Viitteiskö joku viisaampi ja tietävämpi kertoa tosta logista mulle mitä on tehtävissä, kone jumittaa ainakin aikas paljon. ja latailee koko ajan jotain ihan omias Logfile of HijackThis v1.99.1 Scan saved at 20:04:19, on 16.1.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\windows\system\hpsysdrv.exe C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Multimedia Card Reader\shwicon2k.exe C:\Program Files\AVPersonal\AVSched32.EXE C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\pchbutton.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\DC++\DCPlusPlus.exe c:\progra~1\intern~1\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\Lavalys\EVEREST Home Edition\everest.bin C:\Documents and Settings\Omistaja\Omat tiedostot\win archive\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Omistaja\LOCALS~1\Temp\se.dll/sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Omistaja\LOCALS~1\Temp\se.dll/sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Internet R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit R3 - Default URLSearchHook is missing N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.lszbzwlaqewbrpnhbu.net/vecXCDG1pdCpzdzfGItWbab1k2xnnkb36NfNxL2PJ4o.html"); (C:\Documents and Settings\Omistaja\Application Data\Mozilla\Profiles\default\hgntt6u7.slt\prefs.js) N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Omistaja\Application Data\Mozilla\Profiles\default\hgntt6u7.slt\prefs.js) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {6EA76690-19F6-D09C-CDEB-3C704008F2F6} - C:\DOCUME~1\Omistaja\APPLIC~1\JUGSFIND\rule barb.exe O2 - BHO: (no name) - {8CD72AD4-129F-440D-93F3-F259185D6F2B} - C:\WINDOWS\system32\jomb.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll O3 - Toolbar: (no name) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file) O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe" O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [pqbmpsr] C:\WINDOWS\pqbmpsr.exe O4 - HKLM\..\Run: [Grim tray atom boob] C:\Documents and Settings\All Users\Application Data\Exit New Grim Tray\UPMANAGER.exe O4 - HKLM\..\Run: [166_€MÅ"—Ëì9ïpy3ÒÕŸWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\jjifh.exe O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe" O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\Omistaja\LOCALS~1\Temp\se.dll,DllInstall O4 - HKLM\..\Run: [okay scr face more] C:\Documents and Settings\All Users\Application Data\listupokayscr\love 2.exe O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe O4 - HKCU\..\Run: [Axis Four] C:\DOCUME~1\Omistaja\APPLIC~1\ERRORR~1\DupeBalmPlan.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan O4 - HKCU\..\Run: [MessengerPlus3] "\" /WinStart O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\pchbutton.exe O8 - Extra context menu item: &Search - http://kc.bar.need2find.com/KC/menusearch.html?p=KC O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi O16 - DPF: {81B9C506-46D3-4667-9018-3D6575CBC046} (VacPro.finland_ver10) - http://advnt01.com/dialer/finland_ver10.CAB O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Filter: text/html - {20E9DE15-F116-4B42-B336-7672734CB96B} - C:\WINDOWS\system32\jomb.dll O18 - Filter: text/plain - {20E9DE15-F116-4B42-B336-7672734CB96B} - C:\WINDOWS\system32\jomb.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~2\backweb\4436233\Program\SERVIC~1.EXE (file missing) O23 - Service: F-Secure Gatekeeper Handler Starter - Unknown owner - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe (file missing) O23 - Service: fsbwsys - Unknown owner - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe (file missing) O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - Unknown owner - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe (file missing) O23 - Service: F-Secure Management Agent (FSMA) - Unknown owner - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Onhan noita fixattavia, mutta älä fixaa mitään ennen asiantuntijan vahvistusta! Oman käsitykseni mukaan nämä olisi fixattava: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R3 - Default URLSearchHook is missing O3 - Toolbar: (no name) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - Unknown owner - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe (file missing) O23 - Service: F-Secure Management Agent (FSMA) - Unknown owner - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE (file missing) O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~2\backweb\4436233\Program\SERVIC~1.EXE (file missing) O23 - Service: F-Secure Gatekeeper Handler Starter - Unknown owner - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe (file missing) O23 - Service: fsbwsys - Unknown owner - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe (file missing) [bold]HUOM!! Ota tämä teksti vakavissasi: Nuo on siis vain minun käsitykseni ja olen aloitteleva älä vaan mene fixaamaan mitään ennenkuin joku expertti tulee vahvistamaan nämä!! Kuten esim. spertti, aaxxeell, tai -kemisti- saisi vahvistaa nämä ennenkuin saat mennä fixaamaan mitään.[/bold]
@Tonski: Siellä on paljon muutakin fixattavaa/poistettavaa ja tuolle about:blank-variantille (se.dll/sp.html) on ihan oma fixinsä.
Viitteisiks tarkistaa sen listan ja kertoo mitkä pitäis fixata ja miten alkaa ottaa pannuun tää kone ku lataa vaan ja lataa, vaik ei pitäis mitään olla ees ladattavaa!!??
Selvä... Kunhan koetin että mitenkä tämä nyt menee kun alkuun pääsin. Menikö miten paljon vikaan? Mikä fixi tuolle muuten on tuolle about:blankille? (Misc Tools?) Ja mitä muuta sieltä löytyi? (Ota sinä pätevämpänä ohjat tuon ov16v:n auttamisessa) =)
Hyvin löysit epäkohtia Tonski tässä tulevat ohjeet: Tallenna meneillään olevat projektit. Lataa puhdistus työkalu -> http://www.trojaner-info.de/cgi-bin/download.cgi?file=sphjfix Tallenna hakemistoon -> Avaa -> Klikkaa "desinfektionen starten" anna suorittaa puhdistus tavallisesti loppuun jonka jälkeen kone käynnistyy uudelleen. Lähetä sen jälkeen uusi Hjt loki.
@ov16: aaxxeellilta tulee pian fixi, en mene väliin @Tonski: No ei tuo about:blank olisi sillä lähtenyt. Ihan siis oma ajettava fixi on sille, ei mitään tekemistä HjT:n kanssa. Nämä rivit kuuluvat tuohon about:blankiin: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Omistaja\LOCALS~1\Temp\se.dll/sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Omistaja\LOCALS~1\Temp\se.dll/sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: (no name) - {8CD72AD4-129F-440D-93F3-F259185D6F2B} - C:\WINDOWS\system32\jomb.dll O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\Omistaja\LOCALS~1\Temp\se.dll,DllInstall O18 - Filter: text/html - {20E9DE15-F116-4B42-B336-7672734CB96B} - C:\WINDOWS\system32\jomb.dll O18 - Filter: text/plain - {20E9DE15-F116-4B42-B336-7672734CB96B} - C:\WINDOWS\system32\jomb.dll
Kiitos aaxxeell. Takaisin opettelemaan silti vaan... Olen tosi aloitteleva näissä. Hiljaa hyvä tulee.
Tosa on toi uus logi ton tarkistuksen jälkeen onko siin viel paljon jotain epäkohtia? Logfile of HijackThis v1.99.1 Scan saved at 21:08:06, on 16.1.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AVPersonal\AVWUPSRV.EXE C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\windows\system\hpsysdrv.exe C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\hphmon05.exe C:\HP\KBD\KBD.EXE C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Multimedia Card Reader\shwicon2k.exe C:\Windows\Creator\Remind_XP.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\AVPersonal\AVSched32.EXE c:\progra~1\intern~1\iexplore.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\pchbutton.exe C:\Documents and Settings\Omistaja\Omat tiedostot\win archive\HijackThis.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dliocfhrspgorl.com/vecXCDG1pdDQjU71wEzz9Q52Bf5I4AlqthaENhIn51Lq6yhstu/EHGWgfv0mAeFf.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Omistaja\LOCALS~1\Temp\se.dll/sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Internet R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit R3 - Default URLSearchHook is missing N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.lszbzwlaqewbrpnhbu.net/vecXCDG1pdCpzdzfGItWbab1k2xnnkb36NfNxL2PJ4o.html"); (C:\Documents and Settings\Omistaja\Application Data\Mozilla\Profiles\default\hgntt6u7.slt\prefs.js) N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Omistaja\Application Data\Mozilla\Profiles\default\hgntt6u7.slt\prefs.js) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {6EA76690-19F6-D09C-CDEB-3C704008F2F6} - C:\DOCUME~1\Omistaja\APPLIC~1\JUGSFIND\rule barb.exe O2 - BHO: (no name) - {806B08B6-5F87-4F92-8C7B-EB91F14489BB} - C:\WINDOWS\system32\jomb.dll (file missing) O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll O3 - Toolbar: (no name) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file) O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe" O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [pqbmpsr] C:\WINDOWS\pqbmpsr.exe O4 - HKLM\..\Run: [Grim tray atom boob] C:\Documents and Settings\All Users\Application Data\Exit New Grim Tray\UPMANAGER.exe O4 - HKLM\..\Run: [166_€MÅ"—Ëì9ïpy3ÒÕŸWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\jjifh.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min O4 - HKLM\..\Run: [okay scr face more] C:\Documents and Settings\All Users\Application Data\listupokayscr\love 2.exe O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\Omistaja\LOCALS~1\Temp\se.dll,DllInstall O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe O4 - HKCU\..\Run: [Axis Four] C:\DOCUME~1\Omistaja\APPLIC~1\ERRORR~1\DupeBalmPlan.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan O4 - HKCU\..\Run: [MessengerPlus3] "\" /WinStart O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\pchbutton.exe O8 - Extra context menu item: &Search - http://kc.bar.need2find.com/KC/menusearch.html?p=KC O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi O16 - DPF: {81B9C506-46D3-4667-9018-3D6575CBC046} (VacPro.finland_ver10) - http://advnt01.com/dialer/finland_ver10.CAB O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Filter: text/html - {39B4821E-07B3-4D66-AF0C-217400ECD2FD} - C:\WINDOWS\system32\jomb.dll O18 - Filter: text/plain - {39B4821E-07B3-4D66-AF0C-217400ECD2FD} - C:\WINDOWS\system32\jomb.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~2\backweb\4436233\Program\SERVIC~1.EXE (file missing) O23 - Service: fsbwsys - Unknown owner - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe (file missing) O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - Unknown owner - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe (file missing) O23 - Service: F-Secure Management Agent (FSMA) - Unknown owner - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Toi f secure on temppuillut mun kans ku oon asentanu sen ni kone ei suostu menemään windowsiin vaan sammu ku on ollu muutaman sekunnin windowsissa ja käynnistyy uudelleen. olen sen jälkeen menny vikasieto tilassa poistamaan f securen mutta kaikkia tiedostoja ei meinaa saada poistettua.Kaks kertaa oon asentanut sen ja sama homma. Ihan on lailliset lisenssit ja kaikki.
Tässä se uusi on... F-secure, soneran tietoturvan olet poistanut? kerio ja antivir suojaavat konetta ja ovat ajan tasalla? Ohjauspaneeli -> Lisää/poista sovellus Poista jos löytyvät: ->MessengerPlus ->Spyware Begone Fixaa seuraava, eli do a system scan only, laita rasti seuraavaan ja fix checked: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dliocfhrspgorl.com/vecXCDG1pdDQjU71wEzz9Q52Bf5I4Alqtha... R3 - Default URLSearchHook is missing N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.lszbzwlaqewbrpnhbu.net/vecXCDG1pdCpzdzfGItWbab1k2xnnkb...); (C:\Documents and Settings\Omistaja\Application Data\Mozilla\Profiles\default\hgntt6u7.slt\prefs.js) O2 - BHO: (no name) - {6EA76690-19F6-D09C-CDEB-3C704008F2F6} - C:\DOCUME~1\Omistaja\APPLIC~1\JUGSFIND\rule barb.exe O3 - Toolbar: (no name) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file) O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [pqbmpsr] C:\WINDOWS\pqbmpsr.exe O4 - HKLM\..\Run: [Grim tray atom boob] C:\Documents and Settings\All Users\Application Data\Exit New Grim Tray\UPMANAGER.exe O4 - HKLM\..\Run: [166_€MÅ"—Ëì9ïpy3ÒÕŸWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\jjifh.exe O4 - HKLM\..\Run: [okay scr face more] C:\Documents and Settings\All Users\Application Data\listupokayscr\love 2.exe O4 - HKCU\..\Run: [Axis Four] C:\DOCUME~1\Omistaja\APPLIC~1\ERRORR~1\DupeBalmPlan.exe O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan O4 - HKCU\..\Run: [MessengerPlus3] "\" /WinStart O8 - Extra context menu item: &Search - http://kc.bar.need2find.com/KC/menusearch.html?p=KC O16 - DPF: {81B9C506-46D3-4667-9018-3D6575CBC046} (VacPro.finland_ver10) - http://advnt01.com/dialer/finland_ver10.CAB O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab Hae ewido ja päivitä -> http://keskustelu.afterdawn.com/thread_view.cfm/269186 Hae eScan ja päivitä myös mutta älä aja kumpakaan vielä. -> http://koti.mbnet.fi/pattaya1/escanmwav.htm Laita piilotiedostot näkyviin, ohje -> http://keskustelu.afterdawn.com/thread_view.cfm/248944 Poista vikasietotilassa: (Naputtele f8 käynnistyksen yhteydessä ja valitse vikasietotila) C:\DOCUME~1\Omistaja\APPLIC~1\-->JUGSFIND<--- C:\WINDOWS\-->pqbmpsr.exe<--- C:\Documents and Settings\All Users\Application Data\-->Exit New Grim Tray<-- C:\WINDOWS\-->jjifh.exe<-- C:\Documents and Settings\All Users\Application Data\-->listupokayscr<--- C:\DOCUME~1\Omistaja\APPLIC~1\--->ERRORR~1\<--- c:-->\freescan<-- Aja ewido ja eScan vikasietotilassa samalla. Tallenna raportit. Palaa normaalitilaan ja lähetä uusi hjt loki, ewidon raportti sekä eScanin löydöt (se alempi laatikko softassa) Tee ohjeiden mukaisesti, älä siis omaa sooloa yritä. Tallenna vaikka tämä ohje siten että se on aina ulottuvillasi kun puhdistat.
