noniin siis ku olen jonki aikaa oman tietokoneen missään osassa siinä tulee virheraportti explorer.exe jouduttiin sammuttamaan ja sellaista ja avastilla scannasin koneen niin ei viruksia löydy niin onko se vika jossain asetuksissa vai onko avast vain paska???
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:29:07, on 4.9.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Windows Live\Perheturva\fssui.exe C:\WINDOWS\system32\lphce9mj0en2c.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Steam\Steam.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\WinRAR\WinRAR.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Perheturva\fssbho.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Perheturva\fssui.exe" -autorun O4 - HKLM\..\Run: [lphce9mj0en2c] C:\WINDOWS\system32\lphce9mj0en2c.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- End of file - 5903 bytes
Jeps näyttää olevan törkyä koneella eli putsataan. 1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä: Combofix.exe Combofix.exe Avaa Combofix.exe ja seuraa näyttöön tulevia ohjeita Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne. Tyhjennä roskakori ja käynnistä koneesi uudelleen. Postita tänne seuraavat lokit: * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta) * (C:\ComboFix.txt) raportti * Lataa Malwarebytes' Anti-Malware työpöydällesi. * Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. * Lopuksi varmistu, että seuraavat on valittu: Päivitä Malwarebytes' Anti-Malware ja Käynnistä Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Lopeta. * Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. * Kun ohjelma on latautunut, valitse Suorita täysi tarkistus ja klikkaa Tarkista. * Kun skanni on valmis, klikkaa OK ja sitten Näytä tulokset nähdäksesi tulokset. * Varmistu, että kaikki on merkitty ja klikkaa Poista valitut. * Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt * Lähetä lokin sisältö seuraavassa viestissäsi + uusi hjt-loki.
ComboFix 08-09-03.03 - Mikko 2008-09-04 15:24:47.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1418 [GMT 3:00] Running from: C:\Documents and Settings\Mikko\Työpöytä\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . (((((((((((((((((((((((((((((((((((((( Muut poistot )))))))))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\blphce9mj0en2c.scr C:\WINDOWS\system32\lphce9mj0en2c.exe C:\WINDOWS\system32\phce9mj0en2c.bmp . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-08-04 to 2008-09-04 ))))))))))))))))) . 2008-09-04 13:28 . 2008-09-04 13:28 <KANSIO> d-------- C:\Program Files\Trend Micro 2008-09-03 14:20 . 2008-09-03 14:20 620 --a------ C:\WINDOWS\eReg.dat 2008-09-03 14:17 . 2008-09-03 14:17 <KANSIO> d-------- C:\Program Files\EA Games 2008-09-02 18:19 . 2007-10-17 13:53 43,816 --a------ C:\WINDOWS\system32\drivers\fssfltr.sys 2008-09-02 18:18 . 2008-09-02 18:18 <KANSIO> d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2008-09-02 18:18 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2008-09-02 18:16 . 2008-09-02 18:16 <KANSIO> d-------- C:\Program Files\Windows Live Toolbar 2008-09-02 18:08 . 2008-09-02 19:22 <KANSIO> d-------- C:\WINDOWS\SxsCaPendDel 2008-09-01 15:52 . 2008-09-01 16:11 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-09-01 15:42 . 2008-09-01 16:19 <KANSIO> d-------- C:\Fraps 2008-09-01 15:42 . 2008-09-01 16:19 <KANSIO> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-08-31 20:16 . 2008-08-31 20:16 268 --ah----- C:\sqmdata15.sqm 2008-08-31 20:16 . 2008-08-31 20:16 244 --ah----- C:\sqmnoopt15.sqm 2008-08-29 15:54 . 2008-08-29 15:54 268 --ah----- C:\sqmdata14.sqm 2008-08-29 15:54 . 2008-08-29 15:54 244 --ah----- C:\sqmnoopt14.sqm 2008-08-27 19:30 . 2008-08-27 19:30 268 --ah----- C:\sqmdata13.sqm 2008-08-27 19:30 . 2008-08-27 19:30 244 --ah----- C:\sqmnoopt13.sqm 2008-08-27 16:58 . 2008-08-27 16:58 268 --ah----- C:\sqmdata12.sqm 2008-08-27 16:58 . 2008-08-27 16:58 244 --ah----- C:\sqmnoopt12.sqm 2008-08-27 07:20 . 2008-08-28 16:16 <KANSIO> d-------- C:\Program Files\City Interactive 2008-08-25 21:34 . 2008-08-25 21:34 268 --ah----- C:\sqmdata11.sqm 2008-08-25 21:34 . 2008-08-25 21:34 244 --ah----- C:\sqmnoopt11.sqm 2008-08-25 17:22 . 2008-08-25 17:22 <KANSIO> d-------- C:\Program Files\DAEMON Tools Toolbar 2008-08-25 17:22 . 2008-08-26 14:33 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite 2008-08-25 16:53 . 2008-08-25 16:53 <KANSIO> d-------- C:\Documents and Settings\Mikko\Application Data\DAEMON Tools 2008-08-25 16:53 . 2008-08-25 16:53 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-08-25 16:53 . 2008-08-25 16:53 268 --ah----- C:\sqmdata10.sqm 2008-08-25 16:53 . 2008-08-25 16:53 244 --ah----- C:\sqmnoopt10.sqm 2008-08-25 16:40 . 2008-08-25 16:40 <KANSIO> d-------- C:\Program Files\uTorrent 2008-08-25 16:40 . 2008-09-03 14:44 <KANSIO> d-------- C:\Documents and Settings\Mikko\Application Data\uTorrent 2008-08-25 07:37 . 2008-08-25 07:37 268 --ah----- C:\sqmdata09.sqm 2008-08-25 07:37 . 2008-08-25 07:37 244 --ah----- C:\sqmnoopt09.sqm 2008-08-25 06:50 . 2008-08-25 06:50 268 --ah----- C:\sqmdata08.sqm 2008-08-25 06:50 . 2008-08-25 06:50 244 --ah----- C:\sqmnoopt08.sqm 2008-08-22 16:45 . 2008-08-22 16:45 268 --ah----- C:\sqmdata07.sqm 2008-08-22 16:45 . 2008-08-22 16:45 244 --ah----- C:\sqmnoopt07.sqm 2008-08-22 14:07 . 2008-08-19 15:43 <KANSIO> d--h----- C:\Documents and Settings\Vieras\Verkkoympäristö 2008-08-22 14:07 . 2008-08-19 15:43 <KANSIO> d-------- C:\Documents and Settings\Vieras\Työpöytä 2008-08-22 14:07 . 2008-08-19 15:43 <KANSIO> d--h----- C:\Documents and Settings\Vieras\Tulostinympäristö 2008-08-22 14:07 . 2008-08-22 14:07 <KANSIO> dr------- C:\Documents and Settings\Vieras\Suosikit 2008-08-22 14:07 . 2008-08-22 14:07 <KANSIO> dr------- C:\Documents and Settings\Vieras\Omat tiedostot 2008-08-22 14:07 . 2008-08-19 14:47 <KANSIO> d--h----- C:\Documents and Settings\Vieras\Mallit 2008-08-22 14:07 . 2008-08-19 15:43 <KANSIO> dr------- C:\Documents and Settings\Vieras\Käynnistä-valikko 2008-08-22 14:07 . 2008-08-22 14:07 <KANSIO> d-------- C:\Documents and Settings\Vieras\Application Data\ATI 2008-08-22 14:07 . 2008-08-22 14:07 <KANSIO> d-------- C:\Documents and Settings\Vieras 2008-08-22 14:06 . 2008-08-22 14:06 268 --ah----- C:\sqmdata06.sqm 2008-08-22 14:06 . 2008-08-22 14:06 244 --ah----- C:\sqmnoopt06.sqm 2008-08-21 21:59 . 2008-08-21 21:59 268 --ah----- C:\sqmdata05.sqm 2008-08-21 21:59 . 2008-08-21 21:59 244 --ah----- C:\sqmnoopt05.sqm 2008-08-21 17:36 . 2008-08-21 17:36 268 --ah----- C:\sqmdata04.sqm 2008-08-21 17:36 . 2008-08-21 17:36 244 --ah----- C:\sqmnoopt04.sqm 2008-08-21 06:48 . 2008-08-21 06:48 268 --ah----- C:\sqmdata03.sqm 2008-08-21 06:48 . 2008-08-21 06:48 244 --ah----- C:\sqmnoopt03.sqm 2008-08-20 20:49 . 2008-08-20 20:49 268 --ah----- C:\sqmdata02.sqm 2008-08-20 20:49 . 2008-08-20 20:49 244 --ah----- C:\sqmnoopt02.sqm 2008-08-20 09:09 . 2008-06-14 20:59 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-08-20 09:08 . 2008-04-11 21:51 683,520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-08-20 09:08 . 2008-05-01 17:32 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-20 09:04 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll 2008-08-20 09:04 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll 2008-08-20 09:04 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-08-19 23:46 . 2008-08-24 19:01 <KANSIO> d-------- C:\Documents and Settings\Mikko\CabalRider 2008-08-19 23:43 . 2008-08-19 23:43 <KANSIO> d-------- C:\Program Files\Common Files\INCA Shared 2008-08-19 23:43 . 2003-07-21 06:17 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd 2008-08-19 23:43 . 2005-01-04 21:43 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys 2008-08-19 22:51 . 2008-08-19 22:51 <KANSIO> d-------- C:\Program Files\Games-Masters.com 2008-08-19 20:30 . 2008-08-19 20:30 <KANSIO> d-------- C:\Program Files\Winamp Toolbar 2008-08-19 20:30 . 2008-08-19 20:30 <KANSIO> d-------- C:\Program Files\Winamp Remote 2008-08-19 20:30 . 2008-08-19 20:30 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Winamp Toolbar 2008-08-19 20:30 . 2008-08-19 20:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\OrbNetworks 2008-08-19 20:23 . 2008-08-19 20:31 <KANSIO> d-------- C:\Program Files\Winamp 2008-08-19 20:23 . 2008-08-19 20:31 <KANSIO> d-------- C:\Documents and Settings\Mikko\Application Data\Winamp 2008-08-19 19:46 . 2008-09-03 16:26 <KANSIO> d-------- C:\Program Files\RevConnect 2008-08-19 18:20 . 2008-08-19 18:20 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll 2008-08-19 18:20 . 2008-08-19 18:20 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll 2008-08-19 18:20 . 2008-08-19 18:20 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll 2008-08-19 18:12 . 2008-08-19 18:12 94,208 --a------ C:\WINDOWS\DIIUnin.exe 2008-08-19 18:12 . 2008-08-19 18:22 35,708 --a------ C:\WINDOWS\DIIUnin.dat 2008-08-19 18:12 . 2008-08-19 18:12 2,829 --a------ C:\WINDOWS\DIIUnin.pif 2008-08-19 18:03 . 2008-09-04 14:13 <KANSIO> d-------- C:\Program Files\Diablo II 2008-08-19 18:01 . 2008-08-19 18:01 <KANSIO> d-------- C:\WINDOWS\zy_tmp 2008-08-19 18:01 . 2002-08-12 16:20 27,264 --a------ C:\WINDOWS\system32\drivers\rndismpk.sys 2008-08-19 18:01 . 2002-08-12 16:20 11,136 --a------ C:\WINDOWS\system32\drivers\usb8023k.sys 2008-08-19 18:01 . 2003-12-25 17:07 5,120 --a------ C:\WINDOWS\system32\tcusbdrv.dll 2008-08-19 16:37 . 2008-08-19 16:37 268 --ah----- C:\sqmdata00.sqm 2008-08-19 16:37 . 2008-08-19 16:37 244 --ah----- C:\sqmnoopt00.sqm 2008-08-19 16:36 . 2008-08-19 16:36 <KANSIO> d-------- C:\Documents and Settings\Mikko\Contacts 2008-08-19 16:34 . 2008-09-02 18:19 <KANSIO> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-08-19 16:29 . 2008-09-03 22:30 <KANSIO> d-------- C:\Program Files\Windows Live 2008-08-19 16:29 . 2008-08-19 16:34 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2008-08-19 16:29 . 2008-09-02 18:12 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-08-19 16:25 . 2008-08-19 16:25 <KANSIO> d-------- C:\Program Files\Common Files\Nero 2008-08-19 16:24 . 2008-08-19 16:24 <KANSIO> d-------- C:\Program Files\Common Files\Ahead 2008-08-19 16:24 . 2004-07-26 16:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2008-08-19 16:24 . 2004-07-26 16:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2008-08-19 16:24 . 2004-07-26 16:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2008-08-19 16:24 . 2004-07-09 08:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2008-08-19 16:24 . 2004-07-26 16:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2008-08-19 16:24 . 2001-07-09 10:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2008-08-19 16:24 . 2000-06-26 10:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2008-08-19 16:23 . 2008-08-19 16:24 <KANSIO> d-------- C:\Program Files\Ahead 2008-08-19 16:21 . 2008-08-19 16:21 <KANSIO> d-------- C:\WINDOWS\ShellNew 2008-08-19 16:21 . 2008-08-19 16:21 413 --a------ C:\WINDOWS\ODBC.INI 2008-08-19 16:09 . 2008-08-19 16:09 <KANSIO> d-------- C:\Program Files\Lavasoft 2008-08-19 16:09 . 2008-08-19 16:09 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-08-19 16:09 . 2008-08-19 16:09 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-08-19 16:07 . 2008-08-19 16:07 <KANSIO> d-------- C:\WINDOWS\system32\Lang 2008-08-19 16:07 . 2008-08-19 16:07 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-08-19 16:07 . 2008-08-19 16:07 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-08-19 16:05 . 2008-08-19 16:05 <KANSIO> d-------- C:\Program Files\Realtek 2008-08-19 16:03 . 2008-08-19 16:03 <KANSIO> d-------- C:\Documents and Settings\Mikko\Application Data\ATI 2008-08-19 16:03 . 2008-08-19 16:03 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\ATI 2008-08-19 15:52 . 2008-08-19 15:52 0 --a------ C:\WINDOWS\nsreg.dat 2008-08-19 15:51 . 2008-08-19 15:51 0 --a------ C:\WINDOWS\ativpsrm.bin 2008-08-19 15:49 . 2008-07-03 21:05 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe 2008-08-19 15:48 . 2008-09-03 14:58 <KANSIO> d--h----- C:\Program Files\InstallShield Installation Information 2008-08-19 15:48 . 2008-09-03 14:16 <KANSIO> d-------- C:\Program Files\Common Files\InstallShield 2008-08-19 15:48 . 2008-08-19 15:50 <KANSIO> d-------- C:\Program Files\ATI Technologies 2008-08-19 15:47 . 2008-08-19 15:47 <KANSIO> d-------- C:\ATI 2008-08-19 15:45 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2008-08-19 15:45 . 2001-08-17 22:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2008-08-19 15:44 . 2004-09-14 16:12 74,240 --a------ C:\WINDOWS\system32\usbui.dll 2008-08-19 15:44 . 2004-09-14 16:06 57,216 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2008-08-19 15:44 . 2001-08-17 22:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys 2008-08-19 15:43 . 2008-08-19 15:43 <KANSIO> d--h----- C:\Documents and Settings\Default User\Verkkoympäristö . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-04 10:12 --------- d-----w C:\Program Files\Steam 2008-09-03 11:20 12,464 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-08-19 14:42 --------- d-----w C:\Documents and Settings\Mikko\Application Data\MSN6 2008-08-19 14:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6 2008-08-19 13:05 319,488 ----a-w C:\WINDOWS\HideWin.exe 2008-08-19 11:55 --------- d-----w C:\Program Files\Alwil Software 2008-08-19 11:51 --------- d-----w C:\Program Files\microsoft frontpage 2008-08-19 11:50 558,142 ----a-w C:\WINDOWS\java\Packages\SQDF1N75.ZIP 2008-08-19 11:50 155,995 ----a-w C:\WINDOWS\java\Packages\SHBRB7DV.ZIP 2008-08-06 14:12 4,755,968 ----a-w C:\WINDOWS\system32\drivers\RtkHDAud.sys 2008-07-31 12:05 16,806,912 ----a-w C:\WINDOWS\RTHDCPL.exe 2008-07-29 12:42 528,384 ----a-w C:\WINDOWS\RtlExUpd.dll 2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-15 12:20 69,632 ----a-w C:\WINDOWS\system32\ChCfg.exe 2008-07-15 10:47 1,196,032 ----a-w C:\WINDOWS\RtlUpd.exe 2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-04 06:33 3,230,720 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys 2008-07-04 03:48 9,490,432 ----a-w C:\WINDOWS\system32\atioglx2.dll 2008-07-04 03:25 421,888 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2008-07-04 03:23 309,248 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2008-07-04 03:14 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2008-07-04 03:14 184,320 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2008-07-04 03:14 143,360 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2008-07-04 03:13 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2008-07-04 03:13 139,264 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2008-07-04 03:12 561,152 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2008-07-04 03:10 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2008-07-04 03:06 253,952 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2008-07-04 03:00 3,786,144 ----a-w C:\WINDOWS\system32\ati3duag.dll 2008-07-04 02:55 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2008-07-04 02:49 2,140,672 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2008-07-04 02:34 48,640 ----a-w C:\WINDOWS\system32\amdpcom32.dll 2008-07-04 02:30 348,160 ----a-w C:\WINDOWS\system32\atikvmag.dll 2008-07-04 02:29 32,768 ----a-w C:\WINDOWS\system32\atiadlxx.dll 2008-07-04 02:28 53,248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll 2008-07-04 02:28 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2008-07-04 02:25 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll 2008-07-04 02:22 565,248 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 15:40 659,456 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:41 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-19 13:42 2,808,832 ----a-w C:\WINDOWS\alcwzrd.exe 2008-06-19 13:27 9,715,200 ----a-w C:\WINDOWS\RTLCPL.exe 2008-06-19 13:20 57,344 ----a-w C:\WINDOWS\Alcmtr.exe 2008-06-18 15:01 77,824 ----a-w C:\WINDOWS\SoundMan.exe . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 15360] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "Steam"="C:\Program Files\Steam\Steam.exe" [2008-08-19 1271032] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-09-14 1667584] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "fssui"="C:\Program Files\Windows Live\Perheturva\fssui.exe" [2007-12-17 243240] "RTHDCPL"="RTHDCPL.EXE" [2008-07-31 C:\WINDOWS\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 15360] C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Steam\\steamapps\\sipuli123\\counter-strike\\hl.exe"= "C:\\Program Files\\RevConnect\\DCPlusPlus.exe"= "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "C:\\Program Files\\Games-Masters.com\\CABAL Online (Europe)\\launcher\\update\\ESTdnheadless.exe"= "C:\\Documents and Settings\\Mikko\\Työpöytä\\bot_v1.06b___Rider_v1.07\\Cabal Bot 1.06b\\cabalbot.exe"= "C:\\Program Files\\Steam\\steamapps\\sipuli123\\condition zero\\hl.exe"= "C:\\Program Files\\Steam\\steamapps\\karva321\\counter-strike source\\hl2.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 fssfltr;FssFltr;C:\WINDOWS\system32\DRIVERS\fssfltr.sys [2007-10-17 43816] R2 fsssvc;Windows Live OneCare – perheturva;C:\Program Files\Windows Live\Perheturva\fsssvc.exe [2007-12-17 523816] S3 NTProcDrv;Process creation detector for NT.;C:\Documents and Settings\Mikko\Työpöytä\bot_v1.06b___Rider_v1.07\Cabal Bot 1.06b\NtProcDrv.sys [2005-02-23 3584] *Newly Created Service* - PROCEXP90 . 'Ajoitetut tehtävät'-kansion sisältö . - - - - ORPHANS REMOVED - - - - HKLM-Run-lphce9mj0en2c - C:\WINDOWS\system32\lphce9mj0en2c.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Mikko\Application Data\Mozilla\Firefox\Profiles\4948yufe.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.fi . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-04 15:25:36 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-09-04 15:26:10 ComboFix-quarantined-files.txt 2008-09-04 12:26:08 Pre-Run: 205,461,188,608 tavua vapaana Post-Run: 206,721,490,944 tavua vapaana 268 --- E O F --- 2008-09-03 19:31:19
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:46:48, on 4.9.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Windows Live\Perheturva\fssui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Steam\Steam.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Perheturva\fssbho.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Perheturva\fssui.exe" -autorun O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- End of file - 5903 bytes
Malwarebytes' Anti-Malware 1.26 Tietokantaversio: 1112 Windows 5.1.2600 Service Pack 2 4.9.2008 19:59:13 mbam-log-2008-09-04 (19-59-08).txt Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|) Tarkistetut kohteet: 86384 Kulunut aika: 16 minute(s), 54 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 0 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 46 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: C:\Init.exe (Rogue.Agent) -> No action taken. C:\Sys1.exe (Trojan.Agent) -> No action taken. C:\Sys2.exe (Trojan.Agent) -> No action taken. C:\Sys3.exe (Trojan.Agent) -> No action taken. C:\Sys4.exe (Trojan.Agent) -> No action taken. C:\Sys5.exe (Trojan.Agent) -> No action taken. C:\Sys6.exe (Trojan.Agent) -> No action taken. C:\Sys7.exe (Trojan.Agent) -> No action taken. C:\Sys8.exe (Trojan.Agent) -> No action taken. C:\Sys9.exe (Trojan.Agent) -> No action taken. C:\Sys1.tmp (Trojan.Agent) -> No action taken. C:\Sys2.tmp (Trojan.Agent) -> No action taken. C:\Sys3.tmp (Trojan.Agent) -> No action taken. C:\Sys4.tmp (Trojan.Agent) -> No action taken. C:\Sys5.tmp (Trojan.Agent) -> No action taken. C:\Sys6.tmp (Trojan.Agent) -> No action taken. C:\Sys7.tmp (Trojan.Agent) -> No action taken. C:\Sys8.tmp (Trojan.Agent) -> No action taken. C:\Sys9.tmp (Trojan.Agent) -> No action taken. C:\boot.inx (Trojan.Agent) -> No action taken. C:\mstc.exe (Trojan.Agent) -> No action taken. C:\zcom.exe (Trojan.Agent) -> No action taken. C:\smss.exe (Trojan.Agent) -> No action taken. C:\idfq.exe (Trojan.Agent) -> No action taken. C:\mstn.exe (Trojan.Agent) -> No action taken. C:\opgr.exe (Trojan.Agent) -> No action taken. C:\jghp.exe (Trojan.Agent) -> No action taken. C:\nfiu.exe (Trojan.Agent) -> No action taken. C:\xmop.exe (Trojan.Agent) -> No action taken. C:\ihso.exe (Trojan.Agent) -> No action taken. C:\ator.exe (Trojan.Agent) -> No action taken. C:\akts.exe (Trojan.Agent) -> No action taken. C:\Tbfb.exe (Trojan.Agent) -> No action taken. C:\asdf.dll (Trojan.Agent) -> No action taken. C:\jriy.exe (Trojan.Agent) -> No action taken. C:\Ufst.exe (Trojan.Agent) -> No action taken. C:\boot.bin (Malware.Trace) -> No action taken. C:\!!!!.exe (Trojan.Agent) -> No action taken. C:\0xf9.exe (Trojan.Agent) -> No action taken. C:\syst.exe (Trojan.Downloader) -> No action taken. C:\atct.exe (Adware.SurfAssistant) -> No action taken. C:\mrqt.exe (Adware.SurfAssistant) -> No action taken. C:\uxnc.exe (Trojan.Vundo) -> No action taken. C:\wgpo.exe (Trojan.Vundo) -> No action taken. C:\lich.exe (Rootkit.Agent) -> No action taken. C:\lich.sys (Rootkit.Agent) -> No action taken.
C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt Hae tuolta se Malwarebytesin loki ja postaa tänne tuo on väärä loki kun tuossa ei kerrota onko se poistanut nuo eli se loki mikää aukeaa Noiden poistamisen jälkeen.
Malwarebytes' Anti-Malware 1.26 Tietokantaversio: 1112 Windows 5.1.2600 Service Pack 2 4.9.2008 19:59:24 mbam-log-2008-09-04 (19-59-24).txt Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|) Tarkistetut kohteet: 86384 Kulunut aika: 16 minute(s), 54 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 0 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 46 Malwarebytes' Anti-Malware 1.26 Tietokantaversio: 1112 Windows 5.1.2600 Service Pack 2 4.9.2008 19:59:24 mbam-log-2008-09-04 (19-59-24).txt Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|) Tarkistetut kohteet: 86384 Kulunut aika: 16 minute(s), 54 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 0 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 46 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: C:\Init.exe (Rogue.Agent) -> Delete on reboot. C:\Sys1.exe (Trojan.Agent) -> Delete on reboot. C:\Sys2.exe (Trojan.Agent) -> Delete on reboot. C:\Sys3.exe (Trojan.Agent) -> Delete on reboot. C:\Sys4.exe (Trojan.Agent) -> Delete on reboot. C:\Sys5.exe (Trojan.Agent) -> Delete on reboot. C:\Sys6.exe (Trojan.Agent) -> Delete on reboot. C:\Sys7.exe (Trojan.Agent) -> Delete on reboot. C:\Sys8.exe (Trojan.Agent) -> Delete on reboot. C:\Sys9.exe (Trojan.Agent) -> Delete on reboot. C:\Sys1.tmp (Trojan.Agent) -> Delete on reboot. C:\Sys2.tmp (Trojan.Agent) -> Delete on reboot. C:\Sys3.tmp (Trojan.Agent) -> Delete on reboot. C:\Sys4.tmp (Trojan.Agent) -> Delete on reboot. C:\Sys5.tmp (Trojan.Agent) -> Delete on reboot. C:\Sys6.tmp (Trojan.Agent) -> Delete on reboot. C:\Sys7.tmp (Trojan.Agent) -> Delete on reboot. C:\Sys8.tmp (Trojan.Agent) -> Delete on reboot. C:\Sys9.tmp (Trojan.Agent) -> Delete on reboot. C:\boot.inx (Trojan.Agent) -> Delete on reboot. C:\mstc.exe (Trojan.Agent) -> Delete on reboot. C:\zcom.exe (Trojan.Agent) -> Delete on reboot. C:\smss.exe (Trojan.Agent) -> Delete on reboot. C:\idfq.exe (Trojan.Agent) -> Delete on reboot. C:\mstn.exe (Trojan.Agent) -> Delete on reboot. C:\opgr.exe (Trojan.Agent) -> Delete on reboot. C:\jghp.exe (Trojan.Agent) -> Delete on reboot. C:\nfiu.exe (Trojan.Agent) -> Delete on reboot. C:\xmop.exe (Trojan.Agent) -> Delete on reboot. C:\ihso.exe (Trojan.Agent) -> Delete on reboot. C:\ator.exe (Trojan.Agent) -> Delete on reboot. C:\akts.exe (Trojan.Agent) -> Delete on reboot. C:\Tbfb.exe (Trojan.Agent) -> Delete on reboot. C:\asdf.dll (Trojan.Agent) -> Delete on reboot. C:\jriy.exe (Trojan.Agent) -> Delete on reboot. C:\Ufst.exe (Trojan.Agent) -> Delete on reboot. C:\boot.bin (Malware.Trace) -> Delete on reboot. C:\!!!!.exe (Trojan.Agent) -> Delete on reboot. C:\0xf9.exe (Trojan.Agent) -> Delete on reboot. C:\syst.exe (Trojan.Downloader) -> Delete on reboot. C:\atct.exe (Adware.SurfAssistant) -> Delete on reboot. C:\mrqt.exe (Adware.SurfAssistant) -> Delete on reboot. C:\uxnc.exe (Trojan.Vundo) -> Delete on reboot. C:\wgpo.exe (Trojan.Vundo) -> Delete on reboot. C:\lich.exe (Rootkit.Agent) -> Delete on reboot. C:\lich.sys (Rootkit.Agent) -> Delete on reboot.
tuossa tuo ja kiitos paljon avusta nyt toimii taas kunnolla Malwarebytes' Anti-Malware 1.26 Tietokantaversio: 1112 Windows 5.1.2600 Service Pack 2 5.9.2008 14:34:24 mbam-log-2008-09-05 (14-34-24).txt Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|) Tarkistetut kohteet: 89934 Kulunut aika: 22 minute(s), 17 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 0 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 0 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: (Haitallisia kohteita ei löydetty)
