Kone hidas, netti pätkii, prosesseja 64!

Kone on tullut parin päivän sisällä todella hitaaksi. Tehtävienhallinta ilmoittaa prosesseja olevan 64, vaikka toisessa kohdassa niitä on paljon vähemmän. Toisella käyttäjällä prosesseja on 47, jos ei ole mitään ohjelmia päällä paitsi f-secure. Myös netti pätkii; joka puolestunti netti menee pariksi minuutiksi pois päältä ja tulee sitten kohta takaisin. Nytkin kun kirjoitan tätä koneen kesti ladata tämä kirjoitussivu ainakin minuutin (normaaliaika 1-3sek). Aina pitää olla myös mese päällä, koska siitä mesenkuvakkeessa tuolla ilmoitualueella näkee että koska netti menee poikki, ettei vain lähetä viestiä sillon kun yhteys ei toimi . Kts kuva.




[bold]EDIT: Ainiin unohdin mainita, ettäkun käyttäjän on valinnut niin kaiuttimista alkaa kuulua Kentin kappale Kärleken väntar, vaikka en semmoista sinne ole laittanut[/bold]

 

Laita HjT-loki, ohjelman saat täältä -> http://koti.mbnet.fi/pattaya1/HijackThis.exe .
Tallenna hakemistoon c:\hjt\, käynnistä, klikkaa do a system scan and save a logfile ja lähetä loki tänne.

 

Logfile of HijackThis v1.99.1
Scan saved at 21:09:03, on 13.1.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\DNANET~1\backweb\4653381\Program\SERVIC~1.EXE
C:\Program Files\dna Nettiturva\Anti-Virus\fsgk32st.exe
C:\Program Files\dna Nettiturva\backweb\4653381\program\fsbwsys.exe
C:\Program Files\dna Nettiturva\Anti-Virus\FSGK32.EXE
C:\Program Files\dna Nettiturva\Common\FSMA32.EXE
C:\Program Files\dna Nettiturva\Anti-Virus\fssm32.exe
C:\Program Files\dna Nettiturva\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\dna Nettiturva\Common\FCH32.EXE
C:\Program Files\dna Nettiturva\Common\FAMEH32.EXE
C:\Program Files\dna Nettiturva\Anti-Virus\fsrw.exe
C:\Program Files\dna Nettiturva\FWES\Program\fsdfwd.exe
C:\Program Files\dna Nettiturva\Anti-Virus\fsav32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\dna Nettiturva\Common\FSM32.EXE
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\DNANET~1\ANTI-S~1\fsaw.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\dna Nettiturva\backweb\4653381\Program\dna Nettiturva.exe
C:\Program Files\dna Nettiturva\FSGUI\fsguidll.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dnainternet.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dnainternet.fi
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.fmi.fi
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja dna Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus C66 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE /P23 "EPSON Stylus C66 Series" /O6 "USB001" /M "Stylus C66"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC 200NC PC Camera
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\dna Nettiturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\dna Nettiturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\dna Nettiturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\dna Nettiturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [Microsoft Update] bntewe.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
O4 - HKCU\..\RunServices: [Microsoft Update] bntewe.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: dna Nettiturva.lnk = C:\Program Files\dna Nettiturva\backweb\4653381\Program\dna Nettiturva.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\dna Nettiturva\Anti-Spyware\blockpopups.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\dna Nettiturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\dna Nettiturva\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.dnainternet.fi
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {5BDBD95C-1E7F-4FB1-8497-20AF879F8B68} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fi/filesharingctrl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: dna Nettiturva (BackWeb Plug-in - 4653381) - BackWeb Technologies Inc. - C:\PROGRA~1\DNANET~1\backweb\4653381\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\dna Nettiturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\dna Nettiturva\backweb\4653381\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\dna Nettiturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\dna Nettiturva\Common\FSMA32.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

 

Poista lisää/poista sovelluksia kautta jos löytyy:

Microsoft Update
´
Fixaa nämä rivit HjT:lla

O4 - HKCU\..\Run: [Microsoft Update] bntewe.exe
O4 - HKCU\..\RunServices: [Microsoft Update] bntewe.exe

Laita piilotiedostot näkyviin, ohje ->
http://keskustelu.afterdawn.com/thread_view.cfm/248944

Käytä Windowsin omaa "etsi" palvelua, ja yritä paikantaa "bntewe.exe"

Hae Ewido. http://keskustelu.afterdawn.com/thread_view.cfm/269186
Asenna ja päivitä, mutta älä vielä skannaa.

Käynnistä vikasietotilaan ( F8 käynnistyksen yhteydessä )
Poista bntewe.exe sieltä minne sen paikansit. Tämä taitaa vain vaihtaa nimeä joka bootissa, joten sitä ei ehkä löydy....

Aja Ewido siellä vikasietotilassa, ja säästä raportti

Lähetä uusi loki, ja Ewidon raportti

 

En löytänyt lissä/poista paikasta sitä windows updatea, mutta fisasin ne HJT:llä jota sanoit. Ets toiminto ei löytänyt sitä bntewe.exe ohjelmaa. Tässä ewidon raportti ja uusi HjT.

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 11:25:04, 14.1.2006
+ Report-Checksum: BEC2DD5

+ Scan result:

C:\Raine\virusohje.txt -> Not-A-Virus.Eicar.TestFile : Ignored
HKLM\SOFTWARE\SearchRelevancy -> Spyware.SearchRelevancy : Cleaned with backup
HKLM\SOFTWARE\SearchRelevancy\Update -> Spyware.SearchRelevancy : Cleaned with backup
C:\Documents and Settings\Ari\Cookies\ari@ad.yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Ari\Cookies\ari@image.masterstats[1].txt -> Spyware.Cookie.Masterstats : Cleaned with backup
C:\Documents and Settings\Ari\Cookies\ari@ivwbox[1].txt -> Spyware.Cookie.Ivwbox : Cleaned with backup
C:\Documents and Settings\Ari\Cookies\ari@rotator.adjuggler[1].txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
C:\Documents and Settings\Ari\Cookies\ari@vip.clickzs[1].txt -> Spyware.Cookie.Clickzs : Cleaned with backup
C:\Documents and Settings\Ari\Local Settings\Temporary Internet Files\Content.IE5\O1W74NOV\psg[1].anr -> Downloader.Ani.c : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.24:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.25:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Xxxcounter : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Sextracker : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Sextracker : Cleaned with backup
:mozilla.39:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Sextracker : Cleaned with backup
:mozilla.40:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Sextracker : Cleaned with backup
:mozilla.41:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Sextracker : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Sextracker : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Sextracker : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Sextracker : Cleaned with backup
:mozilla.45:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Sextracker : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Xxxcounter : Cleaned with backup
:mozilla.47:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.48:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Erno\Application Data\Mozilla\Firefox\Profiles\y6t42da8.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
C:\Documents and Settings\Erno\Cookies\erno@ad.adocean[2].txt -> Spyware.Cookie.Adocean : Cleaned with backup
C:\Documents and Settings\Erno\Cookies\erno@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Erno\Cookies\erno@burstnet[1].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Erno\Cookies\erno@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup
C:\Documents and Settings\Erno\Cookies\erno@cz4.clickzs[2].txt -> Spyware.Cookie.Clickzs : Cleaned with backup
C:\Documents and Settings\Erno\Cookies\erno@ivwbox[1].txt -> Spyware.Cookie.Ivwbox : Cleaned with backup
C:\Documents and Settings\Erno\Cookies\erno@yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\OEMCUST\TOOLS\WIN32\PSKILL.EXE -> Not-A-Virus.NetTool.Win32.PsKill : Cleaned with backup
C:\System Volume Information\_restore{9E4574A8-9287-4DF8-9874-671EE0C7ED40}\RP547\A0189526.DLL -> Adware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{9E4574A8-9287-4DF8-9874-671EE0C7ED40}\RP547\A0189527.dll -> Spyware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{9E4574A8-9287-4DF8-9874-671EE0C7ED40}\RP547\A0189529.DLL -> Adware.MyWebSearch : Cleaned with backup
C:\System Volume Information\_restore{9E4574A8-9287-4DF8-9874-671EE0C7ED40}\RP547\A0189532.EXE -> Spyware.Wesbar : Cleaned with backup
C:\System Volume Information\_restore{9E4574A8-9287-4DF8-9874-671EE0C7ED40}\RP547\A0189534.DLL -> Spyware.MyWebSearch : Cleaned with backup


::Report End


Logfile of HijackThis v1.99.1
Scan saved at 11:28:26, on 14.1.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\DNANET~1\backweb\4653381\Program\SERVIC~1.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\dna Nettiturva\backweb\4653381\Program\dna Nettiturva.exe
C:\Program Files\dna Nettiturva\Anti-Virus\fsgk32st.exe
C:\Program Files\dna Nettiturva\backweb\4653381\program\fsbwsys.exe
C:\Program Files\dna Nettiturva\Anti-Virus\FSGK32.EXE
C:\Program Files\dna Nettiturva\Common\FSMA32.EXE
C:\Program Files\dna Nettiturva\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\dna Nettiturva\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\dna Nettiturva\Common\FCH32.EXE
C:\Program Files\dna Nettiturva\Common\FAMEH32.EXE
C:\Program Files\dna Nettiturva\Anti-Virus\fsrw.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\dna Nettiturva\Common\FSM32.EXE
C:\Program Files\dna Nettiturva\FSGUI\ispnews.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Teknum Systems\updsvc.exe
C:\Program Files\dna Nettiturva\FWES\Program\fsdfwd.exe
C:\Program Files\dna Nettiturva\Anti-Virus\fsav32.exe
C:\PROGRA~1\DNANET~1\ANTI-S~1\fsaw.exe
C:\Program Files\dna Nettiturva\FSGUI\fsguidll.exe
C:\WINDOWS\System32\svchost.exe
C:\HJT\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dnainternet.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dnainternet.fi
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.fmi.fi
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja dna Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus C66 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE /P23 "EPSON Stylus C66 Series" /O6 "USB001" /M "Stylus C66"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC 200NC PC Camera
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\dna Nettiturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\dna Nettiturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\dna Nettiturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\dna Nettiturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: dna Nettiturva.lnk = C:\Program Files\dna Nettiturva\backweb\4653381\Program\dna Nettiturva.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\dna Nettiturva\Anti-Spyware\blockpopups.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\dna Nettiturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\dna Nettiturva\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.dnainternet.fi
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {5BDBD95C-1E7F-4FB1-8497-20AF879F8B68} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fi/filesharingctrl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: dna Nettiturva (BackWeb Plug-in - 4653381) - BackWeb Technologies Inc. - C:\PROGRA~1\DNANET~1\backweb\4653381\Program\SERVIC~1.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\dna Nettiturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\dna Nettiturva\backweb\4653381\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\dna Nettiturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\dna Nettiturva\Common\FSMA32.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

 

Mun silmiin on puhdasta. Auttoiko yhtään, vai aletaanko karsimaan käynnistyviä ohjelmia pois?

 

Netti katkesi kokonaan. JOudun olemaan vikasietotilassa netissä kun ei muuten toimi.

 

No johan on... Ei ainakaan noista fixeistä kyllä johdu, eikä Ewidon poistoistakaan. Kokeillaanpas eScania tähän väliin. Ohjeet ja lataus > http://koti.mbnet.fi/pattaya1/escanmwav.htm
Kopioi ne alalaatikon "örkkitulokset" tänne

 

Ok. Nyt laitoin escanin päälle. Ja kas kummaa kun vielä kokeilin niin netti toimiikin. Mutta laitan sit ne tulokset tänne.

 

Taitaapi tuo netin pätkiminen muuten johtua palveluntarjoajasta. kun noin satunnaisesti pätkii. Kannattaa ainakin sinnepäin laittaa meiliä, tai soittaa ja kysyä onko ollut muillakin ongelmia.

 

Tässä se nyt on:

File C:\WINDOWS\RESTORE.INS tagged as not-a-virus:NetTool.Win32.PsKill. No Action Taken.
File C:\Documents and Settings\Ari\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jar.jar-521c4f7f-788924cd.zip infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Ari\Local Settings\Temporary Internet Files\Content.IE5\7WJBAT6P\full[1].anr infected by "Trojan-Downloader.Win32.Ani.c" Virus. Action Taken: File Deleted.
File C:\Program Files\mIRC\backup\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
File C:\Raine\Asennustiedostot\mirc616.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
File C:\Raine\kf141.zip tagged as not-a-virusSWTool.Win32.RAS.a. No Action Taken.
File C:\Raine\SmileyCentralFFSetup2.0.4.2.exe tagged as not-a-virus:AdWare.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9E4574A8-9287-4DF8-9874-671EE0C7ED40}\RP538\A0186295.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
File C:\System Volume Information\_restore{9E4574A8-9287-4DF8-9874-671EE0C7ED40}\RP538\A0186296.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
File C:\System Volume Information\_restore{9E4574A8-9287-4DF8-9874-671EE0C7ED40}\RP544\A0188917.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
File C:\System Volume Information\_restore{9E4574A8-9287-4DF8-9874-671EE0C7ED40}\RP547\A0189528.DLL tagged as not-a-virus:AdWare.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9E4574A8-9287-4DF8-9874-671EE0C7ED40}\RP547\A0189530.DLL tagged as not-a-virus:AdWare.Win32.MyWebSearch.t. No Action Taken.
File C:\System Volume Information\_restore{9E4574A8-9287-4DF8-9874-671EE0C7ED40}\RP547\A0189531.DLL tagged as not-a-virus:AdWare.Win32.MyWebSearch.p. No Action Taken.
File C:\System Volume Information\_restore{9E4574A8-9287-4DF8-9874-671EE0C7ED40}\RP547\A0189533.DLL tagged as not-a-virus:AdWare.Win32.MyWebSearch. No Action Taken.
File C:\System Volume Information\_restore{9E4574A8-9287-4DF8-9874-671EE0C7ED40}\RP547\A0189560.dll tagged as not-a-virus:AdWare.Win32.MyWebSearch.p. No Action Taken.
File C:\System Volume Information\_restore{9E4574A8-9287-4DF8-9874-671EE0C7ED40}\RP571\A0195359.exe tagged as not-a-virusSWTool.Win32.RAS.a. No Action Taken.
File C:\System Volume Information\_restore{9E4574A8-9287-4DF8-9874-671EE0C7ED40}\RP580\A0196068.EXE tagged as not-a-virus:NetTool.Win32.PsKill. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\DeskAdX.dll tagged as not-a-virus:AdWare.Win32.WinAD.n. No Action Taken.
File C:\WINDOWS\RESTORE.INS tagged as not-a-virus:NetTool.Win32.PsKill. No Action Taken.
File C:\WINDOWS\system\RESTORE.INS tagged as not-a-virus:NetTool.Win32.PsKill. No Action Taken.

 

File C:\Raine\====>SmileyCentralFFSetup2.0.4.2.exe<====
File C:\WINDOWS\Downloaded Program Files\===>DeskAdX.dll<=====

Poista nuo, ja katso onko lisää/poista valikossa

Mywebsearch
Smileycentral Tai vastaavia ja poista jos on

 

En löytänyt muita kuin tämän: File C:\Raine\====>SmileyCentralFFSetup2.0.4.2.exe<====

Prosesseja 68 ja näkyvissä 18. Ihmettelin tätä prosessia että mikä tämä on: E_s4i0s2.exe En tiedä onko toi i vai ykkönen.

EDIT: Pitäisikö asentaa windows uudestaan?

EDIT 2: Taas katkesi netti ja tuli n. 5 min. päästä takaisin.

 

Tuo kyseinen filu on Epsonin printterin ajuri todennäköisesti.

Turhaan käynnistyviä ohjelmia sinulla on todella paljon!
Nyt on vähän muuta tekemistä, mutta jos jaksat, niin helppo tapa tarkistaa nämä prosessit on tsekata ne tuolla > http://sysinfo.org/startuplist.php

Siis tarkistat nuo 04 rivit tuolla siten, että laitat sen hakasulkeiden sisällä olevan osan tuohon kenttään, ja katsot mitä sivusto sanoo siitä.
Mielestäni kaikki joiden tulos on "N" tai "U" voit ottaa pois käynnistyksestä, eli fixata rivin HjT:lla. Ole tarkkana kuitenkin, sillä esim tuo O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
Näyttää ensialkuun "örkiltä", mutta kun tarkemmin katsot huomaat sen olevan ihan OK, tosin turhaan käynnistyvä =)
Vaikutukset tietenkin näkyvät vasta seuraavan bootin yhteydessä.

Jos et itse halua hommaa tehdä, niin voin yöllä katsella nuo läpi jos kerkeän.

 

Asenna windows uudestaan

 

Ei kannata lähtee forkkaamaan, kun asiat voi ratkoa näinkin. -_-

 

Jos vain viitsit niin mun puolesta saat kattoo

 

No nyt olis aikaa... Kattelen noi läpi, ja kerron mitä voit fixailla =)

 

Eli fixaile näitä oman maun mukaan HjT:lla. Kaikki ovat turvallisia poistaa, mutta eivät luonnollisesti enää käynnisty automaattisesti,
vaan jos haluat kyseistä ohjelmaa käyttää joudut sen itse käynnistämään.

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

Jos joku tuntuu siltä, että ei ollut hyvä idea poistaa voit aina palauttaa ne HjT:n backupeista.
Esim tuo O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
liittyy jotenkin Nvidian näyttikseen, mutta ei ole mitenkään välttämätön.

 

Selvä!!