Logfile of HijackThis v1.99.1
Scan saved at 20:16:23, on 13.4.2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\iexpolere.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\MS_update_0612_KB74062.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\ohojelmia\skanneri.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O1 - Hosts: 209.160.40.27 www.e-gold.com
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0A66D86F-CE32-4EBF-A048-181AEEC46F4E} - C:\WINDOWS\System32\pmnno.dll
O2 - BHO: (no name) - {182B90A3-F372-438A-800C-6814B4DE417B} - C:\WINDOWS\System32\ljjjjge.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\imutus\BitComet\tools\BitCometBHO.dll
O2 - BHO: (no name) - {67C55A8D-E808-4caa-9EA7-F77102DE0BB6} - C:\WINDOWS\System32\jlkokisc.dll
O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\System32\ipv6mons.dll
O2 - BHO: (no name) - {DC1A1297-38E3-4431-8107-C05B804DAF85} - C:\WINDOWS\System32\ptebivkw.dll
O2 - BHO: PEDEV_IEListener Class - {E1412445-4FF8-410e-8D24-F2CF86B171A4} - C:\Program Files\PeDevice\PeDev.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Services] C:\WINDOWS\System32\iexpolere.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\System32\eovfjooq.dll",setvm
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\\PSDrvCheck.exe
O4 - HKCU\..\Run: [Oaws] "C:\WINDOWS\FNTS~1\msiexec.exe" -vt yazr
O4 - HKCU\..\Run: [Mfujhov] "C:\Program Files\??crosoft\n?pdb.exe" 99001322
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: MS_update_0612_KB74062.exe
O8 - Extra context menu item: Download all links using BitComet - res://D:\imutus\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://D:\imutus\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://D:\imutus\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: ljjjjge - C:\WINDOWS\SYSTEM32\ljjjjge.dll
O20 - Winlogon Notify: nnnkjge - C:\WINDOWS\SYSTEM32\nnnkjge.dll
O20 - Winlogon Notify: pmnno - C:\WINDOWS\System32\pmnno.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe
Käyttöjäjerstelmän vaihto mielessä?????????????????????????????????????????
Scan saved at 20:16:23, on 13.4.2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\iexpolere.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\MS_update_0612_KB74062.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\ohojelmia\skanneri.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O1 - Hosts: 209.160.40.27 www.e-gold.com
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0A66D86F-CE32-4EBF-A048-181AEEC46F4E} - C:\WINDOWS\System32\pmnno.dll
O2 - BHO: (no name) - {182B90A3-F372-438A-800C-6814B4DE417B} - C:\WINDOWS\System32\ljjjjge.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\imutus\BitComet\tools\BitCometBHO.dll
O2 - BHO: (no name) - {67C55A8D-E808-4caa-9EA7-F77102DE0BB6} - C:\WINDOWS\System32\jlkokisc.dll
O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\System32\ipv6mons.dll
O2 - BHO: (no name) - {DC1A1297-38E3-4431-8107-C05B804DAF85} - C:\WINDOWS\System32\ptebivkw.dll
O2 - BHO: PEDEV_IEListener Class - {E1412445-4FF8-410e-8D24-F2CF86B171A4} - C:\Program Files\PeDevice\PeDev.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Services] C:\WINDOWS\System32\iexpolere.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\System32\eovfjooq.dll",setvm
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\\PSDrvCheck.exe
O4 - HKCU\..\Run: [Oaws] "C:\WINDOWS\FNTS~1\msiexec.exe" -vt yazr
O4 - HKCU\..\Run: [Mfujhov] "C:\Program Files\??crosoft\n?pdb.exe" 99001322
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: MS_update_0612_KB74062.exe
O8 - Extra context menu item: Download all links using BitComet - res://D:\imutus\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://D:\imutus\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://D:\imutus\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: ljjjjge - C:\WINDOWS\SYSTEM32\ljjjjge.dll
O20 - Winlogon Notify: nnnkjge - C:\WINDOWS\SYSTEM32\nnnkjge.dll
O20 - Winlogon Notify: pmnno - C:\WINDOWS\System32\pmnno.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe
Käyttöjäjerstelmän vaihto mielessä?????????????????????????????????????????
Vastaukset 9
Vanhimmat
Hae VundoFix.exe -> http://www.atribune.org/ccount/click.php?id=4 ja tallenna työpöydälle
[*]Tuplaklikkaa VundoFix.exe
[*]Klikkaa Scan for Vundo
[*]Kun skanni on valmis, klikkaa Remove Vundo -nappulaa
[*]Kun kysytään, haluatko poistaa tiedostot, vastaa YES
[*]Kun klikkaat yes, työpöytä häviää, kun Vundon poisto alkaa.
[*]Kun se on valmis, fixi ilmoittaa, että kone sammutetaan. Klikkaa ok.
[*]Käynnistä kone uudelleen
lähetä C:\vundofix.txt sisältö ja uusi HijackThis logi
sitte kun käynnistää koneen... Eka tulee teksti jossa lukee
RUNDLL virhe ladattaessa C:windows/system32/eovfjooq.dll
määriteltyä osaa ei löydy.
sen jälkeen AVAST alkaa huutaa TROIJALAINEN LÖYTYNYT!
teidosto: C:\DOCUME~1\Joku\LOCALS~1\Temp\tmp1.tmp
Haittaohjelman nimi: Win32:Small-gen2 [Trj]
jota ei pysty poistaa/tulee aina uudestaan.
ja vielä Messingeri ja skype ja ... on siinä konserttia
laitas se tänne.
===========
ajas tuosta
Ohje AVG:n Anti-Spyware 7.5:n käyttöön
Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis työkalun toimintaa.
Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta
Lataa AVG:n Anti-Spyware 7.5 http://www.ewido.net/en/download/
ja tallenna ohjelma työpöydällesi.
• Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
• Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
• Käynnistä AVG:n Anti-Spyware.
• Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
• Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
• Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
• Sitten "Reports" valikon alta:
o Laita täppi kohtaan "Automatically generate report after every scan"
o Ota täppi pois kohdasta"Only if threats were found"
• Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
• "Resident shield is", muuta tila active:sta inactive:ksi
• Sulje ohjelma, ÄLÄ skannaa vielä.
Käynnistä koneesi vikasietotilaan,
sammuta ja käynnistä
käynnistyksen yhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina enter ja enter
HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
• Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
• Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
• Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
• Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
• Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
http://img509.imageshack.us/img509/4851/scanavgjk2.jpg
• Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
• Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
• Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.
Tässä tää vundo logi
VundoFix V6.3.19
Checking Java version...
Sun Java not detected
Scan started at 23:14:53 13.4.2007
Listing files found while scanning....
C:\WINDOWS\system32\anivopin.dll
C:\WINDOWS\system32\aofnvqao.dll
C:\WINDOWS\system32\awtrpno.dll
C:\WINDOWS\system32\awtrqqr.dll
C:\WINDOWS\system32\awtsppq.dll
C:\WINDOWS\system32\byxurol.dll
C:\WINDOWS\system32\byxurqo.dll
C:\WINDOWS\system32\byxywwx.dll
C:\WINDOWS\system32\cbeeg.ini
C:\WINDOWS\system32\cbxurom.dll
C:\WINDOWS\system32\cbxustt.dll
C:\WINDOWS\system32\cbxvvtt.dll
C:\WINDOWS\system32\cbxvvwx.dll
C:\WINDOWS\system32\cbxyvst.dll
C:\WINDOWS\system32\cxyxwslr.dll
C:\WINDOWS\system32\ddcbxvt.dll
C:\WINDOWS\system32\efccaww.dll
C:\WINDOWS\system32\eovfjooq.dll
C:\WINDOWS\system32\erddetva.dll
C:\WINDOWS\system32\fccabyx.dll
C:\WINDOWS\system32\fccaxvs.dll
C:\WINDOWS\system32\fccdeee.dll
C:\WINDOWS\system32\gebcdee.dll
C:\WINDOWS\system32\gebxvur.dll
C:\WINDOWS\system32\geebc.dll
C:\WINDOWS\system32\hggffgd.dll
C:\WINDOWS\system32\hrmgiqlp.dll
C:\WINDOWS\system32\iifdcaw.dll
C:\WINDOWS\system32\iiffcaw.dll
C:\WINDOWS\system32\iifggec.dll
C:\WINDOWS\system32\iupsqwrl.dll
C:\WINDOWS\system32\jkkijkl.dll
C:\WINDOWS\system32\jkkjgef.dll
C:\WINDOWS\system32\jkkkjgf.dll
C:\WINDOWS\system32\jlkokisc.dll
C:\WINDOWS\system32\khfebyy.dll
C:\WINDOWS\system32\khfgedc.dll
C:\WINDOWS\system32\ljjhhii.dll
C:\WINDOWS\system32\ljjighi.dll
C:\WINDOWS\system32\ljjjjge.dll
C:\WINDOWS\system32\mljhghf.dll
C:\WINDOWS\system32\mljkklm.dll
C:\WINDOWS\system32\mrwevqpb.dll
C:\WINDOWS\system32\mvlqgafa.dll
C:\WINDOWS\system32\nbvheoky.dll
C:\WINDOWS\system32\nnnkijh.dll
C:\WINDOWS\system32\nnnkjge.dll
C:\WINDOWS\system32\nnnnomj.dll
C:\WINDOWS\system32\nnnooon.dll
C:\WINDOWS\system32\ohylqjku.dll
C:\WINDOWS\system32\onnmp.bak1
C:\WINDOWS\system32\onnmp.bak2
C:\WINDOWS\system32\onnmp.ini
C:\WINDOWS\system32\onnmp.ini2
C:\WINDOWS\system32\onnmp.tmp
C:\WINDOWS\system32\pmnkjhf.dll
C:\WINDOWS\system32\pmnlkjj.dll
C:\WINDOWS\system32\pmnmjge.dll
C:\WINDOWS\system32\pmnmlkh.dll
C:\WINDOWS\System32\pmnno.dll
C:\WINDOWS\system32\pmnonkj.dll
C:\WINDOWS\system32\psxccbec.dll
C:\WINDOWS\system32\qomkkjj.dll
C:\WINDOWS\system32\qommmmj.dll
C:\WINDOWS\system32\qoojfvoe.ini
C:\WINDOWS\system32\rftesuhc.dll
C:\WINDOWS\system32\rlbpdfxj.dll
C:\WINDOWS\system32\rqroomm.dll
C:\WINDOWS\system32\rqrsqol.dll
C:\WINDOWS\system32\sqedjctk.dll
C:\WINDOWS\system32\ssqolki.dll
C:\WINDOWS\system32\ssqqolm.dll
C:\WINDOWS\system32\tjmvnkyu.dll
C:\WINDOWS\system32\tuvvusp.dll
C:\WINDOWS\system32\tuvvusr.dll
C:\WINDOWS\system32\ufyhddwk.dll
C:\WINDOWS\system32\urqponn.dll
C:\WINDOWS\system32\vrjetvcs.dll
C:\WINDOWS\system32\vtuspnl.dll
C:\WINDOWS\system32\vtuspqq.dll
C:\WINDOWS\system32\vtusstr.dll
C:\WINDOWS\system32\vvbmrdta.dll
C:\WINDOWS\system32\xfpmoijk.dll
C:\WINDOWS\system32\xncgnbnl.dll
C:\WINDOWS\system32\xxyaaww.dll
C:\WINDOWS\system32\xxyabyx.dll
C:\WINDOWS\system32\xxyxwtt.dll
C:\WINDOWS\system32\yaywuut.dll
C:\WINDOWS\system32\yayxvvs.dll
C:\WINDOWS\system32\ycqfsygu.dll
Beginning removal...
Attempting to delete C:\WINDOWS\system32\anivopin.dll
C:\WINDOWS\system32\anivopin.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\aofnvqao.dll
C:\WINDOWS\system32\aofnvqao.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\awtrpno.dll
C:\WINDOWS\system32\awtrpno.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\awtrqqr.dll
C:\WINDOWS\system32\awtrqqr.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\awtsppq.dll
C:\WINDOWS\system32\awtsppq.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\byxurol.dll
C:\WINDOWS\system32\byxurol.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\byxurqo.dll
C:\WINDOWS\system32\byxurqo.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\byxywwx.dll
C:\WINDOWS\system32\byxywwx.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\cbeeg.ini
C:\WINDOWS\system32\cbeeg.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\cbxurom.dll
C:\WINDOWS\system32\cbxurom.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\cbxustt.dll
C:\WINDOWS\system32\cbxustt.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\cbxvvtt.dll
C:\WINDOWS\system32\cbxvvtt.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\cbxvvwx.dll
C:\WINDOWS\system32\cbxvvwx.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\cbxyvst.dll
C:\WINDOWS\system32\cbxyvst.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\cxyxwslr.dll
C:\WINDOWS\system32\cxyxwslr.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\ddcbxvt.dll
C:\WINDOWS\system32\ddcbxvt.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\efccaww.dll
C:\WINDOWS\system32\efccaww.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\eovfjooq.dll
C:\WINDOWS\system32\eovfjooq.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\erddetva.dll
C:\WINDOWS\system32\erddetva.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\fccabyx.dll
C:\WINDOWS\system32\fccabyx.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\fccaxvs.dll
C:\WINDOWS\system32\fccaxvs.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\fccdeee.dll
C:\WINDOWS\system32\fccdeee.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\gebcdee.dll
C:\WINDOWS\system32\gebcdee.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\gebxvur.dll
C:\WINDOWS\system32\gebxvur.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\geebc.dll
C:\WINDOWS\system32\geebc.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\hggffgd.dll
C:\WINDOWS\system32\hggffgd.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\hrmgiqlp.dll
C:\WINDOWS\system32\hrmgiqlp.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\iifdcaw.dll
C:\WINDOWS\system32\iifdcaw.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\iiffcaw.dll
C:\WINDOWS\system32\iiffcaw.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\iifggec.dll
C:\WINDOWS\system32\iifggec.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\iupsqwrl.dll
C:\WINDOWS\system32\iupsqwrl.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\jkkijkl.dll
C:\WINDOWS\system32\jkkijkl.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\jkkjgef.dll
C:\WINDOWS\system32\jkkjgef.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\jkkkjgf.dll
C:\WINDOWS\system32\jkkkjgf.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\jlkokisc.dll
C:\WINDOWS\system32\jlkokisc.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\khfebyy.dll
C:\WINDOWS\system32\khfebyy.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\khfgedc.dll
C:\WINDOWS\system32\khfgedc.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\ljjhhii.dll
C:\WINDOWS\system32\ljjhhii.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\ljjighi.dll
C:\WINDOWS\system32\ljjighi.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\ljjjjge.dll
C:\WINDOWS\system32\ljjjjge.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\mljhghf.dll
C:\WINDOWS\system32\mljhghf.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\mljkklm.dll
C:\WINDOWS\system32\mljkklm.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\mrwevqpb.dll
C:\WINDOWS\system32\mrwevqpb.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\mvlqgafa.dll
C:\WINDOWS\system32\mvlqgafa.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\nbvheoky.dll
C:\WINDOWS\system32\nbvheoky.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\nnnkijh.dll
C:\WINDOWS\system32\nnnkijh.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\nnnkjge.dll
C:\WINDOWS\system32\nnnkjge.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\nnnnomj.dll
C:\WINDOWS\system32\nnnnomj.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\nnnooon.dll
C:\WINDOWS\system32\nnnooon.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\ohylqjku.dll
C:\WINDOWS\system32\ohylqjku.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\onnmp.bak1
C:\WINDOWS\system32\onnmp.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\onnmp.bak2
C:\WINDOWS\system32\onnmp.bak2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\onnmp.ini
C:\WINDOWS\system32\onnmp.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\onnmp.ini2
C:\WINDOWS\system32\onnmp.ini2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\onnmp.tmp
C:\WINDOWS\system32\onnmp.tmp Has been deleted!
Attempting to delete C:\WINDOWS\system32\pmnkjhf.dll
C:\WINDOWS\system32\pmnkjhf.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\pmnlkjj.dll
C:\WINDOWS\system32\pmnlkjj.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\pmnmjge.dll
C:\WINDOWS\system32\pmnmjge.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\pmnmlkh.dll
C:\WINDOWS\system32\pmnmlkh.dll Has been deleted!
Attempting to delete C:\WINDOWS\System32\pmnno.dll
C:\WINDOWS\System32\pmnno.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\pmnonkj.dll
C:\WINDOWS\system32\pmnonkj.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\psxccbec.dll
C:\WINDOWS\system32\psxccbec.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\qomkkjj.dll
C:\WINDOWS\system32\qomkkjj.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\qommmmj.dll
C:\WINDOWS\system32\qommmmj.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\qoojfvoe.ini
C:\WINDOWS\system32\qoojfvoe.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\rftesuhc.dll
C:\WINDOWS\system32\rftesuhc.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\rlbpdfxj.dll
C:\WINDOWS\system32\rlbpdfxj.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\rqroomm.dll
C:\WINDOWS\system32\rqroomm.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\rqrsqol.dll
C:\WINDOWS\system32\rqrsqol.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\sqedjctk.dll
C:\WINDOWS\system32\sqedjctk.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\ssqolki.dll
C:\WINDOWS\system32\ssqolki.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\ssqqolm.dll
C:\WINDOWS\system32\ssqqolm.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\tjmvnkyu.dll
C:\WINDOWS\system32\tjmvnkyu.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\tuvvusp.dll
C:\WINDOWS\system32\tuvvusp.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\tuvvusr.dll
C:\WINDOWS\system32\tuvvusr.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\ufyhddwk.dll
C:\WINDOWS\system32\ufyhddwk.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\urqponn.dll
C:\WINDOWS\system32\urqponn.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\vrjetvcs.dll
C:\WINDOWS\system32\vrjetvcs.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\vtuspnl.dll
C:\WINDOWS\system32\vtuspnl.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\vtuspqq.dll
C:\WINDOWS\system32\vtuspqq.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\vtusstr.dll
C:\WINDOWS\system32\vtusstr.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\vvbmrdta.dll
C:\WINDOWS\system32\vvbmrdta.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\xfpmoijk.dll
C:\WINDOWS\system32\xfpmoijk.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\xncgnbnl.dll
C:\WINDOWS\system32\xncgnbnl.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\xxyaaww.dll
C:\WINDOWS\system32\xxyaaww.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\xxyabyx.dll
C:\WINDOWS\system32\xxyabyx.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\xxyxwtt.dll
C:\WINDOWS\system32\xxyxwtt.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\yaywuut.dll
C:\WINDOWS\system32\yaywuut.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\yayxvvs.dll
C:\WINDOWS\system32\yayxvvs.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\ycqfsygu.dll
C:\WINDOWS\system32\ycqfsygu.dll Has been deleted!
Performing Repairs to the registry.
Done!
Beginning removal...
Attempting to delete C:\WINDOWS\system32\ljjjjge.dll
C:\WINDOWS\system32\ljjjjge.dll Has been deleted!
Performing Repairs to the registry.
Done!
se hjt loki scannaten uudestaan
Logfile of HijackThis v1.99.1
Scan saved at 1:12:22, on 17.4.2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\iexpolere.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\ohojelmia\skanneri.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O1 - Hosts: 209.160.40.27 www.e-gold.com
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: (no name) - {67C55A8D-E808-4caa-9EA7-F77102DE0BB6} - C:\WINDOWS\System32\jlkokisc.dll (file missing)
O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\System32\ipv6mons.dll
O2 - BHO: (no name) - {782DD55D-1E44-48FC-98ED-8D33E2779A5D} - C:\WINDOWS\System32\pmnno.dll (file missing)
O2 - BHO: (no name) - {DC1A1297-38E3-4431-8107-C05B804DAF85} - C:\WINDOWS\System32\ptebivkw.dll
O2 - BHO: PEDEV_IEListener Class - {E1412445-4FF8-410e-8D24-F2CF86B171A4} - C:\Program Files\PeDevice\PeDev.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Services] C:\WINDOWS\System32\iexpolere.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\System32\eovfjooq.dll",setvm
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\\PSDrvCheck.exe
O4 - HKCU\..\Run: [Oaws] "C:\WINDOWS\FNTS~1\msiexec.exe" -vt yazr
O4 - HKCU\..\Run: [Mfujhov] "C:\Program Files\??crosoft\n?pdb.exe" 99001322
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: MS_update_0612_KB74062.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe
scannaa hjt:llä merkkaa paina Fix checked
O2 - BHO: (no name) - {67C55A8D-E808-4caa-9EA7-F77102DE0BB6} - C:\WINDOWS\System32\jlkokisc.dll (file missing)
O2 - BHO: PEDEV_IEListener Class - {E1412445-4FF8-410e-8D24-F2CF86B171A4} - C:\Program Files\PeDevice\PeDev.dll (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
=============
Tapa 1:
Etsi lisää/poista sovelluksesta PuritySCAN By OIN, OuterInfo, OIN tai ohjelma jolla samantapainen nimi , ja poista sen asennus.
Käynnistä uudelleen ja poista tämä hakemisto, jos löytyy
C:\Program Files\PurityScan
Tapa 2:
Jos ohjelmaa ei löydy, lataa ja aja tämä
Uninstaller http://www.outerinfo.com/OiUninstaller.exe
Käynnistä uudelleen ja poista tämä hakemisto:
C:\Program Files\PurityScan
========
Mene vikasietotilaan
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjä tilisi ja taas pikkunen ikkuna paina ok
========
Poista vikasiedossa
C:\WINDOWS\web\---> related.htm
Lataa SDFix by AndyManchesta http://downloads.andymanchesta.com/RemovalTools/SDFix.zip ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:
• Käynnistä tietokone
• Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
• Seuraavaksi pitäisi ilmestyä valikko
• Valitse valikosta vikasietotila.
• Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
• Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
• Paina Y käynnistääksesi skriptin.
• Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
• Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
• Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
• Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
• Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
• Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.
ajoin ohjelmat
eli:AVG Anti-Spyware report ja SDFix: Version 1.79 report
Tossa AVG:ssä ei onnistunut tämä: Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta????
en tiiä kämmäsinkö ite. no kuiteski
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
Created at: 20:25:03 28.4.2007
Scan result:
C:\Documents and Settings\Joku\Local Settings\Temp\exe.exe -> Adware.BHO : Cleaned with backup (quarantined).
C:\Documents and Settings\Joku\Local Settings\Temp\~00754.tmp -> Adware.BHO : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB} -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB} -> Adware.Generic : Cleaned with backup (quarantined).
C:\Program Files\Ipwindows\ipwins.dll -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\Program Files\Ipwindows\ipwins.exe -> Adware.Maxifiles : Cleaned with backup (quarantined).
C:\VundoFix Backups\awtrpno.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\awtrqqr.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\awtsppq.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\byxurol.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\byxurqo.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\byxywwx.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\cbxurom.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\cbxustt.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\cbxvvtt.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\cbxvvwx.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\cbxyvst.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\ddcbxvt.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\efccaww.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\fccabyx.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\fccaxvs.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\fccdeee.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\gebcdee.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\gebxvur.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\hggffgd.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\iifdcaw.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\iiffcaw.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\iifggec.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\jkkijkl.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\jkkjgef.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\jkkkjgf.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\khfebyy.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\khfgedc.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\ljjhhii.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\ljjighi.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\mljhghf.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\mljkklm.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\nnnkijh.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\nnnkjge.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\nnnnomj.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\nnnooon.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\pmnkjhf.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\pmnlkjj.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\pmnmjge.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\pmnmlkh.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\pmnonkj.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\qomkkjj.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\qommmmj.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\rqroomm.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\rqrsqol.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\ssqolki.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\ssqqolm.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\tuvvusp.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\tuvvusr.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\urqponn.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\vtuspnl.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\vtuspqq.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\vtusstr.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\xxyaaww.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\xxyabyx.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\xxyxwtt.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\yaywuut.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\VundoFix Backups\yayxvvs.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Documents and Settings\Joku\Local Settings\Temp\tmp36.tmp -> Backdoor.Apex : Cleaned with backup (quarantined).
C:\Documents and Settings\Joku\Local Settings\Temp\pa_0265.exe -> Dialer.Agent.k : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\MS_update_0612_KB74062.exe -> Downloader.Murlo.ek : Cleaned with backup (quarantined).
C:\0xf9.exe -> Downloader.Tiny.bn : Cleaned with backup (quarantined).
C:\Documents and Settings\Joku\Local Settings\Temp\awuiuep.exe -> Downloader.Tiny.nch : Cleaned with backup (quarantined).
C:\Documents and Settings\Joku\Local Settings\Temp\spoolsv32.exe -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\WINDOWS\424145026.dll -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\WINDOWS\winlogon32.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\Documents and Settings\Joku\Local Settings\Application Data\Microsoft\Internet Explorer\prndrv.dll -> Not-A-Virus.SpamTool.Win32.Agent.ah : Cleaned with backup (quarantined).
C:\WINDOWS\system32\iexpoler.exe -> Proxy.Ranky : Cleaned with backup (quarantined).
C:\WINDOWS\system32\iexpolere.exe -> Proxy.Ranky : Cleaned with backup (quarantined).
C:\WINDOWS\system32\drivers\hflt_ipf.sys -> Rootkit.Agent.eg : Cleaned with backup (quarantined).
C:\Documents and Settings\Joku\Cookies\joku@connextra[2].txt -> TrackingCookie.Connextra : Cleaned.
C:\Documents and Settings\Joku\Cookies\joku@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Joku\Cookies\[email protected][1].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\Joku\Cookies\[email protected][1].txt -> TrackingCookie.Skype : Cleaned.
C:\Documents and Settings\just joo\Cookies\just [email protected][1].txt -> TrackingCookie.Skype : Cleaned.
C:\Documents and Settings\Joku\Cookies\joku@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : Cleaned.
C:\Documents and Settings\Joku\Cookies\joku@toplist[1].txt -> TrackingCookie.Toplist : Cleaned.
C:\Documents and Settings\Joku\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\WINDOWS\system32\drivers\kcp.sys -> Trojan.Agent.lf : Cleaned with backup (quarantined).
C:\WINDOWS\system32\winttr.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\winhp32.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\winlogon32.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\pamnibts.exe -> Trojan.Tanspy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\aaafogqe.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\aagqrcrg.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\aajaaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\aalvfaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\aamicaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\aamrpavw.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\aasplaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\aaunqark.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\aavbaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\aaxebswx.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\aepsjalg.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\diadcfus.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\dimdehji.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\djklaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\djlaaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\djmrnrvg.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\djpwbhpt.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\djujlaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\dnexhoea.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\dnhgiaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\dntdlnwd.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\glcaaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\glhuuaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\gljhwqms.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\glmhqtme.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\glqkaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\glvkaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\glxbhaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\godaaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\gpftaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\gpsukhrs.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\gpuenaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\gpxdaxpp.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\jgbaraaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\jgflaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\jgjxqfoh.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\jgkbaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\jgkhaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\jgunaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\jgvqoyov.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\jgwxaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\jkkvcaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\jkoaaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\moiymbli.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\mskvtiaf.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\mtalvcgl.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\mtbqaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\mtkyxwkh.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\mtoryaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\mtwuuaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\mxnuyqos.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\mxtqjthd.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\pacppfrf.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\paehqaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\pahaaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\pahjqlvs.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\pahopaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\parbhrfe.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\pavvgaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\pejcaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\peputwsy.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\perfrggd.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\perivaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\sdfaaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\sdploaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\sdtutgyl.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\sdwfsctb.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\sxnusqwn.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\sxxsraaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\sybfboyf.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\sycjmaiv.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\sydbwaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\syqtgaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\vqdxbhfm.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\vqdyaaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\vqhrtsdg.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\vqlecaaa.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
C:\WINDOWS\system32\vqvqdbgx.exe -> Trojan.Zapchast.ca : Cleaned with backup (quarantined).
::Report end
-------------------------------------
-------------------------
-------------------------
----------------
---------SDFix: Version 1.79
Run by Joku - la 28.04.2007 - 20:28:11,39
Microsoft Windows XP [versio 5.1.2600]
Running From: C:\DOCUME~1\Joku\TYPYT~1\sdfiks\SDFix
Safe Mode:
Checking Services:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting...
Normal Mode:
Checking Files:
Below files will be copied to Backups folder then removed:
C:\DOCUME~1\Joku\LOCALS~1\Temp\installer.exe - Deleted
C:\WINDOWS\system32\iexploler.exe - Deleted
C:\WINDOWS\system32\ipv6mops.dll - Deleted
C:\WINDOWS\system32\unsvchosts.lzma - Deleted
Removing Temp Files
ADS Check:
Checking if ADS is attached to system32 Folder
C:\WINDOWS\system32
No streams found.
Checking if ADS is attached to svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.
Final Check:
Remaining Services:
------------------
Remaining Files:
---------------
Backups Folder: - C:\DOCUME~1\Joku\TYPYT~1\sdfiks\SDFix\backups\backups.zip
Checking For Files with Hidden Attributes:
C:\Program Files\Internet Explorer\wininet.dll
C:\Program Files\Internet Explorer\iexplore.exe.local
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\433c5277be2bc0f87b49f0ccfdc3cfd8\BIT15.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\f38663470c5b620a4eec62ea395f2df7\BIT1C.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\fc6b36a98cf5af9afa9bb16902c158a8\BIT3.tmp
Finished