täälläkin virus...

Tiinis

2008-06-07 22:01:58

Heippa,

virus on tainnu iskeä tämänkin tytön koneelle. voitko katsoa että kaikki on kunnossa/mitä mun pitää tehä jatkossa jotta saisin viruksen pois?

File C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\PROGRA~1\MYWEBS~1\SrchAstt\1.bin\MWSSRCAS.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.as. No Action Taken.
File C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\WINDOWS\system32\f3PSSavr.scr tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\Documents and Settings\Tiina Nurmikolu\Local Settings\Temp\VVSNInst.exe tagged as not-a-virus:AdTool.Win32.WhenU.a. No Action Taken.
File C:\Program Files\BearShare\BearShareZangoInstaller.exe tagged as not-a-virus:AdWare.Win32.180Solutions.ao. No Action Taken.
File C:\Program Files\Internet Explorer\msimg32.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\Program Files\MSN Messenger\msimg32.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\Program Files\MSN Messenger\riched20.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.af. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE tagged as not-a-virus:AdTool.Win32.MyWebSearch.a. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.an. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.aq. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.bh. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.at. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.ax. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.as. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.ad. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.au. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
File C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.i. No Action Taken.
File C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.as. No Action Taken.
File C:\WINDOWS\system32\f3PSSavr.scr tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.

895

Äänestä

Vastaukset

FixFix
2008-06-07 23:00:37
tuoki kyllä kertoo olevan yksi pha siellä

Lataa [url=http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe][color=red]TÄSTÄ[/color][/url] HJTInstall.exe

* Tallenna [b]HJTInstall.exe[/b] työpöydällesi.
* Tuplaklikkaa [b]HJTInstall.exe[/b]-kuvaketta työpöydälläsi.
* Oletuksena se asentaa itsensä hakemistoon [b]C:\Program Files\Trend Micro\HijackThis.[/b]
* Klikkaa [b]Install.[/b]
* Asennusohjelma luo HijackThis-kuvakkeen työpöydälle.
* Kun asennus on valmis, se käynnistää [b]HijackThisin.[/b]
* Klikkaa [b]Do a system scan and save a logfile-painiketta[/b]. Ohjelma aloittaa skannauksen ja lokin pitäisi avautua Muistioon.
* Klikkaa ensin "Muokkaa > Valitse kaikki" sitten "Muokkaa > Kopioi" kopioidaksesi koko lokin sisällön.
* Liitä lokin sisältö seuraavaan vastaukseesi.
* [color=red]ÄLÄ[/color] käytä [color=red]Analyse This-nappulaa[/color], sen löydöt ovat vaarallisia väärinymmärrettyinä.
* [color=red]ÄLÄ[/color] fixaa HijackThis-ohjelmalla vielä mitään. Suurin osa sen löydöistä ovat joko harmittomia tai jopa tarpeellisia.
- Tiinis
  2008-06-08 01:09:01
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 00:04:15, on 08.06.2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
  C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
  C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Skype\Phone\Skype.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Metacafe\MetacafeAgent.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\Bonjour\mDNSResponder.exe
  C:\Windows\msservice.exe
  C:\WINDOWS\winudpmgr.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Skype\Plugin Manager\skypePM.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Windows Live\installer\WLSetupSvc.exe
  C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\Windows Live\Messenger\usnsvc.exe
  C:\Kaspersky\mwavscan.com
  C:\Kaspersky\kavss.exe
  C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
  C:\WINDOWS\system32\notepad.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nmh.no/
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
  R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
  O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
  O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
  O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
  O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
  O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [\\GRANUM\EPSON Stylus DX6000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE /FU "C:\DOCUME~1\TIINAN~1\LOCALS~1\Temp\E_S4.tmp" /EF "HKLM"
  O4 - HKLM\..\Run: [Windows UDP Control Center] winudpmgr.exe
  O4 - HKLM\..\Run: [MSN] C:\Windows\msservice.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
  O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxmk846YYNO
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by121fd.bay121.hotmail.msn.com/resources/MsnPUpld.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
  O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  
  --
  End of file - 9140 bytes
- Fix.Fix
  2008-06-08 01:21:56
  Tiinis kirjoitti:
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 00:04:15, on 08.06.2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
  C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
  C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Skype\Phone\Skype.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Metacafe\MetacafeAgent.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\Bonjour\mDNSResponder.exe
  C:\Windows\msservice.exe
  C:\WINDOWS\winudpmgr.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Skype\Plugin Manager\skypePM.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Windows Live\installer\WLSetupSvc.exe
  C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\Windows Live\Messenger\usnsvc.exe
  C:\Kaspersky\mwavscan.com
  C:\Kaspersky\kavss.exe
  C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
  C:\WINDOWS\system32\notepad.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nmh.no/
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
  R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
  O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
  O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
  O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
  O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
  O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [\\GRANUM\EPSON Stylus DX6000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE /FU "C:\DOCUME~1\TIINAN~1\LOCALS~1\Temp\E_S4.tmp" /EF "HKLM"
  O4 - HKLM\..\Run: [Windows UDP Control Center] winudpmgr.exe
  O4 - HKLM\..\Run: [MSN] C:\Windows\msservice.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
  O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxmk846YYNO
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by121fd.bay121.hotmail.msn.com/resources/MsnPUpld.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
  O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  
  --
  End of file - 9140 bytes
  alkaa
  
  Poista lisää poista sovelutuksesta
  
  SweetIM For Internet Explorer
  MyWebSearch Search
  SWEETIE > Macrogaming > MyWebSearch
- tiinis
  2008-06-08 12:36:38
  Fix.Fix kirjoitti:
  alkaa
  
  Poista lisää poista sovelutuksesta
  
  SweetIM For Internet Explorer
  MyWebSearch Search
  SWEETIE > Macrogaming > MyWebSearch
  ComboFix 08-06-07.3 - Tiina Nurmikolu 2008-06-08 11:25:10.1 - NTFSx86
  Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.267 [GMT 2:00]
  Running from: C:\Documents and Settings\Tiina Nurmikolu\Desktop\ComboFix.exe
  * Created a new restore point
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  .
  
  ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  C:\Program Files\FunWebProducts
  C:\Program Files\FunWebProducts\ScreenSaver\Images\[u]0[/u]227551D.urr
  
  .
  ((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
  .
  
  2008-06-08 11:04 . 2006-11-19 20:49 360,448 --a------ C:\Program Files\Uninstall My Web Search.dll
  2008-06-08 00:04 . 2008-06-08 00:04 d-------- C:\Program Files\Trend Micro
  2008-06-07 15:34 . 2008-06-07 15:34 0 --a------ C:\23990098.$$$
  2008-06-07 13:01 . 2008-06-07 13:22 d-------- C:\Downloads
  2008-06-07 13:01 . 2008-06-07 13:17 d-------- C:\Bases
  2008-06-07 12:57 . 2008-06-07 13:22 d-------- C:\Kaspersky
  2008-06-07 12:38 . 2008-06-07 12:38 d-------- C:\Program Files\Windows Live Favorites
  2008-06-07 10:23 . 2008-06-07 10:23 d-------- C:\Documents and Settings\Tiina Nurmikolu\Application Data\MSNInstaller
  2008-06-05 09:22 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
  2008-06-05 09:19 . 2008-06-05 09:19 d-------- C:\Program Files\Microsoft SQL Server Compact Edition
  2008-06-02 09:50 . 2008-06-02 09:50 244 --ah----- C:\sqmnoopt03.sqm
  2008-06-02 09:50 . 2008-06-02 09:50 232 --ah----- C:\sqmdata03.sqm
  2008-06-01 15:15 . 2008-06-01 15:15 d-------- C:\Program Files\Bonjour
  2008-05-31 10:41 . 2008-05-31 10:43 83,400 --------- C:\WINDOWS\winudpmgr.exe
  
  .
  (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-06-08 09:07 --------- d-----w C:\Documents and Settings\Tiina Nurmikolu\Application Data\Skype
  2008-06-08 08:53 --------- d-----w C:\Documents and Settings\Tiina Nurmikolu\Application Data\Metacafe
  2008-06-08 08:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Metacafe
  2008-06-07 10:39 --------- d-----w C:\Program Files\Windows Live Toolbar
  2008-06-07 10:36 --------- d-----w C:\Program Files\Windows Live
  2008-06-07 10:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
  2008-06-01 13:14 --------- d-----w C:\Program Files\QuickTime
  2008-05-31 14:29 --------- d-----w C:\Documents and Settings\Tiina Nurmikolu\Application Data\AdobeUM
  2008-05-31 08:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition classic
  2008-05-18 21:35 --------- d-----w C:\Documents and Settings\Tiina Nurmikolu\Application Data\U3
  2008-04-10 08:27 --------- d-----w C:\Program Files\Java
  2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
  2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
  2005-09-17 12:21 21 ----a-w C:\Program Files\AVPersonalAVWIN.INI
  .
  
  ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* empty entries & legit default entries are not shown
  REGEDIT4
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
  "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
  "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [ ]
  "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-07-02 17:10 23237416]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 17:28 49152]
  "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52 339968]
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
  "SoundMan"="SOUNDMAN.EXE" [2004-12-01 09:54 77824 C:\WINDOWS\SOUNDMAN.EXE]
  "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-16 21:51 262401]
  "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [ ]
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
  "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18 270648]
  "\\GRANUM\EPSON Stylus DX6000 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.exe" [2006-02-13 07:00 131072]
  "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
  
  C:\Documents and Settings\Tiina Nurmikolu\Start Menu\Programs\Startup\
  Metacafe.lnk - C:\Program Files\Metacafe\MetacafeAgent.exe [2007-09-04 17:04:34 149256]
  
  C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
  Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-08-20 01:42:15 113664]
  HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 05:19:24 237568]
  Metacafe.lnk - C:\Program Files\Metacafe\MetacafeAgent.exe [2007-09-04 17:04:34 149256]
  Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
  --a------ 2006-08-01 17:04 3305472 C:\Program Files\BearShare\BearShare.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnLockMe]
  c:\bin\unlockme 129.240.114.1
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"=
  "C:\\Program Files\\Messenger\\msmsgs.exe"=
  "C:\\Program Files\\eMule\\emule.exe"=
  "C:\\Program Files\\BearShare\\BearShare.exe"=
  "C:\\Program Files\\iTunes\\iTunes.exe"=
  "C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
  "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
  "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
  "C:\\Kaspersky\\kavupd.exe"=
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
  \Shell\AutoRun\command - F:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d2f80007-d0de-11dc-ac0b-00c026efb07a}]
  \Shell\AutoRun\command - F:\LaunchU3.exe -a
  
  *Newly Created Service* - CATCHME
  .
  Contents of the 'Scheduled Tasks' folder
  "2008-04-09 15:08:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
  - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
  "2008-06-08 08:46:01 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
  - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-06-08 11:29:01
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  .
  --------------------- DLLs Loaded Under Running Processes ---------------------
  
  PROCESS: C:\WINDOWS\system32\winlogon.exe
  -> C:\WINDOWS\system32\Ati2evxx.dll
  .
  Completion time: 2008-06-08 11:31:51
  ComboFix-quarantined-files.txt 2008-06-08 09:30:50
  
  Pre-Run: 65,193,902,080 bytes free
  Post-Run: 66,366,046,208 bytes free
  
  122 --- E O F --- 2008-06-06 22:42:52
- FixFix
  2008-06-08 13:20:20
  tiinis kirjoitti:
  ComboFix 08-06-07.3 - Tiina Nurmikolu 2008-06-08 11:25:10.1 - NTFSx86
  Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.267 [GMT 2:00]
  Running from: C:\Documents and Settings\Tiina Nurmikolu\Desktop\ComboFix.exe
  * Created a new restore point
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  .
  
  ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  C:\Program Files\FunWebProducts
  C:\Program Files\FunWebProducts\ScreenSaver\Images\[u]0[/u]227551D.urr
  
  .
  ((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
  .
  
  2008-06-08 11:04 . 2006-11-19 20:49 360,448 --a------ C:\Program Files\Uninstall My Web Search.dll
  2008-06-08 00:04 . 2008-06-08 00:04 d-------- C:\Program Files\Trend Micro
  2008-06-07 15:34 . 2008-06-07 15:34 0 --a------ C:\23990098.$$$
  2008-06-07 13:01 . 2008-06-07 13:22 d-------- C:\Downloads
  2008-06-07 13:01 . 2008-06-07 13:17 d-------- C:\Bases
  2008-06-07 12:57 . 2008-06-07 13:22 d-------- C:\Kaspersky
  2008-06-07 12:38 . 2008-06-07 12:38 d-------- C:\Program Files\Windows Live Favorites
  2008-06-07 10:23 . 2008-06-07 10:23 d-------- C:\Documents and Settings\Tiina Nurmikolu\Application Data\MSNInstaller
  2008-06-05 09:22 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
  2008-06-05 09:19 . 2008-06-05 09:19 d-------- C:\Program Files\Microsoft SQL Server Compact Edition
  2008-06-02 09:50 . 2008-06-02 09:50 244 --ah----- C:\sqmnoopt03.sqm
  2008-06-02 09:50 . 2008-06-02 09:50 232 --ah----- C:\sqmdata03.sqm
  2008-06-01 15:15 . 2008-06-01 15:15 d-------- C:\Program Files\Bonjour
  2008-05-31 10:41 . 2008-05-31 10:43 83,400 --------- C:\WINDOWS\winudpmgr.exe
  
  .
  (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-06-08 09:07 --------- d-----w C:\Documents and Settings\Tiina Nurmikolu\Application Data\Skype
  2008-06-08 08:53 --------- d-----w C:\Documents and Settings\Tiina Nurmikolu\Application Data\Metacafe
  2008-06-08 08:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Metacafe
  2008-06-07 10:39 --------- d-----w C:\Program Files\Windows Live Toolbar
  2008-06-07 10:36 --------- d-----w C:\Program Files\Windows Live
  2008-06-07 10:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
  2008-06-01 13:14 --------- d-----w C:\Program Files\QuickTime
  2008-05-31 14:29 --------- d-----w C:\Documents and Settings\Tiina Nurmikolu\Application Data\AdobeUM
  2008-05-31 08:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition classic
  2008-05-18 21:35 --------- d-----w C:\Documents and Settings\Tiina Nurmikolu\Application Data\U3
  2008-04-10 08:27 --------- d-----w C:\Program Files\Java
  2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
  2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
  2005-09-17 12:21 21 ----a-w C:\Program Files\AVPersonalAVWIN.INI
  .
  
  ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* empty entries & legit default entries are not shown
  REGEDIT4
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
  "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
  "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [ ]
  "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-07-02 17:10 23237416]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 17:28 49152]
  "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52 339968]
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
  "SoundMan"="SOUNDMAN.EXE" [2004-12-01 09:54 77824 C:\WINDOWS\SOUNDMAN.EXE]
  "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-16 21:51 262401]
  "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [ ]
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
  "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18 270648]
  "\\GRANUM\EPSON Stylus DX6000 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.exe" [2006-02-13 07:00 131072]
  "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
  
  C:\Documents and Settings\Tiina Nurmikolu\Start Menu\Programs\Startup\
  Metacafe.lnk - C:\Program Files\Metacafe\MetacafeAgent.exe [2007-09-04 17:04:34 149256]
  
  C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
  Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-08-20 01:42:15 113664]
  HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 05:19:24 237568]
  Metacafe.lnk - C:\Program Files\Metacafe\MetacafeAgent.exe [2007-09-04 17:04:34 149256]
  Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
  --a------ 2006-08-01 17:04 3305472 C:\Program Files\BearShare\BearShare.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnLockMe]
  c:\bin\unlockme 129.240.114.1
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"=
  "C:\\Program Files\\Messenger\\msmsgs.exe"=
  "C:\\Program Files\\eMule\\emule.exe"=
  "C:\\Program Files\\BearShare\\BearShare.exe"=
  "C:\\Program Files\\iTunes\\iTunes.exe"=
  "C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
  "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
  "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
  "C:\\Kaspersky\\kavupd.exe"=
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
  \Shell\AutoRun\command - F:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d2f80007-d0de-11dc-ac0b-00c026efb07a}]
  \Shell\AutoRun\command - F:\LaunchU3.exe -a
  
  *Newly Created Service* - CATCHME
  .
  Contents of the 'Scheduled Tasks' folder
  "2008-04-09 15:08:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
  - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
  "2008-06-08 08:46:01 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
  - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-06-08 11:29:01
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  .
  --------------------- DLLs Loaded Under Running Processes ---------------------
  
  PROCESS: C:\WINDOWS\system32\winlogon.exe
  -> C:\WINDOWS\system32\Ati2evxx.dll
  .
  Completion time: 2008-06-08 11:31:51
  ComboFix-quarantined-files.txt 2008-06-08 09:30:50
  
  Pre-Run: 65,193,902,080 bytes free
  Post-Run: 66,366,046,208 bytes free
  
  122 --- E O F --- 2008-06-06 22:42:52
  Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
  
  [quote]
  
  File::
  C:\23990098.$$$
  C:\sqmnoopt03.sqm
  C:\sqmdata03.sqm
  C:\WINDOWS\winudpmgr.exe
  C:\WINDOWS\msservice.exe
  
  Folder::
  C:\Program Files\Uninstall My Web Search.dll
  C:\Program Files\Macrogaming
  
  [/quote]
  
  Tallenna se nimellä CFScript.txt
  
  Sitten raahaa CFScript ComboFix.exeen kuten alla.
  [img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
  
  Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
  
  **********
  
  scannaa hjt:llä mekkaa paina Fix checked
  
  R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
  R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
  O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
  O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
  O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
  O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
  O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
  O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
  O4 - HKLM\..\Run: [Windows UDP Control Center] winudpmgr.exe
  O4 - HKLM\..\Run: [MSN] C:\Windows\msservice.exe
  O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
  O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jh tml?p=ZNxmk846YYNO
  O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts /ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
  
  ************
  
  Lataa SDFix by AndyManchesta
  http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
  ja tallenna se työpöydällesi.
  
  Käynnistä koneesi vikasietotilaan:
  sammuta ja käynnistä
  käynnistyksen yhteydessä hakkaa F8 nappia
  valitse nuolinäppäimellä vikasietotila
  paina enter ja enter
  valitse käyttäjätilisi
  paina kyllä
  
  Jossakin koneissa hakataan F8:sin sijasta F5:tä
  •   Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
  •   Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
  •   Paina Y käynnistääksesi skriptin.
  •   Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
  •   Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
  •   Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
  •   Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
  •   Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
  •   Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.
  
  ********
- Tiinis
  2008-06-08 15:23:38
  FixFix kirjoitti:
  Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
  
  [quote]
  
  File::
  C:\23990098.$$$
  C:\sqmnoopt03.sqm
  C:\sqmdata03.sqm
  C:\WINDOWS\winudpmgr.exe
  C:\WINDOWS\msservice.exe
  
  Folder::
  C:\Program Files\Uninstall My Web Search.dll
  C:\Program Files\Macrogaming
  
  [/quote]
  
  Tallenna se nimellä CFScript.txt
  
  Sitten raahaa CFScript ComboFix.exeen kuten alla.
  [img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
  
  Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
  
  **********
  
  scannaa hjt:llä mekkaa paina Fix checked
  
  R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
  R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
  O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
  O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
  O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
  O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
  O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
  O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
  O4 - HKLM\..\Run: [Windows UDP Control Center] winudpmgr.exe
  O4 - HKLM\..\Run: [MSN] C:\Windows\msservice.exe
  O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
  O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jh tml?p=ZNxmk846YYNO
  O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts /ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
  
  ************
  
  Lataa SDFix by AndyManchesta
  http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
  ja tallenna se työpöydällesi.
  
  Käynnistä koneesi vikasietotilaan:
  sammuta ja käynnistä
  käynnistyksen yhteydessä hakkaa F8 nappia
  valitse nuolinäppäimellä vikasietotila
  paina enter ja enter
  valitse käyttäjätilisi
  paina kyllä
  
  Jossakin koneissa hakataan F8:sin sijasta F5:tä
  •   Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
  •   Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
  •   Paina Y käynnistääksesi skriptin.
  •   Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
  •   Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
  •   Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
  •   Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
  •   Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
  •   Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.
  
  ********
  En ollu ihan varma oliko tossa 3 eri vaihtoehtoa mistä valita vai 3 eri toimintoa mitä mun olis tarvinnu tehdä mut oon tehny vaan sen ensimmäisen:
  
  ComboFix 08-06-07.3 - Tiina Nurmikolu 2008-06-08 14:14:20.3 - NTFSx86
  Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.224 [GMT 2:00]
  Running from: C:\Documents and Settings\Tiina Nurmikolu\Desktop\ComboFix.exe
  Command switches used :: C:\Documents and Settings\Tiina Nurmikolu\Desktop\CFScript.txt
  * Created a new restore point
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  
  FILE ::
  C:\23990098.$$$
  C:\sqmdata03.sqm
  C:\sqmnoopt03.sqm
  C:\WINDOWS\msservice.exe
  C:\WINDOWS\winudpmgr.exe
  .
  
  ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  C:\23990098.$$$
  C:\Program Files\Uninstall My Web Search.dll\
  C:\sqmdata03.sqm
  C:\sqmnoopt03.sqm
  C:\WINDOWS\winudpmgr.exe
  
  .
  ((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
  .
  
  2008-06-08 11:04 . 2006-11-19 20:49   360,448   --a------   C:\Program Files\Uninstall My Web Search.dll
  2008-06-08 00:04 . 2008-06-08 00:04      d--------   C:\Program Files\Trend Micro
  2008-06-07 13:01 . 2008-06-07 13:22      d--------   C:\Downloads
  2008-06-07 13:01 . 2008-06-07 13:17      d--------   C:\Bases
  2008-06-07 12:57 . 2008-06-07 13:22      d--------   C:\Kaspersky
  2008-06-07 12:38 . 2008-06-07 12:38      d--------   C:\Program Files\Windows Live Favorites
  2008-06-07 10:23 . 2008-06-07 10:23      d--------   C:\Documents and Settings\Tiina Nurmikolu\Application Data\MSNInstaller
  2008-06-05 09:22 . 2006-11-29 13:06   3,426,072   --a------   C:\WINDOWS\system32\d3dx9_32.dll
  2008-06-05 09:19 . 2008-06-05 09:19      d--------   C:\Program Files\Microsoft SQL Server Compact Edition
  2008-06-01 15:15 . 2008-06-01 15:15      d--------   C:\Program Files\Bonjour
  
  .
  (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-06-08 09:07   ---------   d-----w   C:\Documents and Settings\Tiina Nurmikolu\Application Data\Skype
  2008-06-08 08:53   ---------   d-----w   C:\Documents and Settings\Tiina Nurmikolu\Application Data\Metacafe
  2008-06-08 08:53   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Metacafe
  2008-06-07 10:39   ---------   d-----w   C:\Program Files\Windows Live Toolbar
  2008-06-07 10:36   ---------   d-----w   C:\Program Files\Windows Live
  2008-06-07 10:19   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\WLInstaller
  2008-06-01 13:14   ---------   d-----w   C:\Program Files\QuickTime
  2008-05-31 14:29   ---------   d-----w   C:\Documents and Settings\Tiina Nurmikolu\Application Data\AdobeUM
  2008-05-31 08:24   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition classic
  2008-05-18 21:35   ---------   d-----w   C:\Documents and Settings\Tiina Nurmikolu\Application Data\U3
  2008-04-10 08:27   ---------   d-----w   C:\Program Files\Java
  2008-03-27 08:12   151,583   ----a-w   C:\WINDOWS\system32\msjint40.dll
  2008-03-19 09:47   1,845,248   ----a-w   C:\WINDOWS\system32\win32k.sys
  2005-09-17 12:21   21   ----a-w   C:\Program Files\AVPersonalAVWIN.INI
  .
  
  ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* empty entries & legit default entries are not shown
  REGEDIT4
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
  "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
  "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [ ]
  "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-07-02 17:10 23237416]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 17:28 49152]
  "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52 339968]
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
  "SoundMan"="SOUNDMAN.EXE" [2004-12-01 09:54 77824 C:\WINDOWS\SOUNDMAN.EXE]
  "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-16 21:51 262401]
  "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [ ]
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
  "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18 270648]
  "\\GRANUM\EPSON Stylus DX6000 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.exe" [2006-02-13 07:00 131072]
  "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
  
  C:\Documents and Settings\Tiina Nurmikolu\Start Menu\Programs\Startup\
  Metacafe.lnk - C:\Program Files\Metacafe\MetacafeAgent.exe [2007-09-04 17:04:34 149256]
  
  C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
  Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-08-20 01:42:15 113664]
  HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 05:19:24 237568]
  Metacafe.lnk - C:\Program Files\Metacafe\MetacafeAgent.exe [2007-09-04 17:04:34 149256]
  Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
  --a------ 2006-08-01 17:04 3305472 C:\Program Files\BearShare\BearShare.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnLockMe]
  c:\bin\unlockme 129.240.114.1
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"=
  "C:\\Program Files\\Messenger\\msmsgs.exe"=
  "C:\\Program Files\\eMule\\emule.exe"=
  "C:\\Program Files\\BearShare\\BearShare.exe"=
  "C:\\Program Files\\iTunes\\iTunes.exe"=
  "C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
  "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
  "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
  "C:\\Kaspersky\\kavupd.exe"=
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
  \Shell\AutoRun\command - F:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d2f80007-d0de-11dc-ac0b-00c026efb07a}]
  \Shell\AutoRun\command - F:\LaunchU3.exe -a
  
  *Newly Created Service* - CATCHME
  .
  Contents of the 'Scheduled Tasks' folder
  "2008-04-09 15:08:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
  - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
  "2008-06-08 11:46:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
  - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-06-08 14:15:27
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  **************************************************************************
  .
  --------------------- DLLs Loaded Under Running Processes ---------------------
  
  PROCESS: C:\WINDOWS\system32\winlogon.exe
  -> C:\WINDOWS\system32\Ati2evxx.dll
  .
  Completion time: 2008-06-08 14:17:53
  ComboFix-quarantined-files.txt 2008-06-08 12:16:49
  ComboFix2.txt 2008-06-08 12:09:39
  ComboFix3.txt 2008-06-08 09:31:51
  
  Pre-Run: 66,424,598,528 bytes free
  Post-Run: 66,416,050,176 bytes free
  
  128   --- E O F ---   2008-06-06 22:42:52
- FixFix
  2008-06-08 16:19:42
  Tiinis kirjoitti:
  En ollu ihan varma oliko tossa 3 eri vaihtoehtoa mistä valita vai 3 eri toimintoa mitä mun olis tarvinnu tehdä mut oon tehny vaan sen ensimmäisen:
  
  ComboFix 08-06-07.3 - Tiina Nurmikolu 2008-06-08 14:14:20.3 - NTFSx86
  Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.224 [GMT 2:00]
  Running from: C:\Documents and Settings\Tiina Nurmikolu\Desktop\ComboFix.exe
  Command switches used :: C:\Documents and Settings\Tiina Nurmikolu\Desktop\CFScript.txt
  * Created a new restore point
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  
  FILE ::
  C:\23990098.$$$
  C:\sqmdata03.sqm
  C:\sqmnoopt03.sqm
  C:\WINDOWS\msservice.exe
  C:\WINDOWS\winudpmgr.exe
  .
  
  ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  C:\23990098.$$$
  C:\Program Files\Uninstall My Web Search.dll\
  C:\sqmdata03.sqm
  C:\sqmnoopt03.sqm
  C:\WINDOWS\winudpmgr.exe
  
  .
  ((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
  .
  
  2008-06-08 11:04 . 2006-11-19 20:49   360,448   --a------   C:\Program Files\Uninstall My Web Search.dll
  2008-06-08 00:04 . 2008-06-08 00:04      d--------   C:\Program Files\Trend Micro
  2008-06-07 13:01 . 2008-06-07 13:22      d--------   C:\Downloads
  2008-06-07 13:01 . 2008-06-07 13:17      d--------   C:\Bases
  2008-06-07 12:57 . 2008-06-07 13:22      d--------   C:\Kaspersky
  2008-06-07 12:38 . 2008-06-07 12:38      d--------   C:\Program Files\Windows Live Favorites
  2008-06-07 10:23 . 2008-06-07 10:23      d--------   C:\Documents and Settings\Tiina Nurmikolu\Application Data\MSNInstaller
  2008-06-05 09:22 . 2006-11-29 13:06   3,426,072   --a------   C:\WINDOWS\system32\d3dx9_32.dll
  2008-06-05 09:19 . 2008-06-05 09:19      d--------   C:\Program Files\Microsoft SQL Server Compact Edition
  2008-06-01 15:15 . 2008-06-01 15:15      d--------   C:\Program Files\Bonjour
  
  .
  (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-06-08 09:07   ---------   d-----w   C:\Documents and Settings\Tiina Nurmikolu\Application Data\Skype
  2008-06-08 08:53   ---------   d-----w   C:\Documents and Settings\Tiina Nurmikolu\Application Data\Metacafe
  2008-06-08 08:53   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Metacafe
  2008-06-07 10:39   ---------   d-----w   C:\Program Files\Windows Live Toolbar
  2008-06-07 10:36   ---------   d-----w   C:\Program Files\Windows Live
  2008-06-07 10:19   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\WLInstaller
  2008-06-01 13:14   ---------   d-----w   C:\Program Files\QuickTime
  2008-05-31 14:29   ---------   d-----w   C:\Documents and Settings\Tiina Nurmikolu\Application Data\AdobeUM
  2008-05-31 08:24   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition classic
  2008-05-18 21:35   ---------   d-----w   C:\Documents and Settings\Tiina Nurmikolu\Application Data\U3
  2008-04-10 08:27   ---------   d-----w   C:\Program Files\Java
  2008-03-27 08:12   151,583   ----a-w   C:\WINDOWS\system32\msjint40.dll
  2008-03-19 09:47   1,845,248   ----a-w   C:\WINDOWS\system32\win32k.sys
  2005-09-17 12:21   21   ----a-w   C:\Program Files\AVPersonalAVWIN.INI
  .
  
  ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* empty entries & legit default entries are not shown
  REGEDIT4
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
  "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
  "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [ ]
  "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-07-02 17:10 23237416]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 17:28 49152]
  "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52 339968]
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
  "SoundMan"="SOUNDMAN.EXE" [2004-12-01 09:54 77824 C:\WINDOWS\SOUNDMAN.EXE]
  "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-16 21:51 262401]
  "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [ ]
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
  "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18 270648]
  "\\GRANUM\EPSON Stylus DX6000 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.exe" [2006-02-13 07:00 131072]
  "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
  
  C:\Documents and Settings\Tiina Nurmikolu\Start Menu\Programs\Startup\
  Metacafe.lnk - C:\Program Files\Metacafe\MetacafeAgent.exe [2007-09-04 17:04:34 149256]
  
  C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
  Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-08-20 01:42:15 113664]
  HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 05:19:24 237568]
  Metacafe.lnk - C:\Program Files\Metacafe\MetacafeAgent.exe [2007-09-04 17:04:34 149256]
  Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
  --a------ 2006-08-01 17:04 3305472 C:\Program Files\BearShare\BearShare.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnLockMe]
  c:\bin\unlockme 129.240.114.1
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"=
  "C:\\Program Files\\Messenger\\msmsgs.exe"=
  "C:\\Program Files\\eMule\\emule.exe"=
  "C:\\Program Files\\BearShare\\BearShare.exe"=
  "C:\\Program Files\\iTunes\\iTunes.exe"=
  "C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
  "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
  "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
  "C:\\Kaspersky\\kavupd.exe"=
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
  \Shell\AutoRun\command - F:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d2f80007-d0de-11dc-ac0b-00c026efb07a}]
  \Shell\AutoRun\command - F:\LaunchU3.exe -a
  
  *Newly Created Service* - CATCHME
  .
  Contents of the 'Scheduled Tasks' folder
  "2008-04-09 15:08:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
  - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
  "2008-06-08 11:46:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
  - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-06-08 14:15:27
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  **************************************************************************
  .
  --------------------- DLLs Loaded Under Running Processes ---------------------
  
  PROCESS: C:\WINDOWS\system32\winlogon.exe
  -> C:\WINDOWS\system32\Ati2evxx.dll
  .
  Completion time: 2008-06-08 14:17:53
  ComboFix-quarantined-files.txt 2008-06-08 12:16:49
  ComboFix2.txt 2008-06-08 12:09:39
  ComboFix3.txt 2008-06-08 09:31:51
  
  Pre-Run: 66,424,598,528 bytes free
  Post-Run: 66,416,050,176 bytes free
  
  128   --- E O F ---   2008-06-06 22:42:52
  rum
  
  scannaa uusi hjt:n loki
- tiinis
  2008-06-08 17:54:29
  FixFix kirjoitti:
  rum
  
  scannaa uusi hjt:n loki
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 15:58:47, on 08.06.2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\system32\NOTEPAD.EXE
  C:\WINDOWS\system32\notepad.exe
  C:\WINDOWS\system32\notepad.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nmh.no/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
  O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [\\GRANUM\EPSON Stylus DX6000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE /FU "C:\DOCUME~1\TIINAN~1\LOCALS~1\Temp\E_S4.tmp" /EF "HKLM"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
  O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by121fd.bay121.hotmail.msn.com/resources/MsnPUpld.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
  O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  
  --
  End of file - 7491 bytes
- FixFix
  2008-06-08 18:13:43
  tiinis kirjoitti:
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 15:58:47, on 08.06.2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\system32\NOTEPAD.EXE
  C:\WINDOWS\system32\notepad.exe
  C:\WINDOWS\system32\notepad.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nmh.no/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
  O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [\\GRANUM\EPSON Stylus DX6000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE /FU "C:\DOCUME~1\TIINAN~1\LOCALS~1\Temp\E_S4.tmp" /EF "HKLM"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
  O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by121fd.bay121.hotmail.msn.com/resources/MsnPUpld.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
  O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  
  --
  End of file - 7491 bytes
  kiilotusta
  
  scannaa hjt:llä merkkaa paina Fix checked
  
  O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab

Ketjusta on poistettu 0 sääntöjenvastaista viestiä.

Takaisin ylös

Luetuimmat keskustelut

Tänään pyörit ajatuksissa enemmän, kun erehdyin lukemaan palstaa
En saisi, silti toivon että sinä vielä palaat ja otetaan oikeasti selvää, hioituuko särmät ja sulaudummeko yhteen. Vuod
14.05.2025 12:09Ikävä
22
5074
Huomenta ihana
Kauniskasvoinen ihanuus 😘 saan sut vielä
15.05.2025 08:14Ikävä
25
4238
Hei rakas...
Miten on työpäivä sujunut? Rakastan sinua 💗
15.05.2025 13:38Ikävä
27
2421
Edelleen sitä on vaikea uskoa
Että olisit oikeasti rakastunut muhun
15.05.2025 09:49Ikävä
34
2214
Toiveikas vai toivoton
torstai? Ajatuksia?
15.05.2025 08:36Ikävä
37
1988
Vitsi mihin menit. Heti takasin.
Mä näin sut tuu takasin! Oli kiire, niin en ehtiny sin perään!
15.05.2025 14:44Ikävä
15
1888
En ole koskaan kokenut
Ennen mitään tällaista rakastumista. Tiedän että kaipaan sinua varmaan loppu elämän. Toivottavasti ei tarvitsisi vain ka
15.05.2025 19:21Ikävä
19
1577
Mukavaa päivää
Mun rakkauden kohteelle ❤️ toivottavasti olet onnellinen
15.05.2025 09:41Ikävä
12
1501
Voi ei! Jari Sillanpää heitti keikan Helsingissä - Hämmästyttävä hetki lavalla...
Ex-tangokuningas on parhaillaan konserttikiertueella. Hän esiintyi Savoy teatterissa äitienpäivänä. Sillanpää jakoi kons
15.05.2025 10:12Suomalaiset julkkikset
20
1219
Kerranki asiat oikein
Ilkka ja muut pienpuolueeet...teitte hyvän työn kun valitsitte pätevän henkilön virkaan eikä kepulle passelia!! Jatkakaa
15.05.2025 09:28Haapavesi
10
1154

täälläkin virus...

Vastaukset

Tiinis kirjoitti:

Fix.Fix kirjoitti:

tiinis kirjoitti:

FixFix kirjoitti:

Tiinis kirjoitti:

FixFix kirjoitti:

tiinis kirjoitti:

Luetuimmat keskustelut

Tänään pyörit ajatuksissa enemmän, kun erehdyin lukemaan palstaa

Huomenta ihana

Hei rakas...

Edelleen sitä on vaikea uskoa

Toiveikas vai toivoton

Vitsi mihin menit. Heti takasin.

En ole koskaan kokenut

Mukavaa päivää

Voi ei! Jari Sillanpää heitti keikan Helsingissä - Hämmästyttävä hetki lavalla...

Kerranki asiat oikein

Voi ei! Jari Sillanpää heitti keikan Helsingissä - Hämmästyttävä hetki lavalla...

Euroviisut hallussa? Tule testaamaan tietosi Euroviisut-visassa!

Raideleveys muuttuu

Euroviisut 2025 alkoivat...

Suuri seikkailu -tippuja Jari Isometsää arvelutti tämä ennen kuvauksia: "Vähän mietitytti, kun..."

Kulujen jako parisuhteessa

Oho! Antti Railio yllättää - Tässäkö uusi tangokuningas? Tykkäisitkö?

Kauanko skuutteja on siedettävä? Ei tietoa liikennesäännöistä, ajellaan miten sattuu ja missä vain.

Janne Ahonen rehellisenä Suuri seikkailu -ruoista - Yllättävä seikka: "Ei, ei menty niin..."

Euroviisut ohjelmaa tällä vkolla tv:ssä 13.-17.5. - Katso tärkeät ajat tästä ja pysy kartalla!