Internet Explorer avaa mainosikkunoita ja kone muutenkin hidas

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi fs123 22.08.2009.

Sivu 1 / 2
  1. fs123

    fs123 Member

    Liittynyt:
    16.06.2009
    Viestejä:
    33
    Kiitokset:
    0
    Pisteet:
    16
    Hei!
    Eli Internet Explorer avaa mainosikkuinoita itsestään. Kirjoitin aiheesta muualle, mutta minua neuvottiin laittamaan viestiä tänne. Kone on muutenkin hidas ja välillä vähän outo. Siispä tarvitsisin vähän apua. Neuvokaa minua kädestä pitäen, sillä en ole ennen käyttänyt mitään tällaisia ohjelmia.
    Tässä loki:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:22:17, on 22.8.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\acer\Acer eConsole\MediaServerService.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Acer\eRecovery\Monitor.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\CDBurnerXP\NMSAccessU.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\NewDotNet\nnrun.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\SMC\EZ Connect Wireless USB\WlanMonitor.exe
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\Program Files\NewDotNet\nnrun.exe
    C:\WINDOWS\system32\svchost.exe
    C:\DOCUME~1\JUHO&A~1\LOCALS~1\Temp\b.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ruunarinteet.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
    O4 - HKLM\..\Run: [psyspy-2.1.4 Client Server] C:\WINDOWS\system32\telecms.exe
    O4 - HKLM\..\Run: [Windows svchost] service.exe
    O4 - HKLM\..\Run: [Windows UDP Control Center] winudpmgr.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\RunServices: [psyspy-2.1.4 Client Server] C:\WINDOWS\system32\telecms.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [Monopod] C:\DOCUME~1\JUHO&A~1\LOCALS~1\Temp\b.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: EZ Connect Wireless USB Utility.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?d3854ddbf3e14cc59bfb5a59d47c4300
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?d3854ddbf3e14cc59bfb5a59d47c4300
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\acer\Acer eConsole\MediaServerService.exe
    O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - D:\Program Files\MAGIX\Common\Database\bin\fbserver.exe (file missing)
    O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: Google Update Service (gupdate1c995fb70dde0a2) (gupdate1c995fb70dde0a2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
    O23 - Service: NNServ - New.net, Inc. - C:\Program Files\NewDotNet\nnrun.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    --
    End of file - 10909 bytes
     
    fs123, 22.08.2009
    #1
  2.  
  3. kalminen

    kalminen Regular member

    Liittynyt:
    04.05.2007
    Viestejä:
    3,915
    Kiitokset:
    0
    Pisteet:
    46
    Vältellään Comboa !!!

    (Printtaa tämä ohje paperille)

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    Jos linkki ei toimi, voit ladata myös seuraavista linkeistä:
    Linkki1
    Linkki2

    * Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    * Lopuksi varmistu, että seuraavat on valittu: Päivitä Malwarebytes' Anti-Malware ja Käynnistä Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Lopeta.
    * Jos päivitys löytyy, ohjelma lataa ja asentaa uusimman version. Jos päivityksien lataaminen ei onnistu, voit ladata päivitykset tästä. Tuplaklikkaa mbam-rules.exe asentaaksesi päivitykset.
    * Kun ohjelma on latautunut ja päivitykset tehty, valitse Suorita täysi tarkistus ja klikkaa Tarkista.
    * Kun tarkistus on valmis, klikkaa OK ja sitten Näytä tulokset nähdäksesi tulokset.
    * Varmistu, että kaikki on merkitty ja klikkaa Poista valitut.
    * Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    * Lähetä lokin sisältö seuraavassa viestissäsi.[/list]

    Huom. Jos Mbam ei pystynyt poistamaan tiedostoa, se pyytää sinua käynnistämään koneesi uudelleen. Käynnistä koneesi silloin uudelleen heti. Mbam voi tehdä muutoksia rekisteriisi osana puhdistusta. Jos käytät suojausohjelmaa, joka havaitsee rekisterin muutokset, salli Mbamin tehdä muutokset.

    ----------------------------------------------------------------------------------

    * Lähetä lokin sisältö seuraavassa viestissäsi
    + uusi hjt-loki.
    .
     
    kalminen, 22.08.2009
    #2
  4. fs123

    fs123 Member

    Liittynyt:
    16.06.2009
    Viestejä:
    33
    Kiitokset:
    0
    Pisteet:
    16
    Malwarebytes löysi 43 saastunutta tiedostoa.

    Tässä Malwarebytesin muodostama loki: (kone piti käynnistää vielä uudestaan sen jälkeen)

    Malwarebytes' Anti-Malware 1.40
    Tietokantaversio: 2676
    Windows 5.1.2600 Service Pack 3

    22.8.2009 18:47:35
    mbam-log-2009-08-22 (18-47-35).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
    Tarkistetut kohteet: 297521
    Kulunut aika: 1 hour(s), 4 minute(s), 53 second(s)

    Saastuneita muistiprosesseja: 2
    Saastuneita muistimoduuleja: 1
    Saastuneita rekisteriavaimia: 25
    Saastuneita rekisteriarvoja: 4
    Saastuneita rekisterikohteita: 2
    Saastuneita hakemistoja: 4
    Saastuneita tiedostoja: 43

    Saastuneita muistiprosesseja:
    C:\Documents and Settings\Juho & Aapo\Local Settings\Temp\b.exe (Trojan.Downloader) -> Unloaded process successfully.
    C:\Program Files\NewDotNet\nnrun.exe (Adware.NewDotNet) -> Unloaded process successfully.

    Saastuneita muistimoduuleja:
    C:\Program Files\NewDotNet\nncore.dll (Adware.NewDotNet) -> Delete on reboot.

    Saastuneita rekisteriavaimia:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Generic.Bot.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\acm.acmfactory (Adware.WhenUSave) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\acm.acmfactory.1 (Adware.WhenUSave) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\xml.xml (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{43382522-a846-46f4-ac57-1f71ae6e1086} (Adware.WhenUSave) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{572fb162-c0ba-4edf-8cff-e3846153b9b0} (Adware.WhenUSave) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{72a836d1-bc00-43c0-a941-17960e4fb842} (Adware.WhenUSave) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\{127df9b4-d75d-44a6-af78-8c3a8ceb03db} (Adware.WhenUSave) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a9aae1ab-9688-42c5-86f5-c12f6b9015ad} (Adware.WhenUSave) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{df901432-1b9f-4f5b-9e56-301c553f9095} (Adware.WhenUSave) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{e24211b3-a78a-c6a9-d317-70979ace5058} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\new.net (Adware.NewDotNet) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\ACM.dll (Adware.WhenUSave) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\WUSN.1 (Adware.WhenUSave) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\AdvRemoteDbg (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Monopod (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\NordBull (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\WakeNet (Trojan.Adware) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SaveNow (Adware.WhenUSave) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Monopod (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows svchost (Backdoor.IRCBot) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control Center (Backdoor.Bot) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\psyspy-2.1.4 Client Server (Worm.IRCBot) -> Quarantined and deleted successfully.

    Saastuneita rekisterikohteita:
    HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Saastuneita hakemistoja:
    C:\Program Files\NewDotNet (Adware.NewDotNet) -> Delete on reboot.
    C:\Program Files\Save (Adware.WhenUSave) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Käynnistä-valikko\Ohjelmat\WhenU (Adware.WhenUSave) -> Quarantined and deleted successfully.
    C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 (Trojan.Agent) -> Quarantined and deleted successfully.

    Saastuneita tiedostoja:
    C:\Documents and Settings\Juho & Aapo\Local Settings\Temp\b.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\msxml71.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Application Data\Save\Save.exe (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Application Data\Save\SaveUninst.exe (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Local Settings\Temp\6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Local Settings\Temp\A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Local Settings\Temp\SaveInstaller.exe (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Local Settings\Temporary Internet Files\Content.IE5\CXI749QR\Save[1].prod.v4030001.03mar2009.exe.252a97204d0272bcc88e5c67e8d253c0 (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Local Settings\Temporary Internet Files\Content.IE5\K96ZGPIJ\SaveInstaller[1].exe (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Local Settings\Temporary Internet Files\Content.IE5\OXWDOVK5\SaveUninst[1].prod.v1000000.03mar2009.exe.1a9c17b6238cf818114ddd74b61de9cf (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho & Aapo\Local Settings\Temp\a.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho & Aapo\Local Settings\Temp\c.exe (Trojan-Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho & Aapo\Local Settings\Temp\Tilapäinen kansio 1 GTA San Andreas.zip\SETUP.0XE (Worm.P2P) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Tapio\Local Settings\Temp\8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Tapio\Local Settings\Temp\8.tmp.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Program Files\Mozilla Firefox\components\SaveComponent.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Save\SaveUninst.exe (Adware.Agent) -> Quarantined and deleted successfully.
    C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ISE32.0XE (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0B4A40F6-8B5A-4DC9-A909-2502759DD344}\RP960\A0202167.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\WINDOWS\WINUDPMGR.0XE (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\WINDOWS\WINUDSPM.0XE (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\WINDOWS\SERVICE.0XE (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\WINDOWS\msa.exe (Trojan-Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\msc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\TELECMS.0XE (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\WhoisCL.exe (Adware.BHO) -> Quarantined and deleted successfully.
    C:\Program Files\NewDotNet\nncore.dll (Adware.NewDotNet) -> Delete on reboot.
    C:\Program Files\NewDotNet\nnrun.exe (Adware.NewDotNet) -> Delete on reboot.
    C:\Program Files\NewDotNet\readme.html (Adware.NewDotNet) -> Quarantined and deleted successfully.
    C:\Program Files\NewDotNet\uninstall.exe (Adware.NewDotNet) -> Quarantined and deleted successfully.
    C:\Program Files\Save\SaveNowupdate.exe (Adware.WhenUSave) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Käynnistä-valikko\Ohjelmat\WhenU\Customer Support.lnk (Adware.WhenUSave) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Käynnistä-valikko\Ohjelmat\WhenU\Learn More About WhenU Save.url (Adware.WhenUSave) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Käynnistä-valikko\Ohjelmat\WhenU\Learn More About WhenU SaveNow.url (Adware.WhenUSave) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Käynnistä-valikko\Ohjelmat\WhenU\Uninstall Instructions.lnk (Adware.WhenUSave) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Käynnistä-valikko\Ohjelmat\WhenU\Uninstall.lnk (Adware.WhenUSave) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Käynnistä-valikko\Ohjelmat\WhenU\WhenU Help Desk.lnk (Adware.WhenUSave) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Juho\Käynnistä-valikko\Ohjelmat\WhenU\WhenU.com Website.url (Adware.WhenUSave) -> Quarantined and deleted successfully.
    C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\shell32.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\WINDOWS\msb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\WINDOWS\Tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job (Trojan.Downloader) -> Quarantined and deleted successfully.





    Ja tässä vielä HijackThis loki:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:00:56, on 22.8.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\acer\Acer eConsole\MediaServerService.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\CDBurnerXP\NMSAccessU.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Acer\eRecovery\Monitor.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\SMC\EZ Connect Wireless USB\WlanMonitor.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ruunarinteet.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
    O4 - HKLM\..\Run: [psyspy-2.1.4 Client Server] C:\WINDOWS\system32\telecms.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: EZ Connect Wireless USB Utility.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?d3854ddbf3e14cc59bfb5a59d47c4300
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?d3854ddbf3e14cc59bfb5a59d47c4300
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\acer\Acer eConsole\MediaServerService.exe
    O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - D:\Program Files\MAGIX\Common\Database\bin\fbserver.exe (file missing)
    O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: Google Update Service (gupdate1c995fb70dde0a2) (gupdate1c995fb70dde0a2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
    O23 - Service: NNServ - Unknown owner - C:\Program Files\NewDotNet\nnrun.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    --
    End of file - 10473 bytes
     
    Viimeksi muokattu: 22.08.2009
    fs123, 22.08.2009
    #3
  5. fs123

    fs123 Member

    Liittynyt:
    16.06.2009
    Viestejä:
    33
    Kiitokset:
    0
    Pisteet:
    16
    Nyt ilmeni sellainen juttu, että ilmeisesti malwarebytes on poistanut f-securen käytöstä ja se väittää vielä, että se on vanhentunut. Miten saan f-securen jälleen päälle ja päivitetyksi???
     
    Viimeksi muokattu: 22.08.2009
    fs123, 22.08.2009
    #4
  6. kalminen

    kalminen Regular member

    Liittynyt:
    04.05.2007
    Viestejä:
    3,915
    Kiitokset:
    0
    Pisteet:
    46
    Asenna F-Secure uudelleen !!!

    ---------------------------------------------------------

    Mene Windowsin ControlPaneliin (Ohjauspaneli) ja sieltä Lisää / Poista sovellus
    Vistassa Ohjelmat ja toiminnot
    Etsi ja poista ohjelma jonka nimessä on:

    AskSearch


    ---------------------------------------------------------------------------

    Mene alapalkista KÄYNNISTÄ ==> SUORITA valikkoon ja kirjoita services.msc OK
    Klikkaa Avautuva ikkuna suureksi ja ohjelma saraketta levität niin että näkyy kaikki.

    Etsi
    NNServ

    Klikkaa rivi aktiiviseksi ja
    Hiiren oikealla napilla pääset ko. riviltä valikkoon ==> Ominaisuudet/Propertiers
    josta muutat Käynnistystapa Ei käytössä. => Oikeasta alakulmasta Klikkaa käytä ja OK Tämän lisäksi klikkaat vasemmalla
    puolella olevaa linkkiä Pysäytä palvelu . Poistu ohjelmasta.

    ----------------------------------------------------------------------------------

    Poista ne rivit jotka ovat vielä jäljellä:

    Sammuta selain ja muut ohjelmat Fixin ajaksi. (ei virustorjuntaa)
    Käynnistä HijackThis:ja Scan ja ruksaa seuraavat punaisella listatut tiedostot

    R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
    O4 - HKLM\..\Run: [psyspy-2.1.4 Client Server] C:\WINDOWS\system32\telecms.exe
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O23 - Service: NNServ - Unknown owner - C:\Program Files\NewDotNet\nnrun.exe (file missing)

    sekä poista ne.(fix Chekked) napista.

    Tyhjennä roskakori ja käynnistä koneesi uudelleen.

    Poista kansio/t, jos löytyy:
    C:\Program Files\AskSearch\
    ja tiedosto:
    C:\WINDOWS\system32\telecms.exe

    Postita tänne seuraavat lokit:
    * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
    * Nousiko Virusturva päälle ???
    *
    * Kerro mikä on tilanne ???
    *
     
    kalminen, 23.08.2009
    #5
  7. fs123

    fs123 Member

    Liittynyt:
    16.06.2009
    Viestejä:
    33
    Kiitokset:
    0
    Pisteet:
    16
    Lisää tai poista sovelluksessa ei ollut AskSearch nimistä ohjelmaa tai mikään nimi ei edes sisältänyt sitä. Mitä pitäisi tehdä?
    Niin ja sitten vielä, että f-secure on nyt käynnissä, mutta sanoo: päivitä tietokannat heti. Kun yritän päivittää, se sanoo: Channel has reached maximum disk space allotted. Mitä sille pitäisi tehdä?
     
    Viimeksi muokattu: 23.08.2009
    fs123, 23.08.2009
    #6
  8. kalminen

    kalminen Regular member

    Liittynyt:
    04.05.2007
    Viestejä:
    3,915
    Kiitokset:
    0
    Pisteet:
    46
    Poista kansio Vikasiedossa => C:\Program Files\AskSearch\
    Käynnistä kone vikasietotilaan => OHJE

    Se taitaa nykyään piiloutuneen V-akuisiin sanoihin
    .
     
    kalminen, 23.08.2009
    #7
  9. fs123

    fs123 Member

    Liittynyt:
    16.06.2009
    Viestejä:
    33
    Kiitokset:
    0
    Pisteet:
    16
    Kun poistin AskSearchin vikasietotilassa, koko kone sekosi, eikä se suostu tekemään mitään. Kirjoitin tämänkin viestin vikasietotilassa. Apua!!!!!!!

    Tässä tämänhetkinen hjt-loki vikasietotilassa:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:09:44, on 23.8.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Safe mode with network support

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ruunarinteet.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: EZ Connect Wireless USB Utility.lnk = ?
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?d3854ddbf3e14cc59bfb5a59d47c4300
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?d3854ddbf3e14cc59bfb5a59d47c4300
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\acer\Acer eConsole\MediaServerService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - D:\Program Files\MAGIX\Common\Database\bin\fbserver.exe (file missing)
    O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: Google Update Service (gupdate1c995fb70dde0a2) (gupdate1c995fb70dde0a2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    --
    End of file - 8107 bytes
     
    Viimeksi muokattu: 23.08.2009
    fs123, 23.08.2009
    #8
  10. kalminen

    kalminen Regular member

    Liittynyt:
    04.05.2007
    Viestejä:
    3,915
    Kiitokset:
    0
    Pisteet:
    46
    MalwareBytes ei ole ikinä rikkonut F-Securea, mutta
    Virukset sen tekee. Vai oliko sulla viruksia koneella ???

    Kehotin asentamaan F-Securen uudelleen (asensitko) ????
    Avasti oli ilmestynyt aivan itsellään, vaikka se ei sovi securen kanssa
    samalle koneelle.

    Laita ensimmäiseksi virustorjunta kuntoon.

    Pidä vaikka Winukan muuria päällä sen aikaa, että saat asiat kuntoon.

    -----------------------------------------------------------------

    Nämä pois ennenkuin tulee lisää pöpöjä.

    Sammuta selain ja muut ohjelmat Fixin ajaksi. (ei virustorjuntaa)
    Käynnistä HijackThis:ja Scan ja ruksaa seuraavat punaisella listatut tiedostot
    (HJT sammuttaa ohjelman ei poista)

    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe


    sekä poista ne.(fix Chekked) napista.

    Tyhjennä roskakori ja käynnistä koneesi uudelleen.

    Postita tänne seuraavat lokit:
    * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
    *
     
    kalminen, 23.08.2009
    #9
  11. fs123

    fs123 Member

    Liittynyt:
    16.06.2009
    Viestejä:
    33
    Kiitokset:
    0
    Pisteet:
    16
    Poistin kyseiset rivit. Windowsin palomuuri on päällä kokoajan. Asensin avastin, kun en saanut f-securea toimimaan. Nyt kun kone on vikasietotilassa, en tiedä mitä pitäisi tehdä, mutta rivit on poistettu ja palomuuri ja avast päällä. Viruksista en tiedä, onko niitä ollut, mutta f-secure ei ainakaan mitään ole sanonut.
     
    Viimeksi muokattu: 23.08.2009
    fs123, 23.08.2009
    #10
  12. kalminen

    kalminen Regular member

    Liittynyt:
    04.05.2007
    Viestejä:
    3,915
    Kiitokset:
    0
    Pisteet:
    46
    Nyt joku peeloilee ???

    Malwarebytes' Anti-Malware löysi tuollaisen kasan viruksia !!!
    etkä ole kuullut, että koneellasi olisi ollut viruksia ??????????????????????

    Koodi:
    Malwarebytes' Anti-Malware 1.40 
Tietokantaversio: 2676 
Windows 5.1.2600 Service Pack 3 

22.8.2009 18:47:35 
mbam-log-2009-08-22 (18-47-35).txt 

Tarkistustyyppi: Täysi tarkistus (C:\|D:\|) 
Tarkistetut kohteet: 297521 
Kulunut aika: 1 hour(s), 4 minute(s), 53 second(s) 

Saastuneita muistiprosesseja: 2 
Saastuneita muistimoduuleja: 1 
Saastuneita rekisteriavaimia: 25 
Saastuneita rekisteriarvoja: 4 
Saastuneita rekisterikohteita: 2 
Saastuneita hakemistoja: 4 
Saastuneita tiedostoja: 43
    Voin vannoa, että sun F-Secure on ollut jo pidemmänaikaa kesälomalla.

    Todetaan tosiseikat ja aletaan huomenna (ma) laittamaan sun myllyä kuntoon.
    .
     
    kalminen, 23.08.2009
    #11
  13. kalminen

    kalminen Regular member

    Liittynyt:
    04.05.2007
    Viestejä:
    3,915
    Kiitokset:
    0
    Pisteet:
    46
    Tällä päivämäärällä 14:22:17, on 22.8.2009
    otetussa HJT logissa ei F-Secure ole ollut toiminnassa !!!

    Poista F-Secure sen omalla Uninstallilla koneelta.

    Lataa ja aja =>
    F-Sekuren poisto: Täältä

    käynnistä koneesi uudelleen.

    Postita tänne seuraavat lokit:
    * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
    *
     
    kalminen, 24.08.2009
    #12
  14. fs123

    fs123 Member

    Liittynyt:
    16.06.2009
    Viestejä:
    33
    Kiitokset:
    0
    Pisteet:
    16
    Joo latasin ton poisto-ohjelman ja ekasta ruudusta hyväksyn säännöt ja next, mutta sen jälkeen ei näkyny mitään. Sit kone käynnisty uudelleen itestään, eikä sen jälkeen löytyny mitään merkkejä f-securesta. Kai se sen poisti sitten.
    Tässä kuitenkin loki:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:02:09, on 24.8.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Safe mode with network support

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ruunarinteet.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: EZ Connect Wireless USB Utility.lnk = ?
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?d3854ddbf3e14cc59bfb5a59d47c4300
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?d3854ddbf3e14cc59bfb5a59d47c4300
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\acer\Acer eConsole\MediaServerService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE (file missing)
    O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - D:\Program Files\MAGIX\Common\Database\bin\fbserver.exe (file missing)
    O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\F-Secure\Common\FSAA.EXE (file missing)
    O23 - Service: Google Update Service (gupdate1c995fb70dde0a2) (gupdate1c995fb70dde0a2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    --
    End of file - 7150 bytes
     
    fs123, 24.08.2009
    #13
  15. kalminen

    kalminen Regular member

    Liittynyt:
    04.05.2007
    Viestejä:
    3,915
    Kiitokset:
    0
    Pisteet:
    46
    Asenna koneellesi YKSI palomuuriohjelma:

    1) ZoneAlarm
    (Asennuksessa poista rasti kohdasta "Include a ZoneAlarm Spy Blocker", koska tämä työkalupalkki ei ole suositeltava.
    2) Agnitum
    4) Comodo
    (Asennuksessa poista rasti kohdista "Install Comodo SafeSurf..", Make Comodo my default
    search provider" ja "Make Comodo Search my homepage". Nämä eivät ole suositeltavia.
    Ota asennuksessa rasti myös pois kohdasta "Install Comodo Antivirus", jos käytät muuta
    virustorjuntaa.)

    Jos käytät sisäänrakennettua Windowsin palomuuria, se ei ole suositeltua sillä se ei
    estä koneelta ulosmeneviä yhteyksiä. Tämä tarkoittaa että mikä tahansa haittaohjelma
    koneellasi on vapaa tekemään mitä tahansa internet -yhteydelläsi. Yksinkertaisesti
    sanottuna, Windows XP sisältää keskivertoa huonomman palomuurin. Tämä palomuuri EI ole
    mikään korvike omistautuneelle palomuuriratkaisulle. Muista käyttää vain yhtä
    palomuuria kerrallaan.

    ----------------------------------------------------------------

    Mene alapalkista KÄYNNISTÄ ==> SUORITA valikkoon ja kirjoita services.msc OK
    Klikkaa Avautuva ikkuna suureksi ja ohjelma saraketta levität niin että näkyy kaikki.

    Etsi
    F-Secure BackWeb

    F-Secure Authentication Agent

    Firebird Server

    Klikkaa rivi aktiiviseksi ja
    Hiiren oikealla napilla pääset ko. riviltä valikkoon ==> Ominaisuudet/Propertiers
    josta muutat Käynnistystapa Ei käytössä. => Oikeasta alakulmasta Klikkaa käytä ja OK Tämän lisäksi klikkaat vasemmalla
    puolella olevaa linkkiä Pysäytä palvelu . Poistu ohjelmasta.

    ----------------------------------------------------------------------------------

    Lataa Atribunen ATF Cleaner

    Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman. Main:n alla valitse: Select All
    Klikkaa Empty Selected valintaa.

    Jos käytät FireFoxia selaimenasi Klikkaa Firefox yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.

    Jos käytät Operaa selaimenasi Klikkaa Opera yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa taas.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.

    Klikkaa Exit päävalikosta sulkeaksesi ohjelman.

    ----------------------------------------------

    Skannaa koneesi Kaspersky Online Skannerilla

    * Lue läpi vaatimukset ja yksityisyyssäännökset ja klikkaa Accept.
    * Skannerin ja virustietokannan lataus alkaa. Sinulta kysytään sallitko Kasperskyltä tulevan ohjelman asentamisen. Klikkaa Aja/Run.
    * Kun lataus on valmis, klikkaa Settings.
    * Varmistu, että seuraavat kohdat on valittu. Jos ne eivät ole, valitse ne ja klikkaa Save: Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases

    * Klikkaa Oma Tietokone, My Computer Scan-kohdan alapuolelta.
    * Kun tarkistus on valmis, tulokset näytetään. Klikkaa View Scan Report.
    * Näet listan saastuneista kohteista. Klikkaa Save Report As....
    * Tallenna tiedosto työpöydällesi. Muuta Tiedostotyyppi/Files of type muotoon Tekstitiedosto/Text file(.txt) ennen kuin klikkaat Save.

    * Kopioi ja liitä tiedoston sisältö seuraavaan vastaukseesi uuden HijackThis-lokin kera

    ----------------------------------------------------------------------------------

    Poista ne rivit jotka ovat vielä jäljellä:

    Sammuta selain ja muut ohjelmat Fixin ajaksi. (ei virustorjuntaa)
    Käynnistä HijackThis:ja Scan ja ruksaa seuraavat punaisella listatut tiedostot
    (HJT sammuttaa ohjelman ei poista)

    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - D:\Program Files\MAGIX\Common\Database\bin\fbserver.exe (file missing)
    O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE (file missing)
    O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\F-Secure\Common\FSAA.EXE (file missing)

    sekä poista ne.(fix Chekked) napista.

    Tyhjennä roskakori ja käynnistä koneesi uudelleen.

    Postita tänne seuraavat lokit:
    * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
    * Kaperskyn raportti
    *
    * Kerro mikä on tilanne ???
    *
     
    kalminen, 24.08.2009
    #14
  16. fs123

    fs123 Member

    Liittynyt:
    16.06.2009
    Viestejä:
    33
    Kiitokset:
    0
    Pisteet:
    16
    Asensin ZoneAlarmin ja poistin windowsin muurin käytöstä. Kokeilin konetta käynnistää normaalitilaan. Hitaasti käynnistyy, mutta nyt suostuu jo avaamaan tiedostoja ja ohjelmia. Mozillaa ei kuitenkaan jaksanut käynnistää, joten vielä täältä vikasiedosta kirjoittelen. Kaspersky skannasi koneen ja jotain se tuntui löytävän.

    Tässä Kasperskyn reportti:

    --------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER 7.0: scan report
    Tuesday, August 25, 2009
    Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
    Kaspersky Online Scanner version: 7.0.26.13
    Last database update: Tuesday, August 25, 2009 05:40:10
    Records in database: 2685560
    --------------------------------------------------------------------------------

    Scan settings:
    scan using the following database: extended
    Scan archives: yes
    Scan e-mail databases: yes

    Scan area - My Computer:
    C:\
    D:\
    E:\
    F:\
    G:\
    H:\
    I:\
    J:\

    Scan statistics:
    Objects scanned: 199387
    Threats found: 9
    Infected objects found: 13
    Suspicious objects found: 0
    Scan duration: 02:46:44


    File name / Threat / Threats count
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\51\25d09bb3-76f71be8 Infected: Exploit.Java.ByteVerify 1
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\57\538bb179-21d57eb1 Infected: Trojan-Downloader.Java.OpenStream.ac 1
    C:\Documents and Settings\Juho & Aapo\Local Settings\Temp\866.tmp Infected: Trojan.Win32.FraudPack.qgv 1
    C:\Documents and Settings\Juho & Aapo\Omat tiedostot\Kaikkee sälää\Asennusohjelmat\wc2006scrv03.exe Infected: not-a-virus:AdWare.Win32.NewDotNet 1
    C:\Documents and Settings\Juho & Aapo\Omat tiedostot\Kaikkee sälää\Asennusohjelmat\wc2006scrv03.exe Infected: not-a-virus:WebToolbar.Win32.WhenU.a 1
    C:\Documents and Settings\Juho & Aapo\Omat tiedostot\LimeWire\Incomplete\T-2563347-girl in uniform pete parkkonen.mp3 Infected: Trojan-Downloader.WMA.Wimad.r 1
    C:\is154890.0xe Infected: Trojan-Downloader.Win32.Agent.rcl 1
    C:\Program Files\filesubmit\germanywpv07.zip\NNWDAC638.EXE Infected: not-a-virus:AdWare.Win32.NewDotNet 1
    C:\Program Files\filesubmit\germanywpv07.zip\SetupInst.exe Infected: not-a-virus:WebToolbar.Win32.WhenU.a 1
    C:\Program Files\Windows TaskAd\WinProject.dll Infected: not-a-virus:AdWare.Win32.WinAD.b 1
    C:\WINDOWS\NDNuninstall6_38.exe Infected: not-a-virus:AdWare.Win32.NewDotNet 1
    C:\WINDOWS\NDNuninstall7_22.exe Infected: not-a-virus:AdWare.Win32.NewDotNet.e 1
    C:\WINDOWS\NDNuninstall7_48.exe Infected: not-a-virus:AdWare.Win32.NewDotNet.e 1

    Selected area has been scanned.


    Ja tässä hjt-loki:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:03:25, on 25.8.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Safe mode with network support

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ruunarinteet.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: EZ Connect Wireless USB Utility.lnk = ?
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?d3854ddbf3e14cc59bfb5a59d47c4300
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?d3854ddbf3e14cc59bfb5a59d47c4300
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\acer\Acer eConsole\MediaServerService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Google Update Service (gupdate1c995fb70dde0a2) (gupdate1c995fb70dde0a2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 6666 bytes
     
    fs123, 25.08.2009
    #15
  17. kalminen

    kalminen Regular member

    Liittynyt:
    04.05.2007
    Viestejä:
    3,915
    Kiitokset:
    0
    Pisteet:
    46
    Pöpöjä löytyy aina vain !!!

    * Lataa OTM by OldTimer.
    * Tallenna se työpöydällesi.
    * Tuplaklikkaa OTM.exe käynnistääksesi sen.
    * Kopioi (CTRL+C) alla olevasta laatikosta kaikki teksti.
    Koodi:
    :files
C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache
C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache
C:\Documents and Settings\Juho & Aapo\Local Settings\Temp\866.tmp
C:\Documents and Settings\Juho & Aapo\Omat tiedostot\Kaikkee sälää\Asennusohjelmat\wc2006scrv03.exe
C:\Documents and Settings\Juho & Aapo\Omat tiedostot\LimeWire
C:\is154890.0xe
C:\Program Files\filesubmit\germanywpv07.zip\NNWDAC638.EXE
C:\Program Files\filesubmit\germanywpv07.zip\SetupInst.exe
C:\Program Files\Windows TaskAd\WinProject.dll
C:\WINDOWS\NDNuninstall6_38.exe
C:\WINDOWS\NDNuninstall7_22.exe
C:\WINDOWS\NDNuninstall7_48.exe
:commands 
[emptytemp]
[purity]
    * Palaa takaisin OtmoveIt3, paina oikeanpuoleista hiiren nappia Paste Instructions for Items to be Move-ikkunassa (Keltaisen palkin alla) ja paina Liitä.
    * Paina punaista MoveIt! -nappia.
    * Kopioi (CTRL+C) ja liitä (CTRL+V) Results-ikkunaan (Vihreän palkin alla) tullut teksti seuraavaan viestiisi.
    * Sulje OTM.

    Jos jotain tiedostoa/kansiota ei voitu siirtää heti, ohjelma ehdottaa koneen uudelleenkäynnistystä. Vastaa ehdotukseen Yes, jolloin OtMoveIt käynnistää koneesi uudelleen.

    *********************************************************

    Ole hyvä ja lataa Combofix yhdestä alla olevista linkeistä:

    Linkki 1
    Linkki 2
    Linkki 3

    * TÄRKEÄÄ !!! Tallenna ComboFix.exe työpöydällesi

    * Sulje/ota pois päältä kaikki virustorjunta- ja haittaohjelmien poisto-ohjelmat, jotta ne eivät häiritse ComboFixin ajoa.

    * Tuplaklikkaa Combofix.exe ja noudata ohjeita.

    * Osana skannausta Combofix tarkistaa onko palautuskonsoli asennettuna. Nykypäivän haittaohjelmien takia on erittäin suositeltua olla asennettuna palautuskonsoli ennen haittaohjelmien poistoa. Windowsin palautuskonsoli mahdollistaa käynnistyksen erityiseen palautustilaan. Palautuskonsolin kautta voimme auttaa sinua helpommin mikäli haittaohjelmien poiston yhteydessä ilmenee ongelmia.

    * Seuraa ohjeita ja salli Combofixin ladata ja asentaa Microsoftin palautuskonsoli, ja kun pyydetään, hyväksy ohjelman takuuehdot asentaaksesi palautuskonsolin.

    **Huomaa: Jos palautuskonsoli on jo asennettuna, Combofix jatkaa eteenpäin.

    [​IMG]

    Kun Microsoftin palautuskonsoli on asennettu, sinun pitäisi nähdä seuraava viesti:

    [​IMG]

    Klikkaa Kyllä jatkaaksesi skannausta.

    Kun ComboFix on valmis, se luo raportin. Ole hyvä ja kopioi/liitä seuraavat raportit vastaukseesi:
    C:\ComboFix.txt
    Uusi HijackThis-loki


    Varoitus: ÄLÄ aja ComboFixia ilman valvontaa. Se ei ole lelu ja sitä ei tule käyttää rutiininomaisesti päivittäin.

    Jos tarvitset apua, katso yksityiskohtaisempi ohje:
    http://www.bleepingcomputer.com/combofix/fi/combofixin-kayttoohje

    -------------------------------------------------------

    Lähetä:
    C:\ComboFix.txt
    Uusi HijackThis-loki Ota Normaalitilassa jotta näyttää totuuden.
    sekä => OTMoveIt logi.
    .
     
    kalminen, 25.08.2009
    #16
  18. fs123

    fs123 Member

    Liittynyt:
    16.06.2009
    Viestejä:
    33
    Kiitokset:
    0
    Pisteet:
    16
    Noniin, kaikki ohjelmat pyöritetty!
    Nyt tuntuu kone muuten toimivan, mutta normitilassa netti ei toimi. Sanoo, että yhteys palvelimeen katkesi tms.
    Niin ja jos loki väittää, että palautuskonsolia ei ole asennettu, niin ei ohjelma kyllä mitään kysynytkään, joten oletin, että se on asennettu jo aiemmin. Huomasin vielä, että ZoneAlarm on poistunut käytöstä ilmeisesti tuon Combofixin jälkeen. Miten saan sen takaisin käyttöön vai onko edessä uudelleenasennus?

    Tässä nyt sitten lokit:


    OTM by Oldtimer-loki:

    All processes killed
    ========== FILES ==========
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\tmp moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\tmp moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\ext moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\javapi\v1.0 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\javapi moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\tmp moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\muffin moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\host moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\9 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\8 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\7 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\63 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\62\6bd546be-57de82b5-n moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-7f8645fe-n moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\62 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\61 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\60 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\6 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\59 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\58 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\57 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\56 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\55 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\54 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\53 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\52 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\51 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\50\5b902232-7924552a-n moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\50 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\5 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\49 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\48 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\47 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\46 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\45\4f710eed-3ce8ce6f-n moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\45 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\44 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\43 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\42 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\41 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\40 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\4 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\39 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\38 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\37 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\36 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\35 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\34 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-4c5c6d19-n moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\33 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\32 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\31 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\30 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\3 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\29 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\28 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\27 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\26 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\25 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\24 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\23 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\22 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\21 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\20 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\2 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\19 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\18 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\17 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\16 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\15\58fb3e0f-3c6daf06-n moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\15\4e09eacf-5d1c6081-n moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\15 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\14 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\13 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\12 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\11 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\10 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\1 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0\0 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache\6.0 moved successfully.
    C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache moved successfully.
    File/Folder C:\Documents and Settings\Juho\Application Data\Sun\Java\Deployment\cache not found.
    C:\Documents and Settings\Juho & Aapo\Local Settings\Temp\866.tmp moved successfully.
    C:\Documents and Settings\Juho & Aapo\Omat tiedostot\Kaikkee sälää\Asennusohjelmat\wc2006scrv03.exe moved successfully.
    C:\Documents and Settings\Juho & Aapo\Omat tiedostot\LimeWire\Store Purchased moved successfully.
    C:\Documents and Settings\Juho & Aapo\Omat tiedostot\LimeWire\Shared moved successfully.
    C:\Documents and Settings\Juho & Aapo\Omat tiedostot\LimeWire\Saved moved successfully.
    C:\Documents and Settings\Juho & Aapo\Omat tiedostot\LimeWire\Incomplete moved successfully.
    C:\Documents and Settings\Juho & Aapo\Omat tiedostot\LimeWire moved successfully.
    C:\is154890.0xe moved successfully.
    C:\Program Files\filesubmit\germanywpv07.zip\NNWDAC638.EXE moved successfully.
    C:\Program Files\filesubmit\germanywpv07.zip\SetupInst.exe moved successfully.
    DllUnregisterServer procedure not found in C:\Program Files\Windows TaskAd\WinProject.dll
    C:\Program Files\Windows TaskAd\WinProject.dll NOT unregistered.
    C:\Program Files\Windows TaskAd\WinProject.dll moved successfully.
    C:\WINDOWS\NDNuninstall6_38.exe moved successfully.
    C:\WINDOWS\NDNuninstall7_22.exe moved successfully.
    C:\WINDOWS\NDNuninstall7_48.exe moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes

    User: Juho
    ->Temp folder emptied: 22394825 bytes
    ->Temporary Internet Files folder emptied: 119057443 bytes
    ->FireFox cache emptied: 59936832 bytes

    User: Juho & Aapo
    ->Temp folder emptied: 136362219 bytes
    ->Temporary Internet Files folder emptied: 160712995 bytes
    ->Java cache emptied: 199056817 bytes
    ->FireFox cache emptied: 62969253 bytes

    User: Järjestelmänvalvoja
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes

    User: LocalService
    ->Temp folder emptied: 65984 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes
    ->FireFox cache emptied: 10641862 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: Tapio
    ->Temp folder emptied: 7246427 bytes
    ->Temporary Internet Files folder emptied: 312375625 bytes
    ->Java cache emptied: 34089086 bytes
    ->FireFox cache emptied: 64058815 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 1107545201 bytes
    %systemroot%\System32 .tmp files removed: 7366086 bytes
    Windows Temp folder emptied: 25229650 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = -1874.66 mb


    OTM by OldTimer - Version 3.0.0.6 log created on 08252009_171446

    Files moved on Reboot...

    Registry entries deleted on Reboot...



    Combofix-loki:

    ComboFix 09-08-24.06 - Juho & Aapo 25.08.2009 18:40.1.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.358.1035.18.767.370 [GMT 3:00]
    Running from: c:\documents and settings\Juho & Aapo\Työpöytä\ComboFix.exe
    AV: avast! antivirus 4.8.1351 [VPS 090823-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
    FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\Installer\48ad5e.msi
    c:\windows\system32\autorun.ini
    c:\windows\system32\mdm.exe
    c:\windows\UA000106.DLL

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_NNSERV
    -------\Service_NNServ


    ((((((((((((((((((((((((( Files Created from 2009-07-25 to 2009-08-25 )))))))))))))))))))))))))))))))
    .

    2009-08-25 14:14 . 2009-08-25 14:14 -------- d-----w- C:\_OTM
    2009-08-25 12:46 . 2009-08-25 15:51 368672 --sha-w- c:\windows\system32\drivers\fidbox.dat
    2009-08-24 18:37 . 2009-08-24 18:37 -------- d-----w- c:\documents and settings\All Users\Application Data\MailFrontier
    2009-08-24 18:37 . 2009-08-24 18:39 4212 ---h--w- c:\windows\system32\zllictbl.dat
    2009-08-24 18:35 . 2009-08-25 15:43 -------- d-----w- c:\windows\Internet Logs
    2009-08-22 17:33 . 2009-08-17 16:04 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2009-08-22 17:33 . 2009-08-17 16:04 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2009-08-22 17:33 . 2009-08-17 16:03 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys
    2009-08-22 17:33 . 2009-08-17 16:02 97480 ----a-w- c:\windows\system32\AvastSS.scr
    2009-08-22 17:33 . 2009-08-17 16:06 93392 ----a-w- c:\windows\system32\drivers\aswmon.sys
    2009-08-22 17:33 . 2009-08-17 16:06 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
    2009-08-22 17:33 . 2009-08-17 16:05 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2009-08-22 17:33 . 2009-08-17 16:05 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2009-08-22 17:33 . 2009-08-17 16:10 1279456 ----a-w- c:\windows\system32\aswBoot.exe
    2009-08-22 17:32 . 2009-08-22 17:32 -------- d-----w- c:\program files\Alwil Software
    2009-08-22 14:37 . 2009-08-22 14:37 -------- d-----w- c:\documents and settings\Juho & Aapo\Application Data\Malwarebytes
    2009-08-22 14:37 . 2009-08-03 10:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-08-22 14:37 . 2009-08-22 14:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-08-22 14:37 . 2009-08-22 14:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-08-22 14:37 . 2009-08-03 10:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-22 11:20 . 2009-08-22 11:20 -------- d-----w- c:\program files\Trend Micro
    2009-08-17 16:49 . 2009-08-17 16:49 -------- d-----w- c:\documents and settings\Juho & Aapo\Application Data\Disney Interactive Studios
    2009-08-17 16:25 . 2008-07-31 07:41 68616 ----a-w- c:\windows\system32\XAPOFX1_1.dll
    2009-08-17 16:25 . 2008-07-31 07:41 238088 ----a-w- c:\windows\system32\xactengine3_2.dll
    2009-08-17 16:25 . 2008-07-31 07:40 509448 ----a-w- c:\windows\system32\XAudio2_2.dll
    2009-08-17 16:25 . 2008-07-12 05:18 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
    2009-08-17 16:25 . 2008-07-12 05:18 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
    2009-08-17 16:25 . 2008-07-12 05:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
    2009-08-16 19:40 . 2009-08-17 15:59 -------- d-----w- c:\documents and settings\Juho\Application Data\skypePM
    2009-08-16 12:14 . 2009-08-16 12:14 -------- d-----w- c:\program files\DAEMON Tools Lite
    2009-08-14 14:23 . 2009-08-14 14:23 -------- d-----w- c:\program files\Common Files\Digidesign
    2009-08-13 12:12 . 2009-07-10 13:28 1315328 ------w- c:\windows\system32\dllcache\msoe.dll
    2009-08-07 16:28 . 2009-08-07 16:28 -------- d-----w- c:\windows\system32\XPSViewer
    2009-08-07 16:28 . 2009-08-07 16:28 -------- d-----w- c:\program files\MSBuild
    2009-08-07 16:28 . 2009-08-07 16:28 -------- d-----w- c:\program files\Reference Assemblies
    2009-08-07 16:27 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
    2009-08-07 16:27 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
    2009-08-07 16:27 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll
    2009-08-07 16:27 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
    2009-08-07 16:27 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
    2009-08-07 16:27 . 2009-08-07 16:28 -------- d-----w- C:\4a80da4a8edbe098777673
    2009-08-07 16:27 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
    2009-08-07 16:27 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll
    2009-08-06 09:26 . 2009-08-06 09:27 -------- d-----w- c:\documents and settings\Juho & Aapo\Local Settings\Application Data\Deployment

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-25 15:48 . 2009-08-25 12:46 6320 --sha-w- c:\windows\system32\drivers\fidbox.idx
    2009-08-25 14:15 . 2006-07-21 13:40 -------- d-----w- c:\program files\Windows TaskAd
    2009-08-25 12:59 . 2007-07-23 11:01 1324 ----a-w- c:\windows\system32\d3d9caps.dat
    2009-08-25 12:46 . 2009-08-25 12:46 1091241 ----a-w- c:\windows\Internet Logs\tvDebug.zip
    2009-08-24 18:36 . 2009-08-24 18:36 -------- d-----w- c:\program files\Zone Labs
    2009-08-23 15:59 . 2009-04-14 13:58 -------- d-----w- c:\program files\DNA
    2009-08-23 15:59 . 2009-04-14 13:58 -------- d-----w- c:\documents and settings\Juho & Aapo\Application Data\DNA
    2009-08-22 16:48 . 2006-07-01 14:27 101000 -c--a-w- c:\documents and settings\Tapio\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-08-22 16:40 . 2007-05-04 15:06 -------- d-----w- c:\documents and settings\Juho\Application Data\Skype
    2009-08-22 09:10 . 2007-04-23 12:58 101000 ----a-w- c:\documents and settings\Juho & Aapo\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-08-18 19:37 . 2009-03-11 18:11 -------- d-----w- c:\documents and settings\Juho\Application Data\Save
    2009-08-17 16:49 . 2009-04-14 13:59 -------- d-----w- c:\documents and settings\Juho & Aapo\Application Data\BitTorrent
    2009-08-17 16:39 . 2005-10-21 23:35 -------- d--h--w- c:\program files\InstallShield Installation Information
    2009-08-07 16:34 . 2005-10-21 23:15 86150 ----a-w- c:\windows\system32\perfc00B.dat
    2009-08-07 16:34 . 2005-10-21 23:15 417546 ----a-w- c:\windows\system32\perfh00B.dat
    2009-08-05 09:00 . 2005-10-21 23:15 204800 ----a-w- c:\windows\system32\mswebdvd.dll
    2009-07-30 10:17 . 2006-06-21 16:41 -------- d-----w- c:\program files\Common Files\Adobe
    2009-07-20 18:40 . 2007-05-02 04:52 -------- d-----w- c:\documents and settings\Juho & Aapo\Application Data\Skype
    2009-07-20 18:38 . 2009-07-20 18:38 56 ---ha-w- c:\windows\system32\ezsidmv.dat
    2009-07-20 18:38 . 2009-07-20 18:38 -------- d-----w- c:\documents and settings\Juho & Aapo\Application Data\skypePM
    2009-07-20 18:38 . 2009-07-20 18:38 -------- d-----r- c:\program files\Skype
    2009-07-20 18:38 . 2009-07-20 18:38 -------- d-----w- c:\program files\Common Files\Skype
    2009-07-20 18:38 . 2007-05-01 17:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
    2009-07-17 19:02 . 2005-10-21 23:15 58880 ----a-w- c:\windows\system32\atl.dll
    2009-07-17 14:34 . 2009-07-17 13:42 -------- d-----w- c:\program files\MSECache
    2009-07-17 14:16 . 2009-07-17 14:16 1 ----a-w- c:\documents and settings\Tapio\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
    2009-07-17 14:15 . 2009-07-17 14:15 -------- d-----w- c:\documents and settings\Tapio\Application Data\OpenOffice.org
    2009-07-17 14:13 . 2009-07-17 14:13 -------- d-----w- c:\program files\OpenOffice.org 3
    2009-07-14 20:04 . 2009-05-23 08:22 -------- d-----w- c:\documents and settings\Juho\Application Data\BitTorrent
    2009-07-13 20:43 . 2005-10-21 23:16 286208 ----a-w- c:\windows\system32\wmpdxm.dll
    2009-06-26 16:50 . 2005-10-21 23:15 666624 ----a-w- c:\windows\system32\wininet.dll
    2009-06-26 16:50 . 2005-10-21 23:15 81920 ----a-w- c:\windows\system32\ieencode.dll
    2009-06-16 14:39 . 2005-10-21 23:15 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-06-16 14:39 . 2005-10-21 23:15 81920 ----a-w- c:\windows\system32\fontsub.dll
    2009-06-15 10:44 . 2005-10-21 23:15 76800 ----a-w- c:\windows\system32\telnet.exe
    2009-06-10 14:15 . 2005-10-21 23:15 84992 ----a-w- c:\windows\system32\avifil32.dll
    2009-06-10 06:21 . 2005-10-21 23:25 2066432 ----a-w- c:\windows\system32\mstscax.dll
    2009-06-10 06:15 . 2005-10-21 23:15 132096 ----a-w- c:\windows\system32\wkssvc.dll
    2009-06-08 19:02 . 2006-10-10 16:41 94544 -c--a-w- c:\documents and settings\Juho\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-06-03 19:10 . 2005-10-21 23:15 1291776 ----a-w- c:\windows\system32\quartz.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-15 204288]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 45056]
    "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-14 32768]
    "eRecoveryService"="c:\program files\Acer\eRecovery\Monitor.exe" [2005-06-20 352256]
    "AspireService"="c:\program files\Acer\Acer eMode Management\AspireService.exe" [2005-06-04 110592]
    "MediaSync"="c:\program files\Acer\Acer eConsole\MediaSync.exe" [2005-06-01 421888]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-25 185872]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 919016]
    "VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2005-05-13 53248]
    "VTTrayp"="VTtrayp.exe" - c:\windows\system32\VTTrayp.exe [2005-05-13 143360]
    "SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2005-06-07 77824]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]

    c:\documents and settings\Tapio\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000]

    c:\documents and settings\Juho & Aapo\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    EZ Connect Wireless USB Utility.lnk - c:\program files\SMC\EZ Connect Wireless USB\WlanMonitor.exe [2004-7-9 532480]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\StubInstaller.exe"=
    "c:\\Program Files\\EA SPORTS\\NHL07\\nhl2007pal.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
    "c:\\Program Files\\DNA\\btdna.exe"=
    "d:\\Program Files\\BitTorrent\\bittorrent.exe"=
    "c:\\Program Files\\BitTorrent\\BitTorrent.exe"=
    "d:\\Program Files\\Graffiti Studio 2.0\\Graffiti Studio.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=

    R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [22.8.2009 20:33 114768]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [22.8.2009 20:33 20560]
    R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [24.3.2009 14:17 55152]
    S1 MusCVideo;MusCVideo;c:\windows\system32\drivers\MusCVideo.sys [4.11.2008 16:53 3768]
    S2 FSpm;F-Secure Policy Manager;\??\c:\program files\F-Secure\Common\FSPM.SYS --> c:\program files\F-Secure\Common\FSPM.SYS [?]
    S2 gupdate1c995fb70dde0a2;Google Update Service (gupdate1c995fb70dde0a2);c:\program files\Google\Update\GoogleUpdate.exe [23.2.2009 23:12 133104]
    S3 asbp2poa;asbp2poa;\??\c:\docume~1\JUHO&A~1\LOCALS~1\Temp\asbp2poa.sys --> c:\docume~1\JUHO&A~1\LOCALS~1\Temp\asbp2poa.sys [?]
    S3 fsssvc;Windows Live -perheturva;c:\program files\Windows Live\Family Safety\fsssvc.exe [6.2.2009 18:08 533360]
    S3 MusCAudio;MusCAudio;c:\windows\system32\drivers\MusCAudio.sys [4.11.2008 16:53 23096]
    S4 BackWeb Client - 7681197;F-Secure BackWeb;c:\progra~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE --> c:\progra~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [?]
    S4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;d:\program files\MAGIX\Common\Database\bin\fbserver.exe --> d:\program files\MAGIX\Common\Database\bin\fbserver.exe [?]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-08-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-23 20:11]

    2009-08-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-23 20:11]

    2009-08-21 c:\windows\Tasks\Norton Security Scan for Juho.job
    - c:\program files\Norton Security Scan\Nss.exe [2009-03-13 02:53]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.ruunarinteet.fi/
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: Avaa uuteen etuvälilehteen - c:\program files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?d3854ddbf3e14cc59bfb5a59d47c4300
    IE: Avaa uuteen taustavälilehteen - c:\program files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?d3854ddbf3e14cc59bfb5a59d47c4300
    FF - ProfilePath - c:\documents and settings\Juho & Aapo\Application Data\Mozilla\Firefox\Profiles\3msyvwid.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.ruunarinteet.fi
    FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101761&gct=&gc=1&q=
    FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
    FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np32asw.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
    FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-25 18:51
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-926025441-908459382-2847074879-1007\Software\Microsoft\SystemCertificates\AddressBook*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\�•€|ÿÿÿÿ"•€|ù•Ów*]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\PUBPLACE.HTT"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(3068)
    c:\progra~1\WINDOW~2\wmpband.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\ZoneLabs\vsmon.exe
    c:\program files\Alwil Software\Avast4\aswUpdSv.exe
    c:\program files\Alwil Software\Avast4\ashServ.exe
    c:\program files\acer\Acer eConsole\MediaServerService.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\CDBurnerXP\NMSAccessU.exe
    c:\windows\system32\nvsvc32.exe
    c:\program files\Alwil Software\Avast4\Setup\avast.setup
    c:\program files\Windows Media Player\wmpnetwk.exe
    c:\program files\Alwil Software\Avast4\ashMaiSv.exe
    c:\windows\system32\wbem\wmiapsrv.exe
    .
    **************************************************************************
    .
    Completion time: 2009-08-25 18:55 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-08-25 15:55

    Pre-Run: 3 671 994 368 tavua vapaana
    Post-Run: 3 552 780 288 tavua vapaana

    238 --- E O F --- 2009-08-13 14:20


    Ja hjt-loki:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:00:06, on 25.8.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\acer\Acer eConsole\MediaServerService.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Acer\eRecovery\Monitor.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\SMC\EZ Connect Wireless USB\WlanMonitor.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\CDBurnerXP\NMSAccessU.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Alwil Software\Avast4\setup\avast.setup
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\Program Files\Google\Update\GoogleUpdate.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ruunarinteet.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: EZ Connect Wireless USB Utility.lnk = ?
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?d3854ddbf3e14cc59bfb5a59d47c4300
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?d3854ddbf3e14cc59bfb5a59d47c4300
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\acer\Acer eConsole\MediaServerService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Google Update Service (gupdate1c995fb70dde0a2) (gupdate1c995fb70dde0a2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 8044 bytes
     
    Viimeksi muokattu: 25.08.2009
    fs123, 25.08.2009
    #17
  19. kalminen

    kalminen Regular member

    Liittynyt:
    04.05.2007
    Viestejä:
    3,915
    Kiitokset:
    0
    Pisteet:
    46
    TEMpeistä lähti pöpöjenlisäksi 1.8 Gt roskia


    * Tuplaklikkaa OTM.exe käynnistääksesi sen.
    * Kopioi (CTRL+C) alla olevasta laatikosta kaikki teksti.
    Koodi:
    :files
c:\windows\Tasks\Norton Security Scan for Juho.job 
c:\program files\Norton Security Scan\Nss.exe
    * Palaa takaisin OtmoveIt3, paina oikeanpuoleista hiiren nappia Paste Instructions for Items to be Move-ikkunassa (Keltaisen palkin alla) ja paina Liitä.
    * Paina punaista MoveIt! -nappia.
    * Kopioi (CTRL+C) ja liitä (CTRL+V) Results-ikkunaan (Vihreän palkin alla) tullut teksti seuraavaan viestiisi.
    * Sulje OTM.

    Jos jotain tiedostoa/kansiota ei voitu siirtää heti, ohjelma ehdottaa koneen uudelleenkäynnistystä. Vastaa ehdotukseen Yes, jolloin OtMoveIt käynnistää koneesi uudelleen.

    *********************************************************

    Lataa: RegSeeker.zip työpöydälle:

    Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman.
    Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen.
    Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri
    Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken).
    Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta
    klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin.
    Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet
    Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK".
    Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK".
    Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen.

    -------------------------------------------------------------------------------

    Ensin lataa työpöydälle => winsockfix.exe työpöydälle.

    * Sulje kaikki avoimet ikkunat.
    * Tuplaklikkaa winsockfix.exeä, jonka latasit aiemmin. Anna suorittaa winsockfix, vaikka virustorjunta herjaisi siitä,
    * Klikkaa Fix
    * Klikkaa Kyllä/Yes
    * Odota ja klikkaa OK kun pyydetään käynnistämään uudelleen.

    Mikä tilanne ???
    .
     
    kalminen, 25.08.2009
    #18
  20. fs123

    fs123 Member

    Liittynyt:
    16.06.2009
    Viestejä:
    33
    Kiitokset:
    0
    Pisteet:
    16
    Ajoin ohjelmat.
    ZoneAlarm toimii nyt, mutta netti ei edelleenkään toimi normaalitilassa. Missä vika mahtaa olla?


    Tässä OTM:n loki:

    ========== FILES ==========
    c:\windows\Tasks\Norton Security Scan for Juho.job moved successfully.
    c:\program files\Norton Security Scan\Nss.exe moved successfully.

    OTM by OldTimer - Version 3.0.0.6 log created on 08252009_210246


    Tässä hjt-loki:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:17:28, on 26.8.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Google\Update\GoogleUpdate.exe
    C:\Program Files\acer\Acer eConsole\MediaServerService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Google\Update\GoogleUpdate.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\CDBurnerXP\NMSAccessU.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Acer\eRecovery\Monitor.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\SMC\EZ Connect Wireless USB\WlanMonitor.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Alwil Software\Avast4\setup\avast.setup
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ruunarinteet.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
    O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: EZ Connect Wireless USB Utility.lnk = ?
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?d3854ddbf3e14cc59bfb5a59d47c4300
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?d3854ddbf3e14cc59bfb5a59d47c4300
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\acer\Acer eConsole\MediaServerService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Google Update Service (gupdate1c995fb70dde0a2) (gupdate1c995fb70dde0a2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 8312 bytes
     
    Viimeksi muokattu: 26.08.2009
    fs123, 25.08.2009
    #19
  21. kalminen

    kalminen Regular member

    Liittynyt:
    04.05.2007
    Viestejä:
    3,915
    Kiitokset:
    0
    Pisteet:
    46
    Seuraavaksi poistamme kaikki käytetyt työkalut roskineen.

    * TuplaklikkaaOTM.exe.
    * Klikkaa CleanUp!.
    * Valitse Yes kun kysytään "Begin cleanup Process?".
    * Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.
    * OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.

    -----------------------------------------------------------------

    Tämmöinen jutska pitäisi olla startmenussa, mutta ei ole

    O4 - Startup: EZ Connect Wireless USB Utility.lnk = ?

    En tunne sun netti järjestelmääsi.

    ------------------------------------------------------------

    Sammuta ja käynnistä reititin 10 sekunnin
    kuluttua uudelleen.


    Mene käynnistä -> aloita haku
    Kirjoita cmd ja klikkaa ok
    Kirjoita ipconfig /flushdns , paina enter, kirjoita exit
    ja paina enter

    Jos ei toimi, mene käynnistä -> apuohjelmat -> komentorivi ja kirjoita ipconfig /flushdns sinne ja paina enter. Kirjoita exit ja enter

    Käynnistä uudestaan.
    Testaa.
    .
     
    kalminen, 26.08.2009
    #20
Sivu 1 / 2

Jaa tämä sivu