mainoksia pukkaa

Themes · 11.10.2006

juu nythän tää temput teki ... en tiedä mistä se sit tuli mut nyt kuitenkin tulee ikkunaan jos jonkin näköistä virus ohjelma mainosta ja sitten tuli tossa hetki sitten vielä xp:n omia jotain tietosuoja varoituksia ja pitäis kuulemma skannata kone kokonaan ja jotain ...
tökkii aika pahasti .. oli joskus puoli vuotta sitten vähän saman lainen ongelma ja täältähän se apu löyty sillonkin ... ja meikä ei sit ole mikää nero näitten kans. =)

nii se hitjuk loki:

Logfile of HijackThis v1.99.1
Scan saved at 14:54:35, on 11.10.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\mgabg.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\System32\PDesk\PDesk.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
C:\Program Files\Common Files\{F480C8E9-05CB-1035-0802-010510200166}\Update.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [qhbmyxc.dll] C:\WINNT\system32\rundll32.exe C:\WINNT\system32\qhbmyxc.dll,knlwjaf
O4 - HKLM\..\Run: [ChangeFilterMerit] C:\Program Files\NewSoft\Presto! PVR\ChangeFilterMerit.exe
O4 - HKLM\..\Run: [Presto! PVR Monitor] C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://webcam.harjunopk.fi/activex/AMC.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINNT\System32\mgabg.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

AfterDawn

Themes · 11.10.2006

no voi perkele . nyt tulee niitä errorsave mainoksia. juu kohtaa sumenee....

-kemisti- · 11.10.2006

Uudelleennimeä HijackThis.exe -> HJT.exe ja lähetä uusi HjT-loki.

Themes · 11.10.2006

No jotta....

Logfile of HijackThis v1.99.1
Scan saved at 23:02:30, on 11.10.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\mgabg.exe
C:\WINNT\System32\PDesk\PDesk.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
C:\Program Files\Common Files\{F480C8E9-05CB-1035-0802-010510200166}\Update.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack\Haitsäk.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {1FCF007B-FDDB-4A85-ADBE-D7D7637B0BD9} - C:\WINNT\system32\vtutu.dll
O2 - BHO: (no name) - {562693A3-8FCE-A315-0ECF-0467D45EDF70} - C:\WINNT\system32\nmeyril.dll
O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - C:\WINNT\system32\covltelb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [qhbmyxc.dll] C:\WINNT\system32\rundll32.exe C:\WINNT\system32\qhbmyxc.dll,knlwjaf
O4 - HKLM\..\Run: [ChangeFilterMerit] C:\Program Files\NewSoft\Presto! PVR\ChangeFilterMerit.exe
O4 - HKLM\..\Run: [Presto! PVR Monitor] C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://webcam.harjunopk.fi/activex/AMC.cab
O20 - Winlogon Notify: vtutu - C:\WINNT\system32\vtutu.dll
O20 - Winlogon Notify: winmbj32 - C:\WINNT\SYSTEM32\winmbj32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINNT\System32\mgabg.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

Themes · 11.10.2006

täähän on saman lainen .... mäpäs poistan ton ja asennan uuden . tai siis haen uuden netistä.

Themes · 11.10.2006

ei kyl se antaa vieläkin samanlaisen login

-kemisti- · 12.10.2006

No eipäs ole samanlainen, tällaiset rivit ovat tulleet näkyviin, mikä oli koko homman tarkoitus

O2 - BHO: (no name) - {1FCF007B-FDDB-4A85-ADBE-D7D7637B0BD9} - C:\WINNT\system32\vtutu.dll
O2 - BHO: (no name) - {562693A3-8FCE-A315-0ECF-0467D45EDF70} - C:\WINNT\system32\nmeyril.dll
O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - C:\WINNT\system32\covltelb.dll
O20 - Winlogon Notify: vtutu - C:\WINNT\system32\vtutu.dll
O20 - Winlogon Notify: winmbj32 - C:\WINNT\SYSTEM32\winmbj32.dll

Lataa VundoFix.exe työpöydällesi.
[*]Tupla-klikkaa VundoFix.exe ajaaksesi sen.
[*]Klikkaa Scan for Vundo valintaa.
[*]Kun skannaus on valmis, oikea-klikkaa kyseisen listaboksin sisällä (valkoinen laatikko jossa on löydetyt tiedostot listattu) ja valitse Add more files
[*]Kopioi ja liitä seuraavat 2 riviä kahteen ylimmäiseen boksiin
[*]C:\WINNT\system32\vtutu.dll
[*]C:\WINDOWS\system32\ututv.*

[*]Klikkaa Add Files ja sitten klikkaa Close Window.
[*]Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
[*]Sinulta kysytään haluatko poistaa filut - klikkaa YES.
[*]Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
[*]Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
[*]Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.

Themes · 12.10.2006

kotos vaan .. niinpäs onkii.

no täs olis sitten näitä:

VundoFix V6.2.1

Checking Java version...

Sun Java not detected
Scan started at 0:30:08 13.10.2006

Listing files found while scanning....

C:\WINNT\system32\covltelb.dll
C:\WINNT\system32\nmeyril.dll
C:\WINNT\system32\yblhueng.exe
C:\WINNT\system32\vtutu.dll
C:\WINNT\system32\ututv.ini
C:\WINNT\system32\ututv.bak1
C:\WINNT\system32\ututv.bak2

Beginning removal...

Attempting to delete C:\WINNT\system32\covltelb.dll
C:\WINNT\system32\covltelb.dll Has been deleted!

Attempting to delete C:\WINNT\system32\nmeyril.dll
C:\WINNT\system32\nmeyril.dll Has been deleted!

Attempting to delete C:\WINNT\system32\yblhueng.exe
C:\WINNT\system32\yblhueng.exe Has been deleted!

Attempting to delete C:\WINNT\system32\vtutu.dll
C:\WINNT\system32\vtutu.dll Has been deleted!

Attempting to delete C:\WINNT\system32\ututv.ini
C:\WINNT\system32\ututv.ini Has been deleted!

Attempting to delete C:\WINNT\system32\ututv.bak1
C:\WINNT\system32\ututv.bak1 Has been deleted!

Attempting to delete C:\WINNT\system32\ututv.bak2
C:\WINNT\system32\ututv.bak2 Has been deleted!

Performing Repairs to the registry.
Done!

ja sitten vielä se toinen:

Logfile of HijackThis v1.99.1
Scan saved at 0:49:10, on 13.10.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\PDesk\PDesk.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
C:\Program Files\ipwins\ipwins.exe
C:\Program Files\Common Files\{F480C8E9-05CB-1035-0802-010510200166}\Update.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\mgabg.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {1F3A3976-E494-4F4A-81DE-7023CDCB722C} - C:\WINNT\system32\vtutu.dll (file missing)
O2 - BHO: (no name) - {562693A3-8FCE-A315-0ECF-0467D45EDF70} - C:\WINNT\system32\nmeyril.dll (file missing)
O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - C:\WINNT\system32\covltelb.dll (file missing)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [qhbmyxc.dll] C:\WINNT\system32\rundll32.exe C:\WINNT\system32\qhbmyxc.dll,knlwjaf
O4 - HKLM\..\Run: [ChangeFilterMerit] C:\Program Files\NewSoft\Presto! PVR\ChangeFilterMerit.exe
O4 - HKLM\..\Run: [Presto! PVR Monitor] C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://webcam.harjunopk.fi/activex/AMC.cab
O20 - Winlogon Notify: winmbj32 - C:\WINNT\SYSTEM32\winmbj32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINNT\System32\mgabg.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

-kemisti- · 13.10.2006

Poista ohjauspaneelista:

IpWins

Fixaa:

O2 - BHO: (no name) - {1F3A3976-E494-4F4A-81DE-7023CDCB722C} - C:\WINNT\system32\vtutu.dll (file missing)
O2 - BHO: (no name) - {562693A3-8FCE-A315-0ECF-0467D45EDF70} - C:\WINNT\system32\nmeyril.dll (file missing)
O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - C:\WINNT\system32\covltelb.dll (file missing)
O4 - HKLM\..\Run: [qhbmyxc.dll] C:\WINNT\system32\rundll32.exe C:\WINNT\system32\qhbmyxc.dll,knlwjaf
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O20 - Winlogon Notify: winmbj32 - C:\WINNT\SYSTEM32\winmbj32.dll

Käynnistä vikasietotilaan ja poista:

C:\Program Files\ipwins
C:\WINNT\system32\qhbmyxc.dll
C:\WINNT\SYSTEM32\winmbj32.dll

Käynnistä uudelleen.

1. Lataa combofix.exe tiedosto työpöydällesi.
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

Lähetä combofixin loki ja uusi HjT-loki.

Themes · 14.10.2006

no niin. se ei poistunut se winmbj32.dll ===> herjas jotain että se on käytössä tai muuten vaan ihan vittuillessaan estetty.

sitten se loki:

Compaq - 06-10-14 14:07:31,43 Service Pack 2
ComboFix 06.10.08W - Running from: C:\Documents and Settings\Compaq\Ty”p”yt„

((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log ))))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINNT\system32\IL41_32.DLL

Granting sedebugprivilege to Järjestelmänvalvojat ... successful

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\whcc2.exe
C:\WINNT\system32\tsuninst.exe
C:\WINNT\uninstall_nmon.vbs
C:\WINNT\system32\atmtd.dll
C:\WINNT\system32\atmtd.dll._
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Program Files\Inetget2
C:\Program Files\network monitor
C:\Program Files\Common Files\{3480C8E9-05CB-1035-0802-010510200166}
C:\WINNT\Q29tcGFx
C:\Program Files\Common Files\{F480C8E9-05CB-1035-0802-010510200166}

((((((((((((((((((((((((((((((( Files Created from 2006-09-14 to 2006-10-14 ))))))))))))))))))))))))))))))))))

2006-10-11 14:22 53,760 --a------ C:\WINNT\system32\drivers\vfwwdm32.dll
2006-10-11 14:22 217,728 -ra------ C:\WINNT\system32\drivers\bdacap.sys
2006-10-11 14:22 11,264 -ra------ C:\WINNT\system32\drivers\GLKbFilter.sys
2006-10-11 14:21 114,688 -r------- C:\WINNT\system32\GLAPILIB.dll
2006-10-11 14:18 9,600 --a------ C:\WINNT\system32\drivers\hidusb.sys
2006-10-11 14:18 14,848 --a------ C:\WINNT\system32\drivers\kbdhid.sys
2006-10-11 14:17 31,616 --a------ C:\WINNT\system32\drivers\usbccgp.sys
2006-10-11 12:53 40,973 ---hs---- C:\WINNT\system32\awtqrqn.dll
2006-10-11 12:53 15,872 --a------ C:\WINNT\system32\winmbj32.dll
2006-10-08 15:05 6,144 --a------ C:\WINNT\system32\ff_vfw.dll

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-10-14 14:09 -------- d-a------ C:\Program Files\Common Files
2006-10-14 13:54 -------- d-------- C:\Program Files\Hijackthis
2006-10-11 14:30 -------- d-------- C:\Program Files\Steam
2006-10-11 14:22 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-10-11 14:20 -------- d-------- C:\Program Files\NewSoft
2006-10-11 14:20 -------- d-------- C:\Program Files\Common Files\NewSoft
2006-10-11 14:19 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-10-11 13:14 -------- d-------- C:\Documents and Settings\Compaq\Application Data\SearchToolbarCorp
2006-10-11 13:12 -------- d-------- C:\Program Files\VSToolbar
2006-10-10 14:41 -------- d-------- C:\Program Files\DC++
2006-10-08 15:05 -------- d-------- C:\Program Files\ffdshow
2006-10-08 13:03 -------- d-------- C:\Program Files\GameSpy Arcade
2006-10-08 12:53 -------- d-------- C:\Program Files\Football Tigers
2006-10-08 12:52 -------- d-------- C:\Program Files\Soulseek
2006-10-07 13:23 -------- d-------- C:\Documents and Settings\Compaq\Application Data\vlc
2006-09-25 18:45 666240 --a------ C:\WINNT\system32\aswBoot.exe
2006-09-25 18:40 87424 --a------ C:\WINNT\system32\drivers\aswmon2.sys
2006-09-25 18:40 85952 --a------ C:\WINNT\system32\drivers\aswmon.sys
2006-09-25 18:39 36176 --a------ C:\WINNT\system32\drivers\aswTdi.sys
2006-09-25 18:39 16352 --a------ C:\WINNT\system32\drivers\aswRdr.sys
2006-09-25 18:37 90112 --a------ C:\WINNT\system32\AVASTSS.scr
2006-09-25 18:37 24560 --a------ C:\WINNT\system32\drivers\aavmker4.sys
2006-09-16 20:29 -------- d-------- C:\Program Files\Webteh
2006-09-16 20:29 -------- d-------- C:\Program Files\BSplayer_WhenUSave_Installer
2006-09-13 08:03 1084416 --a------ C:\WINNT\system32\msxml3.dll
2006-09-06 21:55 -------- d---s---- C:\Documents and Settings\Compaq\Application Data\Microsoft
2006-08-30 17:28 -------- d-------- C:\Program Files\Axis Communications
2006-08-25 18:49 617472 --a------ C:\WINNT\system32\comctl32.dll
2006-08-21 15:26 16896 --a------ C:\WINNT\system32\fltlib.dll
2006-08-21 12:14 23040 --a------ C:\WINNT\system32\fltmc.exe
2006-08-21 12:14 128896 --------- C:\WINNT\system32\drivers\fltmgr.sys
2006-08-16 14:58 100352 --a------ C:\WINNT\system32\6to4svc.dll
2006-08-16 12:37 225664 --a------ C:\WINNT\system32\drivers\tcpip6.sys
2006-08-15 17:31 -------- d-------- C:\Program Files\Internet Explorer
2006-08-14 13:34 332928 --a------ C:\WINNT\system32\drivers\srv.sys
2006-07-27 16:26 679424 --a------ C:\WINNT\system32\inetcomm.dll
2006-07-21 11:28 72704 --a------ C:\WINNT\system32\hlink.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINNT\\system32\\ctfmon.exe"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Synchronization Manager"="mobsync.exe /logon"
"Matrox Powerdesk"="C:\\WINNT\\System32\\PDesk\\PDesk.exe /Autolaunch"
"WinampAgent"="\"C:\\Program Files\\Winamp3\\winampa.exe\""
"NeroCheck"="C:\\WINNT\\system32\\NeroCheck.exe"
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"CPQEASYACC"="C:\\Program Files\\COMPAQ\\Easy Access Button Support\\StartEAK.exe"
"ChangeFilterMerit"="C:\\Program Files\\NewSoft\\Presto! PVR\\ChangeFilterMerit.exe"
"Presto! PVR Monitor"="C:\\Program Files\\NewSoft\\Presto! PVR\\Monitor.exe"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"internat.exe"="internat.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=""
"tscuninstall"=""

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"internat.exe"="internat.exe"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=""
"tscuninstall"=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winmbj32

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll

Completion time: Sat 14.10.2006 14:10:15.85
C:\ComboFix.txt ... 14.10.2006 14:10

ja toinen:

Logfile of HijackThis v1.99.1
Scan saved at 14:14:44, on 14.10.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\mgabg.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\System32\PDesk\PDesk.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [ChangeFilterMerit] C:\Program Files\NewSoft\Presto! PVR\ChangeFilterMerit.exe
O4 - HKLM\..\Run: [Presto! PVR Monitor] C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://webcam.harjunopk.fi/activex/AMC.cab
O20 - Winlogon Notify: winmbj32 - C:\WINNT\SYSTEM32\winmbj32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINNT\System32\mgabg.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

-kemisti- · 14.10.2006

Hiukan vielä työtä:

Ota ensin rekisteristä näin varmuuskopio:

Suorita -> regedit -> ok. Sitten Tiedosto -> Vie. Kirjoita sille joku nimi ja sitten Tallenna(ja laita muistiin, mihin tallensit sen).

Sitten tallenna tämä alla oleva tekstinpätkä nimellä fix.reg vaikka muistiossa ja vaikka työpöydälle (tallennusmuoto kaikki tiedostot)

Windows Registry Editor Version 5.00

[-HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

[-HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]

[-HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]

[-HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]

Tuplaklikkaa ja paina kyllä ja ok. Käynnistä kone uudelleen.

Hae KillBox

http://www.bleepingcomputer.com/files/spyware/KillBox.zip

Pura,avaa ja täppi kohtaan Delete on Reboot
Sitte kopioi rivit tosta alapuolelta yhellä kertaa

C:\WINNT\system32\drivers\GLKbFilter.sys
C:\WINNT\system32\awtqrqn.dll
C:\WINNT\system32\winmbj32.dll

Sitten KillBoxissa ylhäältä File > Paste from Clipboard
Valitse "All Files".Sen jälkeen paina Delete (punainen, jossa on valkonen X)
Vastaa myöntävästi kysymyksiin ja jos kone ei itestään käynnisty uudestaan,niin käynnistä se.

Aja combofix uudestaan

Lähetä sen loki ja uusi HjT-loki.

Themes · 14.10.2006

toimenpiteistä tapahtui seuraavaa:

Compaq - 06-10-14 14:58:31,93 Service Pack 2
ComboFix 06.10.08W - Running from: C:\Documents and Settings\Compaq\Ty”p”yt„

((((((((((((((((((((((((((((((( Files Created from 2006-09-14 to 2006-10-14 ))))))))))))))))))))))))))))))))))

2006-10-14 14:48 339 --a------ C:\fix.reg
2006-10-14 14:45 54,750,386 --a------ C:\varmuuskopio.reg
2006-10-11 14:22 53,760 --a------ C:\WINNT\system32\drivers\vfwwdm32.dll
2006-10-11 14:22 217,728 -ra------ C:\WINNT\system32\drivers\bdacap.sys
2006-10-11 14:21 114,688 -r------- C:\WINNT\system32\GLAPILIB.dll
2006-10-11 14:18 9,600 --a------ C:\WINNT\system32\drivers\hidusb.sys
2006-10-11 14:18 14,848 --a------ C:\WINNT\system32\drivers\kbdhid.sys
2006-10-11 14:17 31,616 --a------ C:\WINNT\system32\drivers\usbccgp.sys
2006-10-08 15:05 6,144 --a------ C:\WINNT\system32\ff_vfw.dll

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-10-14 14:14 -------- d-------- C:\Program Files\Hijackthis
2006-10-14 14:09 -------- d-a------ C:\Program Files\Common Files
2006-10-11 14:30 -------- d-------- C:\Program Files\Steam
2006-10-11 14:22 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-10-11 14:20 -------- d-------- C:\Program Files\NewSoft
2006-10-11 14:20 -------- d-------- C:\Program Files\Common Files\NewSoft
2006-10-11 14:19 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-10-11 13:14 -------- d-------- C:\Documents and Settings\Compaq\Application Data\SearchToolbarCorp
2006-10-11 13:12 -------- d-------- C:\Program Files\VSToolbar
2006-10-10 14:41 -------- d-------- C:\Program Files\DC++
2006-10-08 15:05 -------- d-------- C:\Program Files\ffdshow
2006-10-08 13:03 -------- d-------- C:\Program Files\GameSpy Arcade
2006-10-08 12:53 -------- d-------- C:\Program Files\Football Tigers
2006-10-08 12:52 -------- d-------- C:\Program Files\Soulseek
2006-10-07 13:23 -------- d-------- C:\Documents and Settings\Compaq\Application Data\vlc
2006-09-25 18:45 666240 --a------ C:\WINNT\system32\aswBoot.exe
2006-09-25 18:40 87424 --a------ C:\WINNT\system32\drivers\aswmon2.sys
2006-09-25 18:40 85952 --a------ C:\WINNT\system32\drivers\aswmon.sys
2006-09-25 18:39 36176 --a------ C:\WINNT\system32\drivers\aswTdi.sys
2006-09-25 18:39 16352 --a------ C:\WINNT\system32\drivers\aswRdr.sys
2006-09-25 18:37 90112 --a------ C:\WINNT\system32\AVASTSS.scr
2006-09-25 18:37 24560 --a------ C:\WINNT\system32\drivers\aavmker4.sys
2006-09-16 20:29 -------- d-------- C:\Program Files\Webteh
2006-09-16 20:29 -------- d-------- C:\Program Files\BSplayer_WhenUSave_Installer
2006-09-13 08:03 1084416 --a------ C:\WINNT\system32\msxml3.dll
2006-09-06 21:55 -------- d---s---- C:\Documents and Settings\Compaq\Application Data\Microsoft
2006-08-30 17:28 -------- d-------- C:\Program Files\Axis Communications
2006-08-25 18:49 617472 --a------ C:\WINNT\system32\comctl32.dll
2006-08-21 15:26 16896 --a------ C:\WINNT\system32\fltlib.dll
2006-08-21 12:14 23040 --a------ C:\WINNT\system32\fltmc.exe
2006-08-21 12:14 128896 --------- C:\WINNT\system32\drivers\fltmgr.sys
2006-08-16 14:58 100352 --a------ C:\WINNT\system32\6to4svc.dll
2006-08-16 12:37 225664 --a------ C:\WINNT\system32\drivers\tcpip6.sys
2006-08-15 17:31 -------- d-------- C:\Program Files\Internet Explorer
2006-08-14 13:34 332928 --a------ C:\WINNT\system32\drivers\srv.sys
2006-07-27 16:26 679424 --a------ C:\WINNT\system32\inetcomm.dll
2006-07-21 11:28 72704 --a------ C:\WINNT\system32\hlink.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINNT\\system32\\ctfmon.exe"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Synchronization Manager"="mobsync.exe /logon"
"Matrox Powerdesk"="C:\\WINNT\\System32\\PDesk\\PDesk.exe /Autolaunch"
"WinampAgent"="\"C:\\Program Files\\Winamp3\\winampa.exe\""
"NeroCheck"="C:\\WINNT\\system32\\NeroCheck.exe"
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"CPQEASYACC"="C:\\Program Files\\COMPAQ\\Easy Access Button Support\\StartEAK.exe"
"ChangeFilterMerit"="C:\\Program Files\\NewSoft\\Presto! PVR\\ChangeFilterMerit.exe"
"Presto! PVR Monitor"="C:\\Program Files\\NewSoft\\Presto! PVR\\Monitor.exe"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winmbj32

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll

Completion time: Sat 14.10.2006 14:59:24.04
C:\ComboFix.txt ... 14.10.2006 14:59

ja

Logfile of HijackThis v1.99.1
Scan saved at 15:01:17, on 14.10.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\PDesk\PDesk.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\mgabg.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\WINNT\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [ChangeFilterMerit] C:\Program Files\NewSoft\Presto! PVR\ChangeFilterMerit.exe
O4 - HKLM\..\Run: [Presto! PVR Monitor] C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://webcam.harjunopk.fi/activex/AMC.cab
O20 - Winlogon Notify: winmbj32 - winmbj32.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINNT\System32\mgabg.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

-kemisti- · 14.10.2006

Tuo fixiin:

O20 - Winlogon Notify: winmbj32 - winmbj32.dll (file missing)

Muuten ok

Vielä ongelmia?

Themes · 14.10.2006

juu korjasin sen yhen rivin vielä ... toivottavasti auttoi. ei ole ainakaan enään tullut mitään mainoksia tms.

SUURI KIITOS tästä!

-kemisti- · 14.10.2006

Mukava kuulla ja ole hyvä

Kirjaudu tai liity jäseneksi

mainoksia pukkaa

Themes Guest

Themes Guest

-kemisti- Active member

Themes Guest

Themes Guest

Themes Guest

-kemisti- Active member

Themes Guest

-kemisti- Active member

Themes Guest

-kemisti- Active member

Themes Guest

-kemisti- Active member

Themes Guest

-kemisti- Active member

Jaa tämä sivu

Kirjaudu tai liity jäseneksi

mainoksia pukkaa

Themes Guest

Themes Guest

-kemisti- Active member

Themes Guest

Themes Guest

Themes Guest

-kemisti- Active member

Themes Guest

-kemisti- Active member

Themes Guest

-kemisti- Active member

Themes Guest

-kemisti- Active member

Themes Guest

-kemisti- Active member

Jaa tämä sivu

Hyödyllisiä hakuja