1. Tämä sivusto käyttää keksejä (cookie). Jatkamalla sivuston käyttämistä hyväksyt keksien käyttämisen. Lue lisää.

Your privacy is in danger. ongelma

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi vmos 27.10.2007.

  1. sammy19

    sammy19 Member

    Liittynyt:
    30.10.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Sama ongelma kuin edellä, mutta en ole toimiiko poistaminen samalla kaavalla kuin yllä. Jos joku viisaampi voisi auttaa.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:26:29, on 30.10.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Common Files\PCSecureSystem\bm.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
    C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
    C:\Program Files\Windows Media Player\WMPNetwk.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe
    C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    C:\WINDOWS\System32\alg.exe
    C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
    C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\WinRAR\WinRAR.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.multitronic.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: BetaDivX - {48BF2BC0-2945-11D8-8CAC-00080FC65465} - C:\WINDOWS\system32\IR9V0_QCX.dll
    O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet3_88.dll
    O2 - BHO: MSVPS System - {6EB10F79-5E53-4F76-B146-409EFCDCB957} - C:\WINDOWS\movctrlfqd.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: VGOIEBHO Helper - {B6FA00D9-86EC-4158-9488-D00DFF897E86} - C:\Program Files\21cn\VGO\VGOIEBHO.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: The nssfrch - {DF0ACE0C-4A3F-4A1F-8676-BA16DEB23C70} - C:\WINDOWS\nssfrch.dll
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Ville\Käynnistä-valikko\Ohjelmat\Absolute Poker\Absolute Poker.lnk (file missing)
    O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Ville\Käynnistä-valikko\Ohjelmat\Absolute Poker\Absolute Poker.lnk (file missing)
    O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
    O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Program Files\Poker.com\Poker.exe (HKCU)
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O14 - IERESET.INF: START_PAGE_URL=http://www.multitronic.fi/
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134631890125
    O17 - HKLM\System\CCS\Services\Tcpip\..\{6948EC6D-BFDF-4FE7-AE7F-9487A1E0A074}: NameServer = 85.255.114.87,85.255.112.15
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.87 85.255.112.15
    O17 - HKLM\System\CS1\Services\Tcpip\..\{6948EC6D-BFDF-4FE7-AE7F-9487A1E0A074}: NameServer = 85.255.114.87,85.255.112.15
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.87 85.255.112.15
    O21 - SSODL: bxsbang - {E1E74C19-44AC-442C-97E5-ED10BADCC990} - C:\WINDOWS\bxsbang.dll
    O21 - SSODL: ocgrep - {56267F6E-F7AC-44ED-95D0-EAA350B6D544} - C:\WINDOWS\ocgrep.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

    --
    End of file - 12138 bytes
     
  2.  
  3. hannu71

    hannu71 Regular member

    Liittynyt:
    09.02.2006
    Viestejä:
    256
    Kiitokset:
    0
    Pisteet:
    26
    #1Ensin lataa LSPfix.exe sopivaan sijaintiin (kuten C:\Program Files\LSPFix tai vaikkapa työpöydälle). ÄLÄ aja tätä ohjelmaa vielä. Tätä tulee käyttää VAIN jos internetyhteys häviää NewDotNetin poiston jäljiltä.

    NewDotNetin poisto; Mene;

    Käynnistä > Ohjauspaneeli > Lisää/Poista sovellus ja hävitä seuraava jos näkyy;

    New.Net Applications tai New.Net Domains (Mitä vain mikä sanoo New.Net)

    Jos Lisää/Poista sovelluksessa ei ole New.Net listattu, toimi näin.

    Varmista että anti-virus ja anti-spyware ohjelmat ovat suljettuna poiston ajan.

    Ne saattavat estää New.Netin poiston.

    Lataa NNuninstall.exe:
    • Tallenna se työpöydällesi.
    • Tupla-klikkaa NNuninstall.exe filua.
    • Ohjelma kysyy haluatko poistaa kaikki New.Netin nimet ja osat.
    • Klikkaa Yes.
    • Klikkaa poiston jälkeen OK.
    • Käynnistä kone uudelleen ("Yes - Restart now") ellei jäänyt mitään muuta kesken, jos jäi, jätä kone päälle ("No - I will restart later).

    Jos poisto ei onnistu ja virustorjuntaohjelma(t) estävät poisto-ohjelman ajon kokonaan tai
    osittain, tee näin: Irrota koneen verkko- tai modeemijohto koneesta siten, ettei sillä
    ole yhteyttä internettiin. Sulje tämän jälkeen virustorjuntaohjelma(t) ja aja
    NNuninstall.exe. Laita tämän jälkeen virustorjuntaohjelma(t) takaisin päälle ja
    vasta sitten kytke verkko- tai modeemijohto takaisin koneeseen.


    Tyhjennä roskakori.

    JOS menetät nettiyhteytesi kun olet New.Netin poistanut, tupla-klikkaa LSPFix.exe jonka latasit aiemmin. Rastita "I know what I'm doing" valinta. Näet kaksi paneelia; Jos on jotain listattu "Remove" paneeliin oikealla puolella, anna sen olla ja klikkaa "Finish>>". Seuraavaksi käynnistä uudelleen ja netin pitäisi toimia hyvin. Jos mitään ei ole listattu "Remove" paneeliin, ÄLÄ tee MITÄÄN - sulje LSPFix. Tule joltain toiselta koneelta hakemaan lisää neuvoa. (Tämä on vain varotoimenpide, useimmiten netti pysyy ihan kunnossa ;))

    #2Lataa fixwareout.exe täältä > Täältä
    tai > Täältä
    ja tallenna se työpöydälle. Tuplaklikkaa sitä ja seuraa ohjeita. Klikkaa Next, sitten Install ja varmistu, että "Run fixit" on valittu. Sinun pitää käynnistää kone uudelleen, kun niin käsketään.

    #3
    Lataa SmitfraudFix (by S!Ri) työpöydällesi.

    Tuplaklikkaa tiedostoa SmitfraudFix.exe

    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita tämän tekstitiedoston sisältö viestiketjuusi.

    **Jos työkalu ei käynnisty työpöydältä niin siirrä SmitfraudFix.exe suoraan järjestelmäaseman juureen (yleensä C:). Kokeile sitten käynnistää ohjelma uudestaan sieltä.

    Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.
    http://www.beyondlogic.org/consulting/processutil/processutil.htm

    lähetä:
    uusi hjt-loki
    fixwareoutin raportti
    SmitfraudFixin raportti
     
  4. sammy19

    sammy19 Member

    Liittynyt:
    30.10.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Tervehdys.

    Nyt olen yrittänyt tehdä ohjeiden mukaan. Tässä loki ja raportit:

    HJT:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:16:30, on 1.11.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
    C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
    C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
    C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Microsoft Office\Office\WINWORD.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.multitronic.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: BetaDivX - {48BF2BC0-2945-11D8-8CAC-00080FC65465} - C:\WINDOWS\system32\IR9V0_QCX.dll
    O2 - BHO: MSVPS System - {6EB10F79-5E53-4F76-B146-409EFCDCB957} - C:\WINDOWS\movctrlfqd.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: VGOIEBHO Helper - {B6FA00D9-86EC-4158-9488-D00DFF897E86} - C:\Program Files\21cn\VGO\VGOIEBHO.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: The nssfrch - {DF0ACE0C-4A3F-4A1F-8676-BA16DEB23C70} - C:\WINDOWS\nssfrch.dll
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Ville\Käynnistä-valikko\Ohjelmat\Absolute Poker\Absolute Poker.lnk (file missing)
    O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Ville\Käynnistä-valikko\Ohjelmat\Absolute Poker\Absolute Poker.lnk (file missing)
    O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
    O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Program Files\Poker.com\Poker.exe (HKCU)
    O14 - IERESET.INF: START_PAGE_URL=http://www.multitronic.fi/
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134631890125
    O21 - SSODL: bxsbang - {E1E74C19-44AC-442C-97E5-ED10BADCC990} - C:\WINDOWS\bxsbang.dll
    O21 - SSODL: ocgrep - {56267F6E-F7AC-44ED-95D0-EAA350B6D544} - C:\WINDOWS\ocgrep.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

    --
    End of file - 10866 bytes

    Fixware:

    Username "Ville" - 01.11.2007 19:07:52 [Fixwareout edited 9/01/2007]

    ~~~~~ Prerun check
    HKLM\SOFTWARE\~\Winlogon\ "System"="kdsqa.exe"

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
    "nameserver"="85.255.114.87 85.255.112.15" <Value cleared.
    HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{6948EC6D-BFDF-4FE7-AE7F-9487A1E0A074}
    "nameserver"="85.255.114.87,85.255.112.15" <Value cleared.
    HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{D10A3D95-302D-4E95-8286-550CF0B337F8}
    "DhcpNameServer"="85.255.114.87,85.255.112.15" <Value cleared.

    DNS-tulkintatoiminnon välimuistin tyhjentäminen onnistui.


    System was rebooted successfully.

    ~~~~~ Postrun check
    HKLM\SOFTWARE\~\Winlogon\ "system"=""
    ....
    ....
    ~~~~~ Misc files.
    ....
    ~~~~~ Checking for older varients.
    ....
    ~~~~~ Other
    C:\WINDOWS\Temp\kdsqa.ren 66463 14.09.2004


    C:\Program Files\UltimateBet < Found
    C:\Program Files\VideoAccessCodec < Found
    Additional tools are recommended.

    ~~~~~ Current runs (hklm hkcu "run" Keys Only)
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay"
    "RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
    "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
    "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""
    "MessengerPlus3"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\""
    "PCSuiteTrayApplication"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\LaunchApplication.exe -startup"
    "F-Secure Manager"="\"C:\\Program Files\\F-Secure Internet Security\\Common\\FSM32.EXE\" /splash"
    "F-Secure TNB"="\"C:\\Program Files\\F-Secure Internet Security\\TNB\\TNBUtil.exe\" /CHECKALL /WAITFORSW"
    "F-Secure Startup Wizard"="\"C:\\Program Files\\F-Secure Internet Security\\FSGUI\\FSSW.EXE\" /reboot"
    "News Service"="\"C:\\Program Files\\F-Secure Internet Security\\FSGUI\\ispnews.exe\""
    "WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
    "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"
    "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
    "updateMgr"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_8 -reboot 1"
    "WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe"
    ....
    Hosts file was reset, If you use a custom hosts file please replace it...
    ~~~~~ End report ~~~~~


    SmitFraudFix v2.246

    Scan done at 19:22:16,81, to 01.11.2007
    Run from C:\Documents and Settings\Ville\Ty”p”yt„\SmitfraudFix
    OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
    C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
    C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
    C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Microsoft Office\Office\WINWORD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

    C:\WINDOWS\bxsbang.dll FOUND !
    C:\WINDOWS\kthemup.exe FOUND !
    C:\WINDOWS\movctrlfqd.dll FOUND !
    C:\WINDOWS\nssfrch.dll FOUND !
    C:\WINDOWS\ocgrep.dll FOUND !
    C:\WINDOWS\privacy_danger FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Ville


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Ville\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Ville\Suosikit

    C:\DOCUME~1\Ville\Suosikit\Error Cleaner.url FOUND !
    C:\DOCUME~1\Ville\Suosikit\Privacy Protector.url FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop

    C:\DOCUME~1\Ville\TYPYT~1\Error Cleaner.url FOUND !
    C:\DOCUME~1\Ville\TYPYT~1\Privacy Protector.url FOUND !
    C:\DOCUME~1\Ville\TYPYT~1\Spyware?Malware Protection.url FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

    C:\Program Files\VideoAccessCodec\ FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="file:///C:\\WINDOWS\\privacy_danger\\index.htm"
    "SubscribedURL"=""
    "FriendlyName"="Privacy Protection"

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="Nykyinen kotisivu"

    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "system"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Rustock



    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: VIA Rhine II Fast Ethernet Adapter - Paketinajoituksen miniportti
    DNS Server Search Order: 192.168.1.1

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{6948EC6D-BFDF-4FE7-AE7F-9487A1E0A074}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{6948EC6D-BFDF-4FE7-AE7F-9487A1E0A074}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{6948EC6D-BFDF-4FE7-AE7F-9487A1E0A074}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End
     
  5. hannu71

    hannu71 Regular member

    Liittynyt:
    09.02.2006
    Viestejä:
    256
    Kiitokset:
    0
    Pisteet:
    26
    Printtaa ohjeet ulos tai tallenna nämä tekstitiedostoon.

    Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.

    Kun vikasietotilassa, tuplaklikkaa tiedostoa SmitfraudFix.exe
    Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.

    Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.

    Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".

    Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
    Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
    Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.

    Varoitus : Ajamalla optio 2:n EI-tarttuneessa tietokoneessa, poistaa sinun työpöytäsi taustakuvan.

    lähetä:
    uusi hjt-loki
    smitfraud fixin loki
     
    Viimeksi muokattu: 01.11.2007
  6. sammy19

    sammy19 Member

    Liittynyt:
    30.10.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Tein mainitsemasi jutut, ja nyt kone näyttää toimivan suurinpiirtein normaalisti.


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 22:57:56, on 1.11.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
    C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
    C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
    C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\sol.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: BetaDivX - {48BF2BC0-2945-11D8-8CAC-00080FC65465} - C:\WINDOWS\system32\IR9V0_QCX.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: VGOIEBHO Helper - {B6FA00D9-86EC-4158-9488-D00DFF897E86} - C:\Program Files\21cn\VGO\VGOIEBHO.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Ville\Käynnistä-valikko\Ohjelmat\Absolute Poker\Absolute Poker.lnk (file missing)
    O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Ville\Käynnistä-valikko\Ohjelmat\Absolute Poker\Absolute Poker.lnk (file missing)
    O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
    O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Program Files\Poker.com\Poker.exe (HKCU)
    O14 - IERESET.INF: START_PAGE_URL=http://www.multitronic.fi/
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134631890125
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 10029 bytes



    SmitFraudFix v2.246

    Scan done at 22:52:03,34, to 01.11.2007
    Run from C:\Documents and Settings\Ville\Ty”p”yt„\SmitfraudFix
    OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

    S!Ri's WS2Fix: LSP not Found.


    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

    C:\WINDOWS\bxsbang.dll Deleted
    Deleting [HKEY_CLASSES_ROOT\CLSID\{E1E74C19-44AC-442C-97E5-ED10BADCC990}]
    Deleting [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{E1E74C19-44AC-442C-97E5-ED10BADCC990}]
    C:\WINDOWS\kthemup.exe Deleted
    C:\WINDOWS\movctrlfqd.dll Deleted
    C:\WINDOWS\nssfrch.dll Deleted
    C:\WINDOWS\ocgrep.dll Deleted
    Deleting [HKEY_CLASSES_ROOT\CLSID\{56267F6E-F7AC-44ED-95D0-EAA350B6D544}]
    C:\WINDOWS\privacy_danger\ Deleted
    C:\DOCUME~1\Ville\TYPYT~1\Error Cleaner.url Deleted
    C:\DOCUME~1\Ville\TYPYT~1\Privacy Protector.url Deleted
    C:\DOCUME~1\Ville\TYPYT~1\Spyware?Malware Protection.url Deleted
    C:\DOCUME~1\Ville\Suosikit\Error Cleaner.url Deleted
    C:\DOCUME~1\Ville\Suosikit\Privacy Protector.url Deleted

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{6948EC6D-BFDF-4FE7-AE7F-9487A1E0A074}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{6948EC6D-BFDF-4FE7-AE7F-9487A1E0A074}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{6948EC6D-BFDF-4FE7-AE7F-9487A1E0A074}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "system"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End
     
  7. hannu71

    hannu71 Regular member

    Liittynyt:
    09.02.2006
    Viestejä:
    256
    Kiitokset:
    0
    Pisteet:
    26
    #1. Poista Ohjauspaneelin Lisää/Poista valikon kautta seuraavat:
    IE Defender (jos löytyy)

    #2. Avaa HijackThis, klikkaa do a system scan only, merkkaa nämä rivit. Sitten sulje kaikki muut ikkunat ja paina fix checked.
    O2 - BHO: BetaDivX - {48BF2BC0-2945-11D8-8CAC-00080FC65465} - C:\WINDOWS\system32\IR9V0_QCX.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


    3#. laita tarvittaessa piilotiedostot näkyviin. ohje
    mene vikasietotilaan. ohje

    poista seuraavat:
    C:\WINDOWS\system32\IR9V0_QCX.dll

    käynnistä kone normaali tilaan ja laita piilotiedostot takaisin piiloon.

    4#.
    Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

    Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi.
    [*]Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    [*]Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    [*]Käynnistä AVG Anti-Spyware.
    [*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
    [*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

    [*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    [*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
    [*]Sitten "Reports" valikon alta:
    [*]Laita täppi kohtaan "Do not Automatically generate report"
    [*]Ota täppi pois kohdasta"Only if threats were found"

    [*]Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    [*]"Resident shield is", muuta tila active:sta inactive:ksi
    [*]Sulje ohjelma, ÄLÄ skannaa vielä.
    Käynnistä koneesi vikasietotilaan, Ohje!

    HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.
    [*]Kun vikasietotilassa, käynnistä AVG Anti-Spyware.
    [*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    [*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    [*]Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    [*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    [*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    [*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    [*]Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG Anti-Spyware:n raportti viestikejuusi.

    lähetä:
    uusi hjt-loki
    AVG Anti-Spyware:n raportti
     
  8. sammy19

    sammy19 Member

    Liittynyt:
    30.10.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Hei.

    Nyt olen saanut valmiiksi viimeisen ohjeen mukaiset toimet.
    Tässä loki ja raportti:



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:30:11, on 4.11.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
    C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
    C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
    C:\Program Files\Winamp\winamp.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: VGOIEBHO Helper - {B6FA00D9-86EC-4158-9488-D00DFF897E86} - C:\Program Files\21cn\VGO\VGOIEBHO.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Ville\Käynnistä-valikko\Ohjelmat\Absolute Poker\Absolute Poker.lnk (file missing)
    O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Ville\Käynnistä-valikko\Ohjelmat\Absolute Poker\Absolute Poker.lnk (file missing)
    O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
    O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Program Files\Poker.com\Poker.exe (HKCU)
    O14 - IERESET.INF: START_PAGE_URL=http://www.multitronic.fi/
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134631890125
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 10076 bytes



    ---------------------------------------------------------
    AVG Anti-Spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 13:31:56 4.11.2007

    + Scan result:



    C:\System Volume Information\_restore{51BF1D77-3BD7-4FD5-AEE7-A7C9593FB591}\RP359\A0057569.dll -> Adware.NewDotNet : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{51BF1D77-3BD7-4FD5-AEE7-A7C9593FB591}\RP359\A0057570.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{51BF1D77-3BD7-4FD5-AEE7-A7C9593FB591}\RP359\A0057804.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
    HKU\S-1-5-21-3480654949-2013361354-1934684486-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Adware.NewDotNet : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{51BF1D77-3BD7-4FD5-AEE7-A7C9593FB591}\RP359\A0057713.exe -> Downloader.Zlob : Cleaned with backup (quarantined).
    C:\WINDOWS\Temp\kdsqa.ren -> Downloader.Zlob : Cleaned with backup (quarantined).
    :mozilla.770:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
    :mozilla.108:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.109:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.110:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.111:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.112:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.113:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.114:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.115:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.515:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.610:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.626:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.668:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.715:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.774:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.845:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.244:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.245:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.461:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Adengage : Cleaned.
    :mozilla.462:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Adengage : Cleaned.
    :mozilla.885:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.886:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.887:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.888:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.889:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.890:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.57:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
    :mozilla.58:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
    :mozilla.36:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.37:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.38:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.39:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.40:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.450:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
    :mozilla.848:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.849:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.257:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.258:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.259:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.260:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.261:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.262:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.263:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.211:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
    :mozilla.212:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
    :mozilla.213:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
    :mozilla.214:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
    :mozilla.215:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
    :mozilla.216:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
    :mozilla.217:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
    :mozilla.389:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
    :mozilla.625:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Connextra : Cleaned.
    :mozilla.63:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
    :mozilla.293:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.294:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.165:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.26:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.27:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.397:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.398:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.399:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.400:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.401:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.583:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.209:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
    :mozilla.210:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
    :mozilla.804:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Information : Cleaned.
    :mozilla.283:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Ivwbox : Cleaned.
    :mozilla.100:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
    :mozilla.95:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
    :mozilla.74:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
    :mozilla.775:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
    :mozilla.776:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
    :mozilla.655:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.656:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.657:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.658:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.659:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.660:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.661:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.662:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.663:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.826:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
    :mozilla.827:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
    :mozilla.425:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.427:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.428:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.431:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.432:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.433:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.434:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.435:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.436:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.520:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.521:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.522:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.523:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.524:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.525:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.6:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
    :mozilla.447:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.448:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.449:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.451:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.88:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
    :mozilla.89:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
    :mozilla.90:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
    :mozilla.549:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    :mozilla.369:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
    :mozilla.413:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
    :mozilla.144:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.145:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.146:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.151:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.152:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.153:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.154:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.155:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.218:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
    :mozilla.219:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
    :mozilla.220:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
    :mozilla.221:C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
    C:\System Volume Information\_restore{51BF1D77-3BD7-4FD5-AEE7-A7C9593FB591}\RP359\A0057722.ocx -> Trojan.Agent.bvg : Cleaned with backup (quarantined).


    ::Report end
     
  9. hannu71

    hannu71 Regular member

    Liittynyt:
    09.02.2006
    Viestejä:
    256
    Kiitokset:
    0
    Pisteet:
    26
    Moi!

    kuinka kone nyt toimii?

    Oletko itse asentanut nuo pokeri pelit koneelle?
    O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Ville\Käynnistä-valikko\Ohjelmat\Absolute Poker\Absolute Poker.lnk (file missing)
    O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Ville\Käynnistä-valikko\Ohjelmat\Absolute Poker\Absolute Poker.lnk (file missing)
    O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
    O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Program Files\Poker.com\Poker.exe (HKCU)

    Javan päivitys ja välimuistin tyhjennys:

    1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
    2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
    Niissä pitäisi olla seuraava kuva vieressä: [​IMG]
    3. Valitse kaikki entiset Java versiosi ja valitse Poista.
    4. Asenna uusin Java päivitys seuraavasta linkistä..
    5. Käynnistä kone uudelleen asennuksen jälkeen:

    http://java.sun.com/javase/downloads/index.jsp

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u3

    Paina Download

    Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

    7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle
    ).

    8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

    [*]Applications and Applets

    [*]Trace and Log Files



    Ja paina OK -nappia

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
    Huomaa: Tämä poistaa kaikki ladatut sovellukset ja appletit VÄLIMUISTISTA.

    10. Klikkaa OK jättääksesi Java asetusikkunasi.

    lähetä:
    uusi hjt-loki
     
  10. sammy19

    sammy19 Member

    Liittynyt:
    30.10.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Moi!

    Olen asentanut pokerit koneelle itse, kannattaako poistaa?

    Kyllä kone tuntuu toimivan moitteettomasti. F-secure on pari kertaa valittanut että troijalainen löytynyt, poistetaanko. Poisto on onnistunut, joten en ole kummemmin välittänyt.

    Noita kahta en löytänyt javasta:
    [*]Applications and Applets

    [*]Trace and Log Files




    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:44:07, on 6.11.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
    C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
    C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
    C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: VGOIEBHO Helper - {B6FA00D9-86EC-4158-9488-D00DFF897E86} - C:\Program Files\21cn\VGO\VGOIEBHO.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Ville\Käynnistä-valikko\Ohjelmat\Absolute Poker\Absolute Poker.lnk (file missing)
    O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Ville\Käynnistä-valikko\Ohjelmat\Absolute Poker\Absolute Poker.lnk (file missing)
    O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
    O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
    O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Program Files\Poker.com\Poker.exe (HKCU)
    O14 - IERESET.INF: START_PAGE_URL=http://www.multitronic.fi/
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134631890125
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 10052 bytes
     
  11. hannu71

    hannu71 Regular member

    Liittynyt:
    09.02.2006
    Viestejä:
    256
    Kiitokset:
    0
    Pisteet:
    26
    toi Poker.com on eräällä listalla pop-uppien takii, mut sull on vissiin f-securessa esto niihin pop-uppeihin.ei tartte reagoida.

    Skannaa koneesi (toimii ie:llä)
    Kaspersky Online Skannerilla

    Sinulta kysytään sallitko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
    [*] Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
    [*] Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
    [*] Klikkaa nyt asetuksia, Scan Settings
    [*] Tarkista asetuksista, että seuraavat ovat valittuina:

    o Scan using the following Anti-Virus database:

    + Extended (Jos valittavissa, muuten valitse Standard)

    o Scan Options:

    + Scan Archives
    + Scan Mail Bases

    [*] Klikkaa OK
    [*] Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
    [*] Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
    [*] Klikkaa nyt Save as Text-painiketta.
    [*] Tallenna tiedosto työpöydällesi.
    [*] Kopioi ja Liitä tiedoston sisältö seuraavaan vastaukseesi.
     
  12. sammy19

    sammy19 Member

    Liittynyt:
    30.10.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Tuesday, November 06, 2007 10:23:10 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 6/11/2007
    Kaspersky Anti-Virus database records: 452463


    Scan Settings
    Scan using the following antivirus database extended
    Scan Archives true
    Scan Mail Bases true

    Scan Target My Computer
    A:\
    C:\
    D:\

    Scan Statistics
    Total number of scanned objects 67368
    Number of viruses found 11
    Number of infected objects 19
    Number of suspicious objects 0
    Duration of the scan process 01:23:21

    Infected Object Name Virus Name Last Action
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

    C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\cert8.db Object is locked skipped

    C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\formhistory.dat Object is locked skipped

    C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\history.dat Object is locked skipped

    C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\key3.db Object is locked skipped

    C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\parent.lock Object is locked skipped

    C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\search.sqlite Object is locked skipped

    C:\Documents and Settings\Ville\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\urlclassifier2.sqlite Object is locked skipped

    C:\Documents and Settings\Ville\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\java.class-a70697f-5f0b724a.class Infected: Exploit.Java.Gimsh.a skipped

    C:\Documents and Settings\Ville\Cookies\index.dat Object is locked skipped

    C:\Documents and Settings\Ville\Local Settings\Application Data\ApplicationHistory\cli.exe.c88dbd71.ini.inuse Object is locked skipped

    C:\Documents and Settings\Ville\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Documents and Settings\Ville\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

    C:\Documents and Settings\Ville\Local Settings\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\Cache\_CACHE_001_ Object is locked skipped

    C:\Documents and Settings\Ville\Local Settings\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\Cache\_CACHE_002_ Object is locked skipped

    C:\Documents and Settings\Ville\Local Settings\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\Cache\_CACHE_003_ Object is locked skipped

    C:\Documents and Settings\Ville\Local Settings\Application Data\Mozilla\Firefox\Profiles\5hs136fd.default\Cache\_CACHE_MAP_ Object is locked skipped

    C:\Documents and Settings\Ville\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\Ville\Local Settings\Temp\Perflib_Perfdata_1f8.dat Object is locked skipped

    C:\Documents and Settings\Ville\Local Settings\Temp\Perflib_Perfdata_73c.dat Object is locked skipped

    C:\Documents and Settings\Ville\Local Settings\Temp\Perflib_Perfdata_da4.dat Object is locked skipped

    C:\Documents and Settings\Ville\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

    C:\Documents and Settings\Ville\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\Ville\NTUSER.DAT Object is locked skipped

    C:\Documents and Settings\Ville\ntuser.dat.LOG Object is locked skipped

    C:\Documents and Settings\Ville\Omat tiedostot\Vanhat Omat tiedostot\Omat tiedostot\Krääsää\backup\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.601 skipped

    C:\Documents and Settings\Ville\Työpöytä\Krääsää\ieDefender-setup.exe/data0007 Infected: not-a-virus:FraudTool.Win32.IeDefender.b skipped

    C:\Documents and Settings\Ville\Työpöytä\Krääsää\ieDefender-setup.exe NSIS: infected - 1 skipped

    C:\Documents and Settings\Ville\Työpöytä\Krääsää\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

    C:\Documents and Settings\Ville\Työpöytä\Krääsää\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

    C:\Documents and Settings\Ville\Työpöytä\Krääsää\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

    C:\Documents and Settings\Ville\Työpöytä\Krääsää\SmitfraudFix.exe RarSFX: infected - 2 skipped

    C:\Program Files\21cn\VGO\VGOIEBHO.dll Infected: not-a-virus:AdWare.Win32.BHO.ed skipped

    C:\Program Files\Common Files\PCSecureSystem\ugcw.exe Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped

    C:\Program Files\F-Secure Internet Security\Anti-Virus\dbupdate.log Object is locked skipped

    C:\Program Files\F-Secure Internet Security\Anti-Virus\Qrt.log Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\chandir.dat Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\chandir.idx Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\chn.dat Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\chn.idx Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\D0000000.FCS Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\fsbwupst.log Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\inuse.txt Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\L0000153.FCS Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\main.log Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\prs.dat Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\prs.idx Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\prs_die.dat Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\prs_die.idx Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\prs_dnd.dat Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\prs_dnd.idx Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\prs_ext.dat Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\prs_ext.idx Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\prs_rcv.dat Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\prs_rcv.idx Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\storydb.dat Object is locked skipped

    C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\storydb.idx Object is locked skipped

    C:\Program Files\F-Secure Internet Security\Common\admin.pub Object is locked skipped

    C:\Program Files\F-Secure Internet Security\Common\policy.bpf Object is locked skipped

    C:\Program Files\F-Secure Internet Security\Common\policy.ipf Object is locked skipped

    C:\Program Files\F-Secure Internet Security\Spam Control\log\fs_sa_log.txt Object is locked skipped

    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

    C:\System Volume Information\_restore{51BF1D77-3BD7-4FD5-AEE7-A7C9593FB591}\RP358\A0056419.exe/stream/data0003 Infected: Trojan-Downloader.Win32.Zlob.dxq skipped

    C:\System Volume Information\_restore{51BF1D77-3BD7-4FD5-AEE7-A7C9593FB591}\RP358\A0056419.exe/stream Infected: Trojan-Downloader.Win32.Zlob.dxq skipped

    C:\System Volume Information\_restore{51BF1D77-3BD7-4FD5-AEE7-A7C9593FB591}\RP358\A0056419.exe NSIS: infected - 2 skipped

    C:\System Volume Information\_restore{51BF1D77-3BD7-4FD5-AEE7-A7C9593FB591}\RP359\A0056669.exe Infected: not-a-virus:Downloader.Win32.WinFixer.au skipped

    C:\System Volume Information\_restore{51BF1D77-3BD7-4FD5-AEE7-A7C9593FB591}\RP359\A0057770.dll Infected: not-a-virus:AdWare.Win32.Vapsup.it skipped

    C:\System Volume Information\_restore{51BF1D77-3BD7-4FD5-AEE7-A7C9593FB591}\RP359\A0057771.dll Infected: not-a-virus:AdWare.Win32.Vapsup.iu skipped

    C:\System Volume Information\_restore{51BF1D77-3BD7-4FD5-AEE7-A7C9593FB591}\RP364\A0058382.exe Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped

    C:\System Volume Information\_restore{51BF1D77-3BD7-4FD5-AEE7-A7C9593FB591}\RP364\change.log Object is locked skipped

    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

    C:\WINDOWS\rnapxs\rnapxs.dat Object is locked skipped

    C:\WINDOWS\SchedLgU.Txt Object is locked skipped

    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

    C:\WINDOWS\Sti_Trace.log Object is locked skipped

    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

    C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped

    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

    C:\WINDOWS\system32\config\default Object is locked skipped

    C:\WINDOWS\system32\config\default.LOG Object is locked skipped

    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

    C:\WINDOWS\system32\config\SAM Object is locked skipped

    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

    C:\WINDOWS\system32\config\SECURITY Object is locked skipped

    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

    C:\WINDOWS\system32\config\software Object is locked skipped

    C:\WINDOWS\system32\config\software.LOG Object is locked skipped

    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

    C:\WINDOWS\system32\config\system Object is locked skipped

    C:\WINDOWS\system32\config\system.LOG Object is locked skipped

    C:\WINDOWS\system32\drivers\FMTR.sys Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped

    C:\WINDOWS\system32\h323log.txt Object is locked skipped

    C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped

    C:\WINDOWS\system32\SYSINIT32.0XE Infected: Trojan-Downloader.Win32.Delf.cuc skipped

    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

    C:\WINDOWS\wiadebug.log Object is locked skipped

    C:\WINDOWS\wiaservc.log Object is locked skipped

    C:\WINDOWS\WindowsUpdate.log Object is locked skipped

    Scan process completed.
     
  13. sammy19

    sammy19 Member

    Liittynyt:
    30.10.2007
    Viestejä:
    16
    Kiitokset:
    0
    Pisteet:
    11
    Lisäksi:

    Total number of scanned objects: 67368
    Number of viruses found: 11
    Number of infected objects: 19
    Number of suspicious objects: 0
    Duration of the scan process: 01:23:21
     
  14. hannu71

    hannu71 Regular member

    Liittynyt:
    09.02.2006
    Viestejä:
    256
    Kiitokset:
    0
    Pisteet:
    26
    Tässä ohjeet kuinka System Restore (Järjestelmän palautuspiste) puhdistetaan. Windows XP:ssä


    1. Klikkaa hiiren oikealla napilla käynnistävalikon My Computer- tai oma tietokone-kuvaketta
    2. Valitse Properties/ominaisuudet (Järjestelmä)
    3. Valitse System Restore/järjestelmän palauttaminen välilehti
    4. Laita ruxi "Turn off System Restore"/poista järjestelmän palauttaminen kaikissa asemissa
    5. Paina Apply/käytä
    6. Paina OK
    7. Käynnistä Tietokoneesi uudelleen

    8. Laita System Restore taas päälle Kohdassa 4 ruxsi pois ruudusta.=> käytä => OK.

    9. Mene Käynnistä => Suorita ja kopioi laatikkoon %SystemRoot%\system32\restore\rstrui.exe => OK
    Laita täppi kohtaan Luo palautuspiste => Seuraava
    toimi ohjeiden mukaan.

    ja uus kasperskyn online
     

Jaa tämä sivu