Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\ohjelmat\AntiVir PersonalEdition Classic\avgnt.exe
C:\ohjelmat\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\ohjelmat\AntiVir PersonalEdition Classic\sched.exe
C:\ohjelmat\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\ohjelmat\wincommander\WINCMD32.EXE
C:\ohjelmat\virustorjunta\ewido\AVG Anti-Spyware 7.5\guard.exe
C:\ohjelmat\firefox\firefox.exe
C:\ohjelmat\virustorjunta\HJT\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.fi/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ohjelmat\spybotsd\Spybot - Search & Destroy\SDHelper.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\ohjelmat\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] "C:\ohjelmat\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\ohjelmat\deamontools\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\ohjelmat\virustorjunta\ewido\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\ohjelmat\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\ohjelmat\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\ohjelmat\virustorjunta\ewido\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\ohjelmat\AntiVir PersonalEdition Classic\avgnt.exe
C:\ohjelmat\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\ohjelmat\AntiVir PersonalEdition Classic\sched.exe
C:\ohjelmat\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\ohjelmat\wincommander\WINCMD32.EXE
C:\ohjelmat\virustorjunta\ewido\AVG Anti-Spyware 7.5\guard.exe
C:\ohjelmat\firefox\firefox.exe
C:\ohjelmat\virustorjunta\HJT\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.fi/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ohjelmat\spybotsd\Spybot - Search & Destroy\SDHelper.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\ohjelmat\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] "C:\ohjelmat\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\ohjelmat\deamontools\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\ohjelmat\virustorjunta\ewido\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\ohjelmat\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\ohjelmat\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\ohjelmat\virustorjunta\ewido\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Vastaukset 5
Vanhimmat
Ohje AVG Anti-Spyware 7.5:n käyttöön
Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis työkalun toimintaa.
Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta
Lataa AVG Anti-Spyware 7.5 http://www.ewido.net/en/download/
ja tallenna ohjelma työpöydällesi.
• Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
• Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
• Käynnistä AVG Anti-Spyware.
• Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
• Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
• Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
• Sitten "Reports" valikon alta:
o Laita täppi kohtaan "Automatically generate report after every scan"
o Ota täppi pois kohdasta"Only if threats were found"
• Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
• "Resident shield is", muuta tila active:sta inactive:ksi
• Sulje ohjelma, ÄLÄ skannaa vielä.
Käynnistä koneesi vikasietotilaan,
sammuta ja käynnistä
käynnistyksen yhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina enter ja enter
HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.
• Kun vikasietotilassa, käynnistä AVG Anti-Spyware.
• Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
• Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
• Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
• Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
• Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
• Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
• Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.
Lähetä AVG logi ja uusi HJT-logi.
AVG Anti-Spyware - Scan Report
C:\System Volume Information\_restore{2E21AB16-7193-448F-98D6-FB96DDE96A77}\RP123\A0033470.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
:mozilla.20:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.21:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.22:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.23:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.24:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.25:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.26:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.39:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.566:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.567:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.568:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.163:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.37:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.38:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.92:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.93:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.57:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.58:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.59:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.60:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.153:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Fortunecity : Cleaned.
:mozilla.179:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Gemius : Cleaned.
:mozilla.193:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.575:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.579:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.299:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.668:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.43:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.44:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.326:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.327:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.334:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.335:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.131:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.353:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.354:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.355:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.528:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.550:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.366:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.367:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.6:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
:mozilla.8:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.408:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.491:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.492:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.493:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.494:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.495:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.496:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.497:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.498:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.499:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.500:C:\Documents and Settings\pauli\Application Data\Mozilla\Firefox\Profiles\u6k643ar.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
=========================================
HJT logi ei muuttunut ollenkaan
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\ohjelmat\AntiVir PersonalEdition Classic\avgnt.exe
C:\ohjelmat\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\ohjelmat\AntiVir PersonalEdition Classic\sched.exe
C:\ohjelmat\AntiVir PersonalEdition Classic\avguard.exe
C:\ohjelmat\virustorjunta\ewido\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\ohjelmat\wincommander\WINCMD32.EXE
C:\ohjelmat\virustorjunta\HJT\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.fi/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ohjelmat\spybotsd\Spybot - Search & Destroy\SDHelper.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\ohjelmat\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] "C:\ohjelmat\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\ohjelmat\deamontools\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\ohjelmat\virustorjunta\ewido\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\ohjelmat\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\ohjelmat\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\ohjelmat\virustorjunta\ewido\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
scannaa hjt:llä merkkaa paina Fix checked
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
=============
Lataa tuolta http://www.ccleaner.com/download/builds.aspx
CCleaner v1.34.407 - Basic, katso että et asenna Yahoo toolbaria!
laita asetukset näin:
Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.
aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi
=================
scannaa hjt:llä merkkaa paina Fix checked
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
--------------
Tuo ALCMTR.EXE on Realtekin tiedostoja, kannattaako sitä mennä poistamaan?
http://www.castlecops.com/s5306-alcmtr.html
örkki mikä örkki