HJT -lokia jälleen

Tuo ei auta paljoa, mutta yritetään tätä:

Tarkista koneesi Panda Online Skannerilla:

http://www.pandasoftware.com/activescan/com/activescan_principal.htm
[*] Kun olet Pandan sivulla, klikkaa Scan your PC-painiketta
[*]Uusi ikkuna aukeaa...klikkaa Check Now-painiketta
[*]Valitse maa, Country
[*]Syötä kaupunki, State/Province
[*]Syötä sähköpostiosoitteesi, e-mail address ja klikkaa send-painiketta
[*]Valitse joko kotikäyttäjä Home User tai yritys Company
[*]Klikkaa suurta Scan Now-painiketta
[*]Jos ActiveX-komponentin asentamista kysytään, salli se.
[*]Tarvittavien tiedostojen lataaminen alkaa (Huom: Tämä vaihe voi viedä muutamia minuutteja)
[*]Kun lataukset ovat valmiit, klikkaa Local Disks aloittaaksesi skannauksen
[*]Kun skannaus on valmis, klikkaa See Report-painiketta jos infektioita löytyi. Klikkaa sitten Save Report ja tallenna raportti johonkin sopivaan sijaintiin (esim työpöydälle).

Liitä Pandan skannausraportin sisältö vastaukseesi uuden HijackThis-lokin kera.

 

Incident Status Location

Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Cookies\järjestelmänvalvoja@belnk[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Cookies\järjestelmänvalvoja@dist.belnk[2].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Cookies\järjestelmänvalvoja@go[2].txt
Spyware:Cookie/Hypercount Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Cookies\järjestelmänvalvoja@hypercount[2].txt
Spyware:Cookie/Mircx Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Cookies\järjestelmänvalvoja@pop.mircx[2].txt
Spyware:Cookie/Santa Monica networks inc Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Cookies\järjestelmänvalvoja@smni[1].txt
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Cookies\järjestelmänvalvoja@www.toplist[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\oppilas\Cookies\oppilas@atwola[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\oppilas\Cookies\oppilas@belnk[1].txt
Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\oppilas\Cookies\oppilas@bravenet[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\oppilas\Cookies\oppilas@dist.belnk[2].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\oppilas\Cookies\oppilas@go[1].txt
Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\oppilas\Cookies\oppilas@maxserving[1].txt
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\oppilas\Cookies\oppilas@realmedia[1].txt
Spyware:Cookie/Rn11 Not disinfected C:\Documents and Settings\oppilas\Cookies\oppilas@rn11[1].txt
Spyware:Cookie/Eyeblaster Not disinfected C:\Documents and Settings\oppilas\Cookies\oppilas@www.eyeblaster-ds[1].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\oppilas\Cookies\oppilas@xiti[1].txt
Virus:Trj/PSW.BugBear Disinfected C:\WINNT\system32\ulvulkz.0ll






Logfile of HijackThis v1.99.1
Scan saved at 13:06:28, on 12.5.2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\DeltTray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINNT\system32\internat.exe
C:\WINNT\system32\spool\DRIVERS\W32X86\3\LXBZPSWX.EXE
C:\WINNT\system32\spool\DRIVERS\W32X86\3\LXBZJSWX.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis_v1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.edu.ouka.fi/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.msn.fi/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.suomi.net:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [hp Update 3300C] C:\sj650\hpupdate.exe 3300C+
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1138358738101
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C0E89BCD-6254-4410-B4CB-ED80E0620BC5}: NameServer = 193.65.248.170,194.157.175.3
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE

 

Eipä se tietenkään toista niistä löytänyt. Se olisikin ollu liian helppoa

Seuraavaksi Kasperskyn online-skanneri:

http://www.kaspersky.com/downloads/kws/kavwebscan.html

Sinulta kysytään sallitko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
[*] Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
[*] Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
[*] Klikkaa nyt asetuksia, Scan Settings
[*] Tarkista asetuksista, että seuraavat ovat valittuina:

o Scan using the following Anti-Virus database:

+ Extended (Jos valittavissa, muuten valitse Standard)

o Scan Options:

+ Scan Archives
+ Scan Mail Bases

[*] Klikkaa OK
[*] Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
[*] Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
[*] Klikkaa nyt Save as Text-painiketta.
[*] Tallenna tiedosto työpöydällesi.
[*] Kopioi ja Liitä tiedoston sisältö seuraavaan vastaukseesi.

 

Jeps, taitaapi siirtyä ensi viikon puolelle tuo operaatio

Muuten, pitäs kyllä itekin opetella lukee jo HJT -lokeja... Opettakaa mua

 

Kone tahmaa aika ikävästi. Mahtasko olla örkkimörkkejä?

Logfile of HijackThis v1.99.1
Scan saved at 12:30:24, on 15.5.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\WINDOWS\SoftwareDistribution\Download\Install\Windows-KB890830-V1.16-Delta.exe
c:\d104d19914ea8a1c25c8\mrtstub.exe
C:\WINDOWS\system32\MRT.exe
C:\HJT\HijackThis_v1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.opintoluotsi.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://akkuna.oulunkaupunki.fi
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.ouka.fi/proxy_opetus.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.suomi.net:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Pikakuvake bgnolla.lnk = C:\Documents and Settings\All Users\bginfofile\bgnolla.bat
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://akkuna.oulunkaupunki.fi
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = oulunkaupunki.fi
O17 - HKLM\Software\..\Telephony: DomainName = oulunkaupunki.fi
O17 - HKLM\System\CCS\Services\Tcpip\..\{B403D0BF-1473-46FD-84B2-E3B9CC43B54A}: NameServer = 192.107.218.31,192.107.218.32
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = oulunkaupunki.fi
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = oulunkaupunki.fi
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: KTVerSvc - Unknown owner - C:\kuntat\KTVerSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

 

Tiedätkö mikä tämä on ->

O23 - Service: KTVerSvc - Unknown owner - C:\kuntat\KTVerSvc.exe ?

Jos et, niin tarkista se täällä ->
http://www.virustotal.com/flash/index_en.html
ja lähetä tulokset.

Taitaa olla F-secure suurin syy tökkimiseen, raskas kun on

 

Joo, kyllä se asiallinen file on:

STATUS: FINISHEDComplete scanning result of "KTVerSvc.exe", received in VirusTotal at 05.15.2006, 12:28:13 (CET).

Antivirus Version Update Result
AntiVir 6.34.1.27 05.15.2006 no virus found
Avast 4.6.695.0 05.12.2006 no virus found
AVG 386 05.14.2006 no virus found
BitDefender 7.2 05.15.2006 no virus found
CAT-QuickHeal 8.00 05.15.2006 no virus found
ClamAV devel-20060426 05.14.2006 no virus found
DrWeb 4.33 05.15.2006 no virus found
eTrust-InoculateIT 23.72.8 05.14.2006 no virus found
eTrust-Vet 12.4.2209 05.15.2006 no virus found
Ewido 3.5 05.15.2006 no virus found
Fortinet 2.76.0.0 05.15.2006 no virus found
F-Prot 3.16c 05.12.2006 no virus found
Ikarus 0.2.65.0 05.15.2006 no virus found
Kaspersky 4.0.2.24 05.15.2006 no virus found
McAfee 4761 05.12.2006 no virus found
Microsoft 1.1372 05.13.2006 no virus found
NOD32v2 1.1537 05.14.2006 no virus found
Norman 5.90.17 05.12.2006 no virus found
Panda 9.0.0.4 05.14.2006 no virus found
Sophos 4.05.0 05.15.2006 no virus found
Symantec 8.0 05.15.2006 no virus found
TheHacker 5.9.7.143 05.15.2006 no virus found
UNA 1.83 05.12.2006 no virus found
VBA32 3.11.0 05.15.2006 no virus found


Aditional Information
File size: 86016 bytes
MD5: 1a7e651f36e29188c3c99dd3b33c3d94

 

Selvä. Tökkimiseen on paha muuta sanoa kun, että keskusmuistia lisää ja/tai F-securen vaihto kevyempään Tietysti levyn eheytys ja rekisterin siivous voivat myös auttaa.

 

Oisko kökköö?

Logfile of HijackThis v1.99.1
Scan saved at 12:48:54, on 24.5.2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
D:\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\WINNT\System32\svchost.exe
D:\F-Secure\Anti-Virus\fsgk32st.exe
D:\F-Secure\Anti-Virus\FSGK32.EXE
D:\F-Secure\Anti-Virus\fssm32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
D:\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
D:\F-Secure\Common\FSMA32.EXE
D:\F-Secure\Common\FSMB32.EXE
C:\WINNT\system32\S3tray2.exe
C:\WINNT\SOUNDMAN.EXE
D:\F-Secure\Common\FSM32.EXE
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\F-Secure\Common\FCH32.EXE
D:\F-Secure\Common\FAMEH32.EXE
C:\WINNT\system32\ctfmon.exe
D:\F-Secure\Common\FNRB32.EXE
D:\F-Secure\Common\FIH32.EXE
D:\F-Secure\Anti-Virus\fsav32.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Common Files\System\MAPI\1035\nt\MAPISP32.EXE
D:\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\AVACK INFO 5.2\ainfo52.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis_v1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.peda.net/veraja/oulu/rajakyla
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://akkuna.oulunkaupunki.fi
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.ouka.fi/proxy_opetus.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=proxy.suomi.net:8080;gopher=proxy.suomi.net:8080;http=proxy.suomi.net:8080;https=proxy.suomi.net:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 82.128.146.227; http://www.tiehallinto.fi/alk/frames/kelikamerat-frame.html;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [F-Secure Manager] "D:\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://akkuna.oulunkaupunki.fi
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1127212408555
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = oulunkaupunki.fi
O17 - HKLM\System\CCS\Services\Tcpip\..\{11591748-B033-4BF5-871D-78BFA27C2A08}: NameServer = 192.107.218.31,192.107.218.32
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = oulunkaupunki.fi
O17 - HKLM\System\CS1\Services\Tcpip\..\{11591748-B033-4BF5-871D-78BFA27C2A08}: NameServer = 192.107.218.31,192.107.218.32
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = oulunkaupunki.fi
O17 - HKLM\System\CS2\Services\Tcpip\..\{11591748-B033-4BF5-871D-78BFA27C2A08}: NameServer = 192.107.218.31,192.107.218.32
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - D:\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - D:\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - D:\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - D:\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - D:\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - D:\F-Secure\Common\FSMA32.EXE
O23 - Service: NT System Restore (NT-Sys) - Unknown owner - c:\winnt\system32\las\svchost.exe (file missing)

 

Viittiskö joku tsekata ton edellisen lokin? Kone tahmaa taas aika kivasti...