HJT-loki

Nyt suoritin nuo NoLop.exe, SDFix ja HJT ohjelmat.
Tässä on sitten lokit alla:

NoLop.txt:


NoLop! Log by Skate_Punk_21

Please Note: any existing old logs will have now been renamed to NoLop!OLD.log

Fix running from: C:\Documents and Settings\Omistaja\Työpöytä
[24.10.2007]
[16:57:07]

---Infection Files Found/Removed---
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\vgjvapul.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\1d7f89.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\1d7f99.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\2e59ca.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\2e59eb.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\2f2041.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\543911a3.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\55c55060.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\56246136.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\562a4aa7.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\565c997e.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5691ae46.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5694ec28.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5702e6cc.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\570971e6.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57192095.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\572b5e70.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\572bcf08.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5734785c.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5736d8a5.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5742569e.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57513568.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57683b24.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\577ea72d.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57afba2d.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57c65437.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57d62dec.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57df002b.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57efa219.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57f3798c.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57f52dd6.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5c72c9.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5c7819.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\92ffbc66.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\ce929.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\01 chin.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\64 Free.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\About Rule.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Aim About.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\atom sixth.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\bags skip.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\BarbJunk.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Base curb.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Baseshim.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Bashtool.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Beep mapi.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\bibdeaf.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\bluebird.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Boldcast.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\BoreData.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\burnwindow.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Camp Second.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Cash one.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\CastBlue.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Chin The.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\City Deaf.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Close Axis.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\deadbolt.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\deleteeggs.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\DoesSlow.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\DUPE CHIN.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\FACEONCE.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\FILM TEAM.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\fork grid.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Four cash.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\FunkReadme.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Global Bits.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\glue hold.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\GrimSign.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Idol body.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Iso Poke.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Kind Bold.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\log iso.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\LOGBIAS.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Manager cake.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Manager locks.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Mathmeet.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Meet Mags.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\meowmfcd.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Mix Dead.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Multi Grim.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\multi up.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\newace.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\OKAY LOG.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Okaybike.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\One bib.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\One once.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\online once.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Open bin.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\OPTION WMA.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Plan Warn.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\PlanGpl.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Play iso.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Poll tray.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\proc help.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\remote bows.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\RULE TEAM.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\SaveWipe.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\SETTINGS VGA.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Settingsbalm.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Signbend.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\site list.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Skip Bias.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Spam Blah.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\SupportOption.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\The chic.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\TitleFunk.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\tonsbyte.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Two Junk.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Up Amok.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\user tons.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\UserThird.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Vc Close.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\viewjugs.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\WINDOWJUGS.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\adwxbsbl.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\aogmdlye.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\aovdgmju.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\bagypdfn.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\bclxrfxa.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\btbxmoro.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\chuylkfh.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\cjielgup.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\cxmetcdq.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\dfezopxs.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\dparsyzj.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\dzgugeom.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\eeoovxoy.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\eezuwbbs.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ejcbevvt.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ejkimaub.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\elhgivbt.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\fgsnuaaz.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\frwopzjg.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\fsoeqlof.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ftobiluu.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ftwdekag.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\gfwhyqyu.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\gkjvngzk.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\gxnmllfr.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\hdkdnjil.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\hzaaizfz.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ibvhmknf.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\iildptnj.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\imetyspo.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\imieqrny.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\lfunmgzf.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ljezqwvv.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ljtvrtpx.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\lvefyyuv.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\mbojrrzl.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\mbovyirx.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\nggjoqxq.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\nljsxolr.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\npfevdjw.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\nplzudlt.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\odgunuob.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\oebdsbdi.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\oommmgkm.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\otwbmvde.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\pkkzmmgq.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\pqfehwua.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\pyrdxgza.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\pzmgkkas.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\qcpjftjz.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\qkyweozp.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\qqjupmlj.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\rbedgura.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\rfwzhqmt.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\rlinkdmt.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\rtjasgce.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\tkvlkkri.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\twdzygzv.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\tyhstxhk.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ugxnpsyg.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ultyzeen.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\uvwjbwal.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\uwzosbdt.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\uznozyot.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\vnbqgiaa.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\vocpsyga.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\vrbbucou.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\wfhcwbjv.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\wsryvpwm.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\wymosroz.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\xaiwrfqw.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\xfsebozb.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ygjhmddy.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\yiaukvqp.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\yjuqplwc.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ynvbhste.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\yxtcxlib.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\zcdhclif.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\zgsflhhl.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\zqmkynbt.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\zzjzipys.exe
C:\WINDOWS\tasks\AD40F417918B6783.job

Beginning Removal...
Rebooting...
Removing Lop's Leftover Files/Folders...
Editing Registry...
**Fix Complete!**

---Listing AppData sub directories---

C:\Documents and Settings\All Users\Application Data\Adobe
C:\Documents and Settings\All Users\Application Data\Ahead
C:\Documents and Settings\All Users\Application Data\Google Updater
C:\Documents and Settings\All Users\Application Data\Installshield
C:\Documents and Settings\All Users\Application Data\Intra Bin Chic Dumb
C:\Documents and Settings\All Users\Application Data\Lite Bows Close Peak
C:\Documents and Settings\All Users\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Msn6
C:\Documents and Settings\All Users\Application Data\Quicktime
C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Documents and Settings\All Users\Application Data\Whitecap (holiday Edition)
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
C:\Documents and Settings\Default User\Application Data\Identities
C:\Documents and Settings\Default User\Application Data\Microsoft
C:\Documents and Settings\Default User\Application Data\Real
C:\Documents and Settings\Default User\Application Data\Sun
C:\Documents and Settings\Default User\Application Data\Symantec
C:\Documents and Settings\Localservice\Application Data\Microsoft
C:\Documents and Settings\Networkservice\Application Data\Microsoft
C:\Documents and Settings\Networkservice\Application Data\Symantec
C:\Documents and Settings\Omistaja\Application Data\Symantec -- EMPTY Directory
C:\Documents and Settings\Omistaja\Application Data\.bittorrent
C:\Documents and Settings\Omistaja\Application Data\Adobe
C:\Documents and Settings\Omistaja\Application Data\Adobeum -- EMPTY Directory
C:\Documents and Settings\Omistaja\Application Data\Ahead
C:\Documents and Settings\Omistaja\Application Data\Cyberlink
C:\Documents and Settings\Omistaja\Application Data\Digital Design Ltd
C:\Documents and Settings\Omistaja\Application Data\Google
C:\Documents and Settings\Omistaja\Application Data\Grisoft
C:\Documents and Settings\Omistaja\Application Data\Help -- EMPTY Directory
C:\Documents and Settings\Omistaja\Application Data\Identities
C:\Documents and Settings\Omistaja\Application Data\Jasc
C:\Documents and Settings\Omistaja\Application Data\Lavasoft
C:\Documents and Settings\Omistaja\Application Data\Leadertech
C:\Documents and Settings\Omistaja\Application Data\Macromedia
C:\Documents and Settings\Omistaja\Application Data\Microsoft
C:\Documents and Settings\Omistaja\Application Data\Mozilla
C:\Documents and Settings\Omistaja\Application Data\Msn6
C:\Documents and Settings\Omistaja\Application Data\Nasa
C:\Documents and Settings\Omistaja\Application Data\Opera
C:\Documents and Settings\Omistaja\Application Data\Real
C:\Documents and Settings\Omistaja\Application Data\Sonic
C:\Documents and Settings\Omistaja\Application Data\Soundspectrum
C:\Documents and Settings\Omistaja\Application Data\Sun
C:\Documents and Settings\Omistaja\Application Data\Symantec
C:\Documents and Settings\Omistaja\Application Data\Talkback
C:\Documents and Settings\Omistaja\Application Data\Template
C:\Documents and Settings\Omistaja\Application Data\Winamp



SDFixin Report.txt:


SDFix: Version 1.111

Run by Omistaja on ke 24.10.2007 at 19:44

Microsoft Windows XP [versio 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Messenger"
"C:\\Pelit\\elastomania\\belma.exe"="C:\\Pelit\\elastomania\\belma.exe:*:Enabled:belma"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------


Files with Hidden Attributes:

Tue 5 Oct 2004 193 A.SHR --- "C:\BOOT.BAK"
Fri 17 Aug 2007 625,152 A.SH. --- "C:\Program Files\Internet Explorer\iexplore.exe"
Tue 22 Feb 2005 56 ..SHR --- "C:\WINDOWS\system32\10EF1C38FE.sys"
Tue 22 Feb 2005 848 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Tue 19 Oct 2004 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 25 Nov 2004 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv11.bak"
Tue 19 Oct 2004 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv13.bak"
Tue 19 Oct 2004 4,348 ...H. --- "C:\Documents and Settings\All Users\Tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1key.bak"
Sat 18 Aug 2007 782 A..H. --- "C:\Documents and Settings\All Users\Tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1lic.bak"
Wed 12 Jan 2005 400 A.SH. --- "C:\Documents and Settings\All Users\Tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv2key.bak"

Finished!



Ja lopuksi uusi HJT:n loki:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:08:46, on 24.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\keyhook.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Plaza Oy
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {508DB902-7CA1-372F-5663-61B593F2476B} - C:\DOCUME~1\Omistaja\APPLIC~1\THIRDF~1\Browse coal.exe (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [secsrv] C:\WINDOWS\System32\secsrv.exe
O4 - HKLM\..\Run: [ChicDumbDaleBalm] C:\Documents and Settings\All Users\Application Data\intra bin chic dumb\Atom rdr.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AXIS TONS THE MP3] C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons\Plan Hide.exe
O4 - HKCU\..\Run: [Thatfirst] C:\DOCUME~1\Omistaja\APPLIC~1\GREYLI~1\ScrFreeThis.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [Thatfirst] C:\DOCUME~1\Omistaja\APPLIC~1\GREYLI~1\ScrFreeThis.exe (User '?')
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193041416062
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 8642 bytes



Mites nyt sitten.. Miltä loki näyttää?

apua123 kirjoitti:

Nyt suoritin nuo NoLop.exe, SDFix ja HJT ohjelmat.
Tässä on sitten lokit alla:

NoLop.txt:


NoLop! Log by Skate_Punk_21

Please Note: any existing old logs will have now been renamed to NoLop!OLD.log

Fix running from: C:\Documents and Settings\Omistaja\Työpöytä
[24.10.2007]
[16:57:07]

---Infection Files Found/Removed---
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\vgjvapul.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\1d7f89.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\1d7f99.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\2e59ca.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\2e59eb.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\2f2041.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\543911a3.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\55c55060.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\56246136.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\562a4aa7.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\565c997e.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5691ae46.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5694ec28.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5702e6cc.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\570971e6.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57192095.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\572b5e70.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\572bcf08.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5734785c.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5736d8a5.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5742569e.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57513568.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57683b24.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\577ea72d.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57afba2d.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57c65437.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57d62dec.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57df002b.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57efa219.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57f3798c.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\57f52dd6.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5c72c9.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\5c7819.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\92ffbc66.exe
C:\Documents and Settings\Omistaja\Local Settings\Temp\ce929.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\01 chin.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\64 Free.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\About Rule.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Aim About.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\atom sixth.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\bags skip.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\BarbJunk.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Base curb.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Baseshim.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Bashtool.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Beep mapi.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\bibdeaf.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\bluebird.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Boldcast.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\BoreData.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\burnwindow.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Camp Second.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Cash one.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\CastBlue.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Chin The.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\City Deaf.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Close Axis.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\deadbolt.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\deleteeggs.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\DoesSlow.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\DUPE CHIN.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\FACEONCE.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\FILM TEAM.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\fork grid.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Four cash.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\FunkReadme.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Global Bits.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\glue hold.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\GrimSign.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Idol body.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Iso Poke.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Kind Bold.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\log iso.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\LOGBIAS.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Manager cake.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Manager locks.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Mathmeet.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Meet Mags.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\meowmfcd.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Mix Dead.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Multi Grim.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\multi up.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\newace.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\OKAY LOG.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Okaybike.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\One bib.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\One once.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\online once.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Open bin.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\OPTION WMA.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Plan Warn.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\PlanGpl.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Play iso.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Poll tray.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\proc help.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\remote bows.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\RULE TEAM.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\SaveWipe.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\SETTINGS VGA.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Settingsbalm.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Signbend.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\site list.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Skip Bias.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Spam Blah.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\SupportOption.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\The chic.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\TitleFunk.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\tonsbyte.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Two Junk.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Up Amok.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\user tons.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\UserThird.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\Vc Close.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\viewjugs.exe
C:\Documents and Settings\All Users\Application Data\Lite bows close peak\WINDOWJUGS.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\adwxbsbl.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\aogmdlye.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\aovdgmju.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\bagypdfn.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\bclxrfxa.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\btbxmoro.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\chuylkfh.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\cjielgup.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\cxmetcdq.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\dfezopxs.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\dparsyzj.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\dzgugeom.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\eeoovxoy.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\eezuwbbs.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ejcbevvt.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ejkimaub.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\elhgivbt.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\fgsnuaaz.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\frwopzjg.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\fsoeqlof.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ftobiluu.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ftwdekag.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\gfwhyqyu.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\gkjvngzk.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\gxnmllfr.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\hdkdnjil.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\hzaaizfz.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ibvhmknf.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\iildptnj.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\imetyspo.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\imieqrny.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\lfunmgzf.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ljezqwvv.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ljtvrtpx.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\lvefyyuv.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\mbojrrzl.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\mbovyirx.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\nggjoqxq.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\nljsxolr.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\npfevdjw.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\nplzudlt.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\odgunuob.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\oebdsbdi.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\oommmgkm.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\otwbmvde.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\pkkzmmgq.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\pqfehwua.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\pyrdxgza.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\pzmgkkas.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\qcpjftjz.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\qkyweozp.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\qqjupmlj.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\rbedgura.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\rfwzhqmt.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\rlinkdmt.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\rtjasgce.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\tkvlkkri.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\twdzygzv.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\tyhstxhk.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ugxnpsyg.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ultyzeen.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\uvwjbwal.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\uwzosbdt.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\uznozyot.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\vnbqgiaa.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\vocpsyga.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\vrbbucou.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\wfhcwbjv.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\wsryvpwm.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\wymosroz.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\xaiwrfqw.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\xfsebozb.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ygjhmddy.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\yiaukvqp.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\yjuqplwc.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\ynvbhste.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\yxtcxlib.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\zcdhclif.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\zgsflhhl.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\zqmkynbt.exe
C:\Documents and Settings\Omistaja\Application Data\Grey live bend\zzjzipys.exe
C:\WINDOWS\tasks\AD40F417918B6783.job

Beginning Removal...
Rebooting...
Removing Lop's Leftover Files/Folders...
Editing Registry...
**Fix Complete!**

---Listing AppData sub directories---

C:\Documents and Settings\All Users\Application Data\Adobe
C:\Documents and Settings\All Users\Application Data\Ahead
C:\Documents and Settings\All Users\Application Data\Google Updater
C:\Documents and Settings\All Users\Application Data\Installshield
C:\Documents and Settings\All Users\Application Data\Intra Bin Chic Dumb
C:\Documents and Settings\All Users\Application Data\Lite Bows Close Peak
C:\Documents and Settings\All Users\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Msn6
C:\Documents and Settings\All Users\Application Data\Quicktime
C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Documents and Settings\All Users\Application Data\Whitecap (holiday Edition)
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
C:\Documents and Settings\Default User\Application Data\Identities
C:\Documents and Settings\Default User\Application Data\Microsoft
C:\Documents and Settings\Default User\Application Data\Real
C:\Documents and Settings\Default User\Application Data\Sun
C:\Documents and Settings\Default User\Application Data\Symantec
C:\Documents and Settings\Localservice\Application Data\Microsoft
C:\Documents and Settings\Networkservice\Application Data\Microsoft
C:\Documents and Settings\Networkservice\Application Data\Symantec
C:\Documents and Settings\Omistaja\Application Data\Symantec -- EMPTY Directory
C:\Documents and Settings\Omistaja\Application Data\.bittorrent
C:\Documents and Settings\Omistaja\Application Data\Adobe
C:\Documents and Settings\Omistaja\Application Data\Adobeum -- EMPTY Directory
C:\Documents and Settings\Omistaja\Application Data\Ahead
C:\Documents and Settings\Omistaja\Application Data\Cyberlink
C:\Documents and Settings\Omistaja\Application Data\Digital Design Ltd
C:\Documents and Settings\Omistaja\Application Data\Google
C:\Documents and Settings\Omistaja\Application Data\Grisoft
C:\Documents and Settings\Omistaja\Application Data\Help -- EMPTY Directory
C:\Documents and Settings\Omistaja\Application Data\Identities
C:\Documents and Settings\Omistaja\Application Data\Jasc
C:\Documents and Settings\Omistaja\Application Data\Lavasoft
C:\Documents and Settings\Omistaja\Application Data\Leadertech
C:\Documents and Settings\Omistaja\Application Data\Macromedia
C:\Documents and Settings\Omistaja\Application Data\Microsoft
C:\Documents and Settings\Omistaja\Application Data\Mozilla
C:\Documents and Settings\Omistaja\Application Data\Msn6
C:\Documents and Settings\Omistaja\Application Data\Nasa
C:\Documents and Settings\Omistaja\Application Data\Opera
C:\Documents and Settings\Omistaja\Application Data\Real
C:\Documents and Settings\Omistaja\Application Data\Sonic
C:\Documents and Settings\Omistaja\Application Data\Soundspectrum
C:\Documents and Settings\Omistaja\Application Data\Sun
C:\Documents and Settings\Omistaja\Application Data\Symantec
C:\Documents and Settings\Omistaja\Application Data\Talkback
C:\Documents and Settings\Omistaja\Application Data\Template
C:\Documents and Settings\Omistaja\Application Data\Winamp



SDFixin Report.txt:


SDFix: Version 1.111

Run by Omistaja on ke 24.10.2007 at 19:44

Microsoft Windows XP [versio 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Messenger"
"C:\\Pelit\\elastomania\\belma.exe"="C:\\Pelit\\elastomania\\belma.exe:*:Enabled:belma"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------


Files with Hidden Attributes:

Tue 5 Oct 2004 193 A.SHR --- "C:\BOOT.BAK"
Fri 17 Aug 2007 625,152 A.SH. --- "C:\Program Files\Internet Explorer\iexplore.exe"
Tue 22 Feb 2005 56 ..SHR --- "C:\WINDOWS\system32\10EF1C38FE.sys"
Tue 22 Feb 2005 848 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Tue 19 Oct 2004 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 25 Nov 2004 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv11.bak"
Tue 19 Oct 2004 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv13.bak"
Tue 19 Oct 2004 4,348 ...H. --- "C:\Documents and Settings\All Users\Tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1key.bak"
Sat 18 Aug 2007 782 A..H. --- "C:\Documents and Settings\All Users\Tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1lic.bak"
Wed 12 Jan 2005 400 A.SH. --- "C:\Documents and Settings\All Users\Tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv2key.bak"

Finished!



Ja lopuksi uusi HJT:n loki:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:08:46, on 24.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\keyhook.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Plaza Oy
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {508DB902-7CA1-372F-5663-61B593F2476B} - C:\DOCUME~1\Omistaja\APPLIC~1\THIRDF~1\Browse coal.exe (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [secsrv] C:\WINDOWS\System32\secsrv.exe
O4 - HKLM\..\Run: [ChicDumbDaleBalm] C:\Documents and Settings\All Users\Application Data\intra bin chic dumb\Atom rdr.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AXIS TONS THE MP3] C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons\Plan Hide.exe
O4 - HKCU\..\Run: [Thatfirst] C:\DOCUME~1\Omistaja\APPLIC~1\GREYLI~1\ScrFreeThis.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [Thatfirst] C:\DOCUME~1\Omistaja\APPLIC~1\GREYLI~1\ScrFreeThis.exe (User '?')
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193041416062
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 8642 bytes



Mites nyt sitten.. Miltä loki näyttää?

Poistin äsken Spybotilla jonkun CiD.IEPop örkin ja Ad-Aware SE Personalilla jonkun tracking cookien ja tässä on nyt sen jälkeen otettu HJT-loki:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:05:35, on 25.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\keyhook.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Apps\Powercinema\PCMService.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Plaza Oy
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {508DB902-7CA1-372F-5663-61B593F2476B} - C:\DOCUME~1\Omistaja\APPLIC~1\THIRDF~1\Browse coal.exe (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [secsrv] C:\WINDOWS\System32\secsrv.exe
O4 - HKLM\..\Run: [ChicDumbDaleBalm] C:\Documents and Settings\All Users\Application Data\intra bin chic dumb\Atom rdr.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AXIS TONS THE MP3] C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons\Plan Hide.exe
O4 - HKCU\..\Run: [Thatfirst] C:\DOCUME~1\Omistaja\APPLIC~1\GREYLI~1\ScrFreeThis.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [Thatfirst] C:\DOCUME~1\Omistaja\APPLIC~1\GREYLI~1\ScrFreeThis.exe (User '?')
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193041416062
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 8641 bytes

apua123 kirjoitti:

Poistin äsken Spybotilla jonkun CiD.IEPop örkin ja Ad-Aware SE Personalilla jonkun tracking cookien ja tässä on nyt sen jälkeen otettu HJT-loki:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:05:35, on 25.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\keyhook.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Apps\Powercinema\PCMService.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Plaza Oy
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {508DB902-7CA1-372F-5663-61B593F2476B} - C:\DOCUME~1\Omistaja\APPLIC~1\THIRDF~1\Browse coal.exe (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [secsrv] C:\WINDOWS\System32\secsrv.exe
O4 - HKLM\..\Run: [ChicDumbDaleBalm] C:\Documents and Settings\All Users\Application Data\intra bin chic dumb\Atom rdr.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AXIS TONS THE MP3] C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons\Plan Hide.exe
O4 - HKCU\..\Run: [Thatfirst] C:\DOCUME~1\Omistaja\APPLIC~1\GREYLI~1\ScrFreeThis.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [Thatfirst] C:\DOCUME~1\Omistaja\APPLIC~1\GREYLI~1\ScrFreeThis.exe (User '?')
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193041416062
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 8641 bytes

Lataa AVG Anti-Spyware 7.5 http://www.ewido.net/en/download/
ja tallenna ohjelma työpöydällesi.
• Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
• Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
• Käynnistä AVG Anti-Spyware.
• Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

• Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
• Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
• Sitten "Reports" valikon alta:

o Laita täppi kohtaan "Automatically generate report after every scan"
o Ota täppi pois kohdasta"Only if threats were found"

• Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
• "Resident shield is", muuta tila active:sta inactive:ksi
• Sulje ohjelma, ÄLÄ skannaa vielä.



Skannaa HJT:llä ja ruksit eteen

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: (no name) - {508DB902-7CA1-372F-5663-61B593F2476B} - C:\DOCUME~1\Omistaja\APPLIC~1\THIRDF~1\Browse coal.exe (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [secsrv] C:\WINDOWS\System32\secsrv.exe
O4 - HKCU\..\Run: [Thatfirst] C:\DOCUME~1\Omistaja\APPLIC~1\GREYLI~1\ScrFreeThis.
exe
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [Thatfirst] C:\DOCUME~1\Omistaja\APPLIC~1\GREYLI~1\ScrFreeThis.exe (User '?')

poista vikasiedossa C:\WINDOWS\System32\--->secsrv.exe Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi


laita CureIt, AVG ja uusi HJT tänne tai aloita uusi ketju.
Lähen nyt reissuun ja palailen ensi viikolla.

Lionell kirjoitti:

Lataa AVG Anti-Spyware 7.5 http://www.ewido.net/en/download/
ja tallenna ohjelma työpöydällesi.
• Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
• Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
• Käynnistä AVG Anti-Spyware.
• Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

• Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
• Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
• Sitten "Reports" valikon alta:

o Laita täppi kohtaan "Automatically generate report after every scan"
o Ota täppi pois kohdasta"Only if threats were found"

• Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
• "Resident shield is", muuta tila active:sta inactive:ksi
• Sulje ohjelma, ÄLÄ skannaa vielä.



Skannaa HJT:llä ja ruksit eteen

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: (no name) - {508DB902-7CA1-372F-5663-61B593F2476B} - C:\DOCUME~1\Omistaja\APPLIC~1\THIRDF~1\Browse coal.exe (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [secsrv] C:\WINDOWS\System32\secsrv.exe
O4 - HKCU\..\Run: [Thatfirst] C:\DOCUME~1\Omistaja\APPLIC~1\GREYLI~1\ScrFreeThis.
exe
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [Thatfirst] C:\DOCUME~1\Omistaja\APPLIC~1\GREYLI~1\ScrFreeThis.exe (User '?')

poista vikasiedossa C:\WINDOWS\System32\--->secsrv.exe Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi


laita CureIt, AVG ja uusi HJT tänne tai aloita uusi ketju.
Lähen nyt reissuun ja palailen ensi viikolla.

Tein nyt noi mitä neuvoit.

Mut tota "C:\WINDOWS\System32\--->secsrv.exe

apua123 kirjoitti:

Tein nyt noi mitä neuvoit.

Mut tota "C:\WINDOWS\System32\--->secsrv.exe

laita piilotiedostot näkyviin

* Avaa Oma Tietokone.
* Valitse Työkalut ylämenusta ja klikkaa Kansion asetukset.
* Valitse Näytä välilehti.
* Piilotiedostot/kansiot kohdalla valitse Näytä piilotetut tiedostot ja kansiot.
* Poista rasti ruudusta -> Piilota suojatut käyttöjärjestelmätiedostot
* Klikkaa Kyllä varmistaaksesi muutokset.
* Klikkaa OK.

vikasietotilaan....secsrv.exe pois jos löytyy ja piilotiedostot pois näkyvistä.

logi näyttäis olevan kunnossa, vieläkö ongelmia?

Lionell kirjoitti:

laita piilotiedostot näkyviin

* Avaa Oma Tietokone.
* Valitse Työkalut ylämenusta ja klikkaa Kansion asetukset.
* Valitse Näytä välilehti.
* Piilotiedostot/kansiot kohdalla valitse Näytä piilotetut tiedostot ja kansiot.
* Poista rasti ruudusta -> Piilota suojatut käyttöjärjestelmätiedostot
* Klikkaa Kyllä varmistaaksesi muutokset.
* Klikkaa OK.

vikasietotilaan....secsrv.exe pois jos löytyy ja piilotiedostot pois näkyvistä.

logi näyttäis olevan kunnossa, vieläkö ongelmia?

Hyvin on kone kyllä nyt toiminut että kiitoksia vaan avusta =)

Sitä secsrv.exe:ä ei löytynyt ainakaan sieltä C:\WINDOWS\SYSTEM\ -kansiosta vaikka pistin että näyttää ne piilotetutkin järjestelmätiedostot.


Tässä on viel uusin HJT-loki mistä kysyisin pari kysymystä:

Kun tossa aikaisemmassa lokissa fixauksen jälkeen oli vaan 5 riviä vierekkäin missä luki Internet Explorer niin onko normaalia että nyt niitä on 6?

Ja sitten kun tuossa on noi "Running processes:" niin onko ne kaikki tarpeellisia ja hidastaako ne konetta jollain tapaa? Kun vasta käynnistin koneen ja en noita ohjelmia ole käyttänyt niin miks ne on tossa listassa? Saako niitä estettyä / Kannattaako niitä estää käynnistymästä koneen yhteydessä ja miten?

Esim. nämä seuraavat, onko tarpeellisia vai ei? En ole niitä ainakaan itse käynnistänyt.

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\Apps\Powercinema\PCMService.exe

C:\Program Files\Messenger\msmsgs.exe



Tässä tää äsken koneen käynnistämisen jälkeen otettu loki:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:59:13, on 31.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\keyhook.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Plaza Oy
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193041416062
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 7949 bytes

apua123 kirjoitti:

Hyvin on kone kyllä nyt toiminut että kiitoksia vaan avusta =)

Sitä secsrv.exe:ä ei löytynyt ainakaan sieltä C:\WINDOWS\SYSTEM\ -kansiosta vaikka pistin että näyttää ne piilotetutkin järjestelmätiedostot.


Tässä on viel uusin HJT-loki mistä kysyisin pari kysymystä:

Kun tossa aikaisemmassa lokissa fixauksen jälkeen oli vaan 5 riviä vierekkäin missä luki Internet Explorer niin onko normaalia että nyt niitä on 6?

Ja sitten kun tuossa on noi "Running processes:" niin onko ne kaikki tarpeellisia ja hidastaako ne konetta jollain tapaa? Kun vasta käynnistin koneen ja en noita ohjelmia ole käyttänyt niin miks ne on tossa listassa? Saako niitä estettyä / Kannattaako niitä estää käynnistymästä koneen yhteydessä ja miten?

Esim. nämä seuraavat, onko tarpeellisia vai ei? En ole niitä ainakaan itse käynnistänyt.

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\Apps\Powercinema\PCMService.exe

C:\Program Files\Messenger\msmsgs.exe



Tässä tää äsken koneen käynnistämisen jälkeen otettu loki:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:59:13, on 31.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\keyhook.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Plaza Oy
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193041416062
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 7949 bytes

"Sitä secsrv.exe:ä ei löytynyt ainakaan sieltä C:\WINDOWS\SYSTEM\ -kansiosta vaikka pistin että näyttää ne piilotetutkin järjestelmätiedostot."

Tossa piti siis lukea C:\Windows\System32 eikä pelkkä system.

apua123 kirjoitti:

Hyvin on kone kyllä nyt toiminut että kiitoksia vaan avusta =)

Sitä secsrv.exe:ä ei löytynyt ainakaan sieltä C:\WINDOWS\SYSTEM\ -kansiosta vaikka pistin että näyttää ne piilotetutkin järjestelmätiedostot.


Tässä on viel uusin HJT-loki mistä kysyisin pari kysymystä:

Kun tossa aikaisemmassa lokissa fixauksen jälkeen oli vaan 5 riviä vierekkäin missä luki Internet Explorer niin onko normaalia että nyt niitä on 6?

Ja sitten kun tuossa on noi "Running processes:" niin onko ne kaikki tarpeellisia ja hidastaako ne konetta jollain tapaa? Kun vasta käynnistin koneen ja en noita ohjelmia ole käyttänyt niin miks ne on tossa listassa? Saako niitä estettyä / Kannattaako niitä estää käynnistymästä koneen yhteydessä ja miten?

Esim. nämä seuraavat, onko tarpeellisia vai ei? En ole niitä ainakaan itse käynnistänyt.

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\Apps\Powercinema\PCMService.exe

C:\Program Files\Messenger\msmsgs.exe



Tässä tää äsken koneen käynnistämisen jälkeen otettu loki:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:59:13, on 31.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\keyhook.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Plaza Oy
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-3314650626-469906111-2763621737-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193041416062
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 7949 bytes

secsrv.exe ei löytynyt= ok

Kun tossa aikaisemmassa lokissa fixauksen jälkeen oli vaan 5 riviä vierekkäin missä luki Internet Explorer niin onko normaalia että nyt niitä on 6?
=ok


Ja sitten kun tuossa on noi "Running processes:" niin onko ne kaikki tarpeellisia ja hidastaako ne konetta jollain tapaa? Kun vasta käynnistin koneen ja en noita ohjelmia ole käyttänyt niin miks ne on tossa listassa? Saako niitä estettyä / Kannattaako niitä estää käynnistymästä koneen yhteydessä ja miten?

=hidastaa


voit karsia niitä pois. Jätä Symantec rauhaan, muita voit googlailla ja poistella.
Jos tulee ongelmia niin palautat vaan takaisin käynnistyviin

Suorita kenttään kirjoita 'msconfig' ja enter. Välilehdeltä "käynnistys" poisrastitat joutavat. Ok. Uudelleenkäynnistys.

nuo voit vielä fixata
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u