Virus ilmoituksia tullut sen verran useasti ja myös netti hidastelee joten olisi varmaan aika tarkistaa HjT loki.


Logfile of HijackThis v1.99.1
Scan saved at 20:32:16, on 28.3.2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\RunDll32.exe
D:\Ohjelmat\Winamp\winampa.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\System32\spoolsvc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\spooIsv.exe
C:\Documents and Settings\esa\Työpöytä\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saunalahti.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Ohjelmat\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [WinampAgent] D:\Ohjelmat\Winamp\winampa.exe
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spooIsv.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Ohjelmat\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Ohjelmat\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: Avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: Avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

Moi!
Käy ensin Windows update sivoilla ja päivitä SP1 koneelle
sen jälkeen lähetä uusi HjT-loki(Huom!! Älä kuitenkaan vielä päivitä SP2:sta voi mennä kone juntturaan)
Ilman tuota Sp1:stä on ihan turha lähtee putsaamaan,

Jaa, minä kun luulin, että minulla on jo koneella SP1 olemassa. Ilmeisesti ei kuitenkaan sitten sitä ole.

Lainaus:

---

Logfile of HijackThis v1.99.1
Scan saved at 20:32:16, on 28.3.2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

---

juu,ei ole sp1 koneella,näkyis tuossa rivis jos olisi

Jep, täytyy asentaa se sp1 kun jostain sen löytäisin. Microsoft:n sivuilla oli ettei ole enää saatavilla, mutta sp1a:n saa vielä eli laitan sellaisen. Ennen tätä windows:a minulla oli sp1 ja koskaan ei ollut mitään ongelmia. Nyt kun olen joutunut kovalevyn puhdistamaan ja asentamaan windows:n uudestaan niin on ongelmia ja viruksia esiintynyt aika lailla. Ehkä johtuu siitä kun ei ole sp1:stä tässä käyttiksessä.

:) tuo winukka on aika reikäjuusto ilman sp1:stä
kokeile saako sen vielä tästä
http://www.microsoft.com/windowsxp/downl...p1/default.mspx

Nyt on sp1a asennettuna ja uusi HjT loki tässä

Jotain mätää on kyllä kun palomuuri "huuta" punaisena ja kuormittaa verkkoa myös. Joku outo "prosessi" palomuurissa blokattuna (spooIsv.exe) ilmeisesti on joku virus.

ogfile of HijackThis v1.99.1
Scan saved at 22:41:34, on 28.3.2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\RunDll32.exe
D:\Ohjelmat\Winamp\winampa.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\System32\spooIsv.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\adxvu.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Ohjelmat\Reader\reader_sl.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\esa\Työpöytä\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saunalahti.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Ohjelmat\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [WinampAgent] D:\Ohjelmat\Winamp\winampa.exe
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spooIsv.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Ohjelmat\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Ohjelmat\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: Avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: Avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

Kyllä vain... se on tämä örkki-->W32/Poebot-KL
Vaihda kaikki Käyttäjätunnukset ja salasanat
Jos olet käyttänyt Verkkokauppoja,Verkkopankkia tai Visa netis niin ota yhteyttä palveluntarjoajaan




Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:[list][*]Käynnistä tietokone
[*]Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
[*]Seuraavaksi pitäisi ilmestyä valikko
[*]Valitse valikosta vikasietotila.

[*] Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio). Työpöydälle ilmestyy sdfix.exe. Tuplakilikkaa sitä, niin tiedosto purkaantuu ja asentaa itsensä siihen levyasemaan, minne on käyttöjärjestelmä on asennettu ja juureen ilmestyy kansio SDFix, ESIM c:\SDFix
[*] Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
[*] Paina Y käynnistääksesi skriptin.
[*] Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
[*] Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
[*] Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
[*] Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
[*] Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
[*] Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.


Lähetä Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.[/b]

Tässä raportti SDfix:

SDFix: Version 1.75

Run by esa - to 29.03.2007 - 17:28:17,57

Microsoft Windows XP [versio 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:





Restoring Windows Registry Entries
Restoring Default Hosts File


Rebooting...

Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\WINDOWS\SYSTEM32\TJZLMWQ.EXE - Deleted
C:\DOCUME~1\esa\LOCALS~1\Temp\ICD1.tmp\jinstall-1_5_0_11.inf - Deleted
C:\DOCUME~1\esa\LOCALS~1\Temp\ICD1.tmp\jinstall.exe - Deleted
C:\WINDOWS\system32\spooIsv.exe - Deleted
C:\WINDOWS\system32\spoolsvc.exe - Deleted


Folder C:\DOCUME~1\esa\LOCALS~1\Temp\ICD1.tmp - Removed

ADS Check:

C:\WINDOWS\system32
No streams found.


Final Check:

Remaining Services:
------------------




Remaining Files:
---------------

Backups Folder: - C:\SDFix\backups\backups.zip

Checking For Files with Hidden Attributes :


Finished


Ja uusi HjT loki:

Logfile of HijackThis v1.99.1
Scan saved at 17:33:14, on 29.3.2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\RunDll32.exe
D:\Ohjelmat\Winamp\winampa.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
D:\Ohjelmat\Reader\reader_sl.exe
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\esa\Työpöytä\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saunalahti.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Ohjelmat\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [WinampAgent] D:\Ohjelmat\Winamp\winampa.exe
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Ohjelmat\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Ohjelmat\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: Avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: Avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

jep...

Siirrä HijackThis.exe omaan kansioon C:\HJT\HijackThis.exe

Tee uusi HjT-scannaus Do a System scan only
Sulje kaikki muut ikkunat ja selaimen.Merkkaa nämä rivit ja paina Fix checked

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

ja sitten...

Skannaa koneesi Kaspersky Online Skannerilla
Käytä Internet Explorer
Sinulta kysytään sallitko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.[list]
[*] Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
[*] Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
[*] Klikkaa nyt asetuksia, Scan Settings
[*] Tarkista asetuksista, että seuraavat ovat valittuina:

o Scan using the following Anti-Virus database:

+ Extended (Jos valittavissa, muuten valitse Standard)

o Scan Options:

+ Scan Archives
+ Scan Mail Bases

[*] Klikkaa OK
[*] Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
[*] Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
[*] Klikkaa nyt Save as Text-painiketta.
[*] Tallenna tiedosto työpöydällesi.
[*] Kopioi ja Liitä tiedoston sisältö seuraavaan vastaukseesi.


Lähetä uusi HjT-loki ja Kaperskyn-loki

kapersky report olisi tässä:

Thursday, March 29, 2007 9:55:17 PM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 27/03/2007
Kaspersky Anti-Virus database records: 287083


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 52508
Number of viruses found 4
Number of infected objects 177
Number of suspicious objects 0
Duration of the scan process 00:46:01

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\ACD Systems\ACDSee\6.0\ACDInTouch\EN\StaticPages\privacy-popup.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped

C:\Documents and Settings\esa\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\esa\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\esa\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\esa\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\esa\Local Settings\Temp\~DF7B39.tmp Object is locked skipped

C:\Documents and Settings\esa\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\esa\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\esa\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\0XEB0D63\CAELANYH.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\0XEB0D63\CAL4VLZ7.HTM Infected: Net-Worm.Win32.Allaple.a skipped

C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\0XEB0D63\CAMFIFOF.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\0XEB0D63\foorumi_mainos[1].htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\49Q70TA7\CA2J55E4.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\49Q70TA7\search[1].htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\GLUZWDUZ\CA7U9CXL.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\GLUZWDUZ\CAKLQVUR.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\GLUZWDUZ\google[1].htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\S9MVG9MJ\CAYNCXEZ.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\S9MVG9MJ\CAYTX4O4.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\S9MVG9MJ\search[1].htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0TOJETSN\CAL8I1TJ.HTM Infected: Net-Worm.Win32.Allaple.a skipped

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0TOJETSN\CAYFSHUB.HTM Infected: Net-Worm.Win32.Allaple.a skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Program Files\Adobe\Adobe Help Viewer\1.0\help.html Infected: Net-Worm.Win32.Allaple.a skipped

C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\report\Taustasuojaus.txt Object is locked skipped

C:\Program Files\Alwil Software\Avast4\FINNISH\aswClnTg.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Program Files\Alwil Software\Avast4\FINNISH\aswInfTg.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Program Files\Common Files\Adobe\Help\en_US\Adobe Reader\8.0\version.html Infected: Net-Worm.Win32.Allaple.a skipped

C:\Program Files\Common Files\System\ado\MDACReadme.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Program Files\Microsoft Office\Office\1035\FEEDBACK.HTM Infected: Net-Worm.Win32.Allaple.a skipped

C:\Program Files\Microsoft Office\Office\1035\THANKYOU.HTM Infected: Net-Worm.Win32.Allaple.a skipped

C:\Program Files\Microsoft Office\Office\INTLBAND.HTM Infected: Net-Worm.Win32.Allaple.a skipped

C:\Program Files\MSN\MSNCoreFiles\msnread.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Program Files\NetMeeting\netmeet.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\Program Files\Sygate\SPF\debug.log Object is locked skipped

C:\Program Files\Sygate\SPF\rawlog.log Object is locked skipped

C:\Program Files\Sygate\SPF\seclog.log Object is locked skipped

C:\Program Files\Sygate\SPF\syslog.log Object is locked skipped

C:\Program Files\Sygate\SPF\tralog.log Object is locked skipped

C:\Program Files\WinRAR\Order.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\SDFix\backups\backups.zip/backups/spooIsv.exe Infected: Backdoor.Win32.VanBot.ax skipped

C:\SDFix\backups\backups.zip/backups/spoolsvc.exe Infected: Backdoor.Win32.VanBot.ax skipped

C:\SDFix\backups\backups.zip ZIP: infected - 2 skipped

C:\SDFix\backups_old1\backups.zip/backups/urdvxc.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\SDFix\backups_old1\backups.zip ZIP: infected - 1 skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028652.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028653.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028654.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028655.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028656.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028657.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028658.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028659.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028660.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028661.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028662.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028663.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028664.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028665.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028666.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028667.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028668.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028669.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028670.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028671.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028672.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028673.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028674.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028675.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028676.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028677.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028678.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028679.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028680.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028681.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028682.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028683.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028684.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028685.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028686.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028687.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028688.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028689.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028690.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028691.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028692.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028693.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028694.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028695.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028696.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028697.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028698.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028699.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028700.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028701.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028702.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028703.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028704.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028705.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028706.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028707.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028708.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028709.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028710.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028711.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028712.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028713.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028714.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028715.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028716.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028717.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028718.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028719.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028720.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028721.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028722.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028723.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028724.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028725.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028726.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028727.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028728.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028729.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028730.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028731.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028732.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028733.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028734.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028735.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028736.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028737.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028738.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028739.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028740.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028741.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028742.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028743.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028744.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028745.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028746.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028747.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028748.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028749.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028750.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028751.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028752.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028753.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028754.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028755.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028756.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028757.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028758.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028759.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028760.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028761.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028762.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028763.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028764.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028765.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028766.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028767.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028768.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028769.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028770.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028771.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028772.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028773.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028774.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028775.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028776.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028777.exe Infected: Net-Worm.Win32.Allaple.b skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP58\A0034001.exe Infected: Backdoor.Win32.VanBot.ax skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP58\A0034002.exe Infected: Backdoor.Win32.VanBot.ax skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP58\A0034009.exe Infected: Backdoor.Win32.VanBot.ax skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP58\A0034010.exe Infected: Backdoor.Win32.VanBot.ax skipped

C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP58\change.log Object is locked skipped

C:\WINDOWS\Debug\oakley.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\Help\ciadmin.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\snd.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Cnt\contents.htm Infected: Net-Worm.Win32.Allaple.a skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat Object is locked skipped

C:\WINDOWS\system32\config\systemprofile\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_59c.dat Object is locked skipped

C:\WINDOWS\Temp\_avast4_\unp97104302.tmp Infected: Trojan-Proxy.Win32.Agent.mf skipped

C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

D:\Documents and Settings\All Users\Application Data\ACD Systems\ACDSee\6.0\ACDInTouch\EN\StaticPages\privacy-popup.htm Infected: Net-Worm.Win32.Allaple.a skipped

D:\Documents and Settings\Käyttäjä\Application Data\Real\Msg\104_1169249968\ipm_movies011907.html Infected: Net-Worm.Win32.Allaple.a skipped

D:\Documents and Settings\Käyttäjä\Application Data\Real\Msg\3115_1169234317\070118_bom.html Infected: Net-Worm.Win32.Allaple.a skipped

D:\Documents and Settings\Käyttäjä\Application Data\Real\Msg\4155_1168979496\20070116123136newmusicalerts.html Infected: Net-Worm.Win32.Allaple.a skipped

D:\Documents and Settings\Käyttäjä\Application Data\Real\Msg\4155_1169397992\20070120Newmusic_9links.html Infected: Net-Worm.Win32.Allaple.a skipped

D:\Documents and Settings\Käyttäjä\Application Data\Sereniti\Active Security Monitor\IEReport.htm Infected: Net-Worm.Win32.Allaple.a skipped

D:\Documents and Settings\Käyttäjä\Application Data\Sereniti\Active Security Monitor\Report.htm Infected: Net-Worm.Win32.Allaple.a skipped

D:\Ohjelmat\Reader\HowTo\ENU\version.html Infected: Net-Worm.Win32.Allaple.a skipped

D:\Ohjelmat\Winamp\Plugins\milkdrop.html Infected: Net-Worm.Win32.Allaple.a skipped

D:\Ohjelmat\Winamp\Plugins\milkdrop_preset_authoring.html Infected: Net-Worm.Win32.Allaple.a skipped

D:\Ohjelmat\Winamp\Plugins\Predixis MusicMagic\help.htm Infected: Net-Worm.Win32.Allaple.a skipped

D:\Ohjelmat\Winamp\Plugins\Predixis MusicMagic\index.htm Infected: Net-Worm.Win32.Allaple.a skipped

Scan process completed.

Tässä uusi hjt:

Logfile of HijackThis v1.99.1
Scan saved at 21:58:56, on 29.3.2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\RunDll32.exe
D:\Ohjelmat\Winamp\winampa.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saunalahti.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Ohjelmat\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [WinampAgent] D:\Ohjelmat\Winamp\winampa.exe
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Ohjelmat\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Ohjelmat\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: Avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: Avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

jaahans... kaspersky sekoilee taas :( väittää .htm tiedostoja Net-Worm.Win32.Allaple.a :s


Loki on OK :)

ja sitten jälkipuhdistus...

Poista kansio C:\SDFix

Tyhjennä Avstin karanteeni

Lataa Atribunen ATF Cleaner

Ohjeet;

Sulje Firefox selain

Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.
Main:n alla valitse: Select All
Klikkaa Empty Selected valintaa.

Jos käytät FireFoxia selaimenasiKlikkaa Firefox yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.

Jos käytät Operaa selaimenasi
Klikkaa Opera yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa taas.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)


Putsaa järjestelmän palautus:
1. Klikkaa oikealla käynnistävalikon My Computer- tai oma tietokone-kuvaketta
2. Valitse Properties/ominaisuudet
3. Valitse System Restore/järjestelmän palauttaminen välilehti
4. Valitse "Turn off System Restore"/poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Apply/käytä
6. Paina OK
7. Käynnistä kone uudelleen
8. Palauta asetukset takaisin


Päivitä Windowsiin SP2 (Windowsin Update sivuston kautta)
tai tästä(jos linkki vielä toimii)--->ServicePack2


ja lisä vinkkejä...

Pysy Puhtaana !

Käytä Firefox
Firefox on nopeampi turvallisempi selain kuin Internet Explorer
Lataa Firefox

Asenna Hosts-tiedosto
Hosts-tiedosto estää haitalliset internet-osoitteet
Lataa Hosts-tiedosto
Opas!

Asenna AVG Anti-Spyware
AVG Anti-Spyware poistaa haittaohjelmia ja puhdistaa myös rekisteriä
Lataa AVG Anti-Spyware
Opas!

Asenna Ccleaner
Ccleaner puhdistaa väliaikaistiedostot ja rekisteriä
Lataa Ccleaner
Opas!

Asenna SpywareBlaster
SpywareBlaster estää haittaohjelmien asentumista koneelle
Lataa SpywareBlaster
Opas!

Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste.
Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä.
Opas!

Pidä järjestelmäsi ajantasalla
Windows Update

Pidä palomuuri ja virustorjunta ajantasalla
Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi.

Taistele vastaan!!--> Malware Complaints
Sivusto antaa haittaohjelmien uhreille mahdollisuuden kertoa tarinansa ja tehdä valituksen asiasta. Taistellaan yhdessä haittaohjelmien tekijöitä vastaan!

Ok, teen vielä tuon yllämainitun. kiitoksia paljon avusta ja neuvoista.

oleppa hyvä :)