Backdoor.Win32.Bifrose.aej + hjt-logi

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Joniko90, Jul 7, 2007.

  1. Joniko90

    Joniko90 Member

    Joined:
    Jul 22, 2006
    Messages:
    57
    Likes Received:
    0
    Trophy Points:
    16
    Kun avaan WoWin, niin tulee tollanen virus varoitus. Olen scanannut koneen AVG Anti-Spywarella ja Kaspersky online scannerilla, mutta ne eivät pystyneet havaitsemaan kyseistä virusta. Tässä on hjt-logini:

    Logfile of HijackThis v1.99.1
    Scan saved at 22:14:09, on 7.7.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\lan.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\PROGRA~1\LAUNCH~1\LManager.exe
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\GameSpot\GDM_TrayApp.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\GameSpot\DownloadManager_Win32.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\ehome\mcrdsvc.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\system32\wbem\unsecapp.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\HJT\HijackThis_v1.99.1.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
    O4 - Startup: GameSpot Download Manager.lnk = C:\Program Files\GameSpot\GDM_TrayApp.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?3914d026864a47e1b67f41c280d2ef4e
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?3914d026864a47e1b67f41c280d2ef4e
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1183803489453
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: DNADownloader - CNET Networks - C:\Program Files\GameSpot\DownloadManager_Win32.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
     
    Joniko90, Jul 7, 2007
    #1
  2. Auttaja

    Auttaja Guest

    Ajetaanpas blacklightia.

    Lataa ja tallenna Blacklight työpöydällesi;

    Tupla-klikkaa fsbl.exe, hyväksy sopimus, klikkaa -> Scan, sitten -> Next

    Näet listan kaikesta mitä löytyi. Työpöydällesi myös ilmestyy loki jonka nimi on fsbl.xxxxxxx.log (xxxxxxx;n tilalla on luultavimmin numeroita).

    Kopioi ja liitä tämä loki seuraavaan vastaukseesi. Älä valitse "Rename" optiota vielä! Haluamme nähdä login ensin, koska hyviä tiedostoja saattaa olla mukana, kuten "wbemtest.exe".
     
    Auttaja, Jul 7, 2007
    #2
  3. Joniko90

    Joniko90 Member

    Joined:
    Jul 22, 2006
    Messages:
    57
    Likes Received:
    0
    Trophy Points:
    16
    07/07/07 23:18:02 [Info]: BlackLight Engine 1.0.64 initialized
    07/07/07 23:18:02 [Info]: OS: 5.1 build 2600 (Service Pack 2)
    07/07/07 23:18:02 [Note]: 7019 4
    07/07/07 23:18:02 [Note]: 7005 0
    07/07/07 23:18:05 [Note]: 7006 0
    07/07/07 23:18:05 [Note]: 7011 1512
    07/07/07 23:18:05 [Note]: 7026 0
    07/07/07 23:18:05 [Note]: 7026 0
    07/07/07 23:18:07 [Note]: FSRAW library version 1.7.1022
    07/07/07 23:18:43 [Note]: 7007 0
     
    Joniko90, Jul 7, 2007
    #3
  4. Auttaja

    Auttaja Guest

    Onko toi wowisi aito? jos on niin ei syytä huoleen mutta jos olet ladannut jostain siinä voi hyvin olla sisäänrakennettu takaovi jolloin tutkimme lisää.
     
    Auttaja, Jul 7, 2007
    #4
  5. Joniko90

    Joniko90 Member

    Joined:
    Jul 22, 2006
    Messages:
    57
    Likes Received:
    0
    Trophy Points:
    16
    Kyllä on aito WoW. Heti kun avaan sen, niin tulee se sama virus varoitus ja se menee näin:

    "Backdoor.Win.Bifrose.aej" has been detected on your computer. Running this program may compromise the security of your computer and jeopardize your ability to play World of Warcraft. It is highly advised that you correct this problem before playing the game
     
    Joniko90, Jul 7, 2007
    #5
  6. Auttaja

    Auttaja Guest

    Lataa Deckard's System Scanner Työpöydällesi.

    Huomioi: Sinulla tulee olla Järjestelmänvalvojan oikeudet ajaaksesi ohjelman.

    [*]Sulje kaikki avoimet ikkunat ja ohjelmat.
    [*]Tupla Klikkaa Dss.exe tiedostoa ajaaksesi ohjelman, seuraa ohjeita.
    [*]Kun Scannaus on valmis 2 textitiedostoa pitäisi avautua, Main.txt ja extra.txt
    [*]Näppäile Kopioi ( CTRL+A -> CTRL + C ) ja liitä ( CTRL + V )
    [*]kopioi ja liitä Extra.txt & Main.txt sisältö seuraavaan vastaukseesi.
     
    Auttaja, Jul 7, 2007
    #6
  7. Joniko90

    Joniko90 Member

    Joined:
    Jul 22, 2006
    Messages:
    57
    Likes Received:
    0
    Trophy Points:
    16
    Deckard's System Scanner v20070611.50
    Run by Joni on 2007-07-08 at 00:47:59
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    Successfully created a Deckard's System Scanner Restore Point.


    -- Last 5 Restore Point(s) --
    39: 2007-07-07 21:48:05 UTC - RP39 - Deckard's System Scanner Restore Point
    38: 2007-07-07 21:28:42 UTC - RP38 - Installed Microsoft Visual C++ 2005 Redistributable
    37: 2007-07-07 18:02:55 UTC - RP37 - Software Distribution Service 3.0
    36: 2007-07-07 16:50:03 UTC - RP36 - Installed Steam
    35: 2007-07-07 15:47:47 UTC - RP35 - Installed Battlefield 1942 v1.61


    -- First Restore Point --
    1: 2007-07-06 20:25:21 UTC - RP1 - System Checkpoint


    Backed up registry hives.

    Performed disk cleanup.


    -- HijackThis (run as Joni.exe) ------------------------------------------------

    Logfile of HijackThis v1.99.1
    Scan saved at 0:48:57, on 8.7.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\lan.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\PROGRA~1\LAUNCH~1\LManager.exe
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\GameSpot\DownloadManager_Win32.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\ehome\mcrdsvc.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wbem\unsecapp.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Prevx2\PXConsole.exe
    C:\Program Files\Prevx2\PXAgent.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Documents and Settings\Joni\Desktop\dss.exe
    C:\HJT\Joni.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows

    Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
    O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?

    3914d026864a47e1b67f41c280d2ef4e
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?

    3914d026864a47e1b67f41c280d2ef4e
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

    http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1183803489453
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: DNADownloader - CNET Networks - C:\Program Files\GameSpot\DownloadManager_Win32.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common

    Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx2\PXAgent.exe" -f (file missing)
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


    -- File Associations -----------------------------------------------------------

    All associations okay.


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    R0 Teefer (Teefer for NT) - c:\windows\system32\drivers\teefer.sys <Not Verified; Sygate Technologies, Inc.; Sygate Teefer Driver>
    R0 UBHelper - c:\windows\system32\drivers\ubhelper.sys
    R1 wpsdrvnt - c:\windows\system32\drivers\wpsdrvnt.sys <Not Verified; Sygate Technologies, Inc.; wpsdrvnt>
    R2 DritekPortIO (Dritek General Port I/O) - c:\program files\launch manager\dportio.sys <Not Verified; Dritek System Inc.; DPortIO>
    R2 int15 - c:\windows\system32\drivers\int15.sys
    R2 tvicport - c:\windows\system32\drivers\tvicport.sys <Not Verified; EnTech Taiwan; TVicPort Generic Device Driver for Windows

    95/98/ME/NT/2000/2003/XP/XP64>
    R2 zntport - c:\windows\system32\drivers\zntport.sys <Not Verified; Zeal SoftStudio; NTPort Library>
    R3 NTIDrvr (Upper Class Filter Driver) - c:\windows\system32\drivers\ntidrvr.sys <Not Verified; NewTech Infosystems, Inc.; >

    S2 eLock2BurnerLockDriver - c:\windows\system32\elock2burnerlockdriver.sys (file missing)
    S2 eLock2FSCTLDriver - c:\windows\system32\elock2fsctldriver.sys (file missing)


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    R2 AcerMemUsageCheckService (Memory Check Service) - c:\acer\empowering technology\eperformance\memcheck.exe <Not Verified; Acer Inc.; >
    R2 DNADownloader - c:\program files\gamespot\downloadmanager_win32.exe <Not Verified; CNET Networks; GameSpot Download Manager>


    -- Files created between 2007-06-08 and 2007-07-08 -----------------------------

    2007-07-08 00:29:48 0 d-------- C:\Documents and Settings\Joni\Application Data\Prevx
    2007-07-08 00:29:23 0 d-------- C:\Program Files\Prevx2
    2007-07-08 00:29:23 0 d-------- C:\Documents and Settings\All Users\Application Data\Prevx
    2007-07-08 00:28:52 77312 --a------ C:\WINDOWS\ua2.dll
    2007-07-07 23:56:04 0 d-------- C:\Program Files\Enigma Software Group
    2007-07-07 22:13:35 0 d-------- C:\HJT
    2007-07-07 21:13:01 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2007-07-07 21:13:00 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
    2007-07-07 20:59:25 0 d-------- C:\KAV
    2007-07-07 20:24:22 0 d-------- C:\Documents and Settings\Joni\Application Data\Grisoft
    2007-07-07 20:24:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2007-07-07 19:50:03 0 d-------- C:\Program Files\Steam
    2007-07-07 18:54:32 113602 ---hs---- C:\WINDOWS\system32\lan.exe <Not Verified; ; Projekt1>
    2007-07-07 18:54:32 113602 --a------ C:\lan.exe <Not Verified; ; Projekt1>
    2007-07-07 18:20:42 530 --a------ C:\WINDOWS\eReg.dat
    2007-07-07 18:09:52 0 d-------- C:\Program Files\EA GAMES
    2007-07-07 18:04:40 0 d-------- C:\Program Files\GameSpot
    2007-07-07 17:41:54 0 d--h----- C:\WINDOWS\system32\winstec
    2007-07-07 14:41:31 0 dr------- C:\Documents and Settings\NetworkService\Favorites
    2007-07-07 14:41:09 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Mozilla
    2007-07-07 14:36:11 60496 --a------ C:\WINDOWS\system32\drivers\Teefer.sys <Not Verified; Sygate Technologies, Inc.; Sygate Teefer Driver>
    2007-07-07 14:36:10 21075 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys <Not Verified; Sygate Technologies, Inc.; wpsdrvnt>
    2007-07-07 14:36:07 0 d-------- C:\Program Files\Sygate
    2007-07-07 14:35:54 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2007-07-07 14:34:13 0 d-------- C:\Program Files\Alwil Software
    2007-07-07 14:00:28 0 d-------- C:\WINDOWS\Downloaded Installations
    2007-07-07 13:55:49 0 d-------- C:\Documents and Settings\Joni\Application Data\AdobeUM
    2007-07-07 13:52:04 0 d-------- C:\WINDOWS\Sun
    2007-07-07 13:52:04 0 d-------- C:\Documents and Settings\Joni\Application Data\Sun
    2007-07-07 13:42:55 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2007-07-07 13:11:15 0 d-------- C:\Program Files\Microsoft ActiveSync
    2007-07-07 13:10:09 0 d-------- C:\WINDOWS\SHELLNEW
    2007-07-07 13:10:04 0 d-------- C:\Program Files\Microsoft.NET
    2007-07-07 13:03:59 0 d-------- C:\Documents and Settings\Joni\Application Data\WinRAR
    2007-07-07 12:54:57 0 d-------- C:\Documents and Settings\Joni\Application Data\uTorrent
    2007-07-07 12:54:56 0 d-------- C:\Program Files\uTorrent
    2007-07-07 12:45:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Azureus
    2007-07-07 12:45:43 0 d-------- C:\Documents and Settings\Joni\Application Data\Azureus
    2007-07-07 12:45:02 0 d-------- C:\Program Files\Azureus
    2007-07-07 12:43:56 0 d-------- C:\Program Files\Java
    2007-07-07 12:42:10 0 d-------- C:\Program Files\Common Files\Java
    2007-07-07 12:36:06 0 d-------- C:\Documents and Settings\Joni\Application Data\CyberLink
    2007-07-07 12:34:16 0 d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
    2007-07-07 12:34:03 0 d-------- C:\Documents and Settings\Joni\Application Data\Adobe
    2007-07-07 12:22:45 1809 --a------ C:\WINDOWS\mozver.dat
    2007-07-07 12:19:44 0 d-------- C:\Documents and Settings\Joni\Contacts
    2007-07-07 11:09:29 0 d-------- C:\Program Files\Common Files\Blizzard Entertainment
    2007-07-07 11:06:55 0 d-------- C:\Program Files\World of Warcraft
    2007-07-07 10:53:35 0 dr-h----- C:\Documents and Settings\Joni\Recent
    2007-07-07 10:50:00 0 d-------- C:\Program Files\CCleaner
    2007-07-07 10:48:37 0 --a------ C:\WINDOWS\nsreg.dat
    2007-07-07 10:48:34 0 d-------- C:\Documents and Settings\Joni\Application Data\Mozilla
    2007-07-07 10:45:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
    2007-07-07 10:44:54 0 d-------- C:\Program Files\Windows Live Toolbar
    2007-07-07 10:44:10 0 d-------- C:\Program Files\MSN Messenger
    2007-07-07 10:38:42 0 d--hs---- C:\Recycled
    2007-07-07 10:15:57 0 d-------- C:\WINDOWS\network diagnostic
    2007-07-07 10:04:43 0 d---s---- C:\Documents and Settings\Joni\UserData
    2007-07-07 00:51:31 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
    2007-07-07 00:20:17 0 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
    2007-07-07 00:18:25 0 d-------- C:\WINDOWS\system32\PreInstall
    2007-07-07 00:02:04 0 d-------- C:\Documents and Settings\NetworkService\Start Menu
    2007-07-07 00:01:56 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
    2007-07-06 23:56:23 0 d-------- C:\Program Files\Norton AntiVirus
    2007-07-06 23:55:49 0 d-------- C:\Program Files\Symantec
    2007-07-06 23:55:47 0 d-------- C:\Documents and Settings\All Users\Application Data\Symantec
    2007-07-06 23:55:37 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2007-07-06 23:53:20 0 d-------- C:\Program Files\Yahoo!
    2007-07-06 23:47:34 258048 --a------ C:\WINDOWS\system32\Uninstall_eRecovery.exe <Not Verified; Acer Inc.; Uninstall_eRecovery.exe>
    2007-07-06 23:47:34 1168896 --a------ C:\WINDOWS\system32\ERUpdateHidden.EXE <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2007-07-06 23:47:34 159744 --a------ C:\WINDOWS\system32\CloseProcessWindow.dll <Not Verified; acer inc.; CloseProcessWindow.dll>
    2007-07-06 23:47:34 16384 --a------ C:\WINDOWS\system32\ClearEvent.exe
    2007-07-06 23:47:34 258048 --a------ C:\WINDOWS\system32\CheckD2DSystem.exe <Not Verified; Acer Inc.; CheckD2DSystem.exe>
    2007-07-06 23:35:01 0 d-------- C:\Program Files\Launch Manager
    2007-07-06 23:33:53 0 d-------- C:\Program Files\Synaptics
    2007-07-06 23:30:17 45056 --a------ C:\WINDOWS\system32\Epm-Po.dll <Not Verified; Acer Labs USA; EPM-PO Dynamic Link Library>
    2007-07-06 23:30:17 53248 --a------ C:\WINDOWS\system32\acpimof.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
    2007-07-06 23:26:53 0 d-------- C:\WINDOWS\Acer
    2007-07-06 23:26:53 0 d-------- C:\Documents and Settings\Joni\Application Data\Macromedia
    2007-07-06 23:26:12 0 d--h----- C:\Documents and Settings\Joni\Templates
    2007-07-06 23:26:12 0 d-------- C:\Documents and Settings\Joni\Start Menu
    2007-07-06 23:26:12 0 dr-h----- C:\Documents and Settings\Joni\SendTo
    2007-07-06 23:26:12 0 d--h----- C:\Documents and Settings\Joni\PrintHood
    2007-07-06 23:26:12 1835008 --ah----- C:\Documents and Settings\Joni\NTUSER.DAT
    2007-07-06 23:26:12 0 d--h----- C:\Documents and Settings\Joni\NetHood
    2007-07-06 23:26:12 0 dr------- C:\Documents and Settings\Joni\My Documents
    2007-07-06 23:26:12 0 d--h----- C:\Documents and Settings\Joni\Local Settings
    2007-07-06 23:26:12 0 dr------- C:\Documents and Settings\Joni\Favorites
    2007-07-06 23:26:12 0 d-------- C:\Documents and Settings\Joni\Desktop
    2007-07-06 23:26:12 0 d--hs---- C:\Documents and Settings\Joni\Cookies
    2007-07-06 23:26:12 0 d--h----- C:\Documents and Settings\Joni\Application Data
    2007-07-06 23:26:12 0 d-------- C:\Documents and Settings\Joni\Application Data\Identities
    2007-07-06 23:26:12 0 d-------- C:\Documents and Settings\Joni\Application Data\ATI
    2007-07-06 23:25:15 262144 --a------ C:\Documents and Settings\All Users\NTUSER.DAT
    2007-07-06 23:19:58 261627 --a------ C:\WINDOWS\EMEAWG.EXE
    2007-07-06 23:19:53 589824 --a------ C:\WINDOWS\AntiV.EXE
    2007-07-06 23:19:53 163840 --a------ C:\WINDOWS\AExec.exe <Not Verified; Acer Inc.; Acer Tool>
    2007-07-06 23:19:52 633446 --a------ C:\WINDOWS\GVista.exe
    2007-07-06 23:17:53 147456 --a------ C:\WINDOWS\UNINST32.EXE <Not Verified; Dritek System Inc.; Dritek System Inc. Uninstall Application>
    2007-07-06 23:16:07 253952 --a------ C:\WINDOWS\AArrange.exe <Not Verified; Acer Inc.; DesktopAutoArrange.exe>
    2007-07-06 13:25:11 0 d-------- C:\Documents and Settings\Default User\Application Data\Identities
    2007-07-06 13:25:11 0 d-------- C:\Documents and Settings\Default User\Application Data\ATI


    -- Find3M Report ---------------------------------------------------------------

    2007-07-06 23:20:00 1101 --a------ C:\WINDOWS\CLEANUP.CMD
    2007-07-06 23:17:50 842 --a------ C:\WINDOWS\HotFix.bat


    -- Registry Dump ---------------------------------------------------------------

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
    {02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
    {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    {9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} C:\Program Files\Windows Live Toolbar\msntb.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
    "ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
    "IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
    "MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC"
    "PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
    "PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
    "LManager"="C:\\PROGRA~1\\LAUNCH~1\\LManager.exe"
    "ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\CLIStart.exe\""
    "ePower_DMC"="C:\\Acer\\Empowering Technology\\ePower\\ePower_DMC.exe"
    "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
    "SmcService"="C:\\PROGRA~1\\Sygate\\SPF\\smc.exe -startgui"
    "PrevxOne"="\"C:\\Program Files\\Prevx2\\PXConsole.exe\""

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
    "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
    63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
    6d,73,73,74,79,6c,65,73,00
    "InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
    73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools"=dword:00000000

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

    HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
    Authentication Packages REG_MULTI_SZ msv1_0\0\0
    Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
    Notification Packages REG_MULTI_SZ scecli\0\0

    HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver
    HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
    HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
    LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
    NetworkService REG_MULTI_SZ DnsCache\0\0
    DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
    rpcss REG_MULTI_SZ RpcSs\0\0
    imgsvc REG_MULTI_SZ StiSvc\0\0
    termsvcs REG_MULTI_SZ TermService\0\0

    *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_PREVXDRIVER
    *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_PREVXTDI
    *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_PXRDDRIVER


    -- End of Deckard's System Scanner: finished at 2007-07-08 at 00:50:24 ---------


    Deckard's System Scanner v20070611.50
    Extra logfile - please post this as an attachment with your post.
    --------------------------------------------------------------------------------

    -- System Information ----------------------------------------------------------

    Microsoft Windows XP Professional (build 2600) SP 2.0
    Architecture: X86; Language: English

    CPU 0: Mobile AMD Sempron(tm) Processor 3400+
    Percentage of Memory in Use: 39%
    Physical Memory (total/avail): 894.1 MiB / 536.66 MiB
    Pagefile Memory (total/avail): 2165.82 MiB / 1619.1 MiB
    Virtual Memory (total/avail): 2047.88 MiB / 1970.15 MiB

    C: is Fixed (FAT32) - 55.87 GiB total, 34.08 GiB free.
    D: is CDROM (CDFS)


    -- Security Center -------------------------------------------------------------

    AUOptions is scheduled to auto-install.
    Windows Internal Firewall is enabled.

    FirstRunDisabled is set.
    AntiVirusDisableNotify is set.
    FirewallDisableNotify is set.

    FW: Sygate Personal Firewall v4.6 (Sygate Technologies, Inc.)
    AV: avast! antivirus 4.7.1001 [VPS 000754-4] v4.7.1001 (ALWIL Software)
    AV: Prevx 2.0 v1.0.1.33 (Prevx Ltd.) Disabled

    [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"

    [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
    "C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:µTorrent"
    "C:\\Documents and Settings\\Joni\\Desktop\\utorrent.exe"="C:\\Documents and Settings\\Joni\\Desktop\\utorrent.exe:*:Enabled:µTorrent"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam Client"


    -- Environment Variables -------------------------------------------------------

    ALLUSERSPROFILE=C:\Documents and Settings\All Users
    APPDATA=C:\Documents and Settings\Joni\Application Data
    CLIENTNAME=Console
    CommonProgramFiles=C:\Program Files\Common Files
    COMPUTERNAME=ACER-C28991BD48
    ComSpec=C:\WINDOWS\system32\cmd.exe
    FP_NO_HOST_CHECK=NO
    HOMEDRIVE=C:
    HOMEPATH=\Documents and Settings\Joni
    LOGONSERVER=\\ACER-C28991BD48
    NUMBER_OF_PROCESSORS=1
    OS=Windows_NT
    Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\;;C:\PROGRA~1\COMMON~1\MUVEET~1\030625
    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    PROCESSOR_ARCHITECTURE=x86
    PROCESSOR_IDENTIFIER=x86 Family 15 Model 76 Stepping 2, AuthenticAMD
    PROCESSOR_LEVEL=15
    PROCESSOR_REVISION=4c02
    ProgramFiles=C:\Program Files
    PROMPT=$P$G
    SESSIONNAME=Console
    SystemDrive=C:
    SystemRoot=C:\WINDOWS
    TEMP=C:\DOCUME~1\Joni\LOCALS~1\Temp
    TMP=C:\DOCUME~1\Joni\LOCALS~1\Temp
    USERDOMAIN=ACER-C28991BD48
    USERNAME=Joni
    USERPROFILE=C:\Documents and Settings\Joni
    windir=C:\WINDOWS


    -- User Profiles ---------------------------------------------------------------

    Joni (admin)
    Administrator (admin)


    -- Add/Remove Programs ---------------------------------------------------------

    --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Acer Inc.\Acer English Online Help Creator\Uninst.isu"
    --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    µTorrent --> "C:\Program Files\uTorrent\uninstall.exe"
    Acer Empowering Technology --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB6097D9-D722-4987-BD9E-A076E2848EE2}\setup.exe" -l0x9 -removeonly
    Acer ePerformance Management --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7057702F-6D71-4F30-8000-9E72BC771887}\setup.exe" -l0x9 -removeonly
    Acer ePower Management --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58E5844B-7CE2-413D-83D1-99294BF6C74F}\Setup.exe" -l0x9
    Acer ePresentation Management --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BF839132-BD43-4056-ACBF-4377F4A88E2A}\Setup.exe" -l0x9
    Acer eSettings Management --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1F2C8256-2773-46C7-9ABA-3E39C24ABB51}\setup.exe" -l0x9 -removeonly
    Acer GridVista --> C:\WINDOWS\UnInst32.exe GridV.UNI
    Acer Screensaver --> MsiExec.exe /I{D458BBDC-0363-42E0-8FF9-4736E3CB3CA2}
    Adobe Reader 8.1.0 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81000000003}
    Adobe® Photoshop® Album Starter Edition 3.2 --> MsiExec.exe /I{A654A805-41D9-40C7-AA46-4AF04F044D61}
    ATI-ohjelmiston poisto-ohjelma --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
    ATI Catalyst Control Center --> MsiExec.exe /I{14C8B4D9-E917-4319-83E0-5A42EC6CBB7D}
    ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
    ATI Parental Control & Encoder --> MsiExec.exe /I{36CDA33B-909B-4719-97D1-C4B99309BDC7}
    ATI Parental Control & Encoder --> MsiExec.exe /I{8D70145A-3BD3-4DBF-9CBF-223EF4A43257}
    Automaattiset valikot (Windows Live Toolbar) --> MsiExec.exe /X{AD211425-49BE-48D4-889C-C614DA6AC4AD}
    avast! Antivirus --> rundll32 C:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup
    AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
    Azureus Vuze --> C:\Program Files\Azureus\uninstall.exe
    Battlefield 1942 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}\setup.exe" -l0x9
    CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
    GameSpot Download Manager --> "C:\Program Files\GameSpot\uninstall.exe"
    GemMaster Mystic --> "C:\Program Files\GemMaster\uninstallgemmaster.exe"
    High Definition Audio Driver Package - KB888111 --> "C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
    HijackThis 1.99.1 --> C:\HJT\HijackThis.exe /uninstall
    Java(TM) SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
    Kaspersky Online Scanner --> C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
    Launch Manager --> C:\WINDOWS\UnInst32.exe LManager.UNI
    LiveUpdate 3.0 (Symantec Corporation) --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
    Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
    Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
    Mozilla Firefox (2.0.0.4) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
    NTI Backup NOW! 4 --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{385979FE-DC4F-4140-8EAD-A59625000D72} /l1033 BUN4
    NTI CD & DVD-Maker --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2} /l1033 CDM7
    OneCare Advisor (Windows Live Toolbar) --> MsiExec.exe /X{E9B3A621-DCC5-4649-940C-6456CF0AF9DA}
    Otto --> "C:\Program Files\EnglishOtto\uninstallotto.exe"
    Outlook-työkalurivi (Windows Live Toolbar) --> MsiExec.exe /X{EB36F61F-53CD-4813-BB7F-75B16AAC1713}
    Ponnahdusikkunoiden esto (Windows Live Toolbar) --> MsiExec.exe /X{7A888168-7E7D-477C-9490-24CEB079435B}
    PowerDVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.EXE" -uninstall
    PowerProducer --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\setup.exe" -uninstall
    Prevx 2.0 --> "C:\Documents and Settings\All Users\Application Data\Prevx\PrevxSetup.exe" ACTION=UNINSTALL -V -REBOOT -APP
    PunkBuster for Battlefield 1942 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{127B684B-A002-44C8-99A7-6CF8F1E26873}\setup.exe" -l0x9
    Realtek High Definition Audio Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\SETUP.exe" -l0x9 -removeonly
    Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
    Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
    Selaus välilehtiä käyttäen (Windows Live Toolbar) --> MsiExec.exe /X{E14FC354-9ED8-4D79-A7DA-356D66BF5F54}
    SMSC IrCC V5.1.3600.7 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0700\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F1B8DB67-D30E-4FF9-A85F-3CEE51825AA2}\setup.exe" -l0x9 UNINSTALL
    Soft Data Fax Modem with SmartCP --> C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2BFA&SUBSYS_1025009F\HXFSETUP.EXE -U -IAcrS09Fp.inf
    Sonic Encoders --> MsiExec.exe /I{9941F0AA-B903-4AF4-A055-83A9815CC011}
    Steam --> MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
    Syötteen tunnistus (Windows Live Toolbar) --> MsiExec.exe /X{71A52B94-5BF1-4B0A-8098-37A9D495D5D8}
    Sygate Personal Firewall --> MsiExec.exe /I{F34D9A5F-484A-4E31-A9D3-908CB265B289}
    Symantec KB-DocID:2003093015493306 --> MsiExec.exe /I{08C5815C-2C6E-44f8-8748-0E61BC9AFB68}
    Synaptics Pointing Device Driver --> rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
    Update Rollup 2 for Windows XP Media Center Edition 2005 --> C:\WINDOWS\$NtUninstallKB900325$\spuninst\spuninst.exe
    Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (04/28/2006 1.3.1.0) --> C:\PROGRA~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPINST.EXE /d /u C:\WINDOWS\system32\DRVSTORE\amdk8_9EA6D2FA46FEFFB7011ED0B6015B626D07F1EEF7\amdk8.inf
    Windows Live Messenger --> MsiExec.exe /I{DF6FEB75-A0D1-44E5-A754-0072D4967734}
    Windows Live Sign-in Assistant --> MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}
    Windows Live Toolbar --> "C:\Program Files\Windows Live Toolbar\UnInstall.exe" {E33C2495-B60D-4073-80CD-90DC2E66966B}
    Windows Live Toolbar --> MsiExec.exe /X{E33C2495-B60D-4073-80CD-90DC2E66966B}
    Windows Live Toolbarin laajennus (Windows Live Toolbar) --> MsiExec.exe /X{2C4BFAFE-F698-421B-8687-4CBF9A5FD5E0}
    Windows XP Media Center Edition 2005 KB912067 --> "C:\WINDOWS\$NtUninstallKB912067$\spuninst\spuninst.exe"
    WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
    World of Warcraft --> C:\Program Files\Common Files\Blizzard Entertainment\World of Warcraft\Uninstall.exe
    Yahoo! Toolbar --> C:\PROGRA~1\YAHOO!\common\unyt.exe


    -- End of Deckard's System Scanner: finished at 2007-07-08 at 00:50:24 ---------

    tässä nämä logit
     
    Joniko90, Jul 7, 2007
    #7
  8. Auttaja

    Auttaja Guest

    Oisko toi vaan false positive? Ainakin monenlaista skanneria oot veivannu, eikä muut oo sitä huomannu.
     
    Auttaja, Jul 7, 2007
    #8
  9. Joniko90

    Joniko90 Member

    Joined:
    Jul 22, 2006
    Messages:
    57
    Likes Received:
    0
    Trophy Points:
    16
    Sain sen viruksen loppuenlopuksi pois, kun scannasin Ad-Awarella koneen. Se löysi tämän Backdoor.Bifrosen
     
    Joniko90, Jul 8, 2007
    #9
  10. Auttaja

    Auttaja Guest

    Moi, juteltuani erään expertin kanssa hänen neuvonsa on formatoida koneet jotka ovat saastuneet tällä takaovella. Tutkitaan siis viel jos et halua sitä tehdä

    Lataa Dr.Web CureIt työpöydälle:
    ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

    [*]Tuplaklikkaa drweb-cureit.exe ja anna sen tehdä express scan
    [*]Se skannaa käynnissä olevat ohjelmat ja jos jotain löytyy, klikkaa yes kun se kysyy haluatko poistaa sen. Tämä on vain lyhyt scan.
    [*]Kun scan on valmis, merkkaa asemat, jotka haluat scannata.
    [*]Valitse kaikki asemat. Punainen piste osoittaa, mitkä asemat on valittu.
    [*]Klikaa vihreää nuolta oikealla ja scan alkaa.
    [*]Klikkaa 'Yes to all', jos kysytään haluatko poistaa/siirtää tiedoston.
    [*]Kun scan on valmis, katso voitko klikata next-kuvaketta löytyneiden tiedostojen vieressä: [​IMG]
    [*]Jos asia on niin, klikkaa sitä ja sitten klikkaa next-kuvaketta oikealla alhaalla ja valitse Move incurable kuten alla olevalla kuvassa:
    [​IMG]
    Tämä siirtää sen %userprofile%\DoctorWeb\quarantine-hakemistoon.
    [*]Tämän jälkeen klikkaa Dr.Web CureIt-valikossa file ja valitse save report list
    [*]Tallenna raportti työpöydälle. Raportin nimi on DrWeb.csv
    [*]Sulje Dr.Web Cureit.
    [*]Käynnistä kone uudelleen !! Tämä siksi, että käytössä olevat tiedostot poistetaan/siirretään käynnistyksen yhteydessä.
    [*]Käynnistyksen jälkeen liitä Dr.Web-lokin, jonka tallensit aiemmin, sisältö seuraavaan vastaukseesi.
     
    Auttaja, Jul 8, 2007
    #10
  11. Joniko90

    Joniko90 Member

    Joined:
    Jul 22, 2006
    Messages:
    57
    Likes Received:
    0
    Trophy Points:
    16
    lan.exe c:\windows\system32 Probably BINARYRES Incurable.Moved.
    lan.exe C:\ Probably BINARYRES Incurable.Moved.
    Process.exe C:\WINDOWS\system32 Tool.Prockill Incurable.Moved.
    71AA8828d01 C:\Documents and Settings\Joni\Local Settings\Application Data\Mozilla\Firefox\Profiles\lluibkfg.default\Cache Trojan.DownLoader.10449 Deleted.
    Process.exe C:\Documents and Settings\Joni\Desktop\SmitfraudFix Tool.Prockill Incurable.Moved.
    restart.exe C:\Documents and Settings\Joni\Desktop\SmitfraudFix Tool.ShutDown.11 Incurable.Moved.
    mirc.exe C:\Program Files\mIRC Program.mIRC.621 Incurable.Moved.
    A0010427.exe C:\System Volume Information\_restore{099D30DC-C26B-4E90-9285-C34D0601D32B}\RP40 Tool.Prockill Incurable.Moved.
    A0010429.exe C:\System Volume Information\_restore{099D30DC-C26B-4E90-9285-C34D0601D32B}\RP40 Tool.ShutDown.11 Incurable.Moved.
    A0011309.exe C:\System Volume Information\_restore{099D30DC-C26B-4E90-9285-C34D0601D32B}\RP47 Probably BINARYRES Incurable.Moved.
     
    Joniko90, Jul 8, 2007
    #11
  12. Auttaja

    Auttaja Guest

    Lataa GMER ja tallenna se työpöydällesi:
    [*]Pura se työpöydälle ja tuplaklikkaa tiedostoa GMER.exe
    [*]Klikkaa rootkit-välilehteä ja sitten klikkaa scan.
    [*]Älä rastita "Show All" boksia skannauksen aikana!
    [*]Kun skannaus on valmis, klikkaa Copy.
    [*]Tämä kopioi lokin leikepöydälle (voit tallentaa lokin varmuuden vuoksi tekstitiedostoon).
    [*]Liitä loki sitten viestiketjuusi.
     
    Auttaja, Jul 8, 2007
    #12
  13. Joniko90

    Joniko90 Member

    Joined:
    Jul 22, 2006
    Messages:
    57
    Likes Received:
    0
    Trophy Points:
    16
    GMER 1.0.13.12551 - http://www.gmer.net
    Rootkit scan 2007-07-09 16:07:33
    Windows 5.1.2600 Service Pack 2


    ---- System - GMER 1.0.13 ----

    SSDT 84BD7DA0 ZwAlertResumeThread
    SSDT 84BC40A8 ZwAlertThread
    SSDT 84BC4D58 ZwAllocateVirtualMemory
    SSDT 84C1D7B0 ZwConnectPort
    SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS ZwCreateKey
    SSDT 84BFC0E0 ZwCreateMutant
    SSDT 84F7FDB8 ZwCreateThread
    SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS ZwDeleteKey
    SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS ZwDeleteValueKey
    SSDT 84DEE158 ZwFreeVirtualMemory
    SSDT 84BFC1C0 ZwImpersonateAnonymousToken
    SSDT 84BD7CC0 ZwImpersonateThread
    SSDT 84BD8230 ZwMapViewOfSection
    SSDT 84F7F1C0 ZwOpenEvent
    SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwOpenProcess
    SSDT 84F7FCF8 ZwOpenProcessToken
    SSDT 84BD01B8 ZwOpenThreadToken
    SSDT 84F7F0F0 ZwQueryValueKey
    SSDT 84FD47B8 ZwResumeThread
    SSDT 84BD00D8 ZwSetContextThread
    SSDT 84F84098 ZwSetInformationProcess
    SSDT 84FA11B8 ZwSetInformationThread
    SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS ZwSetValueKey
    SSDT 84F7F050 ZwSuspendProcess
    SSDT 84BC4008 ZwSuspendThread
    SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwTerminateProcess
    SSDT 84FA10F8 ZwTerminateThread
    SSDT 84F84178 ZwUnmapViewOfSection
    SSDT 84BC4C68 ZwWriteVirtualMemory

    ---- Devices - GMER 1.0.13 ----

    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_NAMED_PIPE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_READ [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_WRITE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_EA [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_EA [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_FLUSH_BUFFERS [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_VOLUME_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_VOLUME_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DIRECTORY_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_FILE_SYSTEM_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_LOCK_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_MAILSLOT [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_SECURITY [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_SECURITY [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_POWER [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SYSTEM_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CHANGE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_QUOTA [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_QUOTA [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_NAMED_PIPE [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLOSE [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_READ [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_WRITE [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_INFORMATION [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_INFORMATION [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_EA [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_EA [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_FLUSH_BUFFERS [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_VOLUME_INFORMATION [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_VOLUME_INFORMATION [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DIRECTORY_CONTROL [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_FILE_SYSTEM_CONTROL [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CONTROL [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_INTERNAL_DEVICE_CONTROL [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SHUTDOWN [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_LOCK_CONTROL [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLEANUP [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_MAILSLOT [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_SECURITY [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_SECURITY [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_POWER [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SYSTEM_CONTROL [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CHANGE [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_QUOTA [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_QUOTA [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CREATE [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CREATE_NAMED_PIPE [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CLOSE [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_READ [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_WRITE [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_INFORMATION [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_INFORMATION [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_EA [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_EA [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_FLUSH_BUFFERS [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_VOLUME_INFORMATION [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_VOLUME_INFORMATION [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_DIRECTORY_CONTROL [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_FILE_SYSTEM_CONTROL [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_DEVICE_CONTROL [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_INTERNAL_DEVICE_CONTROL [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SHUTDOWN [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_LOCK_CONTROL [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CLEANUP [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CREATE_MAILSLOT [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_SECURITY [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_SECURITY [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_POWER [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SYSTEM_CONTROL [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_DEVICE_CHANGE [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_QUOTA [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_QUOTA [F6EF7A30] SynTP.sys
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_NAMED_PIPE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_READ [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_WRITE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_EA [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_EA [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FLUSH_BUFFERS [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_VOLUME_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_VOLUME_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DIRECTORY_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FILE_SYSTEM_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_LOCK_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_MAILSLOT [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_SECURITY [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_SECURITY [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_POWER [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SYSTEM_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CHANGE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_QUOTA [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_QUOTA [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_NAMED_PIPE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_READ [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_WRITE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_EA [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_EA [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_FLUSH_BUFFERS [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_VOLUME_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_VOLUME_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_DIRECTORY_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_FILE_SYSTEM_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SHUTDOWN [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_LOCK_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_MAILSLOT [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_SECURITY [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_SECURITY [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_POWER [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SYSTEM_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CHANGE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_QUOTA [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_QUOTA [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_NAMED_PIPE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_READ [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_WRITE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_EA [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_EA [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_FLUSH_BUFFERS [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_VOLUME_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_VOLUME_INFORMATION [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_DIRECTORY_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_FILE_SYSTEM_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SHUTDOWN [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_LOCK_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_MAILSLOT [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_SECURITY [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_SECURITY [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_POWER [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SYSTEM_CONTROL [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CHANGE [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_QUOTA [EE5B3570] SYMTDI.SYS
    AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_QUOTA [EE5B3570] SYMTDI.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE [F72EA1DE] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_NAMED_PIPE [F72EA1DE] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLOSE [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_READ [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_WRITE [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_EA [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL [F72EA454] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_INTERNAL_DEVICE_CONTROL [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_MAILSLOT [F72EA1DE] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_SECURITY [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_SECURITY [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_POWER [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SYSTEM_CONTROL [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CHANGE [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_QUOTA [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_QUOTA [F72DDF4C] fltMgr.sys
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_NAMED_PIPE [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLOSE [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_READ [EE4C18F0] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_WRITE [EE4C1950] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_EA [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_INTERNAL_DEVICE_CONTROL [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_MAILSLOT [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_SECURITY [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_SECURITY [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_POWER [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SYSTEM_CONTROL [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CHANGE [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_QUOTA [EE4C1860] SYMEVENT.SYS
    AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_QUOTA [EE4C1860] SYMEVENT.SYS

    ---- EOF - GMER 1.0.13 ----
     
    Joniko90, Jul 9, 2007
    #13
  14. Auttaja

    Auttaja Guest

    moro, takaovien kanssa ei leikitä, joten se voi hyvinkin olla vielä sielä, joten tässä kuitenkin ohjeet "puhtaana" pysymiseen

    Pysy puhtaana

    -> Tyhjennä järjestelmänpalautus Ohjeet
    Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste. Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä.

    -> Käytä CCleaneria -> CCleaner
    Lataa ja asenna CCleaner. Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti.

    -> Asenna SpywareBlaster -> SpywareBlaster
    SpywareBlaster estää haittaohjelmia asentumasta koneellesi. Ei kuluta muistia!
    Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas

    -> Asenna MVPS Hosts tiedosto -> MVPS Hosts
    Estää koneesi yhteyden haitallisiin sivustoihin.
    Opas saatavilla suomeksi! Nimimerkki Axelin opas

    -> Vaihda selaimesi Firefoxiin -> Firefox
    Firefox on nopeampi, turvallisempi ja parempi selain kuin Internet Explorer.

    -> Pidä järjestelmäsi ajantasalla. -> Windows Update
    Vieraile Windows Updatessa säännöllisesti.

    -> Pidä palomuuri ja virustorjunta ajantasalla
    Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi.
    ja hyvä myös escan http://koti.mbnet.fi/pattaya1/escanmwav.htm

    ->Pidä ohjelmistosi ajantasalla. -> Secunia Software Inspector
    Secunia Software Inspector tutkii sinun järjestälmäsi ja ohjelmistosi puuttuvien turvallisuuspäivityksien osalta. Tavallinen tutkinta kestää normaalisti 5-40 sekuntia, kun läpikotainen (thorough system inspection) voi kestää useita minuutteja.

    ->Seuraa säännöllisesti viestintäviraston tietoja uusista haavoittuvuuksista -> CERT-FI

    Jos tulevaisuudessa tulee haittaohjelmien kanssa ongelmia, älä epäröi laittaa Hijackthis-logia tarkistettavaksi!

    lokit on siis kunnossa.
     
    Auttaja, Jul 9, 2007
    #14

Share This Page