|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
HJT-Log
|
|
|
JereHakal
Member
14 tuotearviota
|
6. tammikuuta 2009 @ 23:02 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:01:34 PM, on 1/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\FlashGet\flashget.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\program files\steam\steam.exe
C:\Documents and Settings\JereH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Rockstar Games\Rockstar Games Social Club\1_1_3_0\RGSC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\foobar2000\foobar2000.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\SyncServer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.codecguide.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {E9B5BA28-C732-49DC-94CE-9079F7F75F4E} - (no file)
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [16 test dupe acid] C:\Documents and Settings\All Users\Application Data\dumb tray 16 test\comp noun.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\JereH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [BOOK CHIC] C:\DOCUME~1\JereH\APPLIC~1\CLOSED~1\phone knob.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download with NetPumper - C:\Program Files\NetPumper\AddUrl.htm
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1228424905140
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll,wbsys.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
--
End of file - 8184 bytes
Hmm..
|
|
Hujo
Suspended permanently
|
7. tammikuuta 2009 @ 04:55 |
Linkki tähän viestiin
|
scannaa hjt:llä merkkaa paina Fix checked
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {E9B5BA28-C732-49DC-94CE-9079F7F75F4E} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\JereH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
============
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi
Voiko tietsikka koskaan toimia?
|
|
JereHakal
Member
14 tuotearviota
|
7. tammikuuta 2009 @ 15:44 |
Linkki tähän viestiin
|
Malwarebytes' Anti-Malware 1.32
Database version: 1625
Windows 5.1.2600 Service Pack 3
1/7/2009 3:40:36 PM
mbam-log-2009-01-07 (15-40-36).txt
Scan type: Full Scan (C:\|D:\|E:\|F:\|)
Objects scanned: 318679
Time elapsed: 1 hour(s), 11 minute(s), 4 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 13
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 13
Files Infected: 208
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\alsali (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\alsali.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8dfe3882-5474-4010-bf17-544d1d390117} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fef72f04-58f1-433f-8b51-4c6e85b4605b} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{a8954909-1f0f-41a5-a7fa-3b376d69e226} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e9b5ba28-c732-49dc-94ce-9079f7f75f4e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\netpumper (Adware.NetPumper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with NetPumper (Adware.NetPumper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-netpumper-detector (Adware.NetPumper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\NetPumper (Adware.NetPumper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\anti-leech alnn (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@anti-leech.com/anti-leech plugin,version=1.0.2.3 (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Anti-Leech (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
C:\Program Files\NetPumper (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\props (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\tmp (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\tmp\prop-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\tmp\props (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\tmp\text-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\Anti-Leech (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
C:\Program Files\Anti-Leech\ALNN (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
Files Infected:
C:\Program Files\Anti-Leech\ALNN\alhlp.exe (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
C:\Program Files\Anti-Leech\ALNN\npalnn.dll (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
C:\Program Files\Anti-Leech\ALNN\setup2.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Program Files\Opera\program\plugins\alhlp.exe (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
C:\Program Files\Opera\program\plugins\npalnn.dll (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\plugins\alhlp.exe (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\plugins\npalnn.dll (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{73530B66-2471-4166-A103-905D64D0E156}\RP46\A0017038.exe (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\AddUrl.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\uninstall.exe (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\commonheadfoot.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\compat.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\details.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\features.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\index.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\mainwin.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\nphelp.css (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\prefwindow.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\register.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\schedwin.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\tips.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\apllimit.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\bandwidthpanel.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\buttons.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\cmdadd.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\cmdaddtoschedule.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\cmddetails.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\cmdeditschedule.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\cmdfolder.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\cmdhelp.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\cmdopen.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\cmdopenfolder.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\cmdpause.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\cmdprefs.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\cmdremove.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\cmdresume.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\cmdselectall.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\detailwin-wide.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\detailwin.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\droptoschedule.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\editbandwidth.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\ignlimit.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\limserver.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\limservergold.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\limuser.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\mainwin.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\moveicons.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\prefw-bandwidth.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\prefw-connections.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\prefw-general.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\prefw-login.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\prefw-monitoring.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\prefw-proxy-ftp.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\prefw-proxy-http.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\register-1.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\register-2.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\register-3-1.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\register-3-2.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\schedulewin.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\scnoresume.bmp (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\scnoresume.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\scresumes.bmp (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\scresumes.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\scunk.bmp (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\scunk.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\stanalyzing.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\starticon.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\stcompleted.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\stfatal.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\stinpro.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\stnhelp-old.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\stnhelp.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\stopicon.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\stpaused.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\stqueued.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\stretrying.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\stscheduled.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\summary.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\throtdn.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\zoombtn.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\entries (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\format (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\apllimit.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\bandwidthpanel.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\buttons.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdadd.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdaddtoschedule.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\cmddetails.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdeditschedule.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdfolder.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdhelp.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdopen.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdopenfolder.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdpause.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdprefs.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdremove.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdresume.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdselectall.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\detailwin-wide.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\detailwin.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\droptoschedule.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\editbandwidth.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\ignlimit.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\limserver.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\limservergold.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\limuser.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\mainwin.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\moveicons.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\prefw-bandwidth.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\prefw-connections.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\prefw-general.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\prefw-login.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\prefw-monitoring.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\prefw-proxy-ftp.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\prefw-proxy-http.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\register-1.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\register-2.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\register-3-1.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\register-3-2.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\schedulewin.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\scnoresume.bmp.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\scnoresume.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\scresumes.bmp.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\scresumes.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\scunk.bmp.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\scunk.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\stanalyzing.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\starticon.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\stcompleted.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\stfatal.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\stinpro.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\stnhelp-old.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\stnhelp.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\stopicon.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\stpaused.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\stqueued.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\stretrying.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\stscheduled.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\summary.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\throtdn.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\prop-base\zoombtn.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\apllimit.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\bandwidthpanel.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\buttons.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\cmdadd.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\cmdaddtoschedule.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\cmddetails.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\cmdeditschedule.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\cmdfolder.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\cmdhelp.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\cmdopen.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\cmdopenfolder.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\cmdpause.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\cmdprefs.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\cmdremove.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\cmdresume.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\cmdselectall.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\detailwin-wide.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\detailwin.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\droptoschedule.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\editbandwidth.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\ignlimit.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\limserver.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\limservergold.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\limuser.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\mainwin.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\moveicons.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\prefw-bandwidth.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\prefw-connections.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\prefw-general.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\prefw-login.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\prefw-monitoring.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\prefw-proxy-ftp.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\prefw-proxy-http.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\register-1.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\register-2.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\register-3-1.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\register-3-2.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\schedulewin.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\scnoresume.bmp.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\scnoresume.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\scresumes.bmp.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\scresumes.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\scunk.bmp.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\scunk.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\stanalyzing.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\starticon.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\stcompleted.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\stfatal.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\stinpro.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\stnhelp-old.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\stnhelp.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\stopicon.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\stpaused.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\stqueued.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\stretrying.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\stscheduled.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\summary.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\throtdn.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper\help\images\.svn\text-base\zoombtn.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\c.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\m.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\p.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\s.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\JereH\Favorites\Search Online.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\JereH\Favorites\VIP Casino.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\JereH\Favorites\Cheap Pharmacy Online.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\JereH\Favorites\SMS TRAP.url (Rogue.Link) -> Quarantined and deleted successfully.
Ei Jeesus D:.
Ja tässä vielä HJT jos kiinnostaa ;E.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:41:57 PM, on 1/7/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\FlashGet\flashget.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\program files\steam\steam.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Rockstar Games\Rockstar Games Social Club\1_1_3_0\RGSC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\foobar2000\foobar2000.exe
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Documents and Settings\JereH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\iTunes\iTunes.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.codecguide.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [16 test dupe acid] C:\Documents and Settings\All Users\Application Data\dumb tray 16 test\comp noun.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BOOK CHIC] C:\DOCUME~1\JereH\APPLIC~1\CLOSED~1\phone knob.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1228424905140
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll,wbsys.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
--
End of file - 7312 bytes
Hmm..
|
|
JereHakal
Member
14 tuotearviota
|
7. tammikuuta 2009 @ 15:45 |
Linkki tähän viestiin
|
|
Nyt tuli kahteen kertaan, eka viesti ei näyttänyt menevän, latasi vain tyhjän sivun :E sitten sitä ei näkynyt niin ajattelin ettei toimi kun niin pitkä D:
Hmm..
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 7. tammikuuta 2009 @ 15:46
|
|
Hujo
Suspended permanently
|
7. tammikuuta 2009 @ 21:48 |
Linkki tähän viestiin
|
Scannaa koneesi Kaspersky Online Scannerin
Ohjelman käynnistyessä kysytään sallitaanko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
" Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
" Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
" Klikkaa nyt asetuksia, Scan Settings
" Tarkista asetuksista, että seuraavat ovat valittuina:
o Scan using the following Anti-Virus database:
+ Extended (Jos valittavissa, muuten valitse Standard)
o Scan Options:
+ Scan Archives
+ Scan Mail Bases
" Klikkaa OK
" Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
" Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
" Klikkaa nyt Save as Text-painiketta.
" Tallenna tiedosto työpöydällesi.
" Mikäli haluat jatkaa asian käsittelyä foorumissa niin kopioi tiedoston sisältö viestiisi.
Voiko tietsikka koskaan toimia?
|
|
JereHakal
Member
14 tuotearviota
|
8. tammikuuta 2009 @ 07:55 |
Linkki tähän viestiin
|
|
Joo kiitoksia, aika paljon löytyi kyllä noita spywareja :D.
Hmm..
|
|
Hujo
Suspended permanently
|
8. tammikuuta 2009 @ 11:13 |
Linkki tähän viestiin
|
Lataa Tästä Ccleaner
CCleaner v 2.14.750.- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
Asennuksen jälkeen aukaise CCleaneri.
Valitse vasemmalta pystyrivistä Options.
Valitse viereisestä pystyrivistä Settings.
Language kohtaan valitse Suomi.
Puhdistaja
Valitse vasemmalta pystyrivistä Puhdistaja.
Paina alhaalta Tutki.
Nyt CCleaneri tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
Kun tutkiminen on valmis, paina Aja CCleaner.
Nyt CCleaneri poistaa löydetyt tempit, cookiessit jne.
Rekisterin virheiden korjaus
Valitse vasemmalta pystyrivistä Rekisteri.
Paina alhaalta Etsi rekisterin virheitä.
Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
Saat vielä varmistus kysymyksen, paina Ok.
Kun virheet on korjattu, paina Sulje.
Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
Poista lisää poista sovelutuksesta
NetPumper
Poista kansio vikasiedossa
C:\Program Files\NetPumper jos vielä nuo näkyy
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 8. tammikuuta 2009 @ 11:27
|
|
JereHakal
Member
14 tuotearviota
|
8. tammikuuta 2009 @ 11:19 |
Linkki tähän viestiin
|
|
Ole tuon tehnytkin, ja on crap cleaneri :E.
Hmm..
|
|
Hujo
Suspended permanently
|
8. tammikuuta 2009 @ 11:28 |
Linkki tähän viestiin
|
|
lisäsin tuohon ylös vielä pikku tarkistukset
Voiko tietsikka koskaan toimia?
|
|
JereHakal
Member
14 tuotearviota
|
8. tammikuuta 2009 @ 12:35 |
Linkki tähän viestiin
|
|
Joo, poistan sen kun pääsen kotiin, tiedän mistä se on tullut :E.
Hmm..
|
|
Hujo
Suspended permanently
|
8. tammikuuta 2009 @ 12:40 |
Linkki tähän viestiin
|
|
Scannaa sitten uusi hjt:n loki.
Jostain niitä aina Ilmaatuu, kaupan pikku kylkiäiset ;)
Voiko tietsikka koskaan toimia?
|
|
JereHakal
Member
14 tuotearviota
|
8. tammikuuta 2009 @ 14:42 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:42:21 PM, on 1/8/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\FlashGet\flashget.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\program files\steam\steam.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\foobar2000\foobar2000.exe
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Documents and Settings\JereH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\QuickTime\QuicktimePlayer.exe
C:\Program Files\Webteh\BSplayerPro\bsplayer.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.codecguide.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [16 test dupe acid] C:\Documents and Settings\All Users\Application Data\dumb tray 16 test\comp noun.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BOOK CHIC] C:\DOCUME~1\JereH\APPLIC~1\CLOSED~1\phone knob.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1228424905140
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll,wbsys.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
--
End of file - 7564 bytes
Hmm..
|
|
Hujo
Suspended permanently
|
8. tammikuuta 2009 @ 18:34 |
Linkki tähän viestiin
|
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan:
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä
Jossakin koneissa hakataan F8:sin sijasta F5:tä
" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
Voiko tietsikka koskaan toimia?
|
|
JereHakal
Member
14 tuotearviota
|
9. tammikuuta 2009 @ 01:08 |
Linkki tähän viestiin
|
SDFix: Version 1.240
Run by JereH on Thu 01/08/2009 at 11:17 PM
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\Documents and Settings\JereH\Desktop\SDFix
Checking Services :
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
Checking Files :
No Trojan Files Found
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-09 00:38:56
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="C:\Program Files\DAEMON Tools Pro\"
"h0"=dword:00000000
"hdf12"=hex:f5,f8,2f,63,cb,ff,b6,f6,87,cc,5a,6b,6a,95,ac,94,40,9f,31,f3,80,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,e2,ba,95,73,61,75,dd,ec,f6,4d,a9,35,42,19,c3,93,54,..
"hdf12"=hex:b6,33,fa,d7,33,49,3f,ef,53,ea,aa,99,e2,9e,49,68,16,6b,85,8b,6c,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:7a,a5,78,39,92,8f,4f,01,1b,c3,23,e7,06,47,ba,24,a7,60,2f,86,76,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1]
"hdf12"=hex:80,76,ee,65,51,53,7b,19,9f,95,d9,ea,2f,79,28,02,ba,6e,50,fc,d1,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2]
"hdf12"=hex:c7,98,61,5d,4a,03,a8,80,e6,18,ad,9b,7b,29,18,04,4e,04,86,dd,35,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3]
"hdf12"=hex:eb,ea,8a,6d,09,cb,0f,48,77,92,d4,d5,5f,e3,82,8a,1b,2a,0b,db,0d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="C:\Program Files\DAEMON Tools Pro\"
"h0"=dword:00000000
"hdf12"=hex:f5,f8,2f,63,cb,ff,b6,f6,87,cc,5a,6b,6a,95,ac,94,40,9f,31,f3,80,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,e2,ba,95,73,61,75,dd,ec,f6,4d,a9,35,42,19,c3,93,54,..
"hdf12"=hex:b6,33,fa,d7,33,49,3f,ef,53,ea,aa,99,e2,9e,49,68,16,6b,85,8b,6c,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:7a,a5,78,39,92,8f,4f,01,1b,c3,23,e7,06,47,ba,24,a7,60,2f,86,76,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1]
"hdf12"=hex:80,76,ee,65,51,53,7b,19,9f,95,d9,ea,2f,79,28,02,ba,6e,50,fc,d1,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2]
"hdf12"=hex:c7,98,61,5d,4a,03,a8,80,e6,18,ad,9b,7b,29,18,04,4e,04,86,dd,35,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3]
"hdf12"=hex:eb,ea,8a,6d,09,cb,0f,48,77,92,d4,d5,5f,e3,82,8a,1b,2a,0b,db,0d,..
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000b3d
"TracesSuccessful"=dword:00000036
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"="C:\\Program Files\\AVG\\AVG8\\avgnsx.exe:*:Enabled:avgnsx.exe"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\Steam\\steamapps\\jerehakala\\counter-strike\\hl.exe"="C:\\Program Files\\Steam\\steamapps\\jerehakala\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Steam\\steamapps\\jerehakala\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\jerehakala\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"="C:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe:*:Disabled:Rockstar Games Social Club"
"C:\\Program Files\\iPhone Tunnel Suite\\iTunnel\\iTunnel.exe"="C:\\Program Files\\iPhone Tunnel Suite\\iTunnel\\iTunnel.exe:*:Enabled:iTunnel"
"C:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"="C:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1.exe"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\empires2.exe"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\empires2.exe:*:Enabled:Age of Empires II"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"="C:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV"
"C:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"="C:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe:*:Enabled:Grand Theft Auto IV"
"C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam"
"C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe"="C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (CLI)"
"C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe"="C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (SRV)"
"C:\\Program Files\\Mozilla Firefox\\plugins\\alhlp.exe"="C:\\Program Files\\Mozilla Firefox\\plugins\\alhlp.exe:*:Enabled:Anti-Leech plugin helper program"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
Remaining Files :
Files with Hidden Attributes :
Thu 4 Dec 2008 211 ...H. --- "C:\Boot.BAK"
Tue 6 Jan 2009 8,192 A.SHR --- "C:\BOOTSECT.BAK"
Sat 3 Jan 2009 243,712 A..H. --- "C:\VAC2.dll"
Tue 16 Dec 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 19 Dec 2008 857 ...HR --- "C:\Documents and Settings\JereH\Application Data\SecuROM\UserData\securom_v7_01.bak"
Finished!
Hmm..
|
|
Hujo
Suspended permanently
|
10. tammikuuta 2009 @ 12:36 |
Linkki tähän viestiin
|
|
scannaa uusi hjt:n loki
Voiko tietsikka koskaan toimia?
|
|
JereHakal
Member
14 tuotearviota
|
10. tammikuuta 2009 @ 15:37 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:36:49 PM, on 1/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\JereH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Last.fm\LastFM.exe
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\FlashGet\flashget.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\foobar2000\foobar2000.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.codecguide.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [16 test dupe acid] C:\Documents and Settings\All Users\Application Data\dumb tray 16 test\comp noun.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BOOK CHIC] C:\DOCUME~1\JereH\APPLIC~1\CLOSED~1\phone knob.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1228424905140
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
--
End of file - 7307 bytes
Hmm..
|
|
Hujo
Suspended permanently
|
11. tammikuuta 2009 @ 01:13 |
Linkki tähän viestiin
|
|
scannaa hjt:llä merkkaa paina Fix checked
O4 - HKLM\..\Run: [16 test dupe acid] C:\Documents and Settings\All Users\Application Data\dumb tray 16 test\comp noun.exe
O4 - HKCU\..\Run: [BOOK CHIC] C:\DOCUME~1\JereH\APPLIC~1\CLOSED~1\phone knob.exe
Voiko tietsikka koskaan toimia?
|
|
JereHakal
Member
14 tuotearviota
|
11. tammikuuta 2009 @ 01:16 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:15:50 AM, on 1/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\JereH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Last.fm\LastFM.exe
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\FlashGet\flashget.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Steam\Steam.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\foobar2000\foobar2000.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.codecguide.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\RunOnce: [MessengerPlusLiveUninstall] "C:\DOCUME~1\JereH\LOCALS~1\Temp\MsgPlusUninstall.exe" /Cleanup
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1228424905140
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
--
End of file - 7103 bytes
:E Se oli siinä sitte?
Hmm..
|
|
Hujo
Suspended permanently
|
11. tammikuuta 2009 @ 01:32 |
Linkki tähän viestiin
|
|
Fixsaa tuokin pois
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O4 - HKLM\..\RunOnce: [MessengerPlusLiveUninstall] "C:\DOCUME~1\JereH\LOCALS~1\Temp\MsgPlusUninstall.exe" /Cleanup
Voiko tietsikka koskaan toimia?
|
|
JereHakal
Member
14 tuotearviota
|
11. tammikuuta 2009 @ 01:34 |
Linkki tähän viestiin
|
|
Done, noi ois kuitenki pitäny mennä sitteku restarttaan koneen :E.
Hmm..
|
|
Hujo
Suspended permanently
|
11. tammikuuta 2009 @ 01:44 |
Linkki tähän viestiin
|
|
No mikäs on koneen toiminta
Voiko tietsikka koskaan toimia?
|
|
JereHakal
Member
14 tuotearviota
|
11. tammikuuta 2009 @ 01:46 |
Linkki tähän viestiin
|
|
Huva, ennen oli joskus sillaisia että netti muuttui yhtäkkiä perkeleen hitaaksi, tiedä mistä sitten johtui :P
Hmm..
|
|
Hujo
Suspended permanently
|
11. tammikuuta 2009 @ 01:51 |
Linkki tähän viestiin
|
otetaas tuolla vielä
Lataa NoLop työpöydällesi linkeistä...
Linkki1
1.Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen
2.Tuplaklikkaa NoLop.exe ajaaksesi sen
3.Klikkaa nappulaa "Search and Destroy"
<<Tietokoneesi skannataan saastuneiden tiedostojen osalta>>
4, Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK
5. Klikkaa "REBOOT"-painiketta.
6. NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera.
-- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataa mscomctl.ocx ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan.
Voiko tietsikka koskaan toimia?
|
|
JereHakal
Member
14 tuotearviota
|
11. tammikuuta 2009 @ 01:54 |
Linkki tähän viestiin
|
|
Ei löytän mitään :P
Oon kyllä ajanu ton ennenki :D sillon löysi jtn.
Hmm..
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
11. tammikuuta 2009 @ 02:00 |
Linkki tähän viestiin
|
|
siten ei mmuuta kuin työkalujen poistelut
Nolop
sdfix
Voiko tietsikka koskaan toimia?
|
|
