Koko ajan tulee ponnahdusikkunoita, joissa pyydetään latamaan joku viruksentorjuntaohjelma ja ihan tavallisia ponnahdusikkunnoita tulee myös, ja joku ihan outo ikkuna väittää etä konessa on viirus ja sitä hallitaan vaikka se ei ehkä kaikki ole totta. Kone myös sammuu itsestään. IE-lukitus päällä ja turvatasot: korkeat IE:ssa ja elisatietoturva palvelussa (f-secure) silti tulee ja tapahtuu!!! Mikä vika? : Logfile of HijackThis v1.99.1 Scan saved at 23:40:22, on 21.6.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\spoolsv.exe d:\PROGRA~1\ELISAT~1\backweb\4119343\Program\SERVIC~1.EXE d:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe d:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\FSGK32.EXE d:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\program\fsbwsys.exe d:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe d:\Program Files\Elisa Tietoturvapalvelu\Common\FSMB32.EXE d:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fssm32.exe D:\MSSQL7\binn\sqlservr.exe d:\Program Files\Elisa Tietoturvapalvelu\Common\FCH32.EXE C:\WINDOWS\System32\svchost.exe d:\Program Files\Elisa Tietoturvapalvelu\Common\FAMEH32.EXE d:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsrw.exe D:\MSSQL7\binn\sqlagent.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\atmclk.exe C:\WINDOWS\htpatch.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\System32\LVCOMSX.EXE C:\Program Files\QuickTime\qttask.exe D:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe D:\Program Files\DAEMON Tools\daemon.exe D:\Program Files\Anti-Blaxx\Anti-Blaxx.exe C:\Program Files\WildTangent\Apps\GameChannel.exe C:\WINDOWS\wt\updater\wcmdmgr.exe D:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE D:\Program Files\Elisa Tietoturvapalvelu\FSGUI\ispnews.exe C:\Program Files\Ahead\InCD\InCD.exe D:\Program Files\lg_fwupdate\fwupdate.exe D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Macrogaming\SweetIM\SweetIM.exe D:\Program Files\MessengerPlus! 3\MsgPlus.exe D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe D:\Program Files\Weather Watcher\ww.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Messenger\msmsgs.exe d:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsav32.exe D:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\Program\fspex.exe d:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe d:\PROGRA~1\ELISAT~1\ANTI-S~1\fsaw.exe d:\Program Files\Elisa Tietoturvapalvelu\FSGUI\fsguidll.exe D:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\WINDOWS\system32\svchost.exe D:\Program Files\DC++\DCPlusPlus.exe C:\WINDOWS\system32\dcomcfg.exe D:\PROGRA~1\MOZILL~1\FIREFOX.EXE D:\PROGRA~1\MOZILL~2\THUNDE~1.EXE C:\Documents and Settings\Jimi\Työpöytä\HijackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Elisa Internet R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O2 - BHO: Nothing - {686a161d-5bd1-4999-8832-6393f41e564c} - C:\WINDOWS\system32\hp100.tmp O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [zBrowser Launcher] d:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [xK4KDusV] C:\WINDOWS\uyqhybig.exe O4 - HKLM\..\Run: [VwtkV÷h$vùõš/‚²‘ÆßC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\uyqhybig.exe O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [DAEMON Tools] "d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Anti-Blaxx Manager] d:\Program Files\Anti-Blaxx\Anti-Blaxx.exe O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe O4 - HKLM\..\Run: [WT GameChannel] C:\Program Files\WildTangent\Apps\GameChannel.exe O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM\..\Run: [F-Secure Manager] "d:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "d:\Program Files\Elisa Tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "d:\Program Files\Elisa Tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [News Service] "d:\Program Files\Elisa Tietoturvapalvelu\FSGUI\ispnews.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LGODDFU] "d:\Program Files\lg_fwupdate\fwupdate.exe" O4 - HKLM\..\Run: [OWS Setup CmdLine] "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\40\bin\cfgwiz.exe" /pkg "Office 2000 Server Extensions" O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKLM\..\Run: [MessengerPlus3] "d:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [RemoteControl] "d:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKCU\..\Run: [WinFixer2005] "C:\Program Files\WinFixer 2005\uwfx5.exe" /scan O4 - HKCU\..\Run: [DesktopDictaphone] D:\DesktopDictaphone.exe O4 - HKCU\..\Run: [WeatherWatcher] D:\Program Files\Weather Watcher\ww.exe O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKCU\..\Run: [MessengerPlus3] "d:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [msnmsgr] ~"C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Startup: Sid Registration.lnk = G:\ATR1.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Elisa Tietoturvapalvelu.lnk = D:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\Program\fspex.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Estä tämä kohoikkuna - d:\Program Files\Elisa Tietoturvapalvelu\Anti-Spyware\blockpopups.htm O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - d:\Program Files\Elisa Tietoturvapalvelu\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - d:\Program Files\Elisa Tietoturvapalvelu\Anti-Spyware\ieshield.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Palvelut - {B86A5394-52EE-43BE-B144-5869ACEFDC1F} - http://service.kolumbus.fi/ (file missing) (HKCU) O9 - Extra button: SMS-viesti - {EC30E50C-A8F9-44AC-BBE7-028993D61447} - http://sms.kolumbus.fi/ (file missing) (HKCU) O9 - Extra button: Tuki - {FC2A8A24-362E-48B4-B73C-C32FA9FE5032} - http://tuki.elisa.net/ (file missing) (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/ O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1130331710546 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: winmmt32 - winmmt32.dll (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Elisa Tietoturvapalvelu (BackWeb Plug-in - 4119343) - BackWeb Technologies Inc. - d:\PROGRA~1\ELISAT~1\backweb\4119343\Program\SERVIC~1.EXE O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - d:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe O23 - Service: fsbwsys - F-Secure Corp. - d:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - d:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - d:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Parempi etten kuitenkaan ala silmät ummessa neuvoon mitään tähän aikaan yöstä. Kyllä tuolla logissa kuitenkin probleemaa on useempi rivi.
Aloitetaan tällä: Lataa SmitfraudFix (c) S!Ri http://siri.urz.free.fr/Fix/SmitfraudFix.zip Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi: Avaa SmitfraudFix-kansio ja tuplaklikkaa smitfraudfix.cmd Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa). Postita tämän tekstitiedoston sisältö viestiketjuusi.
SmitFraudFix v2.63 Scan done at 10:14:59,50, to 22.06.2006 Run from C:\Documents and Settings\Jimi\Ty”p”yt„\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT Fix ran in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\atmclk.exe FOUND ! C:\WINDOWS\system32\dcomcfg.exe FOUND ! C:\WINDOWS\system32\hp???.tmp FOUND ! C:\WINDOWS\system32\hp????.tmp FOUND ! C:\WINDOWS\system32\ld????.tmp FOUND ! C:\WINDOWS\system32\ot.ico FOUND ! C:\WINDOWS\system32\regperf.exe FOUND ! C:\WINDOWS\system32\simpole.tlb FOUND ! C:\WINDOWS\system32\stdole3.tlb FOUND ! C:\WINDOWS\system32\ts.ico FOUND ! C:\WINDOWS\system32\1024\ FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Jimi\Application Data C:\Documents and Settings\Jimi\Application Data\Install.dat FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Jimi\Suosikit C:\DOCUME~1\Jimi\Suosikit\Antivirus Test Online.url FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Nykyinen kotisivu" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{af3fd9a8-1287-4159-9212-9a5b4494af70}"="ecosystems" [HKEY_CLASSES_ROOT\CLSID\{af3fd9a8-1287-4159-9212-9a5b4494af70}\InProcServer32] @="C:\WINDOWS\system32\guxxa.dll" [HKEY_CURRENT_USER\Software\Classes\CLSID\{af3fd9a8-1287-4159-9212-9a5b4494af70}\InProcServer32] @="C:\WINDOWS\system32\guxxa.dll" »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End
Poista ohjauspaneelista (lisää/poista sovellus): SurfAccuracy Winfixer 2005 Istbar tai istsvc Fixaa HjT:llä: O4 - HKLM\..\Run: [xK4KDusV] C:\WINDOWS\uyqhybig.exe O4 - HKLM\..\Run: [VwtkV÷h$vùõš/‚²‘ÆßC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\uyqhybig.exe O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKCU\..\Run: [WinFixer2005] "C:\Program Files\WinFixer 2005\uwfx5.exe" /scan O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000 O20 - Winlogon Notify: winmmt32 - winmmt32.dll (file missing) Printtaa ohjeet ulos. Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi. Poista jos löytyy: C:\WINDOWS\uyqhybig.exe C:\Program Files\SurfAccuracy C:\Program Files\ISTsvc C:\Program Files\WinFixer 2005 Avaa SmitfraudFix-kansio ja tuplaklikkaa smitfraudfix.cmd Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot. Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet. Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter". Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin. Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi. Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt. Lähetä sen sisältö ja uusi HjT-loki tänne.
Oon muuten huomannut että ponnahdusikkunoita, tai muita ongelmia tuleevain silloin kun nettiyhteys on päällä esim. jos sen katkaisee tai estää kaiken verkkoliikenteen ongelmia ei synny???????
Kyllä, kuulostaa ihan luonnolliselta Örkki ottaa silloin yhteyttä jonnekin ja lataa niitä. Tee vain antamieni ohjeiden mukaan, niin pääset siitä eroon
No niin... SmitFraudFix v2.63 Scan done at 12:04:23,06, to 22.06.2006 Run from C:\Documents and Settings\Jimi\Ty”p”yt„\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT Fix ran in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{af3fd9a8-1287-4159-9212-9a5b4494af70}"="ecosystems" [HKEY_CLASSES_ROOT\CLSID\{af3fd9a8-1287-4159-9212-9a5b4494af70}\InProcServer32] @="C:\WINDOWS\system32\guxxa.dll" [HKEY_CURRENT_USER\Software\Classes\CLSID\{af3fd9a8-1287-4159-9212-9a5b4494af70}\InProcServer32] @="C:\WINDOWS\system32\guxxa.dll" »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri C:\WINDOWS\system32\guxxa.dll -> Missing File »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files Problem while deleting C:\WINDOWS\system32\atmclk.exe Problem while deleting C:\WINDOWS\system32\dcomcfg.exe Problem while deleting C:\WINDOWS\system32\hp???.tmp Problem while deleting C:\WINDOWS\system32\hp????.tmp Problem while deleting C:\WINDOWS\system32\ld????.tmp C:\WINDOWS\system32\ot.ico Deleted Problem while deleting C:\WINDOWS\system32\regperf.exe C:\WINDOWS\system32\simpole.tlb Deleted Problem while deleting C:\WINDOWS\system32\stdole3.tlb C:\WINDOWS\system32\ts.ico Deleted C:\WINDOWS\system32\1024\ Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Reboot C:\WINDOWS\system32\atmclk.exe Deleted C:\WINDOWS\system32\dcomcfg.exe Deleted C:\WINDOWS\system32\hp???.tmp Deleted C:\WINDOWS\system32\ld????.tmp Deleted C:\WINDOWS\system32\stdole3.tlb Deleted »»»»»»»»»»»»»»»»»»»»»»»» End ja sitten uuni tuore HjT-loki: Logfile of HijackThis v1.99.1 Scan saved at 12:14:48, on 22.6.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\spoolsv.exe d:\PROGRA~1\ELISAT~1\backweb\4119343\Program\SERVIC~1.EXE d:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe d:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\FSGK32.EXE d:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\program\fsbwsys.exe d:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe d:\Program Files\Elisa Tietoturvapalvelu\Common\FSMB32.EXE d:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fssm32.exe D:\MSSQL7\binn\sqlservr.exe d:\Program Files\Elisa Tietoturvapalvelu\Common\FCH32.EXE C:\WINDOWS\System32\svchost.exe d:\Program Files\Elisa Tietoturvapalvelu\Common\FAMEH32.EXE d:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsrw.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE D:\MSSQL7\binn\sqlagent.exe C:\WINDOWS\htpatch.exe d:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsav32.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\System32\LVCOMSX.EXE C:\Program Files\QuickTime\qttask.exe D:\Program Files\HP\HP Software Update\HPWuSchd2.exe D:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe D:\Program Files\Anti-Blaxx\Anti-Blaxx.exe C:\Program Files\WildTangent\Apps\GameChannel.exe C:\WINDOWS\wt\updater\wcmdmgr.exe D:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE d:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe D:\Program Files\Elisa Tietoturvapalvelu\FSGUI\ispnews.exe C:\Program Files\Ahead\InCD\InCD.exe D:\Program Files\lg_fwupdate\fwupdate.exe D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Macrogaming\SweetIM\SweetIM.exe D:\Program Files\MessengerPlus! 3\MsgPlus.exe D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe D:\Program Files\Weather Watcher\ww.exe d:\PROGRA~1\ELISAT~1\ANTI-S~1\fsaw.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\msnmsgr.exe D:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\Program\fspex.exe D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe d:\Program Files\Elisa Tietoturvapalvelu\FSGUI\fsguidll.exe D:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\WINDOWS\system32\NOTEPAD.EXE D:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\WINDOWS\system32\svchost.exe C:\Documents and Settings\Jimi\Työpöytä\HijackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Elisa Internet R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [zBrowser Launcher] d:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [DAEMON Tools] "d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Anti-Blaxx Manager] d:\Program Files\Anti-Blaxx\Anti-Blaxx.exe O4 - HKLM\..\Run: [WT GameChannel] C:\Program Files\WildTangent\Apps\GameChannel.exe O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch O4 - HKLM\..\Run: [F-Secure Manager] "d:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "d:\Program Files\Elisa Tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "d:\Program Files\Elisa Tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [News Service] "d:\Program Files\Elisa Tietoturvapalvelu\FSGUI\ispnews.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LGODDFU] "d:\Program Files\lg_fwupdate\fwupdate.exe" O4 - HKLM\..\Run: [OWS Setup CmdLine] "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\40\bin\cfgwiz.exe" /pkg "Office 2000 Server Extensions" O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKLM\..\Run: [MessengerPlus3] "d:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [RemoteControl] "d:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKCU\..\Run: [DesktopDictaphone] D:\DesktopDictaphone.exe O4 - HKCU\..\Run: [WeatherWatcher] D:\Program Files\Weather Watcher\ww.exe O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKCU\..\Run: [MessengerPlus3] "d:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Startup: Sid Registration.lnk = G:\ATR1.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Elisa Tietoturvapalvelu.lnk = D:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\Program\fspex.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Estä tämä kohoikkuna - d:\Program Files\Elisa Tietoturvapalvelu\Anti-Spyware\blockpopups.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - d:\Program Files\Elisa Tietoturvapalvelu\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - d:\Program Files\Elisa Tietoturvapalvelu\Anti-Spyware\ieshield.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Palvelut - {B86A5394-52EE-43BE-B144-5869ACEFDC1F} - http://service.kolumbus.fi/ (file missing) (HKCU) O9 - Extra button: SMS-viesti - {EC30E50C-A8F9-44AC-BBE7-028993D61447} - http://sms.kolumbus.fi/ (file missing) (HKCU) O9 - Extra button: Tuki - {FC2A8A24-362E-48B4-B73C-C32FA9FE5032} - http://tuki.elisa.net/ (file missing) (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/ O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1130331710546 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Elisa Tietoturvapalvelu (BackWeb Plug-in - 4119343) - BackWeb Technologies Inc. - d:\PROGRA~1\ELISAT~1\backweb\4119343\Program\SERVIC~1.EXE O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - d:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe O23 - Service: fsbwsys - F-Secure Corp. - d:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - d:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - d:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe ps. netti ollu kokoajan, näitten ajan päällä!
voinko sitten kun on ohi niin laittaa taustakuvan takas ja alentaa turvatasot IE:ssa jaj f-securessa normaaliin tai keskisuureen ja laitan kuitenkin IE:ssa ie asetukset lukkoon niinkuin aina, mää kato käytän vain mozillaaa.
Nyt ainakin ei ole tullut noitten tekojen jälkeeen mitä tein niin ongelmia. Onkohan se nyt poissa????
Smitfraudfix olis pitänyt ajaa vikasietotilassa, mutta näytti lähteneen noinkin eli ei haittaa Voit tehdä nuo, juu. Teepä vielä tämä: Hae eScan -> http://koti.mbnet.fi/pattaya1/escanmwav.htm . Asenna, päivitä, skannaa sivulla olevien ohjeiden mukaan. Lähetä sitten "örkkitulokset" tänne (ohje tuolla sivulla, alin kuva ja sen yläpuolella oleva teksti).
Tässä "örkkitulokset" : File C:\WINDOWS\NDNuninstall6_38.exe tagged as not-a-virus:AdWare.Win32.NewDotNet. No Action Taken. File C:\WINDOWS\NDNuninstall6_38.exe tagged as not-a-virus:AdWare.Win32.NewDotNet. No Action Taken. File D:\Program Files\BitComet Accelerator\NNGLZA638.EXE tagged as not-a-virus:AdWare.Win32.NewDotNet. No Action Taken. File D:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll tagged as not-a-virus:AdWare.Win32.MyWebSearch.i. No Action Taken. File D:\Program Files\PPLive TV\SynaLiveSetup.exe tagged as not-a-virus:RiskTool.Win32.PsKill.n. No Action Taken.
Poista nuo: C:\WINDOWS\NDNuninstall6_38.exe D:\Program Files\BitComet Accelerator\NNGLZA638.EXE D:\Program Files\Mozilla Firefox\plugins\NPMyWebS Muuten on ok
Terve! Mulla olisi samanlaista ongelmaa koneessa ja ajoin ton Smitfraudmixin ja tommosen "raportin" pukkas, elikkä voisko joku fiksumpi kertoa mulle mitä teen? SmitFraudFix v2.65 Scan done at 15:54:51,93, su 25.06.2006 Run from C:\Documents and Settings\ekstr”m\Ty”p”yt„\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT Fix ran in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\atmclk.exe FOUND ! C:\WINDOWS\system32\dcomcfg.exe FOUND ! C:\WINDOWS\system32\guxxa.dll FOUND ! C:\WINDOWS\system32\hp???.tmp FOUND ! C:\WINDOWS\system32\hp????.tmp FOUND ! C:\WINDOWS\system32\ld????.tmp FOUND ! C:\WINDOWS\system32\ot.ico FOUND ! C:\WINDOWS\system32\regperf.exe FOUND ! C:\WINDOWS\system32\simpole.tlb FOUND ! C:\WINDOWS\system32\stdole3.tlb FOUND ! C:\WINDOWS\system32\1024\ FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\ekstr”m\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Nykyinen kotisivu" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{af3fd9a8-1287-4159-9212-9a5b4494af70}"="ecosystems" [HKEY_CLASSES_ROOT\CLSID\{af3fd9a8-1287-4159-9212-9a5b4494af70}\InProcServer32] @="C:\WINDOWS\system32\guxxa.dll" [HKEY_CURRENT_USER\Software\Classes\CLSID\{af3fd9a8-1287-4159-9212-9a5b4494af70}\InProcServer32] @="C:\WINDOWS\system32\guxxa.dll" »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End
Tässä vielä "örkkitulokset" File C:\DOCUME~1\ALLUSE~1\APPLIC~1\LONGBA~1\FIVEDA~1.EXE tagged as not-a-virus:AdWare.Win32.Lop.bb. No Action Taken. File C:\WINDOWS\system32\guxxa.dll infected by "not-virus:Hoax.Win32.Renos.du" Virus. Action Taken: File Renamed. File C:\WINDOWS\system32\ld101.tmp infected by "Trojan-Downloader.Win32.Zlob.qd" Virus. Action Taken: File to be deleted on reboot. File C:\WINDOWS\system32\regperf.exe infected by "Trojan-Downloader.Win32.Zlob.qd" Virus. Action Taken: File to be deleted on reboot. File C:\Documents and Settings\All Users\Application Data\Long Ball Bind Free\FIVE DASH.exe tagged as not-a-virus:AdWare.Win32.Lop.bb. No Action Taken. File C:\Program Files\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\072A00B1.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0B926E35.exe tagged as not-a-virus:AdWare.Win32.Lop.bb. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\12AD5A47.exe tagged as not-a-virus:AdWare.Win32.Lop.bb. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\33B029C9.exe tagged as not-a-virus:AdWare.Win32.Lop.ag. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\38A11F5D.wmf infected by "Exploit.Win32.IMG-WMF.v" Virus. Action Taken: File Renamed. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3A7A6C96.def infected by "Trojan.Win32.Agent.e" Virus. Action Taken: File Deleted. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3A7D1692.exe tagged as not-a-virus:AdWare.Win32.Lop.bb. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\450D7B2C.exe tagged as not-a-virus:AdWare.Win32.Lop.bb. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\45CA1036.exe tagged as not-a-virus:AdWare.Win32.Lop.ag. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4FA47B89.exe infected by "Trojan-Downloader.Win32.Swizzor.fg" Virus. Action Taken: File Deleted. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\515A4C34.exe tagged as not-a-virus:AdWare.Win32.Lop.ag. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\592E3859.exe tagged as not-a-virus:AdWare.Win32.Lop.bb. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\59951F35.exe tagged as not-a-virus:AdWare.Win32.Lop.ag. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\59994932.exe tagged as not-a-virus:AdWare.Win32.Lop.bb. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\599C732E.exe tagged as not-a-virus:AdWare.Win32.Lop.bb. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\5A886355.exe tagged as not-a-virus:AdWare.Win32.Lop.bb. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\5B972CC8.exe tagged as not-a-virus:AdWare.Win32.Lop.ag. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\5B9A56C4.exe tagged as not-a-virus:AdWare.Win32.Lop.bb. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\5B9D00C1.exe tagged as not-a-virus:AdWare.Win32.Lop.ag. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\5EAE2470.exe tagged as not-a-virus:AdWare.Win32.Lop.bb. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\64D001C5.exe tagged as not-a-virus:AdWare.Win32.Lop.m. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\6ABF03D5.exe tagged as not-a-virus:AdWare.Win32.Lop.ag. No Action Taken. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\6DA0213F.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\6F945085.exe infected by "Trojan-Downloader.Win32.Swizzor.fg" Virus. Action Taken: File Deleted. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\797807C8.exe infected by "Trojan-Downloader.Win32.Swizzor.fg" Virus. Action Taken: File Deleted. File C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7C937882.exe tagged as not-a-virus:AdWare.Win32.Lop.bb. No Action Taken. File C:\System Volume Information\_restore{2407196E-8E23-4358-A078-BD8A3C970879}\RP577\A0173180.exe tagged as not-a-virusownloader.Win32.WinFixer.d. No Action Taken. File C:\System Volume Information\_restore{2407196E-8E23-4358-A078-BD8A3C970879}\RP583\A0173400.exe tagged as not-a-virusownloader.Win32.WinFixer.d. No Action Taken. File C:\System Volume Information\_restore{2407196E-8E23-4358-A078-BD8A3C970879}\RP585\A0174410.exe tagged as not-a-virusownloader.Win32.WinFixer.d. No Action Taken. File C:\System Volume Information\_restore{2407196E-8E23-4358-A078-BD8A3C970879}\RP590\A0174670.exe tagged as not-a-virusownloader.Win32.WinFixer.d. No Action Taken. File C:\System Volume Information\_restore{2407196E-8E23-4358-A078-BD8A3C970879}\RP591\A0174704.exe tagged as not-a-virusownloader.Win32.WinFixer.d. No Action Taken. File C:\System Volume Information\_restore{2407196E-8E23-4358-A078-BD8A3C970879}\RP596\A0175923.exe tagged as not-a-virusownloader.Win32.WinFixer.d. No Action Taken. File C:\System Volume Information\_restore{2407196E-8E23-4358-A078-BD8A3C970879}\RP599\A0176069.exe tagged as not-a-virusownloader.Win32.WinFixer.d. No Action Taken. File C:\System Volume Information\_restore{2407196E-8E23-4358-A078-BD8A3C970879}\RP601\A0177201.exe tagged as not-a-virusownloader.Win32.WinFixer.d. No Action Taken. File C:\System Volume Information\_restore{2407196E-8E23-4358-A078-BD8A3C970879}\RP606\A0178629.exe tagged as not-a-virusownloader.Win32.WinFixer.d. No Action Taken. File C:\System Volume Information\_restore{2407196E-8E23-4358-A078-BD8A3C970879}\RP607\A0179657.exe tagged as not-a-virus:AdWare.Win32.Lop.bb. No Action Taken. File C:\System Volume Information\_restore{2407196E-8E23-4358-A078-BD8A3C970879}\RP607\A0179658.exe tagged as not-a-virus:AdWare.Win32.Lop.bb. No Action Taken. File C:\System Volume Information\_restore{2407196E-8E23-4358-A078-BD8A3C970879}\RP608\A0180952.dll infected by "not-virus:Hoax.Win32.Renos.du" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{2407196E-8E23-4358-A078-BD8A3C970879}\RP608\A0180953.exe infected by "Trojan-Downloader.Win32.Swizzor.fg" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{2407196E-8E23-4358-A078-BD8A3C970879}\RP608\A0180954.exe infected by "Trojan-Downloader.Win32.Swizzor.fg" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{2407196E-8E23-4358-A078-BD8A3C970879}\RP608\A0180955.exe infected by "Trojan-Downloader.Win32.Swizzor.fg" Virus. Action Taken: File Deleted. File C:\WINDOWS\system32\1024\ldA3F0.tmp infected by "not-virus:Hoax.Win32.Renos.dv" Virus. Action Taken: File Deleted. File E:\Ajurit\mirc616.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Tässä vielä nämä ja olisin TODELLA kiitollinen jos jollain olisi aikaa vilkaista ja auttaa kun en ole itse näissä hommissa todellakaan mikään expertti. Logfile of HijackThis v1.99.1 Scan saved at 18:40:58, on 26.6.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Norton Internet Security\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\dcomcfg.exe C:\WINDOWS\system32\atmclk.exe C:\WINDOWS\system32\sstray.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\MMTrayLSI.exe C:\WINDOWS\system32\MMTray2k.exe C:\WINDOWS\system32\MMTray.exe E:\Ohjelmia\iTunesSetup\iTunesHelper.exe C:\WINDOWS\Dit.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe E:\Ohjelmia2\SSC Service Utility\ssc_serv.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\WINDOWS\system32\qttask.exe E:\Ohjelmia\any\Any DVD 5.5.1.1 + crack by KMI\AnyDVD\AnyDVD.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Messenger\msmsgs.exe E:\Ohjelmia\Phone\Skype.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\WINDOWS\DitExp.exe C:\Program Files\MSN Messenger\msnmsgr.exe E:\Common\Bin\WinCinemaMgr.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe E:\Ohjelmia\opera\Opera.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\ekström\Työpöytä\HijackThis_v1.99.1.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mihorawhovyxtynlgkl.org/...3sDr_MJWWRGXpxSxoKAZrr6rOHUvvK5JIctdZTlwf.jpg R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\OHJELM~1\SPYBOT~1\SDHelper.dll O2 - BHO: Nothing - {5f4c3d09-b3b9-4f88-aa82-31332fee1c08} - C:\WINDOWS\system32\hp100.tmp O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [MMTrayLSI] C:\WINDOWS\system32\MMTrayLSI.exe O4 - HKLM\..\Run: [MMTray2K] C:\WINDOWS\system32\MMTray2k.exe O4 - HKLM\..\Run: [MMTray] C:\WINDOWS\system32\MMTray.exe O4 - HKLM\..\Run: [iTunesHelper] E:\Ohjelmia\iTunesSetup\iTunesHelper.exe O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [SSC Service Utility] E:\Ohjelmia2\SSC Service Utility\ssc_serv.exe /s O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [bindfreebuildsoft] C:\Documents and Settings\All Users\Application Data\Long Ball Bind Free\FIVE DASH.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime O4 - HKLM\..\Run: [AnyDVD] E:\Ohjelmia\any\Any DVD 5.5.1.1 + crack by KMI\AnyDVD\AnyDVD.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [SpywareQuake.com] C:\Program Files\SpywareQuake.com\Spyware-Quake.exe /h O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "E:\Ohjelmia\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Ohjelmia2\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Common\Bin\WinCinemaMgr.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - E:\EmpirePokerMaster\EmpirePoker\RunEPoker.exe O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - E:\EmpirePokerMaster\EmpirePoker\RunEPoker.exe O9 - Extra button: bet365 Poker - {B1BA4A3F-1C95-497b-9F82-F8DA4A5C89DD} - C:\Program Files\bet365MPP\MPPoker.exe O9 - Extra button: NordicBet Poker - {E6073F93-9541-4be4-9800-109D378EB99B} - C:\Program Files\nordicbetMPP\MPPoker.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1099682522106 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
