Files\\Java\\jre1.5.0_10\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_10\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
      "C:\\Program Files\\Hamachi\\hamachi.exe"="C:\\Program Files\\Hamachi\\hamachi.exe:*:Enabled:Hamachi Client"
      "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
      "C:\\Program Files\\ps3d\\PlayScape.exe"="C:\\Program Files\\ps3d\\PlayScape.exe:*:Enabled:PlayScape"
      "C:\\Program Files\\SwiftSwitch\\SwiftSwitch.exe"="C:\\Program Files\\SwiftSwitch\\SwiftSwitch.exe:*:Enabled:World Switcher for RuneScape"
      "C:\\WINDOWS\\display\\services.exe"="C:\\WINDOWS\\display\\services.exe:*:Enabled:Transparent Proxy Server"
      "C:\\WINDOWS\\Outlook32.exe"="C:\\WINDOWS\\Outlook32.exe:*:Enabled:Outlook.exe"
      "C:\\WINDOWS\\winup32.exe"="C:\\WINDOWS\\winup32.exe:*:Enabled:winup32.exe"


      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
      "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"


      Remaining Files:
      ---------------

      Backups Folder: - C:\SDFix\backups\backups.zip


      Checking For Files with Hidden Attributes :


      Finished

      Ja sit toinen:

      "Ojala" - 07-02-04 2:13:07 Service Pack 2
      ComboFix 07.02.04 - Running from: "C:\Documents and Settings\Ojala\Ty”p”yt„"

      ((((((((((((((((((((((((((((((( Files Created from 2007-01-04 to 2007-02-04 ))))))))))))))))))))))))))))))))))


      2007-02-04 02:05      d--------   C:\SDFix
      2007-02-04 02:04      d--------   C:\DOCUME~1\NETWOR~1\Application Data\Webroot
      2007-02-03 20:52      d--------   C:\Program Files\PeerGuardian_1.96b
      2007-02-03 20:51      d--------   C:\DOCUME~1\ALLUSE~1\Application Data\Spybot - Search & Destroy
      2007-02-03 20:48      d--------   C:\Program Files\SpywareBlaster
      2007-02-03 16:52      d--------   C:\DOCUME~1\LOCALS~1\Application Data\Webroot
      2007-02-03 14:58   684,032   --a------   C:\WINDOWS\system32\libeay32.dll
      2007-02-03 14:58   22,080   --a------   C:\WINDOWS\system32\drivers\sshrmd.sys
      2007-02-03 14:58   20,544   --a------   C:\WINDOWS\system32\drivers\SSFS0509.sys
      2007-02-03 14:58   155,648   --a------   C:\WINDOWS\system32\ssleay32.dll
      2007-02-03 14:58   144,448   --a------   C:\WINDOWS\system32\drivers\ssidrv.sys
      2007-02-03 14:58      d--------   C:\Program Files\Webroot
      2007-02-03 14:44      d--------   C:\DOCUME~1\Ojala\Application Data\Webroot
      2007-02-03 14:44      d--------   C:\DOCUME~1\ALLUSE~1\Application Data\Webroot
      2007-02-03 02:55      d--------   C:\DOCUME~1\JRJEST~1.JUS\Application Data\PC Tools
      2007-02-03 02:53      d--------   C:\DOCUME~1\JRJEST~1.JUS\Application Data\Lavasoft
      2007-02-03 02:51      dr-------   C:\DOCUME~1\JRJEST~1.JUS\K„ynnist„-valikko
      2007-02-03 02:51      d--h-----   C:\DOCUME~1\JRJEST~1.JUS\Verkkoymp„rist”
      2007-02-03 02:51      d--h-----   C:\DOCUME~1\JRJEST~1.JUS\Tulostinymp„rist”
      2007-02-03 02:51      d--h-----   C:\DOCUME~1\JRJEST~1.JUS\Mallit
      2007-02-03 02:51      d--------   C:\DOCUME~1\JRJEST~1.JUS\Ty”p”yt„
      2007-02-03 02:51      d--------   C:\DOCUME~1\JRJEST~1.JUS\Suosikit
      2007-02-03 02:49      dr-------   C:\DOCUME~1\JRJEST~1\K„ynnist„-valikko
      2007-02-03 02:49      d--h-----   C:\DOCUME~1\JRJEST~1\Verkkoymp„rist”
      2007-02-03 02:49      d--h-----   C:\DOCUME~1\JRJEST~1\Tulostinymp„rist”
      2007-02-03 02:49      d--h-----   C:\DOCUME~1\JRJEST~1\Mallit
      2007-02-03 02:49      d--------   C:\DOCUME~1\JRJEST~1\Ty”p”yt„
      2007-02-03 02:49      d--------   C:\DOCUME~1\JRJEST~1\Suosikit
      2007-02-03 02:37   21,056   --a------   C:\WINDOWS\system32\drivers\sskbfd.sys
      2007-02-03 02:27      d--------   C:\Program Files\Enigma Software Group
      2007-02-03 02:13      d--------   C:\DOCUME~1\Ojala\Application Data\AdobeUM
      2007-01-31 20:57   89,600   --a------   C:\WINDOWS\taskmgr.exe
      2007-01-31 20:57   69,120   --a------   C:\WINDOWS\hpeg.dll
      2007-01-31 20:57   64,512   --a------   C:\WINDOWS\winup32.exe
      2007-01-31 20:57   57,344   --a------   C:\WINDOWS\srsver.dll
      2007-01-31 20:57   57,344   --a------   C:\WINDOWS\Outlook32.exe
      2007-01-31 20:57   50,176   --a------   C:\WINDOWS\msn64.exe
      2007-01-31 20:57   31,744   --a------   C:\WINDOWS\encod.exe
      2007-01-31 20:57   3,129,325   --a------   C:\WINDOWS\slog.dll
      2007-01-31 20:57   26   --a------   C:\WINDOWS\refsdm.dll
      2007-01-31 20:57      d--------   C:\WINDOWS\display
      2007-01-31 20:57      d--------   C:\Program Files\Accessories
      2007-01-29 18:41      d--------   C:\Program Files\SwiftSwitch
      2007-01-29 18:41      d--------   C:\DOCUME~1\ALLUSE~1\Application Data\SwiftSwitch
      2007-01-29 16:24   3,120   --a------   C:\WINDOWS\system32\2d2ca2ce-704a-428c-8cbe-0736b29190aa.dll
      2007-01-28 23:38      d--------   C:\DOCUME~1\Ojala\dodian.com
      2007-01-28 23:19      d--------   C:\Program Files\ps3d
      2007-01-27 23:48      d--------   C:\DOCUME~1\Ojala\Application Data\Hamachi
      2007-01-27 23:47   17,480   --a------   C:\WINDOWS\system32\drivers\hamachi.sys
      2007-01-27 23:47      d--------   C:\Program Files\Hamachi
      2007-01-27 22:57      d--------   C:\WINDOWS\.mpr_file_store_32
      2007-01-27 22:56      d--------   C:\Program Files\MoparScape
      2007-01-21 02:33      d--------   C:\WINDOWS\pss
      2007-01-20 14:05      d--------   C:\DOCUME~1\Ojala\Typyt
      2007-01-17 16:45      d--------   C:\Program Files\GoldWave
      2007-01-17 16:45      d--------   C:\DOCUME~1\Ojala\Application Data\Help
      2007-01-17 16:45      d--------   C:\DOCUME~1\Ojala\Application Data\GetRightToGo
      2007-01-15 08:44      d--------   C:\WINDOWS\ShellNew
      2007-01-10 18:16      d--------   C:\DOCUME~1\Ojala\Application Data\Adobe
      2007-01-10 17:26      d--------   C:\Program Files\SCAR 2.03
      2007-01-10 14:50   94,208   --a------   C:\WINDOWS\system32\China.dll
      2007-01-08 16:01      d--h-----   C:\Program Files\Zero G Registry
      2007-01-08 08:56      d--------   C:\Program Files\Common Files\Adobe
      2007-01-08 08:56      d--------   C:\DOCUME~1\ALLUSE~1\Application Data\Adobe
      2007-01-07 12:39      d--------   C:\WINDOWS\Sun
      2007-01-07 12:39      d--------   C:\WINDOWS\.file_store_32
      2007-01-07 12:39      d--------   C:\DOCUME~1\Ojala\Application Data\Sun
      2007-01-07 12:38      d--------   C:\Program Files\Java
      2007-01-07 12:37      d--------   C:\Program Files\Common Files\Java
      2007-01-07 12:32      d--------   C:\Program Files\ArtMoney
      2007-01-06 12:56   1,645,320   --a------   C:\WINDOWS\system32\gdiplus.dll
      2007-01-04 23:20      d--------   C:\DOCUME~1\Ojala\Application Data\Real


      (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


      2007-02-04 02:11   --------   d--------   C:\Program Files\mozilla firefox
      2007-02-03 20:53   --------   d--------   C:\Program Files\lavasoft
      2007-02-03 16:52   --------   d--------   C:\DOCUME~1\Ojala\Application Data\utorrent
      2007-02-03 02:28   --------   d--------   C:\Program Files\revconnect
      2007-02-02 18:15   --------   d--------   C:\Program Files\powerarchiver
      2007-01-24 08:40   --------   d---s----   C:\DOCUME~1\Ojala\Application Data\microsoft
      2007-01-21 02:57   --------   d--------   C:\DOCUME~1\Ojala\Application Data\bsplayer pro
      2007-01-10 14:50   --------   d--h-----   C:\Program Files\installshield installation information
      2007-01-09 13:38   --------   d--------   C:\DOCUME~1\Ojala\Application Data\macromedia
      2007-01-08 08:50   12400   --a------   C:\WINDOWS\system32\drivers\secdrv.sys
      2007-01-07 22:17   --------   d--------   C:\Program Files\winamp
      2007-01-03 23:09   --------   d--------   C:\Program Files\quicktime
      2007-01-03 19:00   --------   d--------   C:\Program Files\hycam2
      2007-01-03 08:45   --------   d--------   C:\Program Files\atomftp
      2006-12-31 13:27   --------   d--------   C:\DOCUME~1\Ojala\Application Data\dvdcss
      2006-12-27 16:41   --------   d--------   C:\DOCUME~1\Ojala\Application Data\ahead
      2006-12-27 16:40   --------   d--------   C:\Program Files\ahead
      2006-12-27 16:25   --------   d--------   C:\Program Files\Common Files\installshield
      2006-12-27 16:25   --------   d--------   C:\Program Files\Common Files\ahead
      2006-12-24 16:18   --------   d--------   C:\Program Files\Common Files\blizzard entertainment
      2006-12-22 15:25   162432   --a------   C:\WINDOWS\system32\drivers\ithsgt.sys
      2006-12-22 15:25   12032   --a------   C:\WINDOWS\system32\drivers\lilsgt.sys
      2006-12-20 16:48   --------   d--------   C:\Program Files\mirc
      2006-12-20 00:50   581906   --a------   C:\DOCUME~1\Ojala\Application Data\nmm-metadata.db
      2006-12-20 00:39   --------   d--------   C:\DOCUME~1\Ojala\Application Data\nokia
      2006-12-20 00:37   --------   d--------   C:\Program Files\pc connectivity solution
      2006-12-20 00:37   --------   d--------   C:\Program Files\nokia
      2006-12-20 00:37   --------   d--------   C:\Program Files\difx
      2006-12-20 00:37   --------   d--------   C:\Program Files\Common Files\pcsuite
      2006-12-20 00:37   --------   d--------   C:\Program Files\Common Files\nokia
      2006-12-20 00:37   --------   d--------   C:\DOCUME~1\Ojala\Application Data\pc suite
      2006-12-20 00:12   --------   d--------   C:\DOCUME~1\Ojala\Application Data\vlc
      2006-12-19 00:21   --------   d--------   C:\DOCUME~1\Ojala\Application Data\pc tools
      2006-12-19 00:17   --------   d--------   C:\Program Files\yamicsoft
      2006-12-19 00:10   --------   d--------   C:\Program Files\messenger
      2006-12-18 23:55   --------   d--------   C:\Program Files\nonamescript
      2006-12-18 22:36   --------   d--------   C:\Program Files\dvbviewer
      2006-12-18 20:50   --------   d--------   C:\Program Files\d-tools
      2006-12-18 19:29   --------   d--------   C:\Program Files\amdagp
      2006-12-18 18:38   --------   d--------   C:\DOCUME~1\Ojala\Application Data\lavasoft
      2006-12-18 18:35   62   --ahs----   C:\DOCUME~1\Ojala\Application Data\desktop.ini
      2006-12-18 18:35   --------   d--------   C:\Program Files\Common Files\speechengines
      2006-12-18 18:35   --------   d--------   C:\Program Files\Common Files\odbc
      2006-12-18 18:34   --------   d--------   C:\Program Files\videolan
      2006-12-18 18:27   --------   d--------   C:\Program Files\ffdshow
      2006-12-18 18:22   --------   d--------   C:\Program Files\webteh
      2006-12-18 18:00   --------   d--------   C:\Program Files\msn messenger
      2006-12-18 17:36   --------   d--------   C:\Program Files\bitcomet
      2006-12-18 17:28   --------   d--------   C:\Program Files\Common Files\sonic shared
      2006-12-18 17:27   --------   d--------   C:\Program Files\technisat dvb
      2006-12-18 17:22   --------   d--------   C:\Program Files\utorrent
      2006-12-18 17:03   --------   d--------   C:\Program Files\ati technologies
      2006-12-18 16:59   --------   d--------   C:\DOCUME~1\Ojala\Application Data\mozilla
      2006-12-18 16:56   502368   --a------   C:\WINDOWS\system32\drivers\amon.sys
      2006-12-18 16:56   274432   --a------   C:\WINDOWS\system32\imon.dll
      2006-12-18 16:55   --------   d--------   C:\DOCUME~1\Ojala\Application Data\identities
      2006-12-18 16:50   --------   d--------   C:\Program Files\microsoft frontpage
      2006-12-18 16:49   0   -rahs----   C:\MSDOS.SYS
      2006-12-18 16:49   0   -rahs----   C:\IO.SYS
      2006-12-18 16:49   0   --a------   C:\CONFIG.SYS
      2006-12-18 16:49   0   --a------   C:\AUTOEXEC.BAT
      2006-12-18 16:48   --------   d--------   C:\Program Files\online services
      2006-12-18 16:48   --------   d--------   C:\Program Files\Common Files\mssoap
      2006-12-18 16:47   --------   d--------   C:\Program Files\movie maker
      2006-12-18 16:46   --------   d--------   C:\Program Files\windows nt
      2006-12-18 16:46   --------   d--------   C:\Program Files\msn gaming zone
      2006-12-11 00:12   5120   --a------   C:\WINDOWS\system32\ff_vfw.dll
      2006-12-10 23:32   499712   --a------   C:\WINDOWS\system32\msvcp71.dll
      2006-12-07 07:29   2374472   --a------   C:\WINDOWS\system32\wmvcore.dll
      2006-12-04 22:39   56360   --a------   C:\WINDOWS\system32\wbhelp2.dll
      2006-11-22 10:52   520192   ---------   C:\WINDOWS\system32\ati2sgag.exe
      2006-11-22 05:25   261120   --a------   C:\WINDOWS\system32\ati2dvag.dll
      2006-11-22 05:20   118784   --a------   C:\WINDOWS\system32\atipdlxx.dll
      2006-11-22 05:20   106496   --a------   C:\WINDOWS\system32\oemdspif.dll
      2006-11-22 05:19   90112   --a------   C:\WINDOWS\system32\ati2evxx.dll
      2006-11-22 05:19   42496   --a------   C:\WINDOWS\system32\ati2edxx.dll
      2006-11-22 05:19   26112   --a------   C:\WINDOWS\system32\ati2mdxx.exe
      2006-11-22 05:18   430080   --a------   C:\WINDOWS\system32\ati2evxx.exe
      2006-11-22 05:17   53248   --a------   C:\WINDOWS\system32\atiddc.dll
      2006-11-22 05:12   2526688   --a------   C:\WINDOWS\system32\ati3duag.dll
      2006-11-22 05:11   5279744   --a------   C:\WINDOWS\system32\atioglxx.dll
      2006-11-22 05:08   1090016   --a------   C:\WINDOWS\system32\ativvaxx.dll
      2006-11-22 04:57   217088   --a------   C:\WINDOWS\system32\atikvmag.dll
      2006-11-22 04:56   17408   --a------   C:\WINDOWS\system32\atitvo32.dll
      2006-11-22 04:51   294912   --a------   C:\WINDOWS\system32\ati2cqag.dll
      2006-11-22 04:50   6684672   --a------   C:\WINDOWS\system32\atioglx1.dll
      2006-11-22 04:49   307200   --a------   C:\WINDOWS\system32\atiiiexx.dll
      2006-11-22 04:21   303104   --a------   C:\WINDOWS\system32\atidemgr.dll
      2006-11-08 07:06   679424   --a------   C:\WINDOWS\system32\inetcomm.dll


      (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

      *Note* empty entries & legit default entries are not shown

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
      "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
      "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
      "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
      "nod32kui"="\"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE"
      "DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033"
      "PCSuiteTrayApplication"="\"C:\\Program Files\\Nokia\\Nokia PC Suite 6\\LaunchApplication.exe\" -startup"
      "DHCP"="C:\\WINDOWS\\display\\smss.exe"
      "SpySweeper"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe\" /startintray"

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
      "Installed"="1"

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
      "Installed"="1"
      "NoChange"="1"

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
      "Installed"="1"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Adobe Reader Speed Launch.lnk]
      "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
      "item"="Adobe Reader Speed Launch"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Microsoft Office.lnk]
      "backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\PROGRA~1\\MICROS~2\\Office10\\OSA.EXE -b -l"
      "item"="Microsoft Office"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="msmsgs"
      "hkey"="HKCU"
      "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="MsnMsgr"
      "hkey"="HKCU"
      "command"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="NeroCheck"
      "hkey"="HKLM"
      "command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="qttask"
      "hkey"="HKLM"
      "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="jusched"
      "hkey"="HKLM"
      "command"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="winampa"
      "hkey"="HKLM"
      "command"="C:\\Program Files\\Winamp\\winampa.exe"
      "inimapping"="0"
         

      [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
      "PcSync"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog"

      [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
      "PcSync"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog"

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
      "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

      HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService

      [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
      HTTPFilter   REG_MULTI_SZ    HTTPFilter\0\0
      LocalService   REG_MULTI_SZ    Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
      NetworkService   REG_MULTI_SZ    DnsCache\0\0
      DcomLaunch   REG_MULTI_SZ    DcomLaunch\0TermService\0\0
      rpcss   REG_MULTI_SZ    RpcSs\0\0
      imgsvc   REG_MULTI_SZ    StiSvc\0\0
      termsvcs   REG_MULTI_SZ    TermService\0\0
      Usnsvc   REG_MULTI_SZ    usnsvc\0\0


      [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G]
      Shell\AutoRun\command   G:\asenna.exe /AUTORUN
      Shell\configure\command   G:\asenna.exe
      Shell\install\command   G:\asenna.exe


      Contents of the 'Scheduled Tasks' folder
      C:\WINDOWS\tasks\wrSpySweeperTrialSweep.job


      ********************************************************************

      catchme 0.1 W2K/XP - userland rootkit detector by Gmer, 17 October 2006
      http://www.gmer.net

      scanning hidden processes ...

      scanning hidden services ...

      scanning hidden autostart entries ...

      scanning hidden files ...

      scan completed successfully
      hidden processes: 0
      hidden services: 0
      hidden files: 0

      ********************************************************************

      Completion time: 07-02-04 2:14:07

      Äänestä

    • calis123 kirjoitti:

      Jeps elikkäs tässäpä olis nää logit..


      SDFix: Version 1.63

      su 04.02.2007 - 2:05:42,39

      Microsoft Windows XP [versio 5.1.2600]

      Running From: C:\SDFix

      Safe Mode:
      Checking Services:

      Name:

      Path:


      Restoring Windows Registry Entries
      Restoring Default Hosts File


      Rebooting...

      Normal Mode:
      Checking Files:

      Below files will be copied to Backups folder then removed:

      C:\lsass.exe - Deleted



      ADS Check:

      C:\WINDOWS\system32
      No streams found.

      Final Check:

      Remaining Services:
      ------------------


      Authorized Application Key Export:

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
      "C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:µTorrent"
      "C:\\Program Files\\TechniSat DVB\\bin\\Server4PC.exe"="C:\\Program Files\\TechniSat DVB\\bin\\Server4PC.exe:*:Enabled:Server4PC"
      "C:\\Program Files\\RevConnect\\DCPlusPlus.exe"="C:\\Program Files\\RevConnect\\DCPlusPlus.exe:*:Enabled:DC++"
      "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
      "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
      "E:\\PELIT\\Savagee\\silverback.exe"="E:\\PELIT\\Savagee\\silverback.exe:*:Enabled:silverback"
      "C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
      "E:\\PELIT\\Half-Life 2\\hl2.exe"="E:\\PELIT\\Half-Life 2\\hl2.exe:*:Enabled:hl2"
      "M:\\wowi\\Burning Crusade Closed Beta\\WoW-2.0.3-enGB-downloader.exe"="M:\\wowi\\Burning Crusade Closed Beta\\WoW-2.0.3-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
      "E:\\PELIT\\SoF2\\SoF2MP.exe"="E:\\PELIT\\SoF2\\SoF2MP.exe:*:Enabled:SoF2MP"
      "M:\\wowi\\World Of Warcraft Burning Crusade (beta)\\Patch\\WoW-2.0.0.6052-to-2.0.1.6082-enGB-downloader.exe"="M:\\wowi\\World Of Warcraft Burning Crusade (beta)\\Patch\\WoW-2.0.0.6052-to-2.0.1.6082-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
      "M:\\wowi\\World Of Warcraft Burning Crusade (beta)\\Patch\\WoW-2.0.0-enGB-downloader.exe"="M:\\wowi\\World Of Warcraft Burning Crusade (beta)\\Patch\\WoW-2.0.0-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
      "C:\\Program Files\\AtomFTP\\AtomFTP.exe"="C:\\Program Files\\AtomFTP\\AtomFTP.exe:*:Enabled:AtomFTP - http://pelu.jns.fi/~akarttun/atomftp"
      "C:\\Documents and Settings\\Ojala\\Työpöytä\\WowExpansionMaster_1024_2100_B_English-avi-downloader.exe"="C:\\Documents and Settings\\Ojala\\Työpöytä\\WowExpansionMaster_1024_2100_B_English-avi-downloader.exe:*:Enabled:Blizzard Downloader"
      "C:\\Documents and Settings\\Ojala\\Local Settings\\Temporary Internet Files\\Content.IE5\\4HIJ0DUJ\\WoW-enGB-Installer-downloader[1].exe"="C:\\Documents and Settings\\Ojala\\Local Settings\\Temporary Internet Files\\Content.IE5\\4HIJ0DUJ\\WoW-enGB-Installer-downloader[1].exe:*:Enabled:Blizzard Downloader"
      "C:\\Documents and Settings\\Ojala\\Omat tiedostot\\FuriouZ Autominer\\FuriouZ Autominer.exe"="C:\\Documents and Settings\\Ojala\\Omat tiedostot\\FuriouZ Autominer\\FuriouZ Autominer.exe:*:Enabled:C:\\Documents and Settings\\Ojala\\Omat tiedostot\\FuriouZ Autominer\\FuriouZ Autominer.exe"
      "C:\\lsass.exe"="C:\\lsass.exe:*:Enabled:C:\\lsass.exe"
      "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
      "D:\\Torrentit\\autot\\Happycracker Cheat Pack V6.1\\Other Cheating Programs\\RS Account Hack\\RS Account Hack.exe"="D:\\Torrentit\\autot\\Happycracker Cheat Pack V6.1\\Other Cheating Programs\\RS Account Hack\\RS Account Hack.exe:*:Disabled:RS Account Hack"
      "C:\\WINDOWS\\system32\\java.exe"="C:\\WINDOWS\\system32\\java.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
      "C:\\Program Files\\Java\\jre1.5.0_10\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_10\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
      "C:\\Program Files\\Hamachi\\hamachi.exe"="C:\\Program Files\\Hamachi\\hamachi.exe:*:Enabled:Hamachi Client"
      "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
      "C:\\Program Files\\ps3d\\PlayScape.exe"="C:\\Program Files\\ps3d\\PlayScape.exe:*:Enabled:PlayScape"
      "C:\\Program Files\\SwiftSwitch\\SwiftSwitch.exe"="C:\\Program Files\\SwiftSwitch\\SwiftSwitch.exe:*:Enabled:World Switcher for RuneScape"
      "C:\\WINDOWS\\display\\services.exe"="C:\\WINDOWS\\display\\services.exe:*:Enabled:Transparent Proxy Server"
      "C:\\WINDOWS\\Outlook32.exe"="C:\\WINDOWS\\Outlook32.exe:*:Enabled:Outlook.exe"
      "C:\\WINDOWS\\winup32.exe"="C:\\WINDOWS\\winup32.exe:*:Enabled:winup32.exe"


      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
      "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"


      Remaining Files:
      ---------------

      Backups Folder: - C:\SDFix\backups\backups.zip


      Checking For Files with Hidden Attributes :


      Finished

      Ja sit toinen:

      "Ojala" - 07-02-04 2:13:07 Service Pack 2
      ComboFix 07.02.04 - Running from: "C:\Documents and Settings\Ojala\Ty”p”yt„"

      ((((((((((((((((((((((((((((((( Files Created from 2007-01-04 to 2007-02-04 ))))))))))))))))))))))))))))))))))


      2007-02-04 02:05      d--------   C:\SDFix
      2007-02-04 02:04      d--------   C:\DOCUME~1\NETWOR~1\Application Data\Webroot
      2007-02-03 20:52      d--------   C:\Program Files\PeerGuardian_1.96b
      2007-02-03 20:51      d--------   C:\DOCUME~1\ALLUSE~1\Application Data\Spybot - Search & Destroy
      2007-02-03 20:48      d--------   C:\Program Files\SpywareBlaster
      2007-02-03 16:52      d--------   C:\DOCUME~1\LOCALS~1\Application Data\Webroot
      2007-02-03 14:58   684,032   --a------   C:\WINDOWS\system32\libeay32.dll
      2007-02-03 14:58   22,080   --a------   C:\WINDOWS\system32\drivers\sshrmd.sys
      2007-02-03 14:58   20,544   --a------   C:\WINDOWS\system32\drivers\SSFS0509.sys
      2007-02-03 14:58   155,648   --a------   C:\WINDOWS\system32\ssleay32.dll
      2007-02-03 14:58   144,448   --a------   C:\WINDOWS\system32\drivers\ssidrv.sys
      2007-02-03 14:58      d--------   C:\Program Files\Webroot
      2007-02-03 14:44      d--------   C:\DOCUME~1\Ojala\Application Data\Webroot
      2007-02-03 14:44      d--------   C:\DOCUME~1\ALLUSE~1\Application Data\Webroot
      2007-02-03 02:55      d--------   C:\DOCUME~1\JRJEST~1.JUS\Application Data\PC Tools
      2007-02-03 02:53      d--------   C:\DOCUME~1\JRJEST~1.JUS\Application Data\Lavasoft
      2007-02-03 02:51      dr-------   C:\DOCUME~1\JRJEST~1.JUS\K„ynnist„-valikko
      2007-02-03 02:51      d--h-----   C:\DOCUME~1\JRJEST~1.JUS\Verkkoymp„rist”
      2007-02-03 02:51      d--h-----   C:\DOCUME~1\JRJEST~1.JUS\Tulostinymp„rist”
      2007-02-03 02:51      d--h-----   C:\DOCUME~1\JRJEST~1.JUS\Mallit
      2007-02-03 02:51      d--------   C:\DOCUME~1\JRJEST~1.JUS\Ty”p”yt„
      2007-02-03 02:51      d--------   C:\DOCUME~1\JRJEST~1.JUS\Suosikit
      2007-02-03 02:49      dr-------   C:\DOCUME~1\JRJEST~1\K„ynnist„-valikko
      2007-02-03 02:49      d--h-----   C:\DOCUME~1\JRJEST~1\Verkkoymp„rist”
      2007-02-03 02:49      d--h-----   C:\DOCUME~1\JRJEST~1\Tulostinymp„rist”
      2007-02-03 02:49      d--h-----   C:\DOCUME~1\JRJEST~1\Mallit
      2007-02-03 02:49      d--------   C:\DOCUME~1\JRJEST~1\Ty”p”yt„
      2007-02-03 02:49      d--------   C:\DOCUME~1\JRJEST~1\Suosikit
      2007-02-03 02:37   21,056   --a------   C:\WINDOWS\system32\drivers\sskbfd.sys
      2007-02-03 02:27      d--------   C:\Program Files\Enigma Software Group
      2007-02-03 02:13      d--------   C:\DOCUME~1\Ojala\Application Data\AdobeUM
      2007-01-31 20:57   89,600   --a------   C:\WINDOWS\taskmgr.exe
      2007-01-31 20:57   69,120   --a------   C:\WINDOWS\hpeg.dll
      2007-01-31 20:57   64,512   --a------   C:\WINDOWS\winup32.exe
      2007-01-31 20:57   57,344   --a------   C:\WINDOWS\srsver.dll
      2007-01-31 20:57   57,344   --a------   C:\WINDOWS\Outlook32.exe
      2007-01-31 20:57   50,176   --a------   C:\WINDOWS\msn64.exe
      2007-01-31 20:57   31,744   --a------   C:\WINDOWS\encod.exe
      2007-01-31 20:57   3,129,325   --a------   C:\WINDOWS\slog.dll
      2007-01-31 20:57   26   --a------   C:\WINDOWS\refsdm.dll
      2007-01-31 20:57      d--------   C:\WINDOWS\display
      2007-01-31 20:57      d--------   C:\Program Files\Accessories
      2007-01-29 18:41      d--------   C:\Program Files\SwiftSwitch
      2007-01-29 18:41      d--------   C:\DOCUME~1\ALLUSE~1\Application Data\SwiftSwitch
      2007-01-29 16:24   3,120   --a------   C:\WINDOWS\system32\2d2ca2ce-704a-428c-8cbe-0736b29190aa.dll
      2007-01-28 23:38      d--------   C:\DOCUME~1\Ojala\dodian.com
      2007-01-28 23:19      d--------   C:\Program Files\ps3d
      2007-01-27 23:48      d--------   C:\DOCUME~1\Ojala\Application Data\Hamachi
      2007-01-27 23:47   17,480   --a------   C:\WINDOWS\system32\drivers\hamachi.sys
      2007-01-27 23:47      d--------   C:\Program Files\Hamachi
      2007-01-27 22:57      d--------   C:\WINDOWS\.mpr_file_store_32
      2007-01-27 22:56      d--------   C:\Program Files\MoparScape
      2007-01-21 02:33      d--------   C:\WINDOWS\pss
      2007-01-20 14:05      d--------   C:\DOCUME~1\Ojala\Typyt
      2007-01-17 16:45      d--------   C:\Program Files\GoldWave
      2007-01-17 16:45      d--------   C:\DOCUME~1\Ojala\Application Data\Help
      2007-01-17 16:45      d--------   C:\DOCUME~1\Ojala\Application Data\GetRightToGo
      2007-01-15 08:44      d--------   C:\WINDOWS\ShellNew
      2007-01-10 18:16      d--------   C:\DOCUME~1\Ojala\Application Data\Adobe
      2007-01-10 17:26      d--------   C:\Program Files\SCAR 2.03
      2007-01-10 14:50   94,208   --a------   C:\WINDOWS\system32\China.dll
      2007-01-08 16:01      d--h-----   C:\Program Files\Zero G Registry
      2007-01-08 08:56      d--------   C:\Program Files\Common Files\Adobe
      2007-01-08 08:56      d--------   C:\DOCUME~1\ALLUSE~1\Application Data\Adobe
      2007-01-07 12:39      d--------   C:\WINDOWS\Sun
      2007-01-07 12:39      d--------   C:\WINDOWS\.file_store_32
      2007-01-07 12:39      d--------   C:\DOCUME~1\Ojala\Application Data\Sun
      2007-01-07 12:38      d--------   C:\Program Files\Java
      2007-01-07 12:37      d--------   C:\Program Files\Common Files\Java
      2007-01-07 12:32      d--------   C:\Program Files\ArtMoney
      2007-01-06 12:56   1,645,320   --a------   C:\WINDOWS\system32\gdiplus.dll
      2007-01-04 23:20      d--------   C:\DOCUME~1\Ojala\Application Data\Real


      (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


      2007-02-04 02:11   --------   d--------   C:\Program Files\mozilla firefox
      2007-02-03 20:53   --------   d--------   C:\Program Files\lavasoft
      2007-02-03 16:52   --------   d--------   C:\DOCUME~1\Ojala\Application Data\utorrent
      2007-02-03 02:28   --------   d--------   C:\Program Files\revconnect
      2007-02-02 18:15   --------   d--------   C:\Program Files\powerarchiver
      2007-01-24 08:40   --------   d---s----   C:\DOCUME~1\Ojala\Application Data\microsoft
      2007-01-21 02:57   --------   d--------   C:\DOCUME~1\Ojala\Application Data\bsplayer pro
      2007-01-10 14:50   --------   d--h-----   C:\Program Files\installshield installation information
      2007-01-09 13:38   --------   d--------   C:\DOCUME~1\Ojala\Application Data\macromedia
      2007-01-08 08:50   12400   --a------   C:\WINDOWS\system32\drivers\secdrv.sys
      2007-01-07 22:17   --------   d--------   C:\Program Files\winamp
      2007-01-03 23:09   --------   d--------   C:\Program Files\quicktime
      2007-01-03 19:00   --------   d--------   C:\Program Files\hycam2
      2007-01-03 08:45   --------   d--------   C:\Program Files\atomftp
      2006-12-31 13:27   --------   d--------   C:\DOCUME~1\Ojala\Application Data\dvdcss
      2006-12-27 16:41   --------   d--------   C:\DOCUME~1\Ojala\Application Data\ahead
      2006-12-27 16:40   --------   d--------   C:\Program Files\ahead
      2006-12-27 16:25   --------   d--------   C:\Program Files\Common Files\installshield
      2006-12-27 16:25   --------   d--------   C:\Program Files\Common Files\ahead
      2006-12-24 16:18   --------   d--------   C:\Program Files\Common Files\blizzard entertainment
      2006-12-22 15:25   162432   --a------   C:\WINDOWS\system32\drivers\ithsgt.sys
      2006-12-22 15:25   12032   --a------   C:\WINDOWS\system32\drivers\lilsgt.sys
      2006-12-20 16:48   --------   d--------   C:\Program Files\mirc
      2006-12-20 00:50   581906   --a------   C:\DOCUME~1\Ojala\Application Data\nmm-metadata.db
      2006-12-20 00:39   --------   d--------   C:\DOCUME~1\Ojala\Application Data\nokia
      2006-12-20 00:37   --------   d--------   C:\Program Files\pc connectivity solution
      2006-12-20 00:37   --------   d--------   C:\Program Files\nokia
      2006-12-20 00:37   --------   d--------   C:\Program Files\difx
      2006-12-20 00:37   --------   d--------   C:\Program Files\Common Files\pcsuite
      2006-12-20 00:37   --------   d--------   C:\Program Files\Common Files\nokia
      2006-12-20 00:37   --------   d--------   C:\DOCUME~1\Ojala\Application Data\pc suite
      2006-12-20 00:12   --------   d--------   C:\DOCUME~1\Ojala\Application Data\vlc
      2006-12-19 00:21   --------   d--------   C:\DOCUME~1\Ojala\Application Data\pc tools
      2006-12-19 00:17   --------   d--------   C:\Program Files\yamicsoft
      2006-12-19 00:10   --------   d--------   C:\Program Files\messenger
      2006-12-18 23:55   --------   d--------   C:\Program Files\nonamescript
      2006-12-18 22:36   --------   d--------   C:\Program Files\dvbviewer
      2006-12-18 20:50   --------   d--------   C:\Program Files\d-tools
      2006-12-18 19:29   --------   d--------   C:\Program Files\amdagp
      2006-12-18 18:38   --------   d--------   C:\DOCUME~1\Ojala\Application Data\lavasoft
      2006-12-18 18:35   62   --ahs----   C:\DOCUME~1\Ojala\Application Data\desktop.ini
      2006-12-18 18:35   --------   d--------   C:\Program Files\Common Files\speechengines
      2006-12-18 18:35   --------   d--------   C:\Program Files\Common Files\odbc
      2006-12-18 18:34   --------   d--------   C:\Program Files\videolan
      2006-12-18 18:27   --------   d--------   C:\Program Files\ffdshow
      2006-12-18 18:22   --------   d--------   C:\Program Files\webteh
      2006-12-18 18:00   --------   d--------   C:\Program Files\msn messenger
      2006-12-18 17:36   --------   d--------   C:\Program Files\bitcomet
      2006-12-18 17:28   --------   d--------   C:\Program Files\Common Files\sonic shared
      2006-12-18 17:27   --------   d--------   C:\Program Files\technisat dvb
      2006-12-18 17:22   --------   d--------   C:\Program Files\utorrent
      2006-12-18 17:03   --------   d--------   C:\Program Files\ati technologies
      2006-12-18 16:59   --------   d--------   C:\DOCUME~1\Ojala\Application Data\mozilla
      2006-12-18 16:56   502368   --a------   C:\WINDOWS\system32\drivers\amon.sys
      2006-12-18 16:56   274432   --a------   C:\WINDOWS\system32\imon.dll
      2006-12-18 16:55   --------   d--------   C:\DOCUME~1\Ojala\Application Data\identities
      2006-12-18 16:50   --------   d--------   C:\Program Files\microsoft frontpage
      2006-12-18 16:49   0   -rahs----   C:\MSDOS.SYS
      2006-12-18 16:49   0   -rahs----   C:\IO.SYS
      2006-12-18 16:49   0   --a------   C:\CONFIG.SYS
      2006-12-18 16:49   0   --a------   C:\AUTOEXEC.BAT
      2006-12-18 16:48   --------   d--------   C:\Program Files\online services
      2006-12-18 16:48   --------   d--------   C:\Program Files\Common Files\mssoap
      2006-12-18 16:47   --------   d--------   C:\Program Files\movie maker
      2006-12-18 16:46   --------   d--------   C:\Program Files\windows nt
      2006-12-18 16:46   --------   d--------   C:\Program Files\msn gaming zone
      2006-12-11 00:12   5120   --a------   C:\WINDOWS\system32\ff_vfw.dll
      2006-12-10 23:32   499712   --a------   C:\WINDOWS\system32\msvcp71.dll
      2006-12-07 07:29   2374472   --a------   C:\WINDOWS\system32\wmvcore.dll
      2006-12-04 22:39   56360   --a------   C:\WINDOWS\system32\wbhelp2.dll
      2006-11-22 10:52   520192   ---------   C:\WINDOWS\system32\ati2sgag.exe
      2006-11-22 05:25   261120   --a------   C:\WINDOWS\system32\ati2dvag.dll
      2006-11-22 05:20   118784   --a------   C:\WINDOWS\system32\atipdlxx.dll
      2006-11-22 05:20   106496   --a------   C:\WINDOWS\system32\oemdspif.dll
      2006-11-22 05:19   90112   --a------   C:\WINDOWS\system32\ati2evxx.dll
      2006-11-22 05:19   42496   --a------   C:\WINDOWS\system32\ati2edxx.dll
      2006-11-22 05:19   26112   --a------   C:\WINDOWS\system32\ati2mdxx.exe
      2006-11-22 05:18   430080   --a------   C:\WINDOWS\system32\ati2evxx.exe
      2006-11-22 05:17   53248   --a------   C:\WINDOWS\system32\atiddc.dll
      2006-11-22 05:12   2526688   --a------   C:\WINDOWS\system32\ati3duag.dll
      2006-11-22 05:11   5279744   --a------   C:\WINDOWS\system32\atioglxx.dll
      2006-11-22 05:08   1090016   --a------   C:\WINDOWS\system32\ativvaxx.dll
      2006-11-22 04:57   217088   --a------   C:\WINDOWS\system32\atikvmag.dll
      2006-11-22 04:56   17408   --a------   C:\WINDOWS\system32\atitvo32.dll
      2006-11-22 04:51   294912   --a------   C:\WINDOWS\system32\ati2cqag.dll
      2006-11-22 04:50   6684672   --a------   C:\WINDOWS\system32\atioglx1.dll
      2006-11-22 04:49   307200   --a------   C:\WINDOWS\system32\atiiiexx.dll
      2006-11-22 04:21   303104   --a------   C:\WINDOWS\system32\atidemgr.dll
      2006-11-08 07:06   679424   --a------   C:\WINDOWS\system32\inetcomm.dll


      (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

      *Note* empty entries & legit default entries are not shown

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
      "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
      "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
      "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
      "nod32kui"="\"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE"
      "DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033"
      "PCSuiteTrayApplication"="\"C:\\Program Files\\Nokia\\Nokia PC Suite 6\\LaunchApplication.exe\" -startup"
      "DHCP"="C:\\WINDOWS\\display\\smss.exe"
      "SpySweeper"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe\" /startintray"

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
      "Installed"="1"

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
      "Installed"="1"
      "NoChange"="1"

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
      "Installed"="1"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Adobe Reader Speed Launch.lnk]
      "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
      "item"="Adobe Reader Speed Launch"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Microsoft Office.lnk]
      "backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup"
      "location"="Common Startup"
      "command"="C:\\PROGRA~1\\MICROS~2\\Office10\\OSA.EXE -b -l"
      "item"="Microsoft Office"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="msmsgs"
      "hkey"="HKCU"
      "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="MsnMsgr"
      "hkey"="HKCU"
      "command"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="NeroCheck"
      "hkey"="HKLM"
      "command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="qttask"
      "hkey"="HKLM"
      "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="jusched"
      "hkey"="HKLM"
      "command"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""
      "inimapping"="0"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
      "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
      "item"="winampa"
      "hkey"="HKLM"
      "command"="C:\\Program Files\\Winamp\\winampa.exe"
      "inimapping"="0"
         

      [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
      "PcSync"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog"

      [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
      "PcSync"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog"

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
      "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

      HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService

      [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
      HTTPFilter   REG_MULTI_SZ    HTTPFilter\0\0
      LocalService   REG_MULTI_SZ    Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
      NetworkService   REG_MULTI_SZ    DnsCache\0\0
      DcomLaunch   REG_MULTI_SZ    DcomLaunch\0TermService\0\0
      rpcss   REG_MULTI_SZ    RpcSs\0\0
      imgsvc   REG_MULTI_SZ    StiSvc\0\0
      termsvcs   REG_MULTI_SZ    TermService\0\0
      Usnsvc   REG_MULTI_SZ    usnsvc\0\0


      [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G]
      Shell\AutoRun\command   G:\asenna.exe /AUTORUN
      Shell\configure\command   G:\asenna.exe
      Shell\install\command   G:\asenna.exe


      Contents of the 'Scheduled Tasks' folder
      C:\WINDOWS\tasks\wrSpySweeperTrialSweep.job


      ********************************************************************

      catchme 0.1 W2K/XP - userland rootkit detector by Gmer, 17 October 2006
      http://www.gmer.net

      scanning hidden processes ...

      scanning hidden services ...

      scanning hidden autostart entries ...

      scanning hidden files ...

      scan completed successfully
      hidden processes: 0
      hidden services: 0
      hidden files: 0

      ********************************************************************

      Completion time: 07-02-04 2:14:07

      Lähetä vielä tuore hijack logi.

      Onko sinulla useampia koneita verkossa?

      Äänestä

    • axa.doe kirjoitti:

      Lähetä vielä tuore hijack logi.

      Onko sinulla useampia koneita verkossa?

      Niin tosiaan se jäi vielä. Tämän koneen lisäksi on toinen kone välillä verkossa...

      Kuitenkin se hijack logi...

      Logfile of HijackThis v1.99.1
      Scan saved at 14:37:46, on 4.2.2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Eset\nod32krn.exe
      C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Eset\nod32kui.exe
      C:\Program Files\D-Tools\daemon.exe
      C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
      C:\WINDOWS\display\smss.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\taskmgr.exe
      C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
      C:\Program Files\TechniSat DVB\bin\Server4PC.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\msn64.exe
      C:\Program Files\WinRAR\WinRAR.exe
      C:\DOCUME~1\Ojala\LOCALS~1\Temp\Rar$EX00.062\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [PCSuiteTrayApplication] "C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" -startup
      O4 - HKLM\..\Run: [DHCP] C:\WINDOWS\display\smss.exe
      O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - Startup: MY_C4D.jpg
      O4 - Global Startup: Server4PC.lnk = C:\Program Files\TechniSat DVB\bin\Server4PC.exe
      O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
      O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
      O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

      Äänestä

    • calis123 kirjoitti:

      Niin tosiaan se jäi vielä. Tämän koneen lisäksi on toinen kone välillä verkossa...

      Kuitenkin se hijack logi...

      Logfile of HijackThis v1.99.1
      Scan saved at 14:37:46, on 4.2.2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Eset\nod32krn.exe
      C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Eset\nod32kui.exe
      C:\Program Files\D-Tools\daemon.exe
      C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
      C:\WINDOWS\display\smss.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\taskmgr.exe
      C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
      C:\Program Files\TechniSat DVB\bin\Server4PC.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\msn64.exe
      C:\Program Files\WinRAR\WinRAR.exe
      C:\DOCUME~1\Ojala\LOCALS~1\Temp\Rar$EX00.062\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [PCSuiteTrayApplication] "C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" -startup
      O4 - HKLM\..\Run: [DHCP] C:\WINDOWS\display\smss.exe
      O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - Startup: MY_C4D.jpg
      O4 - Global Startup: Server4PC.lnk = C:\Program Files\TechniSat DVB\bin\Server4PC.exe
      O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
      O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
      O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

      Niin, onko koneilla palomuuria käytössä? Rautamuuri?

      Pidä toinen kone pois verkosta, kunnes tämän puhdistus on valmis. Tarkistetaan
      sen logi myöhemmin.

      ***
      Piilotiedostot näkyviin

      # 1.Napsauta Käynnistä-painiketta ja valitse Ohjauspaneeli.
      # 2.Valitse "Kansion asetukset"
      # 3.Siirry" Näytä välilehdelle"
      # 4.Valitse Näytä-välilehden Piilotetut tiedostot ja kansiot
      -kohdassa" Näytä piilotetut tiedostot ja kansiot.

      Käynnistä koneesi vikasietotilaan, Ohje: http://students.turkuai.fi/~aidata/?Ohjeita_ja_muuta_tietoa:Vikasietotila

      Etsi resurssienhallinnan kautta tiedostot/kansiot, ja poista ne (jos löytyvät)

      C:\WINDOWS\>>taskmgr.exe>msn64.exe>hpeg.dll>winup32.exe>srsver.dll>Outlook32.exe>encod.exe>slog.dll>refsdm.dll>2d2ca2ce-704a-428c-8cbe-0736b29190aa.dll>display>Accessories >pss>Win-Spy>Win-Spy "Apply all Actions"
      * Varmistu, että Set all elements to: näyttää Quarantine, jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
      * Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"

      * Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
      * Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
      * Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestiketjuusi.

      Lähetä jotin tulokset, AVG:n raportti ja uusi hijack logi

      Äänestä

    • axa.doe kirjoitti:

      Niin, onko koneilla palomuuria käytössä? Rautamuuri?

      Pidä toinen kone pois verkosta, kunnes tämän puhdistus on valmis. Tarkistetaan
      sen logi myöhemmin.

      ***
      Piilotiedostot näkyviin

      # 1.Napsauta Käynnistä-painiketta ja valitse Ohjauspaneeli.
      # 2.Valitse "Kansion asetukset"
      # 3.Siirry" Näytä välilehdelle"
      # 4.Valitse Näytä-välilehden Piilotetut tiedostot ja kansiot
      -kohdassa" Näytä piilotetut tiedostot ja kansiot.

      Käynnistä koneesi vikasietotilaan, Ohje: http://students.turkuai.fi/~aidata/?Ohjeita_ja_muuta_tietoa:Vikasietotila

      Etsi resurssienhallinnan kautta tiedostot/kansiot, ja poista ne (jos löytyvät)

      C:\WINDOWS\>>taskmgr.exe>msn64.exe>hpeg.dll>winup32.exe>srsver.dll>Outlook32.exe>encod.exe>slog.dll>refsdm.dll>2d2ca2ce-704a-428c-8cbe-0736b29190aa.dll>display>Accessories >pss>Win-Spy>Win-Spy "Apply all Actions"
      * Varmistu, että Set all elements to: näyttää Quarantine, jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
      * Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"

      * Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
      * Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
      * Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestiketjuusi.

      Lähetä jotin tulokset, AVG:n raportti ja uusi hijack logi

      Jopas oli homma, mut tässä joitakin logeja. Tuo http://virusscan.jotti.org/ ei löytäny kyseisistä tiedostoista mitään.

      Mut tässä taas logit
      |
      |
      v
      Logfile of HijackThis v1.99.1
      Scan saved at 16:48:42, on 5.2.2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Eset\nod32kui.exe
      C:\Program Files\D-Tools\daemon.exe
      C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\Program Files\TechniSat DVB\bin\Server4PC.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      C:\Program Files\Eset\nod32krn.exe
      C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
      C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\Program Files\PeerGuardian_1.96b\PeerGuardian_1.96b.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\DOCUME~1\Ojala\LOCALS~1\Temp\Rar$EX00.125\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [PCSuiteTrayApplication] "C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" -startup
      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - Global Startup: Server4PC.lnk = C:\Program Files\TechniSat DVB\bin\Server4PC.exe
      O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
      O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
      O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

      JA toinen

      ---------------------------------------------------------
      AVG Anti-Spyware - Scan Report
      ---------------------------------------------------------

      Created at:   8:52:26 5.2.2007

      Scan result:   



      E:\System Volume Information\_restore{ADF23A92-3725-4CDD-A105-0766184C9886}\RP30\A0058391.exe -> Backdoor.Ciadoor.n : Cleaned.
      C:\Documents and Settings\Ojala\Omat tiedostot\Autofighter Cheat Package\Macros\mouserec.exe -> Downloader.Delf.aup : Cleaned.
      D:\Torrentit\autot\Happycracker Cheat Pack V6.1\Autoclickers and Mouse Macros\mouserec.exe -> Downloader.Delf.aup : Cleaned.
      E:\PELIT\Half-Life 2 Episode One\HL2_EP1.exe -> Not-A-Virus.HackTool.Win32.Delf.bw : Cleaned.
      :mozilla.68:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
      :mozilla.71:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
      :mozilla.63:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
      :mozilla.64:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
      :mozilla.66:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
      :mozilla.31:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
      :mozilla.32:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
      :mozilla.33:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
      :mozilla.34:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.35:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.36:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.37:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.38:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.44:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.46:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.47:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.51:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
      :mozilla.45:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
      :mozilla.48:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
      :mozilla.49:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
      :mozilla.50:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
      :mozilla.39:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
      :mozilla.40:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
      :mozilla.41:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
      :mozilla.42:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
      :mozilla.43:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
      :mozilla.14:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
      :mozilla.20:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
      :mozilla.21:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
      :mozilla.22:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
      :mozilla.23:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
      :mozilla.25:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
      D:\Torrentit\Autodata 3.16\AdKey.zip/AdKey.exe -> Trojan.Small : Cleaned.
      E:\ADCDA2\AdKey.exe -> Trojan.Small : Cleaned.


      ::Report end

      Äänestä

    • calis123 kirjoitti:

      Jopas oli homma, mut tässä joitakin logeja. Tuo http://virusscan.jotti.org/ ei löytäny kyseisistä tiedostoista mitään.

      Mut tässä taas logit
      |
      |
      v
      Logfile of HijackThis v1.99.1
      Scan saved at 16:48:42, on 5.2.2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Eset\nod32kui.exe
      C:\Program Files\D-Tools\daemon.exe
      C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\Program Files\TechniSat DVB\bin\Server4PC.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      C:\Program Files\Eset\nod32krn.exe
      C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
      C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\Program Files\PeerGuardian_1.96b\PeerGuardian_1.96b.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\DOCUME~1\Ojala\LOCALS~1\Temp\Rar$EX00.125\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [PCSuiteTrayApplication] "C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" -startup
      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - Global Startup: Server4PC.lnk = C:\Program Files\TechniSat DVB\bin\Server4PC.exe
      O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
      O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
      O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

      JA toinen

      ---------------------------------------------------------
      AVG Anti-Spyware - Scan Report
      ---------------------------------------------------------

      Created at:   8:52:26 5.2.2007

      Scan result:   



      E:\System Volume Information\_restore{ADF23A92-3725-4CDD-A105-0766184C9886}\RP30\A0058391.exe -> Backdoor.Ciadoor.n : Cleaned.
      C:\Documents and Settings\Ojala\Omat tiedostot\Autofighter Cheat Package\Macros\mouserec.exe -> Downloader.Delf.aup : Cleaned.
      D:\Torrentit\autot\Happycracker Cheat Pack V6.1\Autoclickers and Mouse Macros\mouserec.exe -> Downloader.Delf.aup : Cleaned.
      E:\PELIT\Half-Life 2 Episode One\HL2_EP1.exe -> Not-A-Virus.HackTool.Win32.Delf.bw : Cleaned.
      :mozilla.68:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
      :mozilla.71:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
      :mozilla.63:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
      :mozilla.64:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
      :mozilla.66:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
      :mozilla.31:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
      :mozilla.32:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
      :mozilla.33:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
      :mozilla.34:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.35:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.36:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.37:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.38:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.44:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.46:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.47:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
      :mozilla.51:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
      :mozilla.45:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
      :mozilla.48:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
      :mozilla.49:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
      :mozilla.50:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
      :mozilla.39:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
      :mozilla.40:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
      :mozilla.41:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
      :mozilla.42:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
      :mozilla.43:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
      :mozilla.14:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
      :mozilla.20:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
      :mozilla.21:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
      :mozilla.22:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
      :mozilla.23:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
      :mozilla.25:C:\Documents and Settings\Ojala\Application Data\Mozilla\Firefox\Profiles\f76lfgyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
      D:\Torrentit\Autodata 3.16\AdKey.zip/AdKey.exe -> Trojan.Small : Cleaned.
      E:\ADCDA2\AdKey.exe -> Trojan.Small : Cleaned.


      ::Report end

      Laita piilotiedostot pois näkyvistä

      # 1.Napsauta Käynnistä-painiketta ja valitse Ohjauspaneeli.
      # 2.Valitse "Kansion asetukset"
      # 3.Siirry" Näytä välilehdelle"
      # 4.Valitse Näytä-välilehden Piilotetut tiedostot ja kansiot
      -kohdassa" Älä näytä piilotettuja.."

      ***
      Käytä järjestelmänpalautus pois päältä:

      1. Klikkaa oikealla käynnistävalikon My Computer- tai oma tietokone-kuvaketta
      2. Valitse Properties/ominaisuudet
      3. Valitse System Restore/järjestelmän palauttaminen välilehti
      4. Valitse "Turn off System Restore"/poista järjestelmän palauttaminen
      kaikissa asemissa
      5. Paina Apply/käytä
      6. Paina OK
      7. Käynnistä kone uudelleen
      8. Palauta asetukset takaisin.

      ***
      * Lataa Dr.Web CureIt työpöydälle:
      ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe


      * Tuplaklikkaa drweb-cureit.exe ja anna sen tehdä express scan
      * Se skannaa käynnissä olevat ohjelmat ja jos jotain löytyy, klikkaa yes kun se kysyy haluatko poistaa sen. Tämä on vain
      lyhyt scan.
      * Kun scan on valmis, merkkaa asemat, jotka haluat scannata.
      * Valitse kaikki asemat. Punainen piste osoittaa, mitkä asemat on valittu.
      * Klikkaa vihreää nuolta oikealla ja scan alkaa.
      * Klikkaa 'Yes to all', jos kysytään haluatko poistaa/siirtää tiedoston.
      * Kun scan on valmis, katso voitko klikata next-kuvaketta löytyneiden tiedostojen vieressä:
      * Jos asia on niin, klikkaa sitä ja sitten klikkaa next-kuvaketta oikealla alhaalla ja valitse Move incurable kuten alla
      olevalla kuvassa:

      Tämä siirtää sen %userprofile%\DoctorWeb\quarantine-hakemistoon.
      * Tämän jälkeen klikkaa Dr.Web CureIt-valikossa file ja valitse save report list
      * Tallenna raportti työpöydälle. Raportin nimi on DrWeb.csv
      * Sulje Dr.Web Cureit.
      * Käynnistä kone uudelleen !! Tämä siksi, että käytössä olevat tiedostot poistetaan/siirretään käynnistyksen yhteydessä.
      * Käynnistyksen jälkeen liitä Dr.Web-lokin, jonka tallensit aiemmin, sisältö seuraavaan vastaukseesi.

      ***
      Katso AVG:n asetukset kuntoon:

      "TÄRKEÄÄ : ÄLÄ KLIKKAA "Save Scan Report" ennen kuin klikkaat --> "Apply all Actions"
      * Varmistu, että Set all elements to: näyttää Quarantine, jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
      * Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
      Sulje AVG.

      Haitko tuon hijackin self.exen? Sen pitäisi asentua C:lle omaan kansioonsa, backup-kansion takia.
      Kokeile vielä asentaa se, ja tee sieltä lopuksi uusi skannaus, "...save a log file"

      Lähetä DrWeb.csv ja uusi hijack logi

      Äänestä

    • axa.doe kirjoitti:

      Laita piilotiedostot pois näkyvistä

      # 1.Napsauta Käynnistä-painiketta ja valitse Ohjauspaneeli.
      # 2.Valitse "Kansion asetukset"
      # 3.Siirry" Näytä välilehdelle"
      # 4.Valitse Näytä-välilehden Piilotetut tiedostot ja kansiot
      -kohdassa" Älä näytä piilotettuja.."

      ***
      Käytä järjestelmänpalautus pois päältä:

      1. Klikkaa oikealla käynnistävalikon My Computer- tai oma tietokone-kuvaketta
      2. Valitse Properties/ominaisuudet
      3. Valitse System Restore/järjestelmän palauttaminen välilehti
      4. Valitse "Turn off System Restore"/poista järjestelmän palauttaminen
      kaikissa asemissa
      5. Paina Apply/käytä
      6. Paina OK
      7. Käynnistä kone uudelleen
      8. Palauta asetukset takaisin.

      ***
      * Lataa Dr.Web CureIt työpöydälle:
      ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe


      * Tuplaklikkaa drweb-cureit.exe ja anna sen tehdä express scan
      * Se skannaa käynnissä olevat ohjelmat ja jos jotain löytyy, klikkaa yes kun se kysyy haluatko poistaa sen. Tämä on vain
      lyhyt scan.
      * Kun scan on valmis, merkkaa asemat, jotka haluat scannata.
      * Valitse kaikki asemat. Punainen piste osoittaa, mitkä asemat on valittu.
      * Klikkaa vihreää nuolta oikealla ja scan alkaa.
      * Klikkaa 'Yes to all', jos kysytään haluatko poistaa/siirtää tiedoston.
      * Kun scan on valmis, katso voitko klikata next-kuvaketta löytyneiden tiedostojen vieressä:
      * Jos asia on niin, klikkaa sitä ja sitten klikkaa next-kuvaketta oikealla alhaalla ja valitse Move incurable kuten alla
      olevalla kuvassa:

      Tämä siirtää sen %userprofile%\DoctorWeb\quarantine-hakemistoon.
      * Tämän jälkeen klikkaa Dr.Web CureIt-valikossa file ja valitse save report list
      * Tallenna raportti työpöydälle. Raportin nimi on DrWeb.csv
      * Sulje Dr.Web Cureit.
      * Käynnistä kone uudelleen !! Tämä siksi, että käytössä olevat tiedostot poistetaan/siirretään käynnistyksen yhteydessä.
      * Käynnistyksen jälkeen liitä Dr.Web-lokin, jonka tallensit aiemmin, sisältö seuraavaan vastaukseesi.

      ***
      Katso AVG:n asetukset kuntoon:

      "TÄRKEÄÄ : ÄLÄ KLIKKAA "Save Scan Report" ennen kuin klikkaat --> "Apply all Actions"
      * Varmistu, että Set all elements to: näyttää Quarantine, jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
      * Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
      Sulje AVG.

      Haitko tuon hijackin self.exen? Sen pitäisi asentua C:lle omaan kansioonsa, backup-kansion takia.
      Kokeile vielä asentaa se, ja tee sieltä lopuksi uusi skannaus, "...save a log file"

      Lähetä DrWeb.csv ja uusi hijack logi

      Elikkäs hijack logi...

      Logfile of HijackThis v1.99.1
      Scan saved at 23:55:23, on 7.2.2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Eset\nod32kui.exe
      C:\Program Files\D-Tools\daemon.exe
      C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\TechniSat DVB\bin\Server4PC.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      C:\Program Files\Eset\nod32krn.exe
      C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
      C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\Program Files\MSN Messenger\usnsvc.exe
      C:\Program Files\uTorrent\uTorrent.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\HJT\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [PCSuiteTrayApplication] "C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" -startup
      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: Server4PC.lnk = C:\Program Files\TechniSat DVB\bin\Server4PC.exe
      O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
      O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
      O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe



      ja sit...

      stdio.dll C:\Program Files\mIRC\script\dlls IRC.Flood Deleted.
      stdio.dll C:\Program Files\NoNameScript\script\dlls IRC.Flood Deleted.
      Process.exe C:\SDFix\apps Tool.Prockill Deleted.
      A0000010.dll C:\System Volume Information\_restore{ADF23A92-3725-4CDD-A105-0766184C9886}\RP1 IRC.Flood Deleted.
      A0000011.dll C:\System Volume Information\_restore{ADF23A92-3725-4CDD-A105-0766184C9886}\RP1 IRC.Flood Deleted.

      Äänestä

    • calis123 kirjoitti:

      Elikkäs hijack logi...

      Logfile of HijackThis v1.99.1
      Scan saved at 23:55:23, on 7.2.2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Eset\nod32kui.exe
      C:\Program Files\D-Tools\daemon.exe
      C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\TechniSat DVB\bin\Server4PC.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      C:\Program Files\Eset\nod32krn.exe
      C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
      C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\Program Files\MSN Messenger\usnsvc.exe
      C:\Program Files\uTorrent\uTorrent.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\HJT\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [PCSuiteTrayApplication] "C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" -startup
      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: Server4PC.lnk = C:\Program Files\TechniSat DVB\bin\Server4PC.exe
      O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
      O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
      O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe



      ja sit...

      stdio.dll C:\Program Files\mIRC\script\dlls IRC.Flood Deleted.
      stdio.dll C:\Program Files\NoNameScript\script\dlls IRC.Flood Deleted.
      Process.exe C:\SDFix\apps Tool.Prockill Deleted.
      A0000010.dll C:\System Volume Information\_restore{ADF23A92-3725-4CDD-A105-0766184C9886}\RP1 IRC.Flood Deleted.
      A0000011.dll C:\System Volume Information\_restore{ADF23A92-3725-4CDD-A105-0766184C9886}\RP1 IRC.Flood Deleted.

      Avaa AVG:
      * Klikkaa "Shield" kuvaketta ikkunan ylälaidassa
      * "Resident shield is", muuta tila active:sta inactive:ksi. Sulje AVG ruksista.
      ***

      Tee uusi skannaus hjt:llä, klikkaa "Do a system scan only"
      laita ruksit rivien eteen, sulje muut sovellukset, selain ja
      uTorrent.

      Paina "Fix Checked"


      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


      Käynnistä kone uudelleen.
      ***

      Päivitä vielä SpySweeper ja skannaa kone.
      ***

      Javan päivitys ja välimuistin tyhjennys


      1. Klikkaa Käynnistä > Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
      2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
      Niissä pitäisi olla seuraava kuva vieressä:
      3. Valitse kaikki entiset Java versiosi ja valitse Poista.
      4. Asenna uusin Java päivitys seuraavasta linkistä..
      5. Käynnistä kone uudelleen asennuksen jälkeen:

      http://java.sun.com/javase/downloads/index.jsp

      Rullaa alas kohteeseen Java Runtime Environment (JRE) 6

      Paina Download

      Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna

      6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
      7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files nappia.

      (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
      Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

      8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

      Applications and Applets

      Trace and Log Files

      Ok

      9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
      Huomaa: Tämä poistaa kaikki ladatut sovellukset ja appletit VÄLIMUISTISTA.
      10. Klikkaa OK jättääksesi Java asetusikkunasi.
      ***

      Hae tuolta kunnon muuri http://koti.mbnet.fi/pattaya1/muut_ilmaisohjelmat.htm

      Lataa ensin asennuspaketti koneelle. Sulje sen jälkeen nettiyhteys, poista Windowsin oma muuri käytöstä, ja
      asenna uusi palomuuri

      Lähetä SpySweeperin raportti ja hijack logi

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    calis123 kirjoitti:

    Elikkäs tälläinen tapaus?

    Sit vielä jos joku osais neuvoa miten poistetaan win-spy "ohjelma"

    Logfile of HijackThis v1.99.1
    Scan saved at 14:00:57, on 3.2.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Eset\nod32krn.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Eset\nod32kui.exe
    C:\Program Files\D-Tools\daemon.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\WINDOWS\display\smss.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\taskmgr.exe
    C:\lsass.exe
    C:\WINDOWS\msn64.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\TechniSat DVB\bin\Server4PC.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\DOCUME~1\Ojala\LOCALS~1\Temp\Rar$EX00.437\HijackThis.exe
    C:\Program Files\Webroot\Spy Sweeper\SSU.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] "C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" -startup
    O4 - HKLM\..\Run: [DHCP] C:\WINDOWS\display\smss.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [lsass] C:\lsass.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\RunOnce: [SpySweeperUninstallSurvey] http://products.webroot.com/disp0201.php?pc=64021&rc=3601&ps=T&oc=33&mjv=5&mnv=0&bld=1608&cd=&dcc=&drc=&mo=&sid=&lang=en&loc=FIN&opi=2&omj=5&omn=1&rsc=
    O4 - Global Startup: Server4PC.lnk = C:\Program Files\TechniSat DVB\bin\Server4PC.exe
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu