HJT-log mesevirus

Elikkä mulla on tälläinen virus: http://keskustelu.afterdawn.com/thread_view.cfm/629265

ja logi on tässä:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:12:12 PM, on 02/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\runservice.exe
C:\Norman\Bin\Zanda.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\MSN Messenger\msn.com
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Norman\bin\NJEEVES.EXE
C:\Norman\Nvc\BIN\nipsvc.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Norman\Nvc\bin\nvcoas.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Norman\bin\ZLH.EXE
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\WhenUSearch\Search.exe
C:\Program Files\Winamp\winampa.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Seekmo\bin\10.0.345.0\SeekmoSA.exe
C:\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Seekmo\bin\10.0.345.0\OEAddOn.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Xfire\Xfire.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\mIRC\mirc.exe
C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F2 - REG:system.ini: Shell=EXPLORER.EXE \351564.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Seekmo /fleok=1D8A83A5C7E1147F9FA975760EA83FA5EF80752B9499803B2A2303766A - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Seekmo\bin\10.0.345.0\HostIE.dll
O2 - BHO: BitComet Toolbar Helper - {6A373B7E-496E-424f-A9BE-486A5E9AB018} - C:\Program Files\BitComet Toolbar\v2.0.0.1\BitComet_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: WhenUSearch Helper - {BA2325ED-F9EB-4830-8FCE-0BC35B16969B} - C:\Program Files\WhenUSearch\search.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Program Files\BitComet Toolbar\v2.0.0.1\BitComet_Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Seekmo - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Seekmo\bin\10.0.345.0\HostIE.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WhenUSearch] "C:\Program Files\WhenUSearch\Search.exe"
O4 - HKLM\..\Run: [WhenUSearchWHSE] "C:\Program Files\WhenUSearch\whse.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SeekmoSA] "C:\Program Files\Seekmo\bin\10.0.345.0\SeekmoSA.exe"
O4 - HKLM\..\Run: [SeekmoOE] C:\Program Files\Seekmo\bin\10.0.345.0\OEAddOn.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Google IME Autoupdater] "C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe"
O4 - HKLM\..\Run: [CHIN PING PHONE PILE] C:\Documents and Settings\All Users\Application Data\Proxy Long Chin Ping\Dart load.exe
O4 - HKLM\..\Run: [MSN Messenger] msn.com
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DoesPeak] C:\DOCUME~1\NIKOAR~1\APPLIC~1\STOREHTM\tons mix bias.exe
O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32\ntos.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{46B44E97-B620-4B4D-93C0-7B9C4FA28E1E}: NameServer = 192.102.59.225,192.102.59.245
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 9725 bytes

 

Lataa SmitfraudFix (c) S!Ri
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita tämän tekstitiedoston sisältö viestiketjuusi.

Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.

============

Lataa MsnCleaner.zip

"Pura tiedosto työpöydälle, älä käytä sitä vielä.
"Käynnistä kone Vikasietotilaan
"Tuplaklikkaa MsnCleaner.exe
"Paina Analyze nappia.
"Jos löytyy tartuntoja, paina Deleted nappia.
"Käynnistä kone normaalisti ja lähetä C:\MsnCleaner.txt raportti viestiketjuusi.

 

MSNcleaner ei löytänyt yhtään mitään, mutta tässä tämä toinen loki:

SmitFraudFix v2.292

Scan done at 15:04:30.60, 02/21/2008
Run from C:\Documents and Settings\Niko Arola\Ty”p”yt„\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\runservice.exe
C:\Norman\Bin\Zanda.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Norman\bin\NJEEVES.EXE
C:\Norman\Nvc\BIN\nipsvc.exe
C:\Norman\Nvc\bin\nvcoas.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Norman\bin\ZLH.EXE
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\WhenUSearch\Search.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Seekmo\bin\10.0.345.0\SeekmoSA.exe
C:\Program Files\Seekmo\bin\10.0.345.0\OEAddOn.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Xfire\Xfire.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Norman\Nvc\bin\cclaw.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Niko Arola


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Niko Arola\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\NIKOAR~1\Suosikit


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller - Paketinajoituksen miniportti
DNS Server Search Order: 192.102.59.225
DNS Server Search Order: 192.102.59.245

HKLM\SYSTEM\CCS\Services\Tcpip\..\{46B44E97-B620-4B4D-93C0-7B9C4FA28E1E}: DhcpNameServer=0.0.0.0
HKLM\SYSTEM\CCS\Services\Tcpip\..\{46B44E97-B620-4B4D-93C0-7B9C4FA28E1E}: NameServer=192.102.59.225,192.102.59.245
HKLM\SYSTEM\CS1\Services\Tcpip\..\{46B44E97-B620-4B4D-93C0-7B9C4FA28E1E}: DhcpNameServer=0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\..\{46B44E97-B620-4B4D-93C0-7B9C4FA28E1E}: NameServer=192.102.59.225,192.102.59.245
HKLM\SYSTEM\CS3\Services\Tcpip\..\{46B44E97-B620-4B4D-93C0-7B9C4FA28E1E}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS3\Services\Tcpip\..\{46B44E97-B620-4B4D-93C0-7B9C4FA28E1E}: NameServer=192.102.59.225,192.102.59.245
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=0.0.0.0
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

 

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

 

SDFix: Version 1.144

Run by Niko Arola on 02/21/2008 at 08:59 PM

Microsoft Windows XP [versio 5.1.2600]
Running From: C:\DOCUME~1\NIKOAR~1\TYPYT~1\SDFix

Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Checking Files:

Trojan Files Found:

C:\048768.EXE - Deleted
C:\065318.EXE - Deleted
C:\082204.EXE - Deleted
C:\111417.EXE - Deleted
C:\257562.EXE - Deleted
C:\287177.EXE - Deleted
C:\340282.EXE - Deleted
C:\351564.EXE - Deleted
C:\373611.EXE - Deleted
C:\406626.EXE - Deleted
C:\470552.EXE - Deleted
C:\534527.EXE - Deleted
C:\537767.EXE - Deleted
C:\551313.EXE - Deleted
C:\553005.EXE - Deleted
C:\565011.EXE - Deleted
C:\638818.EXE - Deleted
C:\735317.EXE - Deleted
C:\743672.EXE - Deleted
C:\834866.EXE - Deleted
C:\877017.EXE - Deleted
C:\WINDOWS\admintxt.txt - Deleted
C:\WINDOWS\system32\0.bat - Deleted
C:\WINDOWS\system32\1.bat - Deleted
C:\WINDOWS\system32\2.bat - Deleted
C:\WINDOWS\system32\ntos.exe - Deleted
C:\WINDOWS\system32\wsnpoem\audio.dll - Deleted
C:\WINDOWS\system32\wsnpoem\audio.dll.cla - Deleted
C:\WINDOWS\system32\wsnpoem\video.dll - Deleted



Folder C:\WINDOWS\system32\wsnpoem - Removed


Removing Temp Files...

ADS Check:



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-21 21:11:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:8496c99a
"s1"=dword:bc23fec0
"s2"=dword:6ac9ad73
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:54,0b,9d,50,0c,4f,8e,93,67,0f,6b,00,d7,dc,8e,6a,28,9f,0c,08,bd,..
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000001
"khjeh"=hex:7f,7c,7d,91,53,7c,0e,88,17,ed,e1,43,23,33,43,9e,7a,4b,40,eb,52,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,f3,ee,42,84,08,34,85,43,ff,80,67,a1,45,a9,aa,67,b5,..
"khjeh"=hex:25,25,52,ff,ee,e4,5e,17,3d,88,36,9c,08,39,97,d4,77,13,13,be,fa,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:bc,38,2e,5e,e1,ef,85,e8,a4,df,86,20,29,88,14,bc,cc,70,fe,0a,8b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:eb,d5,c0,4f,01,75,3a,71,72,09,d5,73,79,b0,b8,e4,cb,0e,d0,20,a0,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:54,0b,9d,50,0c,4f,8e,93,67,0f,6b,00,d7,dc,8e,6a,28,9f,0c,08,bd,..
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000001
"khjeh"=hex:7f,7c,7d,91,53,7c,0e,88,17,ed,e1,43,23,33,43,9e,7a,4b,40,eb,52,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,f3,ee,42,84,08,34,85,43,ff,80,67,a1,45,a9,aa,67,b5,..
"khjeh"=hex:25,25,52,ff,ee,e4,5e,17,3d,88,36,9c,08,39,97,d4,77,13,13,be,fa,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:bc,38,2e,5e,e1,ef,85,e8,a4,df,86,20,29,88,14,bc,cc,70,fe,0a,8b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:eb,d5,c0,4f,01,75,3a,71,72,09,d5,73,79,b0,b8,e4,cb,0e,d0,20,a0,..
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xf9\x2022\xd3w\2]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xfe\xbb\xd3w\2]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\Norman\\NVC\\Bin\\Nvcut.exe"="C:\\Norman\\NVC\\Bin\\Nvcut.exe:*:Enabled:Apuohjelmat"
"C:\\Documents and Settings\\Niko Arola\\Ty”p”yt„\\Internet.lnk"="C:\\Documents and Settings\\Niko Arola\\Ty”p”yt„\\Internet.lnk:*:Enabled:Internet"
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:EnabledC++"
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"="C:\\Program Files\\The All-Seeing Eye\\eye.exe:*:Enabled:Yahoo! All-Seeing Eye"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*isabled:Windows Messenger"
"C:\\Valve\\Steam\\Steam.exe"="C:\\Valve\\Steam\\Steam.exe:*:Enabled:Steam"
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe:*:Enabled:Et„tuki - Windows Messenger ja „„niyhteys"
"C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"="C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4"
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"="C:\\Program Files\\GameSpy Arcade\\Aphex.exe:*:Enabled:GameSpy Arcade"
"C:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe"="C:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe:*:Enabled:GameCenter"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"
"C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"="C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe:*:Enabled:Football Manager 2008"
"C:\\Program Files\\PPMate\\ppmate.exe"="C:\\Program Files\\PPMate\\ppmate.exe:*:EnabledPMate"
"C:\\Program Files\\PPMate\\ppmnet.exe"="C:\\Program Files\\PPMate\\ppmnet.exe:*:EnabledPMate"
"C:\\Program Files\\uusee\\UUSeePlayer.exe"="C:\\Program Files\\uusee\\UUSeePlayer.exe:*:Enabled:UUSEE"
"C:\\Program Files\\Sierra Entertainment\\World in Conflict - DEMO\\wic.exe"="C:\\Program Files\\Sierra Entertainment\\World in Conflict - DEMO\\wic.exe:*:Enabled:World in Conflict - DEMO"
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe"="C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe:*:Enabled:World in Conflict"
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe"="C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe:*:Enabled:World in Conflict - Online Only"
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe"="C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe:*:Enabled:World in Conflict - Dedicated Server"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files:


File Backups: - C:\DOCUME~1\NIKOAR~1\TYPYT~1\SDFix\backups\backups.zip

Files with Hidden Attributes:

Fri 15 Feb 2008 143,872 ..SHR --- "C:\Program Files\MSN Messenger\msn.com"
Tue 5 Dec 2006 51,712 ..SHR --- "C:\Program Files\Ski Jump International\Setup.exe"
Sat 5 May 2007 80 ..SHR --- "C:\WINDOWS\system32\275130C107.dll"
Thu 21 Feb 2008 825 A.SH. --- "C:\WINDOWS\system32\mmf.sys"
Fri 6 Jan 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 15 May 2006 95 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti206.tmp"
Thu 14 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT2.tmp"
Sun 3 Feb 2008 1,301 ...HR --- "C:\Documents and Settings\Niko Arola\Application Data\SecuROM\UserData\securom_v7_01.bak"
Fri 6 Jan 2006 4,348 ...H. --- "C:\Documents and Settings\Niko Arola\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1key.bak"
Tue 4 Apr 2006 20 A..H. --- "C:\Documents and Settings\Niko Arola\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1lic.bak"
Sun 4 Dec 2005 312 A.SH. --- "C:\Documents and Settings\Niko Arola\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv2key.bak"

Finished!

____________________



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:37:09 PM, on 02/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\runservice.exe
C:\Norman\Bin\Zanda.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Norman\Nvc\bin\nvcoas.exe
C:\Norman\Nvc\BIN\nipsvc.exe
C:\Norman\bin\NJEEVES.EXE
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Norman\bin\ZLH.EXE
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\WhenUSearch\Search.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Seekmo\bin\10.0.345.0\SeekmoSA.exe
C:\Program Files\Seekmo\bin\10.0.345.0\OEAddOn.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Seekmo /fleok=1D8A83A5C7E1147F9FA975760EA83FA5EF80752B9499803B2A2303766A - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Seekmo\bin\10.0.345.0\HostIE.dll
O2 - BHO: BitComet Toolbar Helper - {6A373B7E-496E-424f-A9BE-486A5E9AB018} - C:\Program Files\BitComet Toolbar\v2.0.0.1\BitComet_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: WhenUSearch Helper - {BA2325ED-F9EB-4830-8FCE-0BC35B16969B} - C:\Program Files\WhenUSearch\search.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Program Files\BitComet Toolbar\v2.0.0.1\BitComet_Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Seekmo - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Seekmo\bin\10.0.345.0\HostIE.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WhenUSearch] "C:\Program Files\WhenUSearch\Search.exe"
O4 - HKLM\..\Run: [WhenUSearchWHSE] "C:\Program Files\WhenUSearch\whse.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SeekmoSA] "C:\Program Files\Seekmo\bin\10.0.345.0\SeekmoSA.exe"
O4 - HKLM\..\Run: [SeekmoOE] C:\Program Files\Seekmo\bin\10.0.345.0\OEAddOn.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Google IME Autoupdater] "C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe"
O4 - HKLM\..\Run: [CHIN PING PHONE PILE] C:\Documents and Settings\All Users\Application Data\Proxy Long Chin Ping\Dart load.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DoesPeak] C:\DOCUME~1\NIKOAR~1\APPLIC~1\STOREHTM\tons mix bias.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{46B44E97-B620-4B4D-93C0-7B9C4FA28E1E}: NameServer = 192.102.59.225,192.102.59.245
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 9474 bytes

 

poista lisää poista sovelutuksesta

Seekmo
WhenUSearch, WhenU

poista vikasiedossa kansio

C:\Program Files\Seekmo
C:\Program Files\WhenUSearch

==========

Lataa NoLop työpöydällesi yhdestä seuraavista linkeistä...
Linkki1
Linkki2
Linkki3

1.Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen
2.Tuplaklikkaa NoLop.exe ajaaksesi sen
3.Klikkaa nappulaa "Search and Destroy"
<<Tietokoneesi skannataan saastuneiden tiedostojen osalta>>
4, Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK
5. Klikkaa "REBOOT"-painiketta.
6. NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera.
-- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataa mscomctl.ocx ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan.

 

NoLop! Log by Skate_Punk_21

Please Note: any existing old logs will have now been renamed to NoLop!OLD.log

Fix running from: C:\Documents and Settings\Niko Arola\Työpöytä
[02/22/2008]
[1:36:40 AM]

---Infection Files Found/Removed---
C:\WINDOWS\tasks\AD9259A09185CD00.job

Beginning Removal...
Rebooting...
Removing Lop's Leftover Files/Folders...
Editing Registry...
**Fix Complete!**

---Listing AppData sub directories---

C:\Documents and Settings\All Users\Application Data\Adobe
C:\Documents and Settings\All Users\Application Data\Ahead
C:\Documents and Settings\All Users\Application Data\Apple Computer
C:\Documents and Settings\All Users\Application Data\Google
C:\Documents and Settings\All Users\Application Data\Messenger Plus!
C:\Documents and Settings\All Users\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Protexis
C:\Documents and Settings\All Users\Application Data\Proxy Long Chin Ping
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
C:\Documents and Settings\All Users\Application Data\Wlinstaller
C:\Documents and Settings\Default User\Application Data\Identities
C:\Documents and Settings\Default User\Application Data\Microsoft
C:\Documents and Settings\Localservice\Application Data\Google
C:\Documents and Settings\Localservice\Application Data\Microsoft
C:\Documents and Settings\Localservice\Application Data\Xfire -- EMPTY Directory
C:\Documents and Settings\Networkservice\Application Data\Microsoft
C:\Documents and Settings\Networkservice\Application Data\Storehtm
C:\Documents and Settings\Networkservice\Application Data\Xfire -- EMPTY Directory
C:\Documents and Settings\Niko Arola\Application Data\Adobe
C:\Documents and Settings\Niko Arola\Application Data\Adobeum -- EMPTY Directory
C:\Documents and Settings\Niko Arola\Application Data\Apple Computer
C:\Documents and Settings\Niko Arola\Application Data\Chessbase
C:\Documents and Settings\Niko Arola\Application Data\Fretsonfire
C:\Documents and Settings\Niko Arola\Application Data\Google
C:\Documents and Settings\Niko Arola\Application Data\Help
C:\Documents and Settings\Niko Arola\Application Data\Identities
C:\Documents and Settings\Niko Arola\Application Data\Installshield
C:\Documents and Settings\Niko Arola\Application Data\Intervideo
C:\Documents and Settings\Niko Arola\Application Data\Jasc
C:\Documents and Settings\Niko Arola\Application Data\Macromedia
C:\Documents and Settings\Niko Arola\Application Data\Microsoft
C:\Documents and Settings\Niko Arola\Application Data\Mozilla
C:\Documents and Settings\Niko Arola\Application Data\My Games
C:\Documents and Settings\Niko Arola\Application Data\Nvu
C:\Documents and Settings\Niko Arola\Application Data\Ppmate
C:\Documents and Settings\Niko Arola\Application Data\Real
C:\Documents and Settings\Niko Arola\Application Data\Securom
C:\Documents and Settings\Niko Arola\Application Data\Sopcast
C:\Documents and Settings\Niko Arola\Application Data\Sports Interactive
C:\Documents and Settings\Niko Arola\Application Data\Storehtm
C:\Documents and Settings\Niko Arola\Application Data\Sun
C:\Documents and Settings\Niko Arola\Application Data\Teamspeak2
C:\Documents and Settings\Niko Arola\Application Data\Utorrent
C:\Documents and Settings\Niko Arola\Application Data\Ventrilo
C:\Documents and Settings\Niko Arola\Application Data\Vlc
C:\Documents and Settings\Niko Arola\Application Data\Xfire


______________________


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:11:41 AM, on 02/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\runservice.exe
C:\Norman\Bin\Zanda.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Norman\bin\NJEEVES.EXE
C:\Norman\Nvc\BIN\nipsvc.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Norman\Nvc\bin\nvcoas.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Norman\bin\ZLH.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Xfire\Xfire.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet Toolbar Helper - {6A373B7E-496E-424f-A9BE-486A5E9AB018} - C:\Program Files\BitComet Toolbar\v2.0.0.1\BitComet_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Program Files\BitComet Toolbar\v2.0.0.1\BitComet_Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Google IME Autoupdater] "C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe"
O4 - HKLM\..\Run: [CHIN PING PHONE PILE] C:\Documents and Settings\All Users\Application Data\Proxy Long Chin Ping\Dart load.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DoesPeak] C:\DOCUME~1\NIKOAR~1\APPLIC~1\STOREHTM\tons mix bias.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{46B44E97-B620-4B4D-93C0-7B9C4FA28E1E}: NameServer = 192.102.59.225,192.102.59.245
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 8400 bytes

 

scannaa hjt:llä merkkaa paina Fix checked

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKCU\..\Run: [DoesPeak] C:\DOCUME~1\NIKOAR~1\APPLIC~1\STOREHTM\tons mix bias.exe

=============

Javan päivitys ja välimuistin tyhjennys:

1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
Niissä pitäisi olla seuraava kuva vieressä:

3. Valitse kaikki entiset Java versiosi ja valitse Poista.
4. Asenna uusin Java päivitys seuraavasta linkistä..
5. Käynnistä kone uudelleen asennuksen jälkeen:

http://java.sun.com/javase/downloads/index.jsp

Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u4

Paina Download

Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

(Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

*Applications and Applets

*Trace and Log Files

Ja paina OK -nappia

9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.

10. Klikkaa OK jättääksesi Java asetusikkunasi.

===============

Ohje AVG:n Anti-Spyware 7.5:n käyttöön
Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.

Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

Lataa AVG:n Anti-Spyware 7.5:n
ja tallenna ohjelma työpöydällesi.
o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
o Käynnistä AVG:n Anti-Spyware.
o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".

o Sitten "Reports" valikon alta:
o Laita täppi kohtaan "Automatically generate report after every scan"
o Ota täppi pois kohdasta"Only if threats were found"

o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
o "Resident shield is", muuta tila active:sta inactive:ksi
o Sulje ohjelma, ÄLÄ skannaa vielä.

Käynnistä koneesi vikasietotilaan,
sammuta ja käynnistä
käynnistyksen yhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina enter ja enter

Toisissa koneissa paukutetaan F8:sin sijasta F5:tä

HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"

o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.

==================

Lataa tuolta http://www.ccleaner.com/download/builds.aspx
CCleaner v2.03.532- Standard Build, ÄLÄ aseenna Yahoo toolbaria!

laita asetukset näin:
Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi

 

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 4:23:40 AM 02/22/2008

+ Scan result:



HKLM\SOFTWARE\Classes\ClientAX.ClientInstaller -> Adware.180Solutions : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ClientAX.ClientInstaller.1 -> Adware.180Solutions : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ClientAX.ClientInstaller\CLSID -> Adware.180Solutions : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ClientAX.ClientInstaller\CurVer -> Adware.180Solutions : Cleaned with backup (quarantined).
C:\Documents and Settings\Niko Arola\Local Settings\Temporary Internet Files\Content.IE5\0XC0BMPR\pacificpoker[1].exe -> Adware.Casino : Cleaned with backup (quarantined).
HKU\S-1-5-21-3528250313-3959592857-4082376126-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5929CD6E-2062-44A4-B2C5-2C7E78FBAB38} -> Adware.Generic : Cleaned with backup (quarantined).
C:\Program Files\Alcohol Soft\Alcohol 120% Toolbar\a120_tb.dll -> Adware.Softomate : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ClientAX.RequiredComponent -> Adware.Zango : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ClientAX.RequiredComponent.1 -> Adware.Zango : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ClientAX.RequiredComponent\CLSID -> Adware.Zango : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ClientAX.RequiredComponent\CurVer -> Adware.Zango : Cleaned with backup (quarantined).
HKU\S-1-5-21-3528250313-3959592857-4082376126-1006\Software\Coulomb -> Dialer.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-3528250313-3959592857-4082376126-1006\Software\Coulomb\Porn Turbo -> Dialer.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP754\A0072169.dll -> Not-A-Virus.Adware.180Solutions : Cleaned with backup (quarantined).
C:\WINDOWS\Downloaded Program Files\gsda.dll -> Not-A-Virus.Downloader.Win32.SpyGame : Cleaned with backup (quarantined).
:mozilla.251:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.39:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.40:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.41:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.42:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.43:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.44:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.45:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.46:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.47:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.48:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.498:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.49:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.50:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.51:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.52:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.53:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.54:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.55:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.56:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.57:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.58:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.59:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.601:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.60:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.61:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.62:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.63:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.676:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.677:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.889:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.180:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.181:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.182:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Niko Arola\Cookies\niko_arola@ads.addynamix[1].txt -> TrackingCookie.Addynamix : Cleaned.
:mozilla.458:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adengage : Cleaned.
:mozilla.459:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adengage : Cleaned.
:mozilla.460:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adengage : Cleaned.
:mozilla.421:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.422:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.423:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.424:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.425:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.426:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.427:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.428:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.429:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.432:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.435:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.137:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.138:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.139:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.140:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.141:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.279:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.365:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned.
:mozilla.199:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.200:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.203:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.473:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.474:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.475:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.476:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.477:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.478:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.479:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.654:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned.
:mozilla.750:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
:mozilla.312:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
:mozilla.313:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
:mozilla.314:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
:mozilla.315:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
:mozilla.316:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
:mozilla.317:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
:mozilla.318:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
:mozilla.509:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
:mozilla.143:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.468:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.469:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.470:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Niko Arola\Cookies\niko_arola@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.926:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Gamershell : Cleaned.
:mozilla.927:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Gamershell : Cleaned.
:mozilla.928:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Gamershell : Cleaned.
:mozilla.929:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Gamershell : Cleaned.
:mozilla.930:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Gamershell : Cleaned.
:mozilla.931:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Gamershell : Cleaned.
:mozilla.561:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.655:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.934:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.608:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.686:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.709:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.447:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.448:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.568:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Intelli-direct : Cleaned.
:mozilla.507:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.86:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
:mozilla.9:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
:mozilla.488:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.830:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.831:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.832:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.833:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.834:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.835:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.836:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.439:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.440:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.769:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.770:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.772:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.569:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.570:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.574:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.575:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.576:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.577:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.578:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.579:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.580:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.944:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.945:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.946:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.947:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.948:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.949:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.950:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.320:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.321:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.322:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.323:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.324:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.325:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.326:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.327:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.328:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.329:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.330:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.331:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.332:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.333:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.334:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.335:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.336:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.337:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.338:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.339:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.340:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.341:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.342:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.343:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.344:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.345:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.346:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.347:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.348:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.349:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.350:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.351:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.352:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.353:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.354:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.355:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.356:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.357:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.358:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.359:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.360:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.361:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.362:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.363:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.364:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.18:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
:mozilla.201:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.202:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.204:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.176:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.177:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.178:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.179:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Documents and Settings\Niko Arola\Cookies\niko_arola@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.195:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.196:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.197:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.198:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.467:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.
:mozilla.710:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.838:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.147:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.148:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.149:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.150:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.151:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Niko Arola\Cookies\niko_arola@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.410:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.411:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.412:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.413:C:\Documents and Settings\Niko Arola\Application Data\Mozilla\Firefox\Profiles\8wwv3k4i.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\Niko Arola\Application Data\STOREHTM\oezydfcj.exe -> Trojan.Inject.qu : Cleaned with backup (quarantined).
C:\Documents and Settings\Niko Arola\Application Data\STOREHTM\vypjtvqi.exe -> Trojan.Obfuscated.en : Cleaned with backup (quarantined).
C:\Documents and Settings\Niko Arola\Application Data\STOREHTM\udmjwbda.exe -> Trojan.Obfuscated.io : Cleaned with backup (quarantined).


::Report end

 

Olipas sielä otas tosta vielä toisella normaalissa tilassa

Escan
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg

scannaa

jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl+A.
Kopioi rivit komennolla Ctrl+C.
Liitä rivit komennolla Ctrl+V.

Laita virus log tänne.

 

File C:\PROGRA~1\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
File C:\Documents and Settings\NetworkService\Application Data\STOREHTM\tons mix bias.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Niko Arola\Application Data\SecuROM\UserData\???????????p????????? infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Niko Arola\Application Data\SecuROM\UserData\???????????p????????? infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Niko Arola\Application Data\STOREHTM\cmbtlxzg.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Niko Arola\Application Data\STOREHTM\hmxumupp.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Niko Arola\Application Data\STOREHTM\iurmroey.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Niko Arola\Application Data\STOREHTM\krrktdgg.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Niko Arola\Application Data\STOREHTM\tozuspby.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Niko Arola\Application Data\STOREHTM\veviuqqg.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Niko Arola\Työpöytä\Käyttämättömät työpöydän pikakuvakkeet\3wPlayer-1.5.0.0-setup-0664.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Niko Arola\Työpöytä\mirc616.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
File C:\Documents and Settings\Niko Arola\Työpöytä\SmitfraudFix\Reboot.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
File C:\Program Files\DAEMON Tools\SetupDTSB.exe tagged as not-a-virus:AdTool.Win32.WhenU.a. No Action Taken.
File C:\Program Files\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP754\A0072166.dll tagged as not-a-virus:AdWare.Win32.HotBar.ch. No Action Taken.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP754\A0072177.exe tagged as not-a-virus:AdWare.Win32.180Solutions.bj. No Action Taken.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP754\A0072184.exe tagged as not-a-virus:AdTool.Win32.WhenU.c. No Action Taken.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP754\A0072185.exe tagged as not-a-virus:AdWare.Win32.SaveNow.bs. No Action Taken.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP754\A0072192.exe tagged as not-a-virus:AdWare.Win32.SaveNow.bt. No Action Taken.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP758\A0073593.exe infected by "Trojan.Win32.Inject.qu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP758\A0073594.exe infected by "Trojan.Win32.Obfuscated.io" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP758\A0073595.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP758\A0073596.dll tagged as not-a-virus:AdWare.Win32.Mostofate.p. No Action Taken.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP758\A0073853.dll tagged as not-a-virus:AdTool.Win32.WhenU.c. No Action Taken.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP758\A0073864.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP758\A0073865.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP758\A0073866.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP758\A0073867.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP758\A0073868.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP758\A0073869.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP758\A0073870.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{AFD58BDE-0B08-48B4-8CDF-FD55AC6B0EBD}\RP758\A0073871.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.

 

Poista
C:\Program Files\DAEMON Tools\SetupDTSB.exe

========

1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK

 

Onks se sit siinä vai?

 

jeps mites kone jakselee

 

Kone toimii mainiosti. Kiitos tästä.