Ajoittain suuria piikkejä suorittimen ja fyys.muistin käytössä // HjT-logi ok?

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Noroi, Feb 9, 2009.

  1. Noroi

    Noroi Member

    Joined:
    Feb 27, 2008
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    Koneen tiedot:
    * LG S900 läppäri.
    * NVidia GeForce 8600M GT
    * Intel Core 2 Duo CPU T7250 @ 2.00GHz 2.00GHz
    * 2.00 Gt RAM
    ==================================================
    HjT -logi
    ==================================================
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:50:59, on 9.2.2009
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\SYSTEM32\WISPTIS.EXE
    C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\WTablet\Pen_TabletUser.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\LG Software\LG Magnifier\MagnifyingGlass.exe
    C:\Program Files\LG Software\LG Magnifier\Maglev.exe
    C:\Program Files\LG Software\On Screen Display\HotKey.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\lg_swupdate\GiljabiStart.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\lg_swupdate\pnp.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.lge.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Ask Search Assistant BHO - {0A94B111-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [LG Magnifier] %ProgramFiles%\LG Software\LG Magnifier\MagnifyingGlass.exe
    O4 - HKLM\..\Run: [KeybdUtility] C:\Program Files\LG Software\On Screen Display\HotKey.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [LG Intelligent Update] "C:\Program Files\lg_swupdate\giljabistart.exe" Gilautouc
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [ZugPowerConfig] %ProgramFiles%\LG Software\ZugPowerConfig\ZugPowerConfigCurrentValue.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\RunOnce: [*WerKernelReporting] %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
    O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - HKUS\S-1-5-21-1843840881-518019814-377898367-1001\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Noroi')
    O4 - HKUS\S-1-5-21-1843840881-518019814-377898367-1001\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" (User 'Noroi')
    O4 - HKUS\S-1-5-21-1843840881-518019814-377898367-1001\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray (User 'Noroi')
    O4 - HKUS\S-1-5-21-1843840881-518019814-377898367-1001\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'Noroi')
    O4 - HKUS\S-1-5-21-1843840881-518019814-377898367-1001\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" (User 'Noroi')
    O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15105/CTPID.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\system32\CTsvcCDA.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe

    --
    End of file - 9906 bytes
     
    Last edited: Feb 9, 2009
    Noroi, Feb 9, 2009
    #1
  2. Hujo

    Hujo Guest

    Poista lisää poista sovelutuksesta

    AskPBar     mikä sanookin noin

    Poista kansio

    C:\Program Files\AskPBar

    ========

    Scannaa hjt:llä merkkaa paina Fix checked

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog

    ==========

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi
     
    Hujo, Feb 9, 2009
    #2
  3. Noroi

    Noroi Member

    Joined:
    Feb 27, 2008
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    ===
    Malwarebytes' Anti-Malware -logi
    ===
    Malwarebytes' Anti-Malware 1.33
    Database version: 1740
    Windows 6.0.6001 Service Pack 1

    9.2.2009 18:34:13
    mbam-log-2009-02-09 (18-34-13).txt

    Scan type: Full Scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|)
    Objects scanned: 178889
    Time elapsed: 2 hour(s), 22 minute(s), 33 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 64

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\Users\Default\Application Data\Google\kjzna1562565.exe (Trojan.FakeAlert) -> Delete on reboot.
    C:\Users\Default\Application Data\Google\spcffwl.dll (Trojan.FakeAlert) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\Microsoft\Windows\pguard.ini (Rogue.InternetAntivirus) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\Microsoft\Windows\pg32.exe (Rogue.InternetAntivirus) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\anesuzenyp.bin (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\igyzih._sy (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\naciveg.reg (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\ubuqicuho.bin (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\zokawi.lib (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\comrepl.exe (Trojan.Agent) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\Microsoft\Internet Explorer\iv.exe (Trojan.Agent) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\Microsoft\Internet Explorer\procgdsj32.exe (Trojan.Agent) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\Microsoft\sessmgr.exe (Trojan.Agent) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\Microsoft\spoolsv.exe (Trojan.Agent) -> Delete on reboot.
    C:\Users\Default\Cookies\MM2048.DAT (Trojan.Agent) -> Delete on reboot.
    C:\Users\Default\Cookies\MM256.DAT (Trojan.Agent) -> Delete on reboot.
    C:\Users\Default\Local Settings\TempImages\IIEPRS.exe (Trojan.Agent) -> Delete on reboot.
    C:\Users\Default\Local Settings\TempImages\IIEPR.exe (Trojan.Agent) -> Delete on reboot.
    C:\Users\Default\Local Settings\alg.exe (Trojan.Agent) -> Delete on reboot.
    C:\Users\Default\My Documents\My Secret.fold (Backdoor.Bot) -> Delete on reboot.
    C:\Users\Default\My Documents\My Music\New Song.lagu (Backdoor.Bot) -> Delete on reboot.
    C:\Users\Default\My Documents\My Music\Video.vidz (Backdoor.Bot) -> Delete on reboot.
    C:\Users\Default\My Documents\My Pictures\aweks.pikz (Backdoor.Bot) -> Delete on reboot.
    C:\Users\Default\My Documents\My Pictures\seram.pikz (Backdoor.Bot) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\Microsoft\Windows\sav.exe (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Apps\2.0\srw94.exe (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Cookies\bumo.reg (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Cookies\jababug.inf (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\ycuc.lib (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\bokefa.bat (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\sytetuf.sys (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\vege.ban (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\xyzunore.dl (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\zyfotydyjo.exe (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Temporary Internet Files\etokosyb.scr (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\sec3.exe (Trojan.Agent) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\anok.bat (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\ewabutovah.dl (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\fibaw.ban (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\ybikohe.vbs (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Cookies\uwux.exe (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Cookies\jiceji._sy (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Cookies\esycire._dl (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\xacsceib.exe (Trojan.Agent) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\cftmon.exe (Trojan.Agent) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\Windowsupdate.exe (Trojan.Agent) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\spool.exe (Trojan.Agent) -> Delete on reboot.
    C:\Users\Default\My Documents\My Music\My Music.url (Trojan.Zlob) -> Delete on reboot.
    C:\Users\Default\My Documents\My Pictures\My Pictures.url (Trojan.Zlob) -> Delete on reboot.
    C:\Users\Default\My Documents\My Videos\My Video.url (Trojan.Zlob) -> Delete on reboot.
    C:\Users\Default\My Documents\My Documents.url (Trojan.Zlob) -> Delete on reboot.
    C:\Users\Default\my documents\work9\bhobj\bhobj.dll (Adware.WebDir) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\igutymyko.ban (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\ymuxag.com (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\Microsoft\Windows\services.exe (Trojan.FakeAlert) -> Delete on reboot.
    C:\Users\Default\Local Settings\Tempmbroit.exe (Trojan.FakeAlert) -> Delete on reboot.
    C:\Users\Default\Cookies\syssp.exe (Fake.Dropped.Malware) -> Delete on reboot.
    C:\Users\Default\Local Settings\Temp\_check32.bat (Malware.Trace) -> Delete on reboot.
    C:\Users\Default\Application Data\install.exe (Rogue.SpyProtector) -> Delete on reboot.
    C:\Users\Default\Application Data\shellex.dll (Rogue.SpyProtector) -> Delete on reboot.
    C:\Users\Default\Application Data\srcss.exe (Rogue.SpyProtector) -> Delete on reboot.
    C:\Users\Default\Local Settings\Application Data\Microsoft\Windows\procgdwh32.exe (Rogue.InternetAntivirus) -> Delete on reboot.
    C:\Users\Default\Application Data\drivers\srosa2.sys (Rootkit.Bagle) -> Delete on reboot.
    C:\Users\Default\Application Data\Microsoft\Windows\rayio.exe (Adware.WinButler) -> Delete on reboot.



    ===
    Boottauksen jälkeinen HjT -logi // Poistin sen AskPBar kansion, mutta jämä näytti jäävän.
    ===

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:43:03, on 9.2.2009
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\SYSTEM32\WISPTIS.EXE
    C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\LG Software\LG Magnifier\MagnifyingGlass.exe
    C:\Program Files\LG Software\On Screen Display\HotKey.exe
    C:\Program Files\LG Software\LG Magnifier\Maglev.exe
    C:\Windows\system32\WTablet\Pen_TabletUser.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\lg_swupdate\GiljabiStart.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\lg_swupdate\pnp.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.lge.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL (file missing)
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Ask Search Assistant BHO - {0A94B111-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL (file missing)
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [LG Magnifier] %ProgramFiles%\LG Software\LG Magnifier\MagnifyingGlass.exe
    O4 - HKLM\..\Run: [KeybdUtility] C:\Program Files\LG Software\On Screen Display\HotKey.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [LG Intelligent Update] "C:\Program Files\lg_swupdate\giljabistart.exe" Gilautouc
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [ZugPowerConfig] %ProgramFiles%\LG Software\ZugPowerConfig\ZugPowerConfigCurrentValue.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - HKUS\S-1-5-21-1843840881-518019814-377898367-1001\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Noroi')
    O4 - HKUS\S-1-5-21-1843840881-518019814-377898367-1001\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" (User 'Noroi')
    O4 - HKUS\S-1-5-21-1843840881-518019814-377898367-1001\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray (User 'Noroi')
    O4 - HKUS\S-1-5-21-1843840881-518019814-377898367-1001\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'Noroi')
    O4 - HKUS\S-1-5-21-1843840881-518019814-377898367-1001\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" (User 'Noroi')
    O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15105/CTPID.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\system32\CTsvcCDA.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe

    --
    End of file - 9682 bytes


    ===
    Tällä hetkellä kone käyttää suht tasaisesti 42 - 45% fyysisestä muistista ja suorittimen käyttöhistoria vetää vanhanlaista käyrää 2 - 18% välillä.
     
    Last edited: Feb 9, 2009
    Noroi, Feb 9, 2009
    #3
  4. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL (file missing)
    O2 - BHO: Ask Search Assistant BHO - {0A94B111-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL (file missing)
    O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

    ========

    sammuta käynnistä
     
    Hujo, Feb 9, 2009
    #4
  5. Noroi

    Noroi Member

    Joined:
    Feb 27, 2008
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    Suorittimen ja fyysisen muistin käyttö niin, että vain perusprosessit auki
    Suoritin: 2 - 7%
    Fyysinen muisti: alle 30% - laskee tasaisesti.
    Kovokaan ei raksuta yhtä paljon kuin ennen.

    Seuraavat eivät poistuneet logista - HjT ajettu järjestelmävalvojana:
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL (file missing)
    ===
    Uusi HjT -logi
    ===
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:17:34, on 10.2.2009
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\SYSTEM32\WISPTIS.EXE
    C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\LG Software\LG Magnifier\MagnifyingGlass.exe
    C:\Program Files\LG Software\On Screen Display\HotKey.exe
    C:\Program Files\LG Software\LG Magnifier\Maglev.exe
    C:\Windows\system32\WTablet\Pen_TabletUser.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\lg_swupdate\GiljabiStart.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\lg_swupdate\pnp.exe
    C:\Windows\system32\Taskmgr.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.lge.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL (file missing)
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [LG Magnifier] %ProgramFiles%\LG Software\LG Magnifier\MagnifyingGlass.exe
    O4 - HKLM\..\Run: [KeybdUtility] C:\Program Files\LG Software\On Screen Display\HotKey.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [LG Intelligent Update] "C:\Program Files\lg_swupdate\giljabistart.exe" Gilautouc
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [ZugPowerConfig] %ProgramFiles%\LG Software\ZugPowerConfig\ZugPowerConfigCurrentValue.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - HKUS\S-1-5-21-1843840881-518019814-377898367-1001\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Noroi')
    O4 - HKUS\S-1-5-21-1843840881-518019814-377898367-1001\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" (User 'Noroi')
    O4 - HKUS\S-1-5-21-1843840881-518019814-377898367-1001\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray (User 'Noroi')
    O4 - HKUS\S-1-5-21-1843840881-518019814-377898367-1001\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'Noroi')
    O4 - HKUS\S-1-5-21-1843840881-518019814-377898367-1001\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" (User 'Noroi')
    O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15105/CTPID.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\system32\CTsvcCDA.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe

    --
    End of file - 9269 bytes
     
    Last edited: Feb 10, 2009
    Noroi, Feb 10, 2009
    #5
  6. Hujo

    Hujo Guest

    1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
    Combofix1
    Combofix2

    älä asenna palautus consolia
    2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, Feb 10, 2009
    #6
  7. Noroi

    Noroi Member

    Joined:
    Feb 27, 2008
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    ===
    ComboFix -logi
    ===

    ComboFix 09-02-08.02 - Noora 10.02.2009 13:59:42.1 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1035.18.2045.1232 [GMT 2:00]
    Sijainti: c:\users\Noroi\Documents\exe-tiedostot\ComboFix.exe
    AV: avast! antivirus 4.8.1229 [VPS 081112-0] *On-access scanning enabled* (Updated)
    * Uusi palautuspiste luotu
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-10 to 2009-02-10 )))))))))))))))))
    .

    2009-02-09 16:09 . 09.02.2009 16:09 <KANSIO> d-------- c:\users\Noora\AppData\Roaming\Malwarebytes
    2009-02-09 16:09 . 09.02.2009 16:09 <KANSIO> d-------- c:\programdata\Malwarebytes
    2009-02-09 16:09 . 09.02.2009 16:09 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
    2009-02-09 16:09 . 14.01.2009 16:11 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
    2009-02-09 16:09 . 14.01.2009 16:11 15,504 --a------ c:\windows\System32\drivers\mbam.sys
    2009-02-09 15:46 . 09.02.2009 15:46 <KANSIO> d-------- c:\users\Noora\AppData\Roaming\WTablet
    2009-02-09 14:50 . 09.02.2009 14:50 <KANSIO> d-------- c:\program files\Trend Micro
    2009-02-04 17:41 . 04.02.2009 17:41 <KANSIO> d-------- c:\programdata\InstallShield
    2009-02-04 17:33 . 04.02.2009 17:33 <KANSIO> d-------- c:\program files\Gravity
    2009-02-04 17:33 . 09.08.2004 05:04 73,728 --a------ c:\windows\System32\ISUSPM.cpl
    2009-01-18 19:22 . 18.01.2009 19:23 212,937,638 --a------ c:\windows\MEMORY.DMP
    2009-01-14 15:56 . 16.12.2008 04:42 288,768 --a------ c:\windows\System32\drivers\srv.sys

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-02-10 11:11 --------- d-----w c:\users\Noroi\AppData\Roaming\uTorrent
    2009-02-10 11:10 --------- d-----w c:\users\Noroi\AppData\Roaming\WTablet
    2009-02-09 19:54 27,839 ----a-w c:\users\Noroi\AppData\Roaming\nvModes.dat
    2009-02-09 19:04 --------- d-----w c:\users\Noroi\AppData\Roaming\X-Chat 2
    2009-02-09 19:04 --------- d-----w c:\users\Noroi\AppData\Roaming\foobar2000
    2009-02-08 23:14 --------- d-----w c:\users\password kaikkimuut\AppData\Roaming\WTablet
    2009-02-07 17:00 29,169 ----a-w c:\users\password kaikkimuut\AppData\Roaming\nvModes.dat
    2009-02-05 21:06 51,792 ----a-w c:\windows\system32\drivers\aswMonFlt.sys
    2009-02-04 15:33 --------- d--h--w c:\program files\InstallShield Installation Information
    2009-02-04 15:33 --------- d-----w c:\program files\Common Files\InstallShield
    2009-02-04 13:30 --------- d-----w c:\users\Noroi\AppData\Roaming\SystemRequirementsLab
    2009-02-04 13:30 --------- d-----w c:\program files\SystemRequirementsLab
    2009-01-18 18:09 --------- d-----w c:\program files\lg_swupdate
    2009-01-14 18:02 --------- d-----w c:\program files\Windows Mail
    2009-01-03 11:45 410,984 ----a-w c:\windows\System32\deploytk.dll
    2009-01-03 11:45 --------- d-----w c:\program files\Java
    2009-01-02 15:33 --------- d-----w c:\program files\Cellosoft
    2008-12-30 17:50 --------- d-----w c:\program files\Azureus
    2008-12-30 17:47 --------- d-----w c:\program files\uTorrent
    2008-12-26 13:39 --------- d-----w c:\users\Noroi\AppData\Roaming\Azureus
    2008-10-12 11:08 174 --sha-w c:\program files\desktop.ini
    2008-06-22 10:37 27,839 ----a-w c:\users\Noora\AppData\Roaming\nvModes.dat
    2008-04-02 09:32 4,337,664 ----a-w c:\users\Noroi\mplayerc.exe
    1997-03-31 21:00 83,456 ----a-w c:\program files\README.DOC
    1997-03-31 21:00 662,016 ----a-w c:\program files\WWINT32V.DLL
    1997-03-31 21:00 5,238 ----a-w c:\program files\INSTALL.TXT
    1997-03-31 21:00 5,044 ----a-w c:\program files\LICENSE.TXT
    1997-03-31 21:00 3,567,104 ----a-w c:\program files\WORDVIEW.EXE
    2008-06-22 14:02 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    2008-06-22 14:02 32,768 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    2008-06-22 14:03 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies\index.dat
    2008-06-22 14:03 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\History\History.IE5\index.dat
    2008-06-22 14:03 32,768 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
    2008-06-22 14:02 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [19.01.2008 09:33 1233920]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [19.01.2008 09:33 125952]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [19.01.2008 09:33 202240]
    "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [14.02.2008 01:09 486856]
    "CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [17.07.2007 10:03 868352]
    "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [11.08.2008 07:31 1124352]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [18.10.2007 11:34 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LG Magnifier"="c:\program files\LG Software\LG Magnifier\MagnifyingGlass.exe" [09.05.2007 20:41 140856]
    "KeybdUtility"="c:\program files\LG Software\On Screen Display\HotKey.exe" [29.06.2007 02:13 2868528]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [29.06.2007 23:26 894248]
    "LG Intelligent Update"="c:\program files\lg_swupdate\giljabistart.exe" [27.03.2008 08:40 247088]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [12.02.2007 23:37 174872]
    "ZugPowerConfig"="c:\program files\LG Software\ZugPowerConfig\ZugPowerConfigCurrentValue.exe" [15.06.2007 20:41 20480]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [05.02.2009 23:08 81000]
    "PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [15.03.2008 01:50 233472]
    "NvSvc"="c:\windows\system32\nvsvc.dll" [13.12.2007 13:21 86016]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [13.12.2007 13:21 8501792]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [13.12.2007 13:21 81920]
    "RtHDVCpl"="RtHDVCpl.exe" [13.06.2007 22:11 4489216 c:\windows\RtHDVCpl.exe]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [29.02.2008 02:12 76304 c:\windows\KHALMNPR.Exe]
    "Skytel"="Skytel.exe" [29.05.2007 05:39 1826816 c:\windows\SkyTel.exe]

    c:\users\Noora\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-04-05 67128]
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-08-15 805392]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.avis"= ff_acm.acm
    "msacm.divxa32"= msaud32_divx.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1843840881-518019814-377898367-1001]
    "EnableNotifications"=dword:00000001
    "EnableNotificationsRef"=dword:00000002

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{174F2AC7-6F4C-4E5C-9D44-CBBC13E935F3}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
    "{64152558-154D-4D39-A79C-92484506BE67}"= UDP:c:\program files\Sierra Entertainment\FEAR Perseus Mandate\FEARXP2.exe:FEARXP2
    "{1F0F843E-7AA9-40A5-BCE5-FD015C2DD8D6}"= TCP:c:\program files\Sierra Entertainment\FEAR Perseus Mandate\FEARXP2.exe:FEARXP2
    "TCP Query User{501D9196-611F-44E6-A782-BC4D543D9F42}c:\\program files\\ea games\\american mcgee's alice\\alice.exe"= UDP:c:\program files\ea games\american mcgee's alice\alice.exe:American McGee's Alice
    "UDP Query User{4A364F86-3958-4DD1-B5AE-6EAF7DB9E16B}c:\\program files\\ea games\\american mcgee's alice\\alice.exe"= TCP:c:\program files\ea games\american mcgee's alice\alice.exe:American McGee's Alice
    "TCP Query User{E1A08035-76B2-48E7-8629-817F4C63A41D}c:\\users\\noroi\\saved games\\warcraft iii\\war3.exe"= UDP:c:\users\noroi\saved games\warcraft iii\war3.exe:war3.exe
    "UDP Query User{5F818AB2-F9A9-4A3B-A15C-B4ACDA64BEF5}c:\\users\\noroi\\saved games\\warcraft iii\\war3.exe"= TCP:c:\users\noroi\saved games\warcraft iii\war3.exe:war3.exe
    "{DE1EA9BC-20EE-4E4E-9E4A-E4510D9863A8}"= UDP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
    "{7897377B-9272-4D23-AD55-4802D31F11C6}"= TCP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
    "{71B2B46C-5E9C-4A2D-8F0D-06CDB7E46FA8}"= UDP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
    "{F0C28A32-C167-47B7-BDCD-567D1A1C5696}"= TCP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
    "TCP Query User{B4D5CD5F-3E44-486D-8677-42840E12F7B6}c:\\program files\\logitech\\desktop messenger\\8876480\\program\\logitechdesktopmessenger.exe"= UDP:c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe:Logitech Desktop Messenger
    "UDP Query User{35B5CF09-E6A5-4EA8-BB4F-013BCB069F30}c:\\program files\\logitech\\desktop messenger\\8876480\\program\\logitechdesktopmessenger.exe"= TCP:c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe:Logitech Desktop Messenger
    "TCP Query User{DF3282BB-5BC3-48A8-AC7D-4FB4B7E225B3}c:\\users\\noroi\\saved games\\warcraft iii\\war3.exe"= UDP:c:\users\noroi\saved games\warcraft iii\war3.exe:war3.exe
    "UDP Query User{36C75CEF-1A97-40CD-B7A7-AFE133A3E784}c:\\users\\noroi\\saved games\\warcraft iii\\war3.exe"= TCP:c:\users\noroi\saved games\warcraft iii\war3.exe:war3.exe
    "TCP Query User{C77A6BB7-EF53-44F3-AB2F-DB3E4266D849}c:\\program files\\frostwire\\frostwire.exe"= UDP:c:\program files\frostwire\frostwire.exe:FrostWire
    "UDP Query User{C05A5A3F-D57F-43A7-89EA-E5D7D24EEAA3}c:\\program files\\frostwire\\frostwire.exe"= TCP:c:\program files\frostwire\frostwire.exe:FrostWire
    "TCP Query User{79F2E131-EBD9-4C65-868E-ABCA0E90FCAF}c:\\program files\\x-chat 2\\xchat.exe"= UDP:c:\program files\x-chat 2\xchat.exe:X-Chat IRC Client
    "UDP Query User{F1A021D4-3B9E-4252-8E06-2652C5B9FD97}c:\\program files\\x-chat 2\\xchat.exe"= TCP:c:\program files\x-chat 2\xchat.exe:X-Chat IRC Client
    "{62F5CE97-823C-4E72-AA30-BE6CAC9DA25A}"= UDP:c:\program files\Unreal Tournament 3\Binaries\UT3.exe:Unreal Tournament 3
    "{3090D79F-29EA-475D-9154-4FD170C9AFAF}"= TCP:c:\program files\Unreal Tournament 3\Binaries\UT3.exe:Unreal Tournament 3
    "TCP Query User{4AAE8315-19C1-464E-9992-AF5C1EF06457}c:\\program files\\unreal tournament 3\\binaries\\ut3.exe"= UDP:c:\program files\unreal tournament 3\binaries\ut3.exe:UT3
    "UDP Query User{F6B3065C-20F7-4B9C-9832-0172EAFA5072}c:\\program files\\unreal tournament 3\\binaries\\ut3.exe"= TCP:c:\program files\unreal tournament 3\binaries\ut3.exe:UT3
    "TCP Query User{3B8BD8B4-BE15-43DA-A298-3A6F4100406D}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
    "UDP Query User{F4D72858-08EF-43B2-B42C-A8528817EF12}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
    "TCP Query User{02142286-55AC-4FAE-975C-8B2246D44147}c:\\program files\\ea games\\american mcgee's alice\\alice.exe"= Disabled:UDP:c:\program files\ea games\american mcgee's alice\alice.exe:American McGee's Alice
    "UDP Query User{2093B09D-707C-45B4-8FD2-30E478B5F22D}c:\\program files\\ea games\\american mcgee's alice\\alice.exe"= Disabled:TCP:c:\program files\ea games\american mcgee's alice\alice.exe:American McGee's Alice
    "TCP Query User{467E8419-06A1-409A-BDA5-57C34957653E}c:\\program files\\dc++\\dcplusplus.exe"= Disabled:UDP:c:\program files\dc++\dcplusplus.exe:DC++
    "UDP Query User{47AE14FE-F136-475B-BE1B-8BC9B5F6FDC2}c:\\program files\\dc++\\dcplusplus.exe"= Disabled:TCP:c:\program files\dc++\dcplusplus.exe:DC++
    "{421426EB-9D55-4753-A3FE-16A4EFCE62F0}"= Disabled:UDP:18101:u-torrent-portti
    "TCP Query User{F6176550-34A0-41D6-9A1F-3B572E468560}c:\\program files\\atari\\neverwinter nights 2\\nwn2server.exe"= UDP:c:\program files\atari\neverwinter nights 2\nwn2server.exe:Neverwinter Nights 2 Server
    "UDP Query User{9906F6E4-66F7-4281-A1CE-E67E44D092FF}c:\\program files\\atari\\neverwinter nights 2\\nwn2server.exe"= TCP:c:\program files\atari\neverwinter nights 2\nwn2server.exe:Neverwinter Nights 2 Server
    "{E3EE4A7C-E622-4418-8F2E-8EDC16C12EDC}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
    "{A0AE74E7-2A4A-49CC-8DEB-13117BFF6821}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
    "{3A7E73D8-3488-477D-86C5-1573D4B367F2}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
    "TCP Query User{480672A3-0A7F-4B00-9DFB-F0745954CFEC}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
    "UDP Query User{69C38CDE-BC22-4B35-822D-0E06A256AE3F}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
    "TCP Query User{E71EDF47-0C8C-455E-8C46-BA980F84A5DB}c:\\program files\\utorrent\\utorrent.exe"= Disabled:UDP:c:\program files\utorrent\utorrent.exe:uTorrent
    "UDP Query User{724110FD-0F03-41D8-8090-49ADD4053E69}c:\\program files\\utorrent\\utorrent.exe"= Disabled:TCP:c:\program files\utorrent\utorrent.exe:uTorrent
    "{4FFF442E-72D8-4D0E-AE29-5C9BC79F21C5}"= UDP:c:\program files\Gravity\Requiem\UPDATERUSA.EXE:Requiem
    "{5409E9D6-4B61-4F00-8FE0-6751455B7F37}"= TCP:c:\program files\Gravity\Requiem\UPDATERUSA.EXE:Requiem

    R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [2008-04-04 114768]
    R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [2008-04-04 20560]
    R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [2008-02-22 51792]
    R2 TabletServicePen;TabletServicePen;c:\windows\System32\Pen_Tablet.exe [2008-12-02 3032360]
    R3 CXSONORA;AVerMedia 23885 AvStream Video Capture;c:\windows\System32\drivers\A885VCap.sys [2007-10-25 733824]
    R3 wacmoumonitor;Wacom Mode Helper;c:\windows\System32\drivers\wacmoumonitor.sys [2008-12-02 15144]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bthsvcs REG_MULTI_SZ BthServ
    .
    'Ajoitetut tehtävät'-kansion sisältö

    2009-02-06 c:\windows\Tasks\Norton Security Scan.job
    - c:\program files\Norton Security Scan\Nss.exe [09.01.2008 03:08]
    .
    - - - - POISTETUT JÄMÄRIVIT - - - -

    URLSearchHooks-{0A94B116-4504-4e26-AB05-E61E474AA38B} - c:\program files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
    HKU-Default-Run-Nokia.PCSync - c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe


    .
    ------- Täydentävä tarkistus -------
    .
    uStart Page = hxxp://www.daemon-search.com/startpage
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    FF - ProfilePath - c:\users\Noora\AppData\Roaming\Mozilla\Firefox\Profiles\bk3znzy2.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.daemon-search.com/startpage
    FF - component: c:\users\Noora\AppData\Roaming\Mozilla\Firefox\Profiles\bk3znzy2.default\extensions\bkmrksync@nokia.com\components\BkMrkExt.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

    ---- FIREFOXIN KÄYTÄNNÖT ----
    FF - user.js: general.useragent.extra.zencast - .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-10 14:05:17
    Windows 6.0.6001 Service Pack 1 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    --------------------- LUKITUT REKISTERIAVAIMET ---------------------

    [HKEY_USERS\.Default\CMI-CreateHive{274AB9BD-5778-42E7-84B9-863B8D8DF87A}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="FirefoxHTML"

    [HKEY_USERS\.Default\CMI-CreateHive{274AB9BD-5778-42E7-84B9-863B8D8DF87A}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="FirefoxHTML"

    [HKEY_USERS\.Default\CMI-CreateHive{274AB9BD-5778-42E7-84B9-863B8D8DF87A}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="FirefoxHTML"

    [HKEY_USERS\.Default\CMI-CreateHive{274AB9BD-5778-42E7-84B9-863B8D8DF87A}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="FirefoxHTML"

    [HKEY_USERS\.Default\CMI-CreateHive{274AB9BD-5778-42E7-84B9-863B8D8DF87A}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="FirefoxHTML"
    .
    --------------------- Prosesseihin ladatut DLLt ---------------------

    - - - - - - - > 'Explorer.exe'(1944)
    c:\program files\Logitech\SetPoint\GameHook.dll
    c:\program files\Logitech\SetPoint\lgscroll.dll
    .
    Valmistumisajankohta: 10.02.2009 14:07:14
    ComboFix-quarantined-files.txt 2009-02-10 12:07:12

    Ennen ajoa: 272 101 912 576 tavua vapaana
    Ajon jälkeen: 273,797,406,720 tavua vapaana

    207 --- E O F --- 2009-02-10 10:32:10
     
    Noroi, Feb 10, 2009
    #7
  8. Hujo

    Hujo Guest

    Kirjoita suorita luukkuun

    ComboFix /u

    Klikkaa ok

     
    Hujo, Feb 10, 2009
    #8
  9. Noroi

    Noroi Member

    Joined:
    Feb 27, 2008
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    Kone ilmoitti ComboFixin poistetun onnistuneesti
     
    Noroi, Feb 10, 2009
    #9
  10. Hujo

    Hujo Guest

    No niin mikäs on koneen toiminta
     
    Hujo, Feb 10, 2009
    #10
  11. Noroi

    Noroi Member

    Joined:
    Feb 27, 2008
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    Fyysisen muistin käyttö perusprosesseilla tasainen 44% (Firefoxin kanssa ~49%)
    Muoks
    Uudelleenkäynnistyksen jälkeen fyysisen muistin käyttö perusprosesseilla <40%
    Firefoxin kanssa ~45%
    --> Kaikki tuntuisi olevan siis ok.

    Suoritinkäyttö normaalia 2 - 10% käyrää

    Kone toimii hyvin, eikä kovo raksuta niin pahaan malliin kuin viimeksi. Nyt vain normaalia pikkusurinaa.
     
    Last edited: Feb 10, 2009
    Noroi, Feb 10, 2009
    #11
  12. Hujo

    Hujo Guest

    ok pörinät näyttäis olevan
     
    Hujo, Feb 10, 2009
    #12

Share This Page