Joo minäkin tyhmyyksissäni menin sitten kaverilta ottamaan sen meseviruksen, mutta nyt eräiden täältä keskustelu alueelta löytämieni ohjeiden mukaan, ei mese oo enää lähettäny mitään paskaviestejä kellekkään.
Ajattelin nyt kumminkin vielä, että jos joku kattois tän lokin ja kertoo, jos on viel jotain hämminkiä...ja muistakin hämminkeistä voi kertoo tietenkin...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:15:12, on 30.7.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
G:\Kimmon\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\SOUNDMAN.EXE
G:\Kimmon\Quicktime itunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\System32\svchost.exe
G:\Kimmon\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
G:\Kimmon\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\AntiVir PersonalEdition Classic\avcenter.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.medion.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "G:\Kimmon\Quicktime itunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [keyboard] C:\\keyboard25.exe
O4 - HKLM\..\Run: [newname] C:\\newname25.exe
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "G:\Kimmon\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "g:\janin\pelit\steam\steam.exe" -silent
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digimax Viewer 2.1.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.medion.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://www.virustorjunta.net/modules/Online_Scanner/fscax.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - G:\Kimmon\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O24 - Desktop Component 0: (no name) - http://members.tiscali.fi/ewk/eiiskuairakiin/valokuvat/viimeinenranta.jpg
--
End of file - 10591 bytes
Ajattelin nyt kumminkin vielä, että jos joku kattois tän lokin ja kertoo, jos on viel jotain hämminkiä...ja muistakin hämminkeistä voi kertoo tietenkin...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:15:12, on 30.7.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
G:\Kimmon\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\SOUNDMAN.EXE
G:\Kimmon\Quicktime itunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\System32\svchost.exe
G:\Kimmon\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
G:\Kimmon\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\AntiVir PersonalEdition Classic\avcenter.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.medion.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "G:\Kimmon\Quicktime itunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [keyboard] C:\\keyboard25.exe
O4 - HKLM\..\Run: [newname] C:\\newname25.exe
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "G:\Kimmon\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "g:\janin\pelit\steam\steam.exe" -silent
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digimax Viewer 2.1.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.medion.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://www.virustorjunta.net/modules/Online_Scanner/fscax.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - G:\Kimmon\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O24 - Desktop Component 0: (no name) - http://members.tiscali.fi/ewk/eiiskuairakiin/valokuvat/viimeinenranta.jpg
--
End of file - 10591 bytes
Vastaukset 12
Vanhimmat
Lataa SDFix by AndyManchesta
http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:
• Käynnistä tietokone
• Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
• Seuraavaksi pitäisi ilmestyä valikko
• Valitse valikosta vikasietotila.
• Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
• Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
• Paina Y käynnistääksesi skriptin.
• Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
• Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
• Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
• Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
• Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
• Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.
=================
Escan
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg
scannaa
jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl A.
Kopioi rivit komennolla Ctrl C.
Liitä rivit komennolla Ctrl V.
Laita virus log tänne.
En eilen kikkaillu koneen kaa, ni kesti vähäsen. Mutta tein noi sun käskemät jutut ja tässä loppu tulos.
SDFix: Version 1.94
Run by Norsu Naattori on ke 01.08.2007 at 15:50
Microsoft Windows XP [versio 5.1.2600]
Running From: C:\DOCUME~1\NORSUN~1\TYPYT~1\SDFix
Safe Mode:
Checking Services:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing Security Center Service
Restoring Missing SharedAccess Service
Rebooting...
Normal Mode:
Checking Files:
No Trojan Files Found
Removing Temp Files...
ADS Check:
C:\WINDOWS
No streams found.
C:\WINDOWS\system32
No streams found.
C:\WINDOWS\system32\svchost.exe
No streams found.
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.
Final Check:
Remaining Services:
------------------
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%WinDir%\\system32\\fxsclnt.exe"="%WinDir%\\system32\\fxsclnt.exe:*:enabled:Microsoft Fax Console"
"%ProgramFiles%\\CA\\eTrust Antivirus\\InocIT.exe"="%ProgramFiles%\\CA\\eTrust Antivirus\\InocIT.exe:*:enabled:eTrust Antivirus - Local Scanner"
"%ProgramFiles%\\CA\\eTrust Antivirus\\Realmon.exe"="%ProgramFiles%\\CA\\eTrust Antivirus\\Realmon.exe:*:enabled:eTrust Antivirus - Realtime monitor"
"%ProgramFiles%\\CA\\eTrust Antivirus\\InoRpc.exe"="%ProgramFiles%\\CA\\eTrust Antivirus\\InoRpc.exe:*:enabled:eTrust Antivirus - RPC Server"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Documents and Settings\\Norsu Naattori\\Omat tiedostot\\Kimmon\\l”ll”\\iTunes.exe"="C:\\Documents and Settings\\Norsu Naattori\\Omat tiedostot\\Kimmon\\l”ll”\\iTunes.exe:*:Enabled:iTunes"
"G:\\Janin\\Ohjelmat\\oDC\\oDC.exe"="G:\\Janin\\Ohjelmat\\oDC\\oDC.exe:*:Enabled:oDC"
"G:\\Janin\\Pelit\\Steam\\Steam.exe"="G:\\Janin\\Pelit\\Steam\\Steam.exe:*:Enabled:Steam"
"G:\\Janin\\Pelit\\Steam\\SteamApps\\[email protected]\\counter-strike\\hl.exe"="G:\\Janin\\Pelit\\Steam\\SteamApps\\[email protected]\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DC++"
"G:\\Janin\\Pelit\\Steammm\\SteamApps\\[email protected]\\counter-strike\\hl.exe"="G:\\Janin\\Pelit\\Steammm\\SteamApps\\[email protected]\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"G:\\Kimmon\\Quicktime+itunes\\iTunes.exe"="G:\\Kimmon\\Quicktime+itunes\\iTunes.exe:*:Enabled:iTunes"
"G:\\Janin\\Pelit\\Steammmmm\\SteamApps\\spell91\\counter-strike\\hl.exe"="G:\\Janin\\Pelit\\Steammmmm\\SteamApps\\spell91\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Documents and Settings\\Norsu Naattori\\Local Settings\\Temp\\wz3e2c\\BitComet\\BitComet.exe"="C:\\Documents and Settings\\Norsu Naattori\\Local Settings\\Temp\\wz3e2c\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"G:\\Kimmon\\BitComet\\BitComet.exe"="G:\\Kimmon\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Documents and Settings\\Norsu Naattori\\Ty”p”yt„\\utorrent-1.6.1-beta-build-483.exe"="C:\\Documents and Settings\\Norsu Naattori\\Ty”p”yt„\\utorrent-1.6.1-beta-build-483.exe:*:Enabled:æTorrent"
"C:\\Program Files\\AntiVir PersonalEdition Classic\\avcenter.exe"="C:\\Program Files\\AntiVir PersonalEdition Classic\\avcenter.exe:*:Enabled:Start AntiVir PersonalEdition Classic"
"C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"G:\\Kimmon\\Adobe Version Cue CS2\\bin\\VersionCueCS2.exe"="G:\\Kimmon\\Adobe Version Cue CS2\\bin\\VersionCueCS2.exe:*:Enabled:Adobe Version Cue CS2"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%ProgramFiles%\\Messenger\\msmsgs.exe"="%ProgramFiles%\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"%WinDir%\\system32\\fxsclnt.exe"="%WinDir%\\system32\\fxsclnt.exe:*:enabled:Microsoft Fax Console"
"%ProgramFiles%\\CA\\eTrust Antivirus\\InocIT.exe"="%ProgramFiles%\\CA\\eTrust Antivirus\\InocIT.exe:*:enabled:eTrust Antivirus - Local Scanner"
"%ProgramFiles%\\CA\\eTrust Antivirus\\Realmon.exe"="%ProgramFiles%\\CA\\eTrust Antivirus\\Realmon.exe:*:enabled:eTrust Antivirus - Realtime monitor"
"%ProgramFiles%\\CA\\eTrust Antivirus\\InoRpc.exe"="%ProgramFiles%\\CA\\eTrust Antivirus\\InoRpc.exe:*:enabled:eTrust Antivirus - RPC Server"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
Remaining Files:
---------------
Files with Hidden Attributes:
C:\Documents and Settings\Norsu Naattori\Local Settings\Application Data\Microsoft\Messenger\[email protected]\Sharing Folders\[email protected]\Thumbs.db
C:\WINDOWS\system32\26B1184847.sys
C:\WINDOWS\system32\KGyGaAvL.sys
C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp
Finished
---------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:02:53, on 1.8.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
G:\Kimmon\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\System32\svchost.exe
G:\Kimmon\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
G:\Kimmon\Quicktime+itunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
G:\Kimmon\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Mozilla Firefox\firefox.exe
c:\kaspersky\mwavscan.com
c:\kaspersky\kavss.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.medion.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "G:\Kimmon\Quicktime+itunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [newname] C:\\newname25.exe
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "G:\Kimmon\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digimax Viewer 2.1.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.medion.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://www.virustorjunta.net/modules/Online_Scanner/fscax.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - G:\Kimmon\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O24 - Desktop Component 0: (no name) - http://members.tiscali.fi/ewk/eiiskuairakiin/valokuvat/viimeinenranta.jpg
--
End of file - 10530 bytes
-----------------------
Ja tuo eScan ilmoitti tämän...
File C:\Documents and Settings\Norsu Naattori\Omat tiedostot\BSplayer_WhenUSave_InstallerInstRe.exe tagged as not-a-virus:AdTool.Win32.WhenU.a. No Action Taken.
Lisää poista sovelutuksesta
SweetIM
scannaa hjt:llä merkkaa paina Fix checked
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [newname] C:\\newname25.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
================
1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Lisää poista sovelutuksesta
SweetIM
scannaa hjt:llä merkkaa paina Fix checked
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [newname] C:\\newname25.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
================
1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
=============
Poista vikasiedossa kansio
C:\Program Files\===> Macrogaming
Niin en löytänyt näitä kahta tuosta hjt-lokista
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
Mutta tässä tuo combofix loki:
ComboFix 07-07-30.2 - "Norsu Naattori" 2007-08-02 16:12:34.1 [GMT 3:00] - NTFS
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.Tosi
* Created a new restore point
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\drsmartload2.dat
C:\WINDOWS\keyboard1.dat
C:\WINDOWS\newname.dat
g:\RECYCLER\desktop.ini
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\nm
((((((((((((((((((((((((( Files Created from 2007-07-02 to 2007-08-02 )))))))))))))))))))))))))))))))
2007-08-02 16:11 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-01 16:23 d-------- C:\Downloads
2007-08-01 16:23 d-------- C:\Bases
2007-08-01 16:15 d-------- C:\Kaspersky
2007-08-01 15:49 d-------- C:\WINDOWS\ERUNT
2007-08-01 15:45 1,310,720 --ah----- C:\DOCUME~1\JRJEST~1\NTUSER.DAT
2007-08-01 15:45 dr------- C:\DOCUME~1\JRJEST~1\Suosikit
2007-08-01 15:45 dr------- C:\DOCUME~1\JRJEST~1\Omat tiedostot
2007-08-01 15:45 dr------- C:\DOCUME~1\JRJEST~1\K„ynnist„-valikko
2007-08-01 15:45 d--h----- C:\DOCUME~1\JRJEST~1\Verkkoymp„rist”
2007-08-01 15:45 d--h----- C:\DOCUME~1\JRJEST~1\Tulostinymp„rist”
2007-08-01 15:45 d--h----- C:\DOCUME~1\JRJEST~1\Mallit
2007-08-01 15:45 d---s---- C:\DOCUME~1\JRJEST~1\UserData
2007-08-01 15:45 d-------- C:\DOCUME~1\JRJEST~1\Ty”p”yt„
2007-08-01 15:45 d-------- C:\DOCUME~1\JRJEST~1\APPLIC~1\CyberLink
2007-08-01 15:45 d-------- C:\DOCUME~1\JRJEST~1\APPLIC~1\Ahead
2007-08-01 15:45 d-------- C:\DOCUME~1\JRJEST~1\APPLIC~1\AdobeUM
2007-07-31 22:54 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
2007-07-31 22:54 60,496 --a------ C:\WINDOWS\system32\drivers\Teefer.sys
2007-07-31 22:54 21,075 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys
2007-07-31 22:54 14,568 --a------ C:\WINDOWS\system32\drivers\wg6n.sys
2007-07-31 22:54 14,568 --a------ C:\WINDOWS\system32\drivers\wg5n.sys
2007-07-31 22:54 14,568 --a------ C:\WINDOWS\system32\drivers\wg4n.sys
2007-07-31 22:54 14,568 --a------ C:\WINDOWS\system32\drivers\wg3n.sys
2007-07-31 22:53 d-------- C:\Program Files\Sygate
2007-07-31 22:53 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-31 16:57 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\AntiVir PersonalEdition Classic
2007-07-30 17:13 d-------- C:\Program Files\Trend Micro
2007-07-29 22:00 396,288 --a------ C:\HijackThis.exe
2007-07-29 20:31 d-------- C:\WINDOWS\SxsCaPendDel
2007-07-26 17:41 217,127 --a------ C:\WINDOWS\system32\drv43260.dll
2007-07-26 17:41 208,935 --a------ C:\WINDOWS\system32\drv33260.dll
2007-07-26 17:41 176,165 --a------ C:\WINDOWS\system32\drv23260.dll
2007-07-26 17:41 d-------- C:\Program Files\vso
2007-07-26 17:14 d-------- C:\Program Files\URUSoft
2007-07-26 16:27 87,608 --a------ C:\DOCUME~1\NORSUN~1\APPLIC~1\inst.exe
2007-07-26 16:27 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-07-26 16:27 47,360 --a------ C:\DOCUME~1\NORSUN~1\APPLIC~1\pcouffin.sys
2007-07-26 16:27 d-------- C:\DOCUME~1\NORSUN~1\APPLIC~1\Vso
2007-07-22 12:18 5,120 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-07-22 12:18 d-------- C:\Program Files\ffdshow
2007-07-22 12:10 d-------- C:\Program Files\Gabest
2007-07-12 18:10 8,192 --a------ C:\WINDOWS\system32\wshirda.dll
2007-07-12 18:10 26,624 --a------ C:\WINDOWS\system32\irmon.dll
2007-07-12 18:10 153,088 --a------ C:\WINDOWS\system32\irftp.exe
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-26 17:41 --------- d-------- C:\Program Files\vso
2007-07-26 17:12 --------- d-------- C:\DOCUME~1\NORSUN~1\APPLIC~1\uTorrent
2007-07-25 08:47 --------- d-------- C:\Program Files\eMule
2007-07-23 11:03 67264 --a------ C:\WINDOWS\system32\perfc00B.dat
2007-07-23 11:03 359842 --a------ C:\WINDOWS\system32\perfh00B.dat
2007-07-08 12:41 --------- d-------- C:\DOCUME~1\NORSUN~1\APPLIC~1\MSN6
2007-07-05 18:15 --------- d-------- C:\Program Files\Winamp
2007-07-01 21:18 --------- d-------- C:\Program Files\Nokia
2007-07-01 21:18 --------- d-------- C:\Program Files\Common Files\PCSuite
2007-07-01 21:18 --------- d-------- C:\Program Files\Common Files\Nokia
2007-06-21 13:21 --------- d-------- C:\Program Files\Windows Live Safety Center
2007-05-16 18:14 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-03-15 20:10:09 56 --sh--r C:\WINDOWS\system32\26B1184847.sys
2007-03-15 20:10:09 13,146 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-04-22 19:04 C:\WINDOWS\SOUNDMAN.EXE]
"iTunesHelper"="G:\Kimmon\Quicktime+itunes\iTunesHelper.exe" [2005-10-18 12:58]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-22 17:17]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 18:05]
"Adobe Version Cue CS2"="G:\Kimmon\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" [2005-04-04 19:58]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-11-23 15:04]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2005-10-19 18:19]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"DataLayer"="C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-06-07 11:31]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-06-29 15:29]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 01:22]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-14 16:12 C:\WINDOWS\system32\bthprops.cpl]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-04-02 10:35]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-10-24 16:53]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-25 17:47]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-06-24 14:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"=0 (0x0)
"NoFind"=0 (0x0)
"NoRun"=0 (0x0)
"NoDesktop"=0 (0x0)
"NoClose"=0 (0x0)
"StartMenuLogOff"=0 (0x0)
"HideClock"=0 (0x0)
R0 Teefer;Teefer for NT;C:\WINDOWS\system32\Drivers\Teefer.sys
R1 avgio;avgio;\??\C:\Program Files\AntiVir PersonalEdition Classic\avgio.sys
R1 avipbb;avipbb;C:\WINDOWS\system32\DRIVERS\avipbb.sys
R1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys
R1 ssmdrv;ssmdrv;C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
R1 wpsdrvnt;wpsdrvnt;\??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys
R2 ANIO;ANIO Service;\??\C:\WINDOWS\system32\ANIO.SYS
R2 BthServ;Bluetooth Support Service;C:\WINDOWS\system32\svchost.exe -k bthsvcs
R2 LogWatch;Event Log Watch;C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
R2 wg3n;SyGate for NT, wg3n;C:\WINDOWS\system32\Drivers\wg3n.sys
R2 wg4n;SyGate for NT, wg4n;C:\WINDOWS\system32\Drivers\wg4n.sys
R2 wg5n;SyGate for NT, wg5n;C:\WINDOWS\system32\Drivers\wg5n.sys
R2 wg6n;SyGate for NT, wg6n;C:\WINDOWS\system32\Drivers\wg6n.sys
R3 ALCXSENS;Service for WDM 3D Audio Driver;C:\WINDOWS\system32\drivers\ALCXSENS.SYS
R3 avgntflt;avgntflt;\??\C:\Program Files\AntiVir PersonalEdition Classic\avgntflt.sys
R3 pcouffin;VSO Software pcouffin;C:\WINDOWS\system32\Drivers\pcouffin.sys
S3 779b08be-39c1-4c00-8197-19d24339da44;779b08be-39c1-4c00-8197-19d24339da44;\??\F:\Player\cds300.dll
S3 BthEnum;Bluetooth-pyynt”lohkojen ohjain;C:\WINDOWS\system32\DRIVERS\BthEnum.sys
S3 BTHMODEM;Bluetooth-modeemiyhteyden ohjain;C:\WINDOWS\system32\DRIVERS\bthmodem.sys
S3 BthPan;Bluetooth-laite (henkil”kohtainen l„hiverkko);C:\WINDOWS\system32\DRIVERS\bthpan.sys
S3 BTHPORT;Bluetooth-porttiohjain;C:\WINDOWS\system32\Drivers\BTHport.sys
S3 BTHUSB;Bluetooth-radion USB-ohjain;C:\WINDOWS\system32\Drivers\BTHUSB.sys
S3 CA_LIC_CLNT;CA License Client;C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
S3 CA_LIC_SRVR;CA License Server;C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
S3 Nokia USB Generic;Nokia USB Generic;C:\WINDOWS\system32\drivers\nmwcdc.sys
S3 Nokia USB Modem;Nokia USB Modem;C:\WINDOWS\system32\drivers\nmwcdcm.sys
S3 Nokia USB Phone Parent;Nokia USB Phone Parent;C:\WINDOWS\system32\drivers\nmwcd.sys
S3 RFCOMM;Bluetooth-laite (RFCOMM-protokollan TDI);C:\WINDOWS\system32\DRIVERS\rfcomm.sys
S3 RT73;D-Link USB Wireless LAN Card Driver;C:\WINDOWS\system32\DRIVERS\Dr71WU.sys
S3 tunmp;Microsoft Tun Miniport -sovittimen ohjain;C:\WINDOWS\system32\DRIVERS\tunmp.sys
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cbaa3b7c-1834-11d9-bd52-0040ca7c7bc4}]
AutoRun\command- @%systemroot%\explorer.exe /e,.
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-02 16:18:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x00ffc\xd3w\2]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-08-02 16:20:24 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-02 16:19
--- E O F ---
Ja tässä hjt-loki, vaik et ees vissiin pyytäny sitä:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:32:05, on 2.8.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
G:\Kimmon\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\System32\svchost.exe
G:\Kimmon\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\WINDOWS\SOUNDMAN.EXE
G:\Kimmon\Quicktime+itunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
G:\Kimmon\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.medion.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [iTunesHelper] "G:\Kimmon\Quicktime+itunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "G:\Kimmon\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digimax Viewer 2.1.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.medion.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://www.virustorjunta.net/modules/Online_Scanner/fscax.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - G:\Kimmon\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O24 - Desktop Component 0: (no name) - http://members.tiscali.fi/ewk/eiiskuairakiin/valokuvat/viimeinenranta.jpg
--
End of file - 9718 bytes
scannaa hjt:llä merkkaa paina Fix checked
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
==============
Ohje AVG:n Anti-Spyware 7.5:n käyttöön
Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis työkalun toimintaa.
Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta
Lataa AVG:n Anti-Spyware 7.5 http://www.ewido.net/en/download/
ja tallenna ohjelma työpöydällesi.
• Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
• Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
• Käynnistä AVG:n Anti-Spyware.
• Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
• Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
• Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
• Sitten "Reports" valikon alta:
o Laita täppi kohtaan "Automatically generate report after every scan"
o Ota täppi pois kohdasta"Only if threats were found"
• Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
• "Resident shield is", muuta tila active:sta inactive:ksi
• Sulje ohjelma, ÄLÄ skannaa vielä.
Käynnistä koneesi vikasietotilaan,
sammuta ja käynnistä
käynnistyksen yhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina enter ja enter
HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
• Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
• Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
• Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
• Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
• Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
http://img509.imageshack.us/img509/4851/scanavgjk2.jpg
• Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
• Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
• Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.
Javan päivitys ja välimuistin tyhjennys:
1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
Niissä pitäisi olla seuraava kuva vieressä:
http://users.telenet.be/bluepatchy/miekiemoes/images/javaicon.jpg
3. Valitse kaikki entiset Java versiosi ja valitse Poista.
4. Asenna uusin Java päivitys seuraavasta linkistä..
5. Käynnistä kone uudelleen asennuksen jälkeen:
http://java.sun.com/javase/downloads/index.jsp
Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u2
Paina Download
Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.
6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.
(Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).
8. Varmista että kaikki kaksi valintaa ovat rastitettuja:
*Applications and Applets
*Trace and Log Files
Ja paina OK -nappia
9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
10. Klikkaa OK jättääksesi Java asetusikkunasi.
Tässä tämä AVG-raportti:
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
Created at: 16:41:54 3.8.2007
Scan result:
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014453.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014558.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014603.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014885.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014886.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014892.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014893.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0015064.vxd -> Adware.BargainBuddy : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0015284.srg -> Adware.BargainBuddy : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0015482.vxd/C:/WINDOWS/System32/bbchk.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0015482.vxd/C:/WINDOWS/System32/exdl.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0015482.vxd/C:/WINDOWS/System32/exul.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0015482.vxd/C:/WINDOWS/System32/javexulm.vxd -> Adware.BargainBuddy : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0015482.vxd/C:/WINDOWS/System32/mqexdlm.srg -> Adware.BargainBuddy : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0019181.INF -> Adware.MediaTickets : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0019182.ocx -> Adware.MediaTickets : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0019229.exe -> Adware.WinAD : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP9\A0020858.exe -> Adware.WinShow : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP9\A0003309.0XE -> Backdoor.Thunk.d : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0015482.vxd/C:/WINDOWS/System32/msexreg.exe -> Dialer.Small : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014484.exe:pojkg -> Downloader.Agent.an : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014460.exe:jkzpp -> Downloader.Agent.bq : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014463.ini:rwiow -> Downloader.Agent.bq : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014464.0xe -> Downloader.Agent.bq : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014484.exe:uyzpt -> Downloader.Agent.bq : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014489.dll:unsjz -> Downloader.Agent.bq : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014490.ini:svmvn -> Downloader.Agent.bq : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014498.pif:okagn -> Downloader.Agent.bq : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014992.0xe -> Downloader.Agent.bq : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0015022.0xe -> Downloader.Agent.bq : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014473.INI:wwxoq -> Downloader.Agent.cd : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0014493.exe:fhwuw -> Downloader.Agent.cd : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0019763.0cx -> Downloader.Agent.ex : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0019366.0ll -> Downloader.IstBar.dh : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{D05D4764-CE24-40B3-9E54-C489EA171E99}\RP5\A0019365.0xe -> Downloader.IstBar.fr : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP11\A0010424.0xe -> Downloader.Monurl : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP11\A0011518.0xe -> Downloader.Monurl : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP8\A0003275.0xe -> Downloader.Monurl : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP9\A0003312.0xe -> Downloader.Monurl : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP11\A0010440.0xe -> Hijacker.StartPage.pu : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP11\A0010515.0xe -> Hijacker.StartPage.pu : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP11\A0011517.0xe -> Hijacker.StartPage.pu : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP9\A0003311.0xe -> Logger.Small.ak : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP11\A0010436.0xe -> Proxy.Agent.ai : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP11\A0010437.0xe -> Proxy.Agent.ai : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP11\A0010438.0xe -> Proxy.Agent.ai : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP11\A0010439.0xe -> Proxy.Agent.ai : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP9\A0003310.0xe -> Proxy.Agent.ai : Cleaned with backup (quarantined).
:mozilla.204:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.205:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.206:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.207:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.208:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.209:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.210:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.211:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.212:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.213:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.214:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.215:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.216:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.217:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.218:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.219:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.220:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.221:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.222:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.223:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.505:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.573:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.490:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.492:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.493:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.494:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu [email protected][1].txt -> TrackingCookie.Admarketplace : Cleaned.
:mozilla.173:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.174:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.175:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.176:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.177:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.178:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.179:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.350:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.351:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.42:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.43:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.44:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.45:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.47:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.241:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu_naattori@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.763:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu naattori@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.264:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.265:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.266:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.267:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.268:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.269:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu [email protected][1].txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.656:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
:mozilla.657:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
:mozilla.658:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu [email protected][2].txt -> TrackingCookie.Clickhype : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu [email protected][1].txt -> TrackingCookie.Cnn : Cleaned.
:mozilla.315:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu naattori@connextra[2].txt -> TrackingCookie.Connextra : Cleaned.
:mozilla.33:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.372:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.373:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.497:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.498:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.499:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.908:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Goclick : Cleaned.
:mozilla.909:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Goclick : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu [email protected][2].txt -> TrackingCookie.Goclick : Cleaned.
:mozilla.293:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.354:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.378:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.836:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.278:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.279:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.280:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.325:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.353:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.473:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.813:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.824:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.921:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.40:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.41:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu naattori@info[2].txt -> TrackingCookie.Info : Cleaned.
:mozilla.917:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Information : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu naattori@intelli-direct[1].txt -> TrackingCookie.Intelli-direct : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu [email protected][1].txt -> TrackingCookie.Masterstats : Cleaned.
:mozilla.340:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu [email protected][2].txt -> TrackingCookie.Msn : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu [email protected][2].txt -> TrackingCookie.Msn : Cleaned.
:mozilla.27:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu [email protected][2].txt -> TrackingCookie.Netflame : Cleaned.
:mozilla.263:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu [email protected][1].txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.932:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.933:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.934:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.935:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.822:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.823:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu [email protected][1].txt -> TrackingCookie.Real : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu [email protected][1].txt -> TrackingCookie.Realcastmedia : Cleaned.
:mozilla.914:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.915:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.916:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.76:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.77:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.78:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.79:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.80:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.81:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.82:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.83:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.84:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.727:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.728:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.294:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.295:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.296:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.297:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.298:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu [email protected][2].txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.808:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Spylog : Cleaned.
:mozilla.443:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.444:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.445:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.446:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.447:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.448:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.449:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.450:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.451:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.452:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.453:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.454:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.455:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.456:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.457:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.458:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.459:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.460:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.461:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.462:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.463:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.464:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.465:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.466:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.467:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.468:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.469:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.470:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.471:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.28:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu_naattori@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : Cleaned.
:mozilla.381:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.382:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.383:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.384:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu [email protected][2].txt -> TrackingCookie.Texttbnru : Cleaned.
:mozilla.34:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.35:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.36:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.37:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.38:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.408:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.695:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\[email protected][2].txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.166:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.807:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
:mozilla.810:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
C:\Documents and Settings\Norsu Naattori\Cookies\norsu naattori@yadro[1].txt -> TrackingCookie.Yadro : Cleaned.
:mozilla.475:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.476:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.477:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.478:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.482:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.341:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.342:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.343:C:\Documents and Settings\Norsu Naattori\Application Data\Mozilla\Firefox\Profiles\fw1w0jbr.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP11\A0010425.0xe -> Trojan.Favadd.c : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP11\A0011522.0xe -> Trojan.Favadd.c : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP8\A0003276.0xe -> Trojan.Favadd.c : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP11\A0010426.exe -> Trojan.Killav.db : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP11\A0010504.exe -> Trojan.Killav.db : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP11\A0012538.exe -> Trojan.Killav.db : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{CF82B17C-9AE1-4E1F-AC29-1D8E6BF3CF8D}\RP8\A0003278.exe -> Trojan.Killav.db : Cleaned with backup (quarantined).
::Report end
--------------
Ja laitetaan taas se HJT-loki:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:34:57, on 3.8.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\SOUNDMAN.EXE
G:\Kimmon\Quicktime itunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
G:\Kimmon\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
G:\AVG Anti-Spyware 7.5\avgas.exe
G:\Kimmon\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
G:\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
G:\Kimmon\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.medion.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [iTunesHelper] "G:\Kimmon\Quicktime itunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "G:\Kimmon\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "G:\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digimax Viewer 2.1.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.medion.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://www.virustorjunta.net/modules/Online_Scanner/fscax.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - G:\Kimmon\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - G:\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O24 - Desktop Component 0: (no name) - http://members.tiscali.fi/ewk/eiiskuairakiin/valokuvat/viimeinenranta.jpg
--
End of file - 9618 bytes
Ja sitten takas dokaan!!!!!!!!!!! ;)
1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK
Ja sitten vielä jotain????
uusia pöpöjä ;)
Toivottavasti ei tuu oltuu nii hölmö, ku viimetteks. Kiitoksia vain!