* C:\Documents and Settings\Omistaja\Local Settings\Temp\WIN5F.TMP.0XE Virustartunta: Trojan.Win32.Dialer.oy * C:\Documents and Settings\Omistaja\Local Settings\Temp\WIN47.TMP.0XE Virustartunta: Trojan.Win32.Dialer.oy * C:\Documents and Settings\Omistaja\Local Settings\Temp\cli5E.tmp Virustartunta: Trojan.Win32.Agent.qt Nimetty uudelleen. * C:\Documents and Settings\Omistaja\Local Settings\Temp\cli5.tmp Virustartunta: Trojan.Win32.Agent.qt Nimetty uudelleen. * C:\Documents and Settings\Omistaja\Local Settings\Temp\cli46.tmp Virustartunta: Trojan.Win32.Agent.qt Nimetty uudelleen. * C:\Documents and Settings\Omistaja\Local Settings\Temp\cli3F.tmp Virustartunta: Trojan.Win32.Agent.qt Nimetty uudelleen. * C:\Documents and Settings\Omistaja\Local Settings\Temp\cli38.tmp Virustartunta: Trojan.Win32.Agent.qt Nimetty uudelleen. * C:\Documents and Settings\Omistaja\Local Settings\Temp\cli31.tmp Virustartunta: Trojan.Win32.Agent.qt Nimetty uudelleen. * C:\Documents and Settings\Omistaja\Local Settings\Temp\cli2A.tmp Virustartunta: Trojan.Win32.Agent.qt Nimetty uudelleen. * C:\Documents and Settings\Omistaja\Local Settings\Temp\cli25.tmp Virustartunta: Trojan.Win32.Agent.qt Nimetty uudelleen. * C:\Documents and Settings\Omistaja\Local Settings\Temp\cli21.tmp Virustartunta: Trojan.Win32.Agent.qt Nimetty uudelleen. * C:\Documents and Settings\Omistaja\Local Settings\Temp\cli1D.tmp Virustartunta: Trojan.Win32.Agent.qt Nimetty uudelleen. * C:\Documents and Settings\Omistaja\Local Settings\Temp\cli16.tmp Virustartunta: Trojan.Win32.Agent.qt Nimetty uudelleen. * C:\Documents and Settings\Omistaja\Local Settings\Temp\bisDB.exe Virustartunta: Trojan-Downloader.Win32.Swizzor.co * C:\WINDOWS\system32\WINJGF32.0LL Virustartunta: Trojan.Win32.Agent.qt * C:\WINDOWS\system32\MSsec32.exe Virustartunta: Backdoor.Win32.Rbot.gen Nimetty uudelleen. * C:\WINDOWS\system32\iexplorer.exe Virustartunta: Backdoor.Win32.Rbot.gen Nimetty uudelleen. * Tiedoston C:\pagefile.sys avaaminen ei onnistu. * Tiedoston C:\WINDOWS\system32\config\default avaaminen ei onnistu. * Tiedoston C:\WINDOWS\system32\config\SAM avaaminen ei onnistu. * Tiedoston C:\WINDOWS\system32\config\SECURITY avaaminen ei onnistu. * Tiedoston C:\WINDOWS\system32\config\system avaaminen ei onnistu. * Tiedoston C:\Program Files\F-Secure\Common\policy.ipf avaaminen ei onnistu. * Tiedoston C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\chandir.dat avaaminen ei onnistu. * Tiedoston C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\D0000000.FCS avaaminen ei onnistu. * Tiedoston C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\L0000001.FCS avaaminen ei onnistu. * Tiedoston C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs.dat avaaminen ei onnistu. * Tiedoston C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\storydb.dat avaaminen ei onnistu. * Tiedoston C:\Documents and Settings\Omistaja\NTUSER.DAT avaaminen ei onnistu. * Tiedoston C:\Documents and Settings\Omistaja\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat avaaminen ei onnistu. * Tiedoston C:\Documents and Settings\NetworkService\NTUSER.DAT avaaminen ei onnistu. * Tiedoston C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat avaaminen ei onnistu. * Tiedoston C:\Documents and Settings\LocalService\NTUSER.DAT avaaminen ei onnistu. * Tiedoston C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat avaaminen ei onnistu. tos on f-securen logi käyn hakee tähän viel hjt-login
tota miksköhän en saa ladattua hjt:tä aina vaa sivusto käskee kokeilla tota rekisteröitymitä ja kun rekisteröityy nii se pyytää rekisteröitymää taas kun pääsee latauslinkkiä painamasta ni taas pitäs rekisteröityä et muuten ei onnaa! missähän vika?
tässä ois tää hjt-logi jos joku kattois... Logfile of HijackThis v1.99.1 Scan saved at 19:10:56, on 18.4.2006 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\ewido anti-malware\ewidoguard.exe C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE C:\Program Files\F-Secure\Anti-Virus\fssm32.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\F-Secure\Common\FSMA32.EXE C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Program Files\F-Secure\Common\FSMB32.EXE C:\Program Files\F-Secure\Common\FCH32.EXE C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\Program Files\F-Secure\Common\FSM32.EXE C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\F-Secure\Common\FNRB32.EXE C:\Program Files\Logitech\iTouch\iTouch.exe C:\Program Files\F-Secure\Common\FIH32.EXE C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\wpabaln.exe C:\Documents and Settings\Omistaja\Työpöytä\HijackThis_v1.99.1.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: MSN-työkalurivi - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fi\msntb.dll O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1144867040798 O16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.com/setacceptlang.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: winjgf32 - winjgf32.dll (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
Fixaa nämä (do a system scan only, merkkaa ja paina fix checked): O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O20 - Winlogon Notify: winjgf32 - winjgf32.dll (file missing) Poista: C:\WINDOWS\web\related.htm Tyhjennä hakemisto: C:\Documents and Settings\Omistaja\Local Settings\Temp Käynnistä uudelleen ja lähetä uusi HjT-loki.
sitä viimestä settings/temp kansiota en löytäny Logfile of HijackThis v1.99.1 Scan saved at 20:12:22, on 18.4.2006 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\ewido anti-malware\ewidoguard.exe C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe C:\Program Files\F-Secure\Anti-Virus\fssm32.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\F-Secure\Common\FSMA32.EXE C:\Program Files\F-Secure\Common\FSMB32.EXE C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\Program Files\F-Secure\Common\FSM32.EXE C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Logitech\iTouch\iTouch.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\F-Secure\Common\FNRB32.EXE C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\F-Secure\Common\FIH32.EXE C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\Omistaja\Työpöytä\HijackThis_v1.99.1.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\F-Secure\Anti-Virus\fsav32.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: MSN-työkalurivi - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fi\msntb.dll O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1144867040798 O16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.com/setacceptlang.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
Loki on ok. Kyllä sellanen hakemisto on. Hae ccleaner -> http://www.ccleaner.com ja aja sen puhdistaja. Merkkaa siitä Tilapäistiedostot.
onkohan mulla "pieni" tietosuoja aukko ku taas f-secure ilmoittelee jostain troijalaisista mutta ei tee niille mitää että täs ois taas loki jos joku kattois onkos jotai vikana Logfile of HijackThis v1.99.1 Scan saved at 19:44:10, on 19.4.2006 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\ewido anti-malware\ewidoguard.exe C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE C:\Program Files\F-Secure\Anti-Virus\fssm32.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\F-Secure\Common\FSMA32.EXE C:\Program Files\F-Secure\Common\FSMB32.EXE C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\Program Files\F-Secure\Common\FSM32.EXE C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Logitech\iTouch\iTouch.exe C:\Program Files\F-Secure\Common\FNRB32.EXE C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\F-Secure\Common\FIH32.EXE C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\Omistaja\Työpöytä\HijackThis_v1.99.1.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: MSN-työkalurivi - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fi\msntb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1144867040798 O16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.com/setacceptlang.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
tais olla ainaki modzillassa tai jotain sinne päin mutta eipä niitä örkkejä oo taas näkynny eilisen jälkee!
no taas tuli Vahingollinen koodi on löytynyt tiedostosta C:\SYSTEM VOLUME INFORMATION\_RESTORE{AB18CA95-E922-4051-83B4-F29CD0A4C8A0}\RP20\A0002226.EXE. Virustartunta: Trojan-Dropper.Win32.Small.aod Toiminto: häiriötila.
Tuo on järjestelmänpalutuksessa, joten se täytyy tyhjentää. 1. Valitse Oma tietokone (klikkaa oikealla). 2. Valitse Ominaisuudet. 3. Valitse Järjestelmän palauttaminen- välilehti. 4. Valitse "Poista järjestelmän palauttaminen käytöstä". 5. Paina Käytä. 6. Paina OK. 7. Käynnistä kone uudelleen 8. Tee kohdat 1.-3. 9. Ota rasti pois kohdasta "Poista järjestelmän palauttaminen käytöstä" 10. Tee kohdat 5. ja 6. Huomaa, että kaikki aiemmat palautuspisteet häviävät tällöin!
