Logfile of HijackThis v1.99.1
Scan saved at 15:55:46, on 23.6.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
c:\program files\a-squared free\a2service.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\livecall.exe
D:\mIRC1\mirc.exe
C:\Program Files\Grisoft\AVG Free\avgcc.exe
C:\Program Files\PAFPoker\PAFPoker.exe
C:\WINDOWS\Explorer.EXE
C:\HJT\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\musiikki\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: PartyCasino.com - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunCasino.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyCasino.com - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunCasino.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winzwr32 - winzwr32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
Scan saved at 15:55:46, on 23.6.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
c:\program files\a-squared free\a2service.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\livecall.exe
D:\mIRC1\mirc.exe
C:\Program Files\Grisoft\AVG Free\avgcc.exe
C:\Program Files\PAFPoker\PAFPoker.exe
C:\WINDOWS\Explorer.EXE
C:\HJT\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\musiikki\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: PartyCasino.com - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunCasino.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyCasino.com - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunCasino.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winzwr32 - winzwr32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
Vastaukset 3
Vanhimmat
scannaa hjt:llä merkkaa paina Fix checked
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
O20 - Winlogon Notify: winzwr32 - winzwr32.dll (file missing)
===============
Escan
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg
scannaa
jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl A.
Kopioi rivit komennolla Ctrl C.
Liitä rivit komennolla Ctrl V.
Laita virus log tänne.
=============
Lataa tuolta http://www.ccleaner.com/download/builds.aspx
CCleaner v1.34.407 - Basic, ÄLÄ aseenna Yahoo toolbaria!
laita asetukset näin:
Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.
aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi
File C:\Program Files\MSN Messenger\msimg32.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\Program Files\a-squared Free\Quarantine\362B4D06183C5742C8F19B124CE1094BB6001444.a2q tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\Program Files\a-squared Free\Quarantine\AB74D43B396669129F7760B0AB6CB40EEA92028A.a2q tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\Program Files\a-squared Free\Quarantine\5D230C3D85C1B72F634BA7F7F3C4AFA3413CDCCB.a2q tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\Program Files\a-squared Free\Quarantine\F3A540C943ADAA786C4B9092CF5B8D10EB17FCD3.a2q tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\Program Files\a-squared Free\Quarantine\287959B6793DFF6B4B413C2CE8E05E4189C5F729.a2q tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065975.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.ax. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065976.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.aq. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065977.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.an. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065978.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.af. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065979.EXE tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065980.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.as. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065981.scr tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065982.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.at. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065984.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.bc. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065985.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065986.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065987.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065988.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065990.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.bc. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065992.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.at. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065994.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065995.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.ad. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065998.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.as. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0065999.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0066000.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.i. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0066001.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.i. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0066002.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0066003.SCR tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0066004.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0066005.EXE tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0066006.exe tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0066030.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0066033.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.l. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0066034.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0066035.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.ba. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0066036.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0066037.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066503.exe tagged as not-a-virus:AdTool.Win32.MyWebSearch.av. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066548.exe tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066549.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.as. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066550.scr tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066551.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.at. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066553.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.bc. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066554.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066555.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.af. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066556.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066557.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066558.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066559.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.an. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066560.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.aq. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066561.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066563.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.bc. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066565.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.at. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066567.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066568.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.ad. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066570.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.ba. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066571.exe tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066573.exe tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066574.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066575.EXE tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066576.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066577.SCR tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066578.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.i. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066579.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.as. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066580.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.ax. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066591.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066592.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.i. No Action Taken.
File C:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP408\A0066593.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File D:\System Volume Information\_restore{9D934E69-BB56-4D50-A59E-8CF235319415}\RP404\A0066010.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.617. No Action Taken.
File D:\mIRC1\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.617. No Action Taken.
File F:\Program Files\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.621. No Action Taken.
File F:\Users\Koivikko\Downloads\mirc621.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.621. No Action Taken.
Elikkäs pitäiskö jotain tehdä?
a-squared karanteenistä kaikki
================
1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK