Hjt-logi, kiitos avusta..

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi Yyteri365 13.12.2008.

Sivu 1 / 2
  1. Yyteri365

    Yyteri365 Member

    Liittynyt:
    31.03.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Käytössä F-Secure virustorjunta ja palomuuri, SpywareBlaster ja Ad-Aware. Welhon kaapeliliittymä.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:31:10, on 13.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\SM1BG.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSM32.EXE
    C:\WINDOWS\System32\LVCOMSX.EXE
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
    C:\WINDOWS\system32\kmw_run.exe
    C:\WINDOWS\system32\KMW_SHOW.EXE
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsgk32st.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSMA32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\FSGK32.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSMB32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FCH32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Common\FAMEH32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsqh.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSGUI\fsguidll.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fssm32.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSAUA\program\fsaua.exe
    C:\Program Files\Welho-tietoturvapalvelut\FWES\Program\fsdfwd.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsav32.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSAUA\program\fsus.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Welho-tietoturvapalvelut\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Welho-tietoturvapalvelut\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [SpyStopper] C:\Program Files\SpyStopper\spystopper.exe
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
    O4 - HKLM\..\Run: [kmw_run.exe] kmw_run.exe
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Welho-tietoturvapalvelut\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Photosmart Premier -pikakäynnistys.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1131982667343
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\Common\FSMA32.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    --
    End of file - 10898 bytes
     
    Viimeksi muokattu: 13.12.2008
    Yyteri365, 13.12.2008
    #1
  2.  
  3. Hujo

    Hujo Guest

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi

    =============

    1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
    Combofix1
    Combofix2

    2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    =============

    Lataa Tästä Ccleaner
    CCleaner v 2.14.750.- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
    Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
    Asennuksen jälkeen aukaise CCleaneri.
    Valitse vasemmalta pystyrivistä Options.
    Valitse viereisestä pystyrivistä Settings.
    Language kohtaan valitse Suomi.

    Puhdistaja
    Valitse vasemmalta pystyrivistä Puhdistaja.
    Paina alhaalta Tutki.
    Nyt CCleaneri tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
    Kun tutkiminen on valmis, paina Aja CCleaner.
    Nyt CCleaneri poistaa löydetyt tempit, cookiessit jne.

    Rekisterin virheiden korjaus
    Valitse vasemmalta pystyrivistä Rekisteri.
    Paina alhaalta Etsi rekisterin virheitä.
    Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
    Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
    Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
    Saat vielä varmistus kysymyksen, paina Ok.
    Kun virheet on korjattu, paina Sulje.
    Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.

    ===========

    scannaa viimisenä uusi hjt:n loki
     
    Hujo, 14.12.2008
    #2
  4. Yyteri365

    Yyteri365 Member

    Liittynyt:
    31.03.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Ant-Malware hoitui ihan Ok ja tallensin lokin.

    Mutta tuo Combofix ei tuottanut lokia lainkaan, antoi näytölle vain tyhjän sinipohjaisen ikkunan. En klikkaillut ikkunaa tms. Toinenkaan kerta ei antanut lokia.

    Sen sijaan Firefox ei enää suostunut käynnistymään vaan jouduin turvautumaan järjestelmän palautuspisteeseen.

    Jatkanko ohjeiden mukaisesti vai mitä tulisi tehdä ?
     
    Yyteri365, 14.12.2008
    #3
  5. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki

    Luo poistolista:
    • Avaa HiJackThis
    • Klikkaa "Configure" valintaa oikealla alhaalla
    • Klikkaa "Misc Tools"
    • Klikkaa boxia joka sanoo "Uninstall Manager"
    • Klikkaa valintaa "Save list"
    • Kopioi ja liitä kyseinen lista muistiosta ketjuusi
     
    Hujo, 14.12.2008
    #4
  6. Yyteri365

    Yyteri365 Member

    Liittynyt:
    31.03.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Hjt poistolista

    Ad-Aware
    Adobe Flash Player 10 Plugin
    Adobe Flash Player 9 ActiveX
    Adobe Reader 8.1.3
    Adobe Shockwave Player
    AP Guitar Tuner 1.02
    AP Tuner 2.10
    Apple Software Update
    ArcSoft ShowBiz 2
    ATI Control Panel
    ATI Display Driver
    Audacity 1.2.3
    BSPlayer
    Canon i250
    Canon Utilities Easy-PhotoPrint
    cdrLabel 7.1
    Cypress USB Mass Storage Driver Installation
    DivX
    DivX Player
    DivX Web Player
    Easy Thumbnails (Remove only)
    Easy-WebPrint
    Enhanced Multimedia Keyboard Solution
    Filesharing
    Fire 1.1
    foobar2000 v0.9.4.3
    GdiplusUpgrade
    Google Toolbar for Internet Explorer
    Google Video Player
    GXB Dialer 160-xnxx
    HijackThis 2.0.2
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix-korjauspäivitys Windows Media Player 11:lle (KB939683)
    Hotfix-päivitys Windows Internet Explorer 7:lle (KB947864)
    Hotfix-päivitys Windows XP:lle (KB952287)
    HP Deskjet Preloaded Printer Drivers
    HP Flat Panel Monitor INF Software 2.00
    HP Imaging Device Functions 7.0
    HP Photosmart Essential
    HP Photosmart -kamerat 7.0
    HP Photosmart Premier Software 6.5
    HP Solution Center 7.0
    HP Update
    Intel(R) Extreme Graphics Driver
    InterVideo WinDVD Player
    InterVideo WinDVRX
    iTunes
    Java 2 Runtime Environment, SE v1.4.1_02
    Java Web Start
    Kensington MouseWorks
    Language Pack for Ad-aware 6
    LiveReg (Symantec Corporation)
    LiveUpdate 1.80 (Symantec Corporation)
    Logitech QuickCam
    Logitech® Camera -ohjain
    Memories Disc Creator 2.0
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Finnish Language Pack
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Language Pack - FIN
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Data Access Components KB870669
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office Excel Viewer 2003
    Microsoft Office PowerPoint Viewer 2007 (Finnish)
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Windows Journal Viewer
    Microsoft Windows XP -käyttöjärjestelmän ohjatun CD-levylle tallentamisen HighMAT-laajennus
    Microsoft Word 2002
    Microsoft Works 7.0
    Mozilla Firefox (3.0.4)
    MSN Messenger 6.1
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    NVIDIA Ethernet Driver
    NVIDIA Gart Driver
    NVIDIA Windows 2000/XP Display Drivers
    Photosmart 140,240,7200,7600,7700,7900 Series
    Python 2.2 combined Win32 extensions
    Python 2.2.1
    Päivitys Windows XP:lle (KB951072-v2)
    Päivitys Windows XP:lle (KB951978)
    Päivitys Windows XP:lle (KB955839)
    QuickTime
    RealPlayer
    RealRhapsody
    RecordNow!
    S3Display
    S3Gamma2
    S3Info2
    S3Overlay
    Security Update for CAPICOM (KB931906)
    Security Update for CAPICOM (KB931906)
    Shockwave
    Sonic Update Manager
    Spelling Dictionaries Support For Adobe Reader 8
    SpywareBlaster 4.1
    Suojauspäivitys ohjelmistolle Windows XP (KB941569)
    Suojauspäivitys Windows Internet Explorer 7:lle (KB928090)
    Suojauspäivitys Windows Internet Explorer 7:lle (KB929969)
    Suojauspäivitys Windows Internet Explorer 7:lle (KB931768)
    Suojauspäivitys Windows Internet Explorer 7:lle (KB933566)
    Suojauspäivitys Windows Internet Explorer 7:lle (KB937143)
    Suojauspäivitys Windows Internet Explorer 7:lle (KB938127)
    Suojauspäivitys Windows Internet Explorer 7:lle (KB939653)
    Suojauspäivitys Windows Internet Explorer 7:lle (KB942615)
    Suojauspäivitys Windows Internet Explorer 7:lle (KB944533)
    Suojauspäivitys Windows Internet Explorer 7:lle (KB950759)
    Suojauspäivitys Windows Internet Explorer 7:lle (KB953838)
    Suojauspäivitys Windows Internet Explorer 7:lle (KB956390)
    Suojauspäivitys Windows Internet Explorer 7:lle (KB958215)
    Suojauspäivitys Windows Media Player 10:lle (KB911565)
    Suojauspäivitys Windows Media Player 10:lle (KB917734)
    Suojauspäivitys Windows Media Player 11:lle (KB936782)
    Suojauspäivitys Windows Media Player 11:lle (KB954154)
    Suojauspäivitys Windows Media Playerille (KB952069)
    Suojauspäivitys Windows XP:lle (KB938464)
    Suojauspäivitys Windows XP:lle (KB946648)
    Suojauspäivitys Windows XP:lle (KB950760)
    Suojauspäivitys Windows XP:lle (KB950762)
    Suojauspäivitys Windows XP:lle (KB950974)
    Suojauspäivitys Windows XP:lle (KB951066)
    Suojauspäivitys Windows XP:lle (KB951376)
    Suojauspäivitys Windows XP:lle (KB951376-v2)
    Suojauspäivitys Windows XP:lle (KB951698)
    Suojauspäivitys Windows XP:lle (KB951748)
    Suojauspäivitys Windows XP:lle (KB952954)
    Suojauspäivitys Windows XP:lle (KB953839)
    Suojauspäivitys Windows XP:lle (KB954211)
    Suojauspäivitys Windows XP:lle (KB954459)
    Suojauspäivitys Windows XP:lle (KB954600)
    Suojauspäivitys Windows XP:lle (KB955069)
    Suojauspäivitys Windows XP:lle (KB956391)
    Suojauspäivitys Windows XP:lle (KB956802)
    Suojauspäivitys Windows XP:lle (KB956803)
    Suojauspäivitys Windows XP:lle (KB956841)
    Suojauspäivitys Windows XP:lle (KB957095)
    Suojauspäivitys Windows XP:lle (KB957097)
    Suojauspäivitys Windows XP:lle (KB958644)
    USB Storage Adapter FX (SM1)
    Welho Tietoturva
    WIDCOMM Bluetooth-ohjelmisto
    Winamp (remove only)
    Windows Genuine Advantage v1.3.0254.0
    Windows Media Format 11 runtime
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Media Player 11
    Windows XP Service Pack 3
    VR Dr13 v1.1
    Yahoo! extras
    Yahoo! Install Manager
    Yahoo! Internet Mail
    Yahoo! Messenger



    Tässä myös Anti-Malware loki (ennen järjestelmän palauttamista 14.12.2008)

    Malwarebytes' Anti-Malware 1.31
    Tietokantaversio: 1499
    Windows 5.1.2600 Service Pack 3

    14.12.2008 12:27:51
    mbam-log-2008-12-14 (12-27-51).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
    Tarkistetut kohteet: 141045
    Kulunut aika: 51 minute(s), 28 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 56
    Saastuneita rekisteriarvoja: 1
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 3

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    HKEY_CLASSES_ROOT\imcupdate.update (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\imcupdate.update.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\imcwselparser.wselparser (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\imcwselparser.wselparser.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\whistlehlprobj.whistlehlprobj.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wselservices.wsellogservices (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wselservices.wsellogservices.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wselservices.wselnetworkservices (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wselservices.wselnetworkservices.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wselservices.wselxmlservices (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wselservices.wselxmlservices.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wseltypelibrary.user (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wseltypelibrary.user.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wseltypelibrary.wselservice (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wseltypelibrary.wselservice.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wseltypelibrary.wselservicecol (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wseltypelibrary.wselservicecol.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{0bf6b2ca-be97-4275-8695-2fb086be0b9b} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{0cc38e71-6ad3-450c-8c71-50728a640b43} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{0fbd6033-24c5-45d2-a1e5-38c46ed3b135} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{322400d5-8fb0-45ba-8f09-0e837d57493b} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{54a770f4-d5f3-42ae-9fd5-390a6a4d85e7} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{7ea005fe-90da-4bc7-955b-9face4a2069c} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{80e6ee09-3db1-4627-a7c9-dad7cfbdf05f} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{8179b6d6-513d-45dc-b910-aa329a524142} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{8d9bffc9-e027-4ea3-8ae9-8dbefed2fb93} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{8da46338-ba81-4065-b7b9-36450e42b017} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{92a17f40-e69b-44fa-9b8a-aaf7dbe413af} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{930cb039-564e-4c04-b6a8-8b31bfb28347} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{99258154-5666-4561-ad45-c76ae7077b70} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{a58aacf2-6e0f-4465-8c81-52151e60e07b} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{aa5955f9-b090-4d3b-ad7f-c9b46509bb87} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{bb46ac71-9f97-4518-b0d0-f3008b65cf88} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{d02fac77-c2e0-44d9-aa62-e9f40831ca8e} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{d5e6a641-453e-4650-a49a-fa912a870827} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{f75448f7-4f62-45fa-9bc1-4250bb4d87c9} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{fdc2fa83-0e09-427a-a4e6-04fb98667c32} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{fe2c03f1-eb17-4017-9c22-99c65870b9ec} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{3fecb959-1fdd-4803-850a-ca3f2859f5ab} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{889395bf-f7f7-4023-b42e-6074de380ea5} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{9f05772f-c5ab-4491-b8e1-a5a1a0b883a7} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a16e4ecf-12aa-49e2-9891-ece57af678b9} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a625720f-c6eb-4806-b3d6-8fc4df89db94} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{ac8b00eb-0b68-49a6-a278-cbba09e8151e} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{b135ed26-a131-4861-b081-35c69398a704} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{c7a2084b-969c-439a-96e8-176bf9a93879} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{ebcf7b0e-2277-4ee4-95ee-3d542cdb8191} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{0a88c7a6-f482-462a-8f43-f1ad8c009f50} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{568f3ba7-b0e2-4a83-b8b6-319631c4622c} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{93cf2521-df05-41f4-b803-5eb17c4bb424} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{b8848f69-e8e2-4952-90f2-bc4ef0c22243} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{d1bcd273-d241-4bff-a2a0-e45b3b4eb27b} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{ce7c3cf0-4b15-11d1-abed-709549c10000} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\whistlehlprobj.whistlehlprobj (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\WhistleSoftware (Adware.Whistle) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    C:\WINDOWS\Downloaded Program Files\uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\didduid.ini (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Omistaja\Local Settings\Temp\gos533.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
     
    Yyteri365, 14.12.2008
    #5
  7. Hujo

    Hujo Guest

    Poista lisää poista sovelutuksesta

    Java 2 Runtime Environment, SE v1.4.1_02
    LiveReg (Symantec Corporation)
    LiveUpdate 1.80 (Symantec Corporation)

    ========

    mikäs lainen se hjt:n loki on nyt
     
    Hujo, 14.12.2008
    #6
  8. Yyteri365

    Yyteri365 Member

    Liittynyt:
    31.03.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Poistin nuo Ohjauspaneelin (poista tai lisää sovellus) kautta, buuttasin koneen ja suoritin Hjt:n. Tässä loki :

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:12:23, on 14.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsgk32st.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSMA32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\FSGK32.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSMB32.EXE
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\SM1BG.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSM32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Common\FCH32.EXE
    C:\WINDOWS\System32\LVCOMSX.EXE
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
    C:\WINDOWS\system32\kmw_run.exe
    C:\WINDOWS\system32\KMW_SHOW.EXE
    C:\Program Files\Welho-tietoturvapalvelut\FSGUI\ispnews.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fssm32.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsqh.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FAMEH32.EXE
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSAUA\program\fsaua.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    C:\Program Files\Welho-tietoturvapalvelut\FWES\Program\fsdfwd.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSGUI\fsguidll.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsav32.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSAUA\program\fsus.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Welho-tietoturvapalvelut\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Welho-tietoturvapalvelut\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [SpyStopper] C:\Program Files\SpyStopper\spystopper.exe
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
    O4 - HKLM\..\Run: [kmw_run.exe] kmw_run.exe
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Welho-tietoturvapalvelut\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Photosmart Premier -pikakäynnistys.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1131982667343
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\Common\FSMA32.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    --
    End of file - 11161 bytes
     
    Yyteri365, 14.12.2008
    #7
  9. Hujo

    Hujo Guest

    Poista lisää poista sovelutuksesta

    Yahoo! extras
    Yahoo! Install Manager
    Yahoo! Internet Mail
    Yahoo! Messenger

    poista kansio vikasiedossa

    C:\Program Files\Yahoo!

    =================

    scannaa hjt:llä merkkaa paina Fix checked

    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

    =================

    Sitten ei muuta kuin uudestaan kaikki lävitse.

    Malwarebytes' Anti-Malware
    Combofix

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

    =============

    tossa on vielä netin fixsi

    Lataa Winsockfix
    työpöydällesi
    pura zip, Avaa Winsockfix paina Fix

    =============

    1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
    2. Valitse ominaisuudet
    3. Valitse järjestelmän palauttaminen välilehti
    4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
    5. Paina Käytä
    6. Paina ok
    7. Sammuta ja käynnistä
    8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
    9. Käytä ja OK

    ==============

    Lopuksi pyyhkäse ccleanerilla

    Puhdista
    Rekisteri
     
    Moderaattorin viimeksi muokkaama: 14.12.2008
    Hujo, 14.12.2008
    #8
  10. Yyteri365

    Yyteri365 Member

    Liittynyt:
    31.03.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Nuo Yahoot voin poistaa, niitä en tarvitse.

    Mutta nyt on mentävä, teen ohjeittesi mukaan. Toivottavasti saan sulta apua huomennakin :) Kiitos ja mukavaa sunnuntai-iltaa !
     
    Yyteri365, 14.12.2008
    #9
  11. Hujo

    Hujo Guest

    joo meni uusiksi koko hela hoito. :D
     
    Hujo, 14.12.2008
    #10
  12. Yyteri365

    Yyteri365 Member

    Liittynyt:
    31.03.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Poistin sovelluksesta (ohjauspaneeli poista/lisää)
    Yahoo! extras
    Yahoo! Install Manager
    Yahoo! Internet Mail
    Yahoo! Messenger

    Poistin vikasietotilassa
    C:\Program Files\Yahoo!

    scannaa hjt:llä merkkaa paina Fix checked

    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

    Noita ei listalta löytynyt, eli ei ollut fixattavaa.Tässä loki :

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:02:47, on 15.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\SM1BG.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSM32.EXE
    C:\WINDOWS\System32\LVCOMSX.EXE
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
    C:\WINDOWS\system32\kmw_run.exe
    C:\WINDOWS\system32\KMW_SHOW.EXE
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsgk32st.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSMA32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\FSGK32.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSMB32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FCH32.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fssm32.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FAMEH32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsqh.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSAUA\program\fsaua.exe
    C:\Program Files\Welho-tietoturvapalvelut\FWES\Program\fsdfwd.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSGUI\fsguidll.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsav32.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSAUA\program\fsus.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Welho-tietoturvapalvelut\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Welho-tietoturvapalvelut\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [SpyStopper] C:\Program Files\SpyStopper\spystopper.exe
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
    O4 - HKLM\..\Run: [kmw_run.exe] kmw_run.exe
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Welho-tietoturvapalvelut\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Photosmart Premier -pikakäynnistys.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1131982667343
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\Common\FSMA32.EXE
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    --
    End of file - 9610 bytes


    Malwarebytes´ Anti-Malwaren suoritin ja poistin kaikki merkityt. Tässä loki :

    Malwarebytes' Anti-Malware 1.31
    Tietokantaversio: 1501
    Windows 5.1.2600 Service Pack 3

    15.12.2008 18:39:34
    mbam-log-2008-12-15 (18-39-34).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
    Tarkistetut kohteet: 140761
    Kulunut aika: 59 minute(s), 12 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 55
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    HKEY_CLASSES_ROOT\imcupdate.update (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\imcupdate.update.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\imcwselparser.wselparser (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\imcwselparser.wselparser.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\whistlehlprobj.whistlehlprobj.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wselservices.wsellogservices (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wselservices.wsellogservices.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wselservices.wselnetworkservices (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wselservices.wselnetworkservices.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wselservices.wselxmlservices (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wselservices.wselxmlservices.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wseltypelibrary.user (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wseltypelibrary.user.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wseltypelibrary.wselservice (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wseltypelibrary.wselservice.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wseltypelibrary.wselservicecol (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wseltypelibrary.wselservicecol.1 (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{0bf6b2ca-be97-4275-8695-2fb086be0b9b} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{0cc38e71-6ad3-450c-8c71-50728a640b43} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{0fbd6033-24c5-45d2-a1e5-38c46ed3b135} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{322400d5-8fb0-45ba-8f09-0e837d57493b} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{54a770f4-d5f3-42ae-9fd5-390a6a4d85e7} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{7ea005fe-90da-4bc7-955b-9face4a2069c} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{80e6ee09-3db1-4627-a7c9-dad7cfbdf05f} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{8179b6d6-513d-45dc-b910-aa329a524142} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{8d9bffc9-e027-4ea3-8ae9-8dbefed2fb93} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{8da46338-ba81-4065-b7b9-36450e42b017} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{92a17f40-e69b-44fa-9b8a-aaf7dbe413af} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{930cb039-564e-4c04-b6a8-8b31bfb28347} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{99258154-5666-4561-ad45-c76ae7077b70} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{a58aacf2-6e0f-4465-8c81-52151e60e07b} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{aa5955f9-b090-4d3b-ad7f-c9b46509bb87} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{bb46ac71-9f97-4518-b0d0-f3008b65cf88} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{d02fac77-c2e0-44d9-aa62-e9f40831ca8e} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{d5e6a641-453e-4650-a49a-fa912a870827} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{f75448f7-4f62-45fa-9bc1-4250bb4d87c9} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{fdc2fa83-0e09-427a-a4e6-04fb98667c32} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{fe2c03f1-eb17-4017-9c22-99c65870b9ec} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{3fecb959-1fdd-4803-850a-ca3f2859f5ab} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{889395bf-f7f7-4023-b42e-6074de380ea5} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{9f05772f-c5ab-4491-b8e1-a5a1a0b883a7} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a16e4ecf-12aa-49e2-9891-ece57af678b9} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a625720f-c6eb-4806-b3d6-8fc4df89db94} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{ac8b00eb-0b68-49a6-a278-cbba09e8151e} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{b135ed26-a131-4861-b081-35c69398a704} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{c7a2084b-969c-439a-96e8-176bf9a93879} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{ebcf7b0e-2277-4ee4-95ee-3d542cdb8191} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{0a88c7a6-f482-462a-8f43-f1ad8c009f50} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{568f3ba7-b0e2-4a83-b8b6-319631c4622c} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{93cf2521-df05-41f4-b803-5eb17c4bb424} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{b8848f69-e8e2-4952-90f2-bc4ef0c22243} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{d1bcd273-d241-4bff-a2a0-e45b3b4eb27b} (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{ce7c3cf0-4b15-11d1-abed-709549c10000} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\whistlehlprobj.whistlehlprobj (Adware.Whistle) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\WhistleSoftware (Adware.Whistle) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)

    Combofixin suoritin ja hyvin pienessä ikkunassa rullasi palkki. Logia se ei tuottanut, vain saman sinipohjasen tyhjän ikkunan kuin viimeksikin, jossa yläpalkissa C:\

    Tähän lopetin. Mitä nyt.. seuraavaksi ?
     
    Yyteri365, 15.12.2008
    #11
  13. Yyteri365

    Yyteri365 Member

    Liittynyt:
    31.03.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Firefox ei taaskaan avaudu, mutta tämä avoinna ollut selain toimii.
     
    Yyteri365, 15.12.2008
    #12
  14. Hujo

    Hujo Guest

    taulun väri oli ainakin oikea
    näkykö c:\ perässä tapahtuvan näin .............--> ja jatkui

    ==================

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Moderaattorin viimeksi muokkaama: 15.12.2008
    Hujo, 15.12.2008
    #13
  15. Yyteri365

    Yyteri365 Member

    Liittynyt:
    31.03.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Ei siinä c:\ perässä muistaakseni mitään ollut. Odottelin abt 5 min, eikä siihen mitään tullutkaan.

    Eli jatkanko ohjeesi mukaan ilman palautuspistettä ? Olen tän yhden selainikkunan varassa.. :)

     
    Yyteri365, 15.12.2008
    #14
  16. Hujo

    Hujo Guest

    combofix kö se siellä on nyt käytössä kuitenkin ...ota se palautus piste käytöön jos sitä tarjoo muuten jatka vain eteen päin
     
    Hujo, 15.12.2008
    #15
  17. Yyteri365

    Yyteri365 Member

    Liittynyt:
    31.03.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Palautuspistettä ei tarvittu ja Firefoxkin toimii bueno.

    SDFix loki :


    SDFix: Version 1.240
    Run by Omistaja on ma 15.12.2008 at 20:24

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\Documents and Settings\Omistaja\Työpöytä\SDFix\SDFix

    Checking Services :


    Restoring Default Security Values
    Restoring Default Hosts File

    Rebooting


    Checking Files :

    Trojan Files Found:

    C:\WINDOWS\system32\drivers\etc\hosts.bho - Deleted





    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-15 20:31:39
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001986000ca9]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001986000ca9]

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""
    "DeviceNotSelectedTimeout"="15"
    "GDIProcessHandleQuota"=dword:00002710
    "Spooler"="yes"
    "swapdisk"=""
    "TransmissionRetryTimeout"="90"
    "USERProcessHandleQuota"=dword:00002710

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Disabled:Yahoo! FT Server"
    "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:*:Disabled:Yahoo! Messenger"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"

    Remaining Files :


    File Backups: - C:\DOCUME~1\Omistaja\TYPYT~1\SDFix\SDFix\backups\backups.zip

    Files with Hidden Attributes :

    Mon 8 Dec 2003 196 A.SHR --- "C:\BOOT.BAK"
    Mon 14 Apr 2008 60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe"
    Thu 15 Jan 2004 0 A.SH. --- "C:\WINDOWS\SMINST\HPCD.sys"
    Thu 29 Apr 2004 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Mon 5 Feb 2001 34,331 ...H. --- "C:\swsetup\Monitors\f1523\INSTALL.EXE"
    Sun 15 Apr 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"

    Finished!

    ==

    Ja tuon jälkeen suoritetun hjt:n loki :

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:58:57, on 15.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsgk32st.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSMA32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\FSGK32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSMB32.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FCH32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fssm32.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FAMEH32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsqh.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSAUA\program\fsaua.exe
    C:\Program Files\Welho-tietoturvapalvelut\FWES\Program\fsdfwd.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSAUA\program\fsus.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsav32.exe
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\SM1BG.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSM32.EXE
    C:\WINDOWS\System32\LVCOMSX.EXE
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
    C:\WINDOWS\system32\kmw_run.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSGUI\fsguidll.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSGUI\ispnews.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\KMW_SHOW.EXE
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Welho-tietoturvapalvelut\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Welho-tietoturvapalvelut\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [SpyStopper] C:\Program Files\SpyStopper\spystopper.exe
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
    O4 - HKLM\..\Run: [kmw_run.exe] kmw_run.exe
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Welho-tietoturvapalvelut\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Photosmart Premier -pikakäynnistys.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1131982667343
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\Common\FSMA32.EXE
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    --
    End of file - 9565 bytes

    ===

    Miltä näyttää, mitä mahdollisesti seuravaksi..
     
    Yyteri365, 15.12.2008
    #16
  18. Hujo

    Hujo Guest

    koita nyt sitä combofixsiä

    Älä käyttä muita ohjelmia sulje kaikki muut ohjelmat combofix vain toimii pelkästään.

    ================
     
    Hujo, 15.12.2008
    #17
  19. Yyteri365

    Yyteri365 Member

    Liittynyt:
    31.03.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Ei, niin ei.. :)

    Suoritin Combofixin, mutta jälleen sama tulos : ei logia.
    Firefox ei auennut kuin buuttauksen jälkeen..

     
    Yyteri365, 15.12.2008
    #18
  20. Yyteri365

    Yyteri365 Member

    Liittynyt:
    31.03.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Aikanen herätys, aikasin nukkumaan..
     
    Yyteri365, 15.12.2008
    #19
  21. Yyteri365

    Yyteri365 Member

    Liittynyt:
    31.03.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Suoritin Ccleanerin onnistuneesti. Linkistä saamani versio oli 2.14.765

    Tässä uusin Hjt -loki :

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:04:04, on 16.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\SM1BG.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSM32.EXE
    C:\WINDOWS\System32\LVCOMSX.EXE
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
    C:\WINDOWS\system32\kmw_run.exe
    C:\WINDOWS\system32\KMW_SHOW.EXE
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsgk32st.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSMA32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\FSGK32.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FSMB32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Welho-tietoturvapalvelut\Common\FCH32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Common\FAMEH32.EXE
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsqh.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSGUI\fsguidll.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fssm32.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSAUA\program\fsaua.exe
    C:\Program Files\Welho-tietoturvapalvelut\FWES\Program\fsdfwd.exe
    C:\Program Files\Welho-tietoturvapalvelut\FSAUA\program\fsus.exe
    C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsav32.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Welho-tietoturvapalvelut\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Welho-tietoturvapalvelut\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
    O4 - HKLM\..\Run: [kmw_run.exe] kmw_run.exe
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Welho-tietoturvapalvelut\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Photosmart Premier -pikakäynnistys.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1131982667343
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelut\Common\FSMA32.EXE
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    --
    End of file - 9279 bytes
     
    Yyteri365, 16.12.2008
    #20
Sivu 1 / 2

Jaa tämä sivu