Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    hijak loki..

    vitusti kone..

    eli,joku asian osaava kiitos ja kumarrus jos sanotte turhat pois tästä koneesta.....

    Logfile of HijackThis v1.99.1
    Scan saved at 9:30:36, on 4.2.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    D:\Program Files\Norman\NPF\NPFSVICE.EXE
    D:\norman viruscontrol\Bin\Zanda.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\slserv.exe
    D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\WINDOWS\system32\svchost.exe
    D:\norman viruscontrol\Nvc\bin\nvcoas.exe
    D:\norman viruscontrol\bin\NJEEVES.EXE
    D:\norman viruscontrol\Nvc\BIN\nipsvc.exe
    D:\norman viruscontrol\bin\ZLH.EXE
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\WINDOWS\system32\ctfmon.exe
    c:\progra~1\intern~1\iexplore.exe
    D:\Program Files\Norman\NPF\NPFMSG.EXE
    C:\WINDOWS\system32\sistray.exe
    D:\norman viruscontrol\Nvc\BIN\NIP.EXE
    D:\norman viruscontrol\Nvc\bin\cclaw.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [Norman ZANDA] D:\norman viruscontrol\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [CloneDVDElbyDelay] "d:\Program Files\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay
    O4 - HKLM\..\Run: [ElbyCheckAnyDVD] "d:\Program Files\SlySoft\AnyDVD\ElbyCheck.exe" /L AnyDVD
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Biaslies] C:\DOCUME~1\Juho\APPLIC~1\SAVECO~1\More Base.exe
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: NPF Messenger.lnk = ?
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O8 - Extra context menu item: Download all links using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: Download all videos using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: Download link using &BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://mppv2flash3.valueactive.com/NordicBet/FlashAX.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{1153E4A2-4A5B-4A8B-BF51-CB161DD57A87}: NameServer = 192.168.10.1,193.210.18.18
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - D:\norman viruscontrol\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - D:\norman viruscontrol\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - D:\Program Files\Norman\NPF\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown owner - D:\norman viruscontrol\Bin\Zanda.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - D:\norman viruscontrol\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - D:\norman viruscontrol\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
    5355
    Äänestä

    Muut lukivat myös

    Vastaukset 5

    Vanhimmat

    Käynnistä Hijackthis, skannaa Do a system scan only
    merkkaa tuo rivi:

    O4 - HKCU\..\Run: [Biaslies] C:\DOCUME~1\Juho\APPLIC~1\SAVECO~1\More Base.exe
    Muut ohjelmat suljettuina, klikkaa Fix Checked, vastaa myöntävästi mahdolliseen varoitukseen.
    Sulje HJT.


    Käynnistä kone vikasietotilaan, laita piilotiedostot näkyviin ja poista tuo kansio:
    (ohje molempiin löytyy täältä:
    http://www.virustorjunta.net/modules.php?name=FAQ&myfaq=yes&id_cat=6&categories=Yleisohjeita ongelmatilanteiden ratkaisuun )

    O4 - HKCU\..\Run: [Biaslies] C:\DOCUME~1\Juho\APPLIC~1\SAVECO~1

    Äänestä

    • perinpohjaiset ohjeet! kiitos!:)

      Äänestä

    • lisää...


      Logfile of HijackThis v1.99.1
      Scan saved at 12:43:00, on 4.2.2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.5730.0011)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      D:\Program Files\Norman\NPF\NPFSVICE.EXE
      D:\norman viruscontrol\Bin\Zanda.exe
      C:\WINDOWS\system32\HPZipm12.exe
      C:\WINDOWS\system32\slserv.exe
      D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      D:\norman viruscontrol\Nvc\bin\nvcoas.exe
      D:\norman viruscontrol\bin\NJEEVES.EXE
      D:\norman viruscontrol\Nvc\BIN\nipsvc.exe
      C:\WINDOWS\System32\alg.exe
      C:\WINDOWS\system32\wuauclt.exe
      D:\norman viruscontrol\bin\ZLH.EXE
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\WINDOWS\system32\Rundll32.exe
      C:\Program Files\Microsoft IntelliPoint\point32.exe
      C:\WINDOWS\system32\ctfmon.exe
      D:\Program Files\Norman\NPF\NPFMSG.EXE
      C:\WINDOWS\system32\sistray.exe
      D:\norman viruscontrol\Nvc\BIN\NIP.EXE
      D:\norman viruscontrol\Nvc\bin\cclaw.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
      O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO.dll
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O4 - HKLM\..\Run: [Norman ZANDA] D:\norman viruscontrol\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
      O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
      O4 - HKLM\..\Run: [CloneDVDElbyDelay] "d:\Program Files\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay
      O4 - HKLM\..\Run: [ElbyCheckAnyDVD] "d:\Program Files\SlySoft\AnyDVD\ElbyCheck.exe" /L AnyDVD
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: NPF Messenger.lnk = ?
      O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
      O8 - Extra context menu item: Download all links using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
      O8 - Extra context menu item: Download all videos using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
      O8 - Extra context menu item: Download link using &BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O11 - Options group: [INTERNATIONAL] International*
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://mppv2flash3.valueactive.com/NordicBet/FlashAX.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{1153E4A2-4A5B-4A8B-BF51-CB161DD57A87}: NameServer = 192.168.10.1,193.210.18.18
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - D:\norman viruscontrol\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown owner - D:\norman viruscontrol\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown owner - D:\Program Files\Norman\NPF\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown owner - D:\norman viruscontrol\Bin\Zanda.exe
      O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - D:\norman viruscontrol\Nvc\bin\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - D:\norman viruscontrol\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
      O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
      O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe





      NoLop! Log by Skate_Punk_21

      Fix running from: E:\Imuroinnit\Netti imut
      [4.2.2007]
      [12:31:48]

      ---Infection Files Found/Removed---
      C:\WINDOWS\tasks\AFF80F43918F804F.job

      Beginning Removal...
      Rebooting...
      Removing Lop's Leftover Files/Folders...
      Editing Registry...
      **Fix Complete!**

      ---Listing AppData sub directories---

      C:\Documents and Settings\All Users\Application Data\Adobe
      C:\Documents and Settings\All Users\Application Data\Adobe Systems
      C:\Documents and Settings\All Users\Application Data\Barbgrimbiasmeow
      C:\Documents and Settings\All Users\Application Data\Hp
      C:\Documents and Settings\All Users\Application Data\Microsoft
      C:\Documents and Settings\All Users\Application Data\Npf
      C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
      C:\Documents and Settings\All Users\Application Data\Trymedia
      C:\Documents and Settings\All Users\Application Data\Tuneup Software
      C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
      C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
      C:\Documents and Settings\Default User\Application Data\Microsoft
      C:\Documents and Settings\Juho\Application Data\Adobe
      C:\Documents and Settings\Juho\Application Data\Adobeum -- EMPTY Directory
      C:\Documents and Settings\Juho\Application Data\Ahead
      C:\Documents and Settings\Juho\Application Data\Bitroll
      C:\Documents and Settings\Juho\Application Data\Google
      C:\Documents and Settings\Juho\Application Data\Help -- EMPTY Directory
      C:\Documents and Settings\Juho\Application Data\Hp
      C:\Documents and Settings\Juho\Application Data\Identities
      C:\Documents and Settings\Juho\Application Data\Leadertech
      C:\Documents and Settings\Juho\Application Data\Macromedia
      C:\Documents and Settings\Juho\Application Data\Microgaming
      C:\Documents and Settings\Juho\Application Data\Microsoft
      C:\Documents and Settings\Juho\Application Data\Mozilla
      C:\Documents and Settings\Juho\Application Data\Nero
      C:\Documents and Settings\Juho\Application Data\Opera -- EMPTY Directory
      C:\Documents and Settings\Juho\Application Data\Sun
      C:\Documents and Settings\Juho\Application Data\Template
      C:\Documents and Settings\Juho\Application Data\Tuneup Software
      C:\Documents and Settings\Juho\Application Data\Urusoft
      C:\Documents and Settings\Juho\Application Data\Vso -- EMPTY Directory
      C:\Documents and Settings\Juho\Application Data\Winpatrol
      C:\Documents and Settings\Localservice\Application Data\Microsoft
      C:\Documents and Settings\Localservice\Application Data\Save Corn Sixth
      C:\Documents and Settings\Networkservice\Application Data\Microsoft

      Äänestä

    • olis kirjoitti:

      lisää...


      Logfile of HijackThis v1.99.1
      Scan saved at 12:43:00, on 4.2.2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.5730.0011)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      D:\Program Files\Norman\NPF\NPFSVICE.EXE
      D:\norman viruscontrol\Bin\Zanda.exe
      C:\WINDOWS\system32\HPZipm12.exe
      C:\WINDOWS\system32\slserv.exe
      D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      D:\norman viruscontrol\Nvc\bin\nvcoas.exe
      D:\norman viruscontrol\bin\NJEEVES.EXE
      D:\norman viruscontrol\Nvc\BIN\nipsvc.exe
      C:\WINDOWS\System32\alg.exe
      C:\WINDOWS\system32\wuauclt.exe
      D:\norman viruscontrol\bin\ZLH.EXE
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\WINDOWS\system32\Rundll32.exe
      C:\Program Files\Microsoft IntelliPoint\point32.exe
      C:\WINDOWS\system32\ctfmon.exe
      D:\Program Files\Norman\NPF\NPFMSG.EXE
      C:\WINDOWS\system32\sistray.exe
      D:\norman viruscontrol\Nvc\BIN\NIP.EXE
      D:\norman viruscontrol\Nvc\bin\cclaw.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
      O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO.dll
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O4 - HKLM\..\Run: [Norman ZANDA] D:\norman viruscontrol\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
      O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
      O4 - HKLM\..\Run: [CloneDVDElbyDelay] "d:\Program Files\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay
      O4 - HKLM\..\Run: [ElbyCheckAnyDVD] "d:\Program Files\SlySoft\AnyDVD\ElbyCheck.exe" /L AnyDVD
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: NPF Messenger.lnk = ?
      O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
      O8 - Extra context menu item: Download all links using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
      O8 - Extra context menu item: Download all videos using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
      O8 - Extra context menu item: Download link using &BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O11 - Options group: [INTERNATIONAL] International*
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://mppv2flash3.valueactive.com/NordicBet/FlashAX.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{1153E4A2-4A5B-4A8B-BF51-CB161DD57A87}: NameServer = 192.168.10.1,193.210.18.18
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - D:\norman viruscontrol\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown owner - D:\norman viruscontrol\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown owner - D:\Program Files\Norman\NPF\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown owner - D:\norman viruscontrol\Bin\Zanda.exe
      O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - D:\norman viruscontrol\Nvc\bin\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - D:\norman viruscontrol\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
      O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
      O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe





      NoLop! Log by Skate_Punk_21

      Fix running from: E:\Imuroinnit\Netti imut
      [4.2.2007]
      [12:31:48]

      ---Infection Files Found/Removed---
      C:\WINDOWS\tasks\AFF80F43918F804F.job

      Beginning Removal...
      Rebooting...
      Removing Lop's Leftover Files/Folders...
      Editing Registry...
      **Fix Complete!**

      ---Listing AppData sub directories---

      C:\Documents and Settings\All Users\Application Data\Adobe
      C:\Documents and Settings\All Users\Application Data\Adobe Systems
      C:\Documents and Settings\All Users\Application Data\Barbgrimbiasmeow
      C:\Documents and Settings\All Users\Application Data\Hp
      C:\Documents and Settings\All Users\Application Data\Microsoft
      C:\Documents and Settings\All Users\Application Data\Npf
      C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
      C:\Documents and Settings\All Users\Application Data\Trymedia
      C:\Documents and Settings\All Users\Application Data\Tuneup Software
      C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
      C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
      C:\Documents and Settings\Default User\Application Data\Microsoft
      C:\Documents and Settings\Juho\Application Data\Adobe
      C:\Documents and Settings\Juho\Application Data\Adobeum -- EMPTY Directory
      C:\Documents and Settings\Juho\Application Data\Ahead
      C:\Documents and Settings\Juho\Application Data\Bitroll
      C:\Documents and Settings\Juho\Application Data\Google
      C:\Documents and Settings\Juho\Application Data\Help -- EMPTY Directory
      C:\Documents and Settings\Juho\Application Data\Hp
      C:\Documents and Settings\Juho\Application Data\Identities
      C:\Documents and Settings\Juho\Application Data\Leadertech
      C:\Documents and Settings\Juho\Application Data\Macromedia
      C:\Documents and Settings\Juho\Application Data\Microgaming
      C:\Documents and Settings\Juho\Application Data\Microsoft
      C:\Documents and Settings\Juho\Application Data\Mozilla
      C:\Documents and Settings\Juho\Application Data\Nero
      C:\Documents and Settings\Juho\Application Data\Opera -- EMPTY Directory
      C:\Documents and Settings\Juho\Application Data\Sun
      C:\Documents and Settings\Juho\Application Data\Template
      C:\Documents and Settings\Juho\Application Data\Tuneup Software
      C:\Documents and Settings\Juho\Application Data\Urusoft
      C:\Documents and Settings\Juho\Application Data\Vso -- EMPTY Directory
      C:\Documents and Settings\Juho\Application Data\Winpatrol
      C:\Documents and Settings\Localservice\Application Data\Microsoft
      C:\Documents and Settings\Localservice\Application Data\Save Corn Sixth
      C:\Documents and Settings\Networkservice\Application Data\Microsoft

      C:\Documents and Settings\Localservice\Application Data\Save Corn Sixth

      Tuo näyttäis vielä kuuluvan lop.com' ille, katso mitä siellä on ja poista jos ei löydy mitään tarpeellista.
      Lisäsiivouksena ajaisin AVG:n Anti-Spywaren:

      Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

      Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi.

      http://www.ewido.net/en/download/
      * Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
      * Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
      * Käynnistä AVG Anti-Spyware.
      * Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

      o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

      * Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
      * Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
      * Sitten "Reports" valikon alta:

      o Laita täppi kohtaan "Automatically generate report after every scan"
      o Ota täppi pois kohdasta"Only if threats were found"

      * Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
      * "Resident shield is", muuta tila active:sta inactive:ksi
      * Sulje ohjelma, ÄLÄ skannaa vielä.

      Käynnistä koneesi vikasietotilaan, Ohje!

      HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.

      * Kun vikasietotilassa, käynnistä AVG Anti-Spyware.
      * Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
      * AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

      Kun skannaus on valmis:
      TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"

      http://img509.imageshack.us/img509/4851/scanavgjk2.jpg
      * Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
      * Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"

      * Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
      * Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
      * Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestiketjuusi.

      Äänestä

    • olis kirjoitti:

      lisää...


      Logfile of HijackThis v1.99.1
      Scan saved at 12:43:00, on 4.2.2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.5730.0011)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      D:\Program Files\Norman\NPF\NPFSVICE.EXE
      D:\norman viruscontrol\Bin\Zanda.exe
      C:\WINDOWS\system32\HPZipm12.exe
      C:\WINDOWS\system32\slserv.exe
      D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      D:\norman viruscontrol\Nvc\bin\nvcoas.exe
      D:\norman viruscontrol\bin\NJEEVES.EXE
      D:\norman viruscontrol\Nvc\BIN\nipsvc.exe
      C:\WINDOWS\System32\alg.exe
      C:\WINDOWS\system32\wuauclt.exe
      D:\norman viruscontrol\bin\ZLH.EXE
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\WINDOWS\system32\Rundll32.exe
      C:\Program Files\Microsoft IntelliPoint\point32.exe
      C:\WINDOWS\system32\ctfmon.exe
      D:\Program Files\Norman\NPF\NPFMSG.EXE
      C:\WINDOWS\system32\sistray.exe
      D:\norman viruscontrol\Nvc\BIN\NIP.EXE
      D:\norman viruscontrol\Nvc\bin\cclaw.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
      O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO.dll
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O4 - HKLM\..\Run: [Norman ZANDA] D:\norman viruscontrol\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
      O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
      O4 - HKLM\..\Run: [CloneDVDElbyDelay] "d:\Program Files\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay
      O4 - HKLM\..\Run: [ElbyCheckAnyDVD] "d:\Program Files\SlySoft\AnyDVD\ElbyCheck.exe" /L AnyDVD
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: NPF Messenger.lnk = ?
      O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
      O8 - Extra context menu item: Download all links using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
      O8 - Extra context menu item: Download all videos using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
      O8 - Extra context menu item: Download link using &BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O11 - Options group: [INTERNATIONAL] International*
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://mppv2flash3.valueactive.com/NordicBet/FlashAX.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{1153E4A2-4A5B-4A8B-BF51-CB161DD57A87}: NameServer = 192.168.10.1,193.210.18.18
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - D:\norman viruscontrol\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown owner - D:\norman viruscontrol\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown owner - D:\Program Files\Norman\NPF\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown owner - D:\norman viruscontrol\Bin\Zanda.exe
      O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - D:\norman viruscontrol\Nvc\bin\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - D:\norman viruscontrol\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
      O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
      O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe





      NoLop! Log by Skate_Punk_21

      Fix running from: E:\Imuroinnit\Netti imut
      [4.2.2007]
      [12:31:48]

      ---Infection Files Found/Removed---
      C:\WINDOWS\tasks\AFF80F43918F804F.job

      Beginning Removal...
      Rebooting...
      Removing Lop's Leftover Files/Folders...
      Editing Registry...
      **Fix Complete!**

      ---Listing AppData sub directories---

      C:\Documents and Settings\All Users\Application Data\Adobe
      C:\Documents and Settings\All Users\Application Data\Adobe Systems
      C:\Documents and Settings\All Users\Application Data\Barbgrimbiasmeow
      C:\Documents and Settings\All Users\Application Data\Hp
      C:\Documents and Settings\All Users\Application Data\Microsoft
      C:\Documents and Settings\All Users\Application Data\Npf
      C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
      C:\Documents and Settings\All Users\Application Data\Trymedia
      C:\Documents and Settings\All Users\Application Data\Tuneup Software
      C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
      C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
      C:\Documents and Settings\Default User\Application Data\Microsoft
      C:\Documents and Settings\Juho\Application Data\Adobe
      C:\Documents and Settings\Juho\Application Data\Adobeum -- EMPTY Directory
      C:\Documents and Settings\Juho\Application Data\Ahead
      C:\Documents and Settings\Juho\Application Data\Bitroll
      C:\Documents and Settings\Juho\Application Data\Google
      C:\Documents and Settings\Juho\Application Data\Help -- EMPTY Directory
      C:\Documents and Settings\Juho\Application Data\Hp
      C:\Documents and Settings\Juho\Application Data\Identities
      C:\Documents and Settings\Juho\Application Data\Leadertech
      C:\Documents and Settings\Juho\Application Data\Macromedia
      C:\Documents and Settings\Juho\Application Data\Microgaming
      C:\Documents and Settings\Juho\Application Data\Microsoft
      C:\Documents and Settings\Juho\Application Data\Mozilla
      C:\Documents and Settings\Juho\Application Data\Nero
      C:\Documents and Settings\Juho\Application Data\Opera -- EMPTY Directory
      C:\Documents and Settings\Juho\Application Data\Sun
      C:\Documents and Settings\Juho\Application Data\Template
      C:\Documents and Settings\Juho\Application Data\Tuneup Software
      C:\Documents and Settings\Juho\Application Data\Urusoft
      C:\Documents and Settings\Juho\Application Data\Vso -- EMPTY Directory
      C:\Documents and Settings\Juho\Application Data\Winpatrol
      C:\Documents and Settings\Localservice\Application Data\Microsoft
      C:\Documents and Settings\Localservice\Application Data\Save Corn Sixth
      C:\Documents and Settings\Networkservice\Application Data\Microsoft

      C:\Documents and Settings\All Users\Application Data\Barbgrimbiasmeow

      Ilmiselvältä lop.com ' in kansioltahan tuokin näyttää. Poista, jos et löydä sieltä mitään itsellesi tarpeellista. Lähtenee parhaiten vikasietotilassa, ei vaadi HJT:llä fixausta ,koska ei näy logissa.
      Ellen tulkitse väärin, näyttäis sinun java olevan ikääntynyttä sorttia. Poista vanha ja asenna uusi tämän ohjeen mukaan:

      Javan päivitys ja välimuistin tyhjennys


      1. Klikkaa Käynnistä > Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
      2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
      Niissä pitäisi olla seuraava kuva vieressä:
      3. Valitse kaikki entiset Java versiosi ja valitse Poista.
      4. Asenna uusin Java päivitys seuraavasta linkistä..
      5. Käynnistä kone uudelleen asennuksen jälkeen:

      http://java.sun.com/javase/downloads/index.jsp

      Rullaa alas kohteeseen Java Runtime Environment (JRE) 6

      Paina Download

      Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna

      6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
      7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files nappia.

      (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
      Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liusäädintä isommalle).

      8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

      Applications and Applets

      Trace and Log Files

      Ok

      9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
      Huomaa: Tämä poistaa kaikki ladatut sovellukset ja appletit VÄLIMUISTISTA.
      10. Klikkaa OK jättääksesi Java asetusikkunasi.

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    hidastelee kirjoitti:

    vitusti kone..

    eli,joku asian osaava kiitos ja kumarrus jos sanotte turhat pois tästä koneesta.....

    Logfile of HijackThis v1.99.1
    Scan saved at 9:30:36, on 4.2.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    D:\Program Files\Norman\NPF\NPFSVICE.EXE
    D:\norman viruscontrol\Bin\Zanda.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\slserv.exe
    D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\WINDOWS\system32\svchost.exe
    D:\norman viruscontrol\Nvc\bin\nvcoas.exe
    D:\norman viruscontrol\bin\NJEEVES.EXE
    D:\norman viruscontrol\Nvc\BIN\nipsvc.exe
    D:\norman viruscontrol\bin\ZLH.EXE
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\WINDOWS\system32\ctfmon.exe
    c:\progra~1\intern~1\iexplore.exe
    D:\Program Files\Norman\NPF\NPFMSG.EXE
    C:\WINDOWS\system32\sistray.exe
    D:\norman viruscontrol\Nvc\BIN\NIP.EXE
    D:\norman viruscontrol\Nvc\bin\cclaw.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [Norman ZANDA] D:\norman viruscontrol\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [CloneDVDElbyDelay] "d:\Program Files\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay
    O4 - HKLM\..\Run: [ElbyCheckAnyDVD] "d:\Program Files\SlySoft\AnyDVD\ElbyCheck.exe" /L AnyDVD
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Biaslies] C:\DOCUME~1\Juho\APPLIC~1\SAVECO~1\More Base.exe
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: NPF Messenger.lnk = ?
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O8 - Extra context menu item: Download all links using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: Download all videos using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: Download link using &BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://mppv2flash3.valueactive.com/NordicBet/FlashAX.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{1153E4A2-4A5B-4A8B-BF51-CB161DD57A87}: NameServer = 192.168.10.1,193.210.18.18
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - D:\norman viruscontrol\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - D:\norman viruscontrol\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - D:\Program Files\Norman\NPF\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown owner - D:\norman viruscontrol\Bin\Zanda.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - D:\norman viruscontrol\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - D:\norman viruscontrol\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu