Ei asenna ohjelmia/lagaa.

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by maakari, Feb 16, 2009.

  1. maakari

    maakari Newbie

    Joined:
    Sep 1, 2006
    Messages:
    0
    Likes Received:
    0
    Trophy Points:
    0
    Niin kaikki tuntuu menevän päin p#rsettä tän koneen kanssa.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:59:30, on 16.2.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Java\jre1.5.0\bin\jusched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\ZyXEL\G360\Gcc.exe
    C:\Program Files\ZyXEL\G360\OdHost.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
    C:\Program Files\Steam\Steam.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: ZyXEL G-360 Wireless Adapter Utility.lnk = C:\Program Files\ZyXEL\G360\Gcc.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1234710757781
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    --
    End of file - 4403 bytes
     
    maakari, Feb 16, 2009
    #1
  2. Hujo

    Hujo Guest

    Lataa JavaRa ja pura se työpöydällesi.

    ***Sulje kaikki päällä olevat Internet Explorerin ikkunat ennen jatkamista!***

    * Tuplaklikkaa JavaRa.exeä käynnistääksesi ohjelma.
    * Valitse English pudotusvalikosta valitaksesi kieleksi englannin ja klikkaa Select.
    * Klikkaa Remove Older Versions poistaaksesi vanhat Java-versiot koneeltasi.
    * Klikkaa Yes kun pyydetään. Kun JavaRa on valmis, se ilmoittaa, että lokitiedosto on luotu. Klikkaa OK.
    * Lokitiedosto avautuu. Lähetä sen sisältö seuraavassa viestissäsi.
    4. Asenna uusin Java päivitys seuraavasta linkistä..

    Lataa täältä uusi java

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6 Update 12
    Paina Download
    Laita Platform -kohtaan Windows
    Ruksaa I agree to the Java SE Runtime Environment 6 License Agreement ja paina Continue
    Paina Windows Offline Installationin alapuolella jre-6u4-windows-i586-p.exe

    Tallenna tiedosto vaikka työpöydälle ja asenna se.

    5. Käynnistä kone uudelleen asennuksen jälkeen.
    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
    7. General-välilehdellä klikkaa Settings. Vedä liukusäädintä (Disk Space) pienemmälle.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

    8. Klikkaa Delete Files -nappia. Varmista että kaikki kaksi valintaa ovat rastitettuja:
    * Applications and Applets
    * Trace and Log Files

    Ja paina OK -nappia
    Huomaa: Tämä poistaa kaikki ladatut sovellukset ja appletit VÄLIMUISTISTA.

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
    10. Välilehti Update: ota ruksi pois kohdasta Check for Updates automatically
    Valitse Never check
    11. Klikkaa Apply ja OK jättääksesi Java asetusikkunasi.

    ============

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi
     
    Hujo, Feb 16, 2009
    #2
  3. maakari

    maakari Newbie

    Joined:
    Sep 1, 2006
    Messages:
    0
    Likes Received:
    0
    Trophy Points:
    0
    Java ei suostunut asentumaan jostain syystä mutta tässä ne logit:

    Malwarebytes' Anti-Malware 1.34
    Tietokantaversio: 1765
    Windows 5.1.2600 Service Pack 3

    16.2.2009 20:19:29
    mbam-log-2009-02-16 (20-19-29).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|)
    Tarkistetut kohteet: 86609
    Kulunut aika: 25 minute(s), 31 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)

    JavaRa 1.13 Removal Log.

    Report follows after line.

    ------------------------------------

    The JavaRa removal process was started on Mon Feb 16 19:46:52 2009

    Found and removed: C:\Windows\System32\jpicpl32.cpl

    Found and removed: Software\JavaSoft\Java2D\1.5.0

    Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}

    Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D510000

    Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510000

    Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D510000

    Found and removed: SOFTWARE\Classes\JavaPlugin.150

    Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0

    Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.5.0

    Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5

    Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0

    Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D510000

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510000

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150000}

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.5.0

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.5.0\

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core1.zip

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core2.zip

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core3.zip

    ------------------------------------

    Finished reporting.



    JavaRa 1.13 Removal Log.

    Report follows after line.

    ------------------------------------

    The JavaRa removal process was started on Mon Feb 16 19:47:20 2009

    ------------------------------------

    Finished reporting.



    Myöskään spybot ei löytäny mitään.
     
    maakari, Feb 16, 2009
    #3
  4. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki

    ==========

    Luo poistolista:
    • Avaa HiJackThis
    • Klikkaa "Configure" valintaa oikealla alhaalla
    • Klikkaa "Misc Tools"
    • Klikkaa boxia joka sanoo "Uninstall Manager"
    • Klikkaa valintaa "Save list"
    • Kopioi ja liitä kyseinen lista muistiosta ketjuusi
     
    Hujo, Feb 16, 2009
    #4
  5. maakari

    maakari Newbie

    Joined:
    Sep 1, 2006
    Messages:
    0
    Likes Received:
    0
    Trophy Points:
    0
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:36:30, on 16.2.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\ZyXEL\G360\Gcc.exe
    C:\Program Files\ZyXEL\G360\OdHost.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
    C:\Program Files\Steam\Steam.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: ZyXEL G-360 Wireless Adapter Utility.lnk = C:\Program Files\ZyXEL\G360\Gcc.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1234710757781
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    --
    End of file - 5009 bytes
     
    maakari, Feb 16, 2009
    #5
  6. Hujo

    Hujo Guest

    Poista lisää poistra sovelutuksesta

    Spybot - Search & Destroy

    Poista kansio vikasiedossa

    C:\Program Files\Spybot - Search & Destroy


    ============

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
    O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
     
    Hujo, Feb 16, 2009
    #6
  7. maakari

    maakari Newbie

    Joined:
    Sep 1, 2006
    Messages:
    0
    Likes Received:
    0
    Trophy Points:
    0
    Poistin spybotin ja noi jutut hjt:llä, tuntuu kyllä vieläkin tökkivän ja ei suostu asentamaan ohjelmia.
     
    maakari, Feb 16, 2009
    #7
  8. Hujo

    Hujo Guest

    1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
    Combofix1
    Combofix2

    älä asenna palautus consolia
    2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, Feb 16, 2009
    #8
  9. maakari

    maakari Newbie

    Joined:
    Sep 1, 2006
    Messages:
    0
    Likes Received:
    0
    Trophy Points:
    0
    ComboFix 09-02-15.01 - 2009-02-16 22:30:01.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.2047.1652 [GMT 2:00]
    Sijainti: c:\documents and settings\\Työpöytä\ComboFix.exe
    AV: avast! antivirus 4.8.1335 [VPS 090216-1] *On-access scanning disabled* (Updated)
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-16 to 2009-02-16 )))))))))))))))))
    .

    2009-02-16 21:54 . 2009-02-16 22:02 <KANSIO> d-------- c:\program files\Savage 2 - A Tortured Soul
    2009-02-16 20:40 . 2009-02-16 21:47 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-02-16 19:52 . 2009-02-16 19:52 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
    2009-02-16 19:52 . 2009-02-16 19:52 <KANSIO> d-------- c:\documents and settings\Miro Nieminen\Application Data\Malwarebytes
    2009-02-16 19:52 . 2009-02-16 19:52 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-02-16 19:52 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
    2009-02-16 19:52 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
    2009-02-16 16:59 . 2009-02-16 16:59 <KANSIO> d-------- c:\program files\Trend Micro
    2009-02-15 23:19 . 2009-02-15 23:19 <KANSIO> d-------- c:\program files\uTorrent
    2009-02-15 23:19 . 2009-02-16 19:45 <KANSIO> d-------- c:\documents and settings\Miro Nieminen\Application Data\uTorrent
    2009-02-15 23:17 . 2009-02-15 23:17 <KANSIO> d-------- c:\program files\Wolfenstein - Enemy Territory
    2009-02-15 21:54 . 2009-02-15 21:54 <KANSIO> d-------- c:\program files\ASTRA32
    2009-02-15 21:52 . 2009-02-15 21:52 <KANSIO> d-------- c:\program files\Lavalys
    2009-02-15 21:16 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
    2009-02-15 21:16 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll
    2009-02-15 21:16 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
    2009-02-15 21:06 . 2009-02-15 21:06 31 --a------ c:\windows\GunzLauncher.INI
    2009-02-15 19:49 . 2009-02-15 19:49 <KANSIO> d-------- c:\program files\Common Files\INCA Shared
    2009-02-15 19:49 . 2009-02-15 19:49 <KANSIO> d-------- c:\documents and settings\Miro Nieminen\Application Data\NPLUTO Corporation
    2009-02-15 19:49 . 2003-07-19 17:17 5,174 --a------ c:\windows\system32\nppt9x.vxd
    2009-02-15 19:49 . 2005-01-03 08:43 4,682 --a------ c:\windows\system32\npptNT2.sys
    2009-02-15 19:28 . 2009-02-15 19:49 <KANSIO> d-------- c:\program files\DriftCity
    2009-02-15 19:03 . 2009-02-16 22:28 <KANSIO> d-------- c:\program files\Steam
    2009-02-15 18:15 . 2009-02-15 18:15 <KANSIO> d-------- C:\ijji
    2009-02-15 18:15 . 2009-02-15 21:02 <KANSIO> d--h----- c:\documents and settings\Miro Nieminen\Application Data\ijjigame
    2009-02-15 18:14 . 2009-02-15 18:14 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\IJJIGame
    2009-02-15 18:08 . 2009-02-15 22:18 <KANSIO> d-------- C:\World of Warcraft
    2009-02-15 18:08 . 2009-02-15 22:13 <KANSIO> d-------- c:\program files\Common Files\Blizzard Entertainment
    2009-02-15 17:51 . 2008-06-14 19:34 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys
    2009-02-15 17:49 . 2008-10-16 03:01 666,112 -----c--- c:\windows\system32\dllcache\wininet.dll
    2009-02-15 17:48 . 2009-02-15 17:49 <KANSIO> d-------- c:\documents and settings\Miro Nieminen\Application Data\Ventrilo
    2009-02-15 17:48 . 2008-10-16 03:01 1,498,624 -----c--- c:\windows\system32\dllcache\shdocvw.dll
    2009-02-15 17:48 . 2008-10-16 03:01 619,008 -----c--- c:\windows\system32\dllcache\urlmon.dll
    2009-02-15 17:47 . 2009-02-15 17:47 <KANSIO> d-------- c:\program files\Ventrilo
    2009-02-15 17:47 . 2009-02-15 17:47 <KANSIO> d-------- c:\program files\Common Files\Wise Installation Wizard
    2009-02-15 17:47 . 2008-08-14 15:25 2,191,488 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
    2009-02-15 17:47 . 2008-08-14 15:25 2,147,840 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
    2009-02-15 17:47 . 2008-08-14 15:25 2,068,352 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
    2009-02-15 17:47 . 2008-08-14 15:24 2,026,496 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
    2009-02-15 17:47 . 2008-09-15 17:27 1,846,656 -----c--- c:\windows\system32\dllcache\win32k.sys
    2009-02-15 17:47 . 2009-02-15 17:47 262 --a------ c:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
    2009-02-15 17:46 . 2008-12-12 19:03 3,088,896 -----c--- c:\windows\system32\dllcache\mshtml.dll
    2009-02-15 17:45 . 2008-10-24 13:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
    2009-02-15 17:45 . 2008-12-11 12:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys
    2009-02-15 17:45 . 2008-05-08 16:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys
    2009-02-15 17:44 . 2008-04-11 21:05 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
    2009-02-15 17:44 . 2008-05-01 16:35 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll
    2009-02-15 17:42 . 2009-02-16 22:28 <KANSIO> d-------- c:\documents and settings\Miro Nieminen\Tracing
    2009-02-15 17:41 . 2009-02-15 17:41 <KANSIO> d-------- c:\program files\Windows Live SkyDrive
    2009-02-15 17:41 . 2009-02-15 17:41 <KANSIO> d-------- c:\program files\Windows Live
    2009-02-15 17:41 . 2009-02-15 17:41 <KANSIO> d-------- c:\program files\Microsoft
    2009-02-15 17:41 . 2008-10-15 18:37 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
    2009-02-15 17:40 . 2008-09-04 19:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
    2009-02-15 17:37 . 2009-02-15 17:37 <KANSIO> d-------- c:\program files\Common Files\Windows Live
    2009-02-15 17:30 . 2009-02-15 17:30 <KANSIO> d-------- c:\windows\system32\fi-fi
    2009-02-15 17:30 . 2009-02-15 17:30 <KANSIO> d-------- c:\windows\system32\fi
    2009-02-15 17:30 . 2009-02-15 17:30 <KANSIO> d-------- c:\windows\system32\bits
    2009-02-15 17:30 . 2009-02-15 17:30 <KANSIO> d-------- c:\windows\l2schemas
    2009-02-15 17:29 . 2009-02-15 17:31 <KANSIO> d-------- c:\windows\ServicePackFiles
    2009-02-15 17:27 . 2009-02-15 17:27 <KANSIO> d-------- c:\windows\EHome
    2009-02-15 17:23 . 2004-09-14 16:06 326,912 --------- c:\windows\system32\drivers\ati2mtaa.sys
    2009-02-15 17:13 . 2008-10-16 14:09 43,544 --a------ c:\windows\system32\wups2.dll
    2009-02-15 17:13 . 2008-10-16 14:08 31,768 --a------ c:\windows\system32\wucltui.dll.mui
    2009-02-15 17:13 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuaucpl.cpl.mui
    2009-02-15 17:13 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui
    2009-02-15 17:13 . 2008-10-16 14:07 18,968 --a------ c:\windows\system32\wuaueng.dll.mui
    2009-02-15 17:09 . 2009-02-15 17:09 <KANSIO> d---s---- c:\documents and settings\Miro Nieminen\UserData
    2009-02-15 17:01 . 2009-02-15 17:01 <KANSIO> d-------- c:\program files\Realtek AC97
    2009-02-15 17:01 . 2006-11-17 05:40 18,804,736 --a------ c:\windows\system32\alsndmgr.cpl
    2009-02-15 17:01 . 2006-12-08 15:20 10,528,768 --a------ c:\windows\system32\RTLCPL.exe
    2009-02-15 17:01 . 2008-09-24 10:40 4,122,368 -ra------ c:\windows\system32\drivers\alcxwdm.sys
    2009-02-15 17:01 . 2007-04-16 15:28 577,536 --a------ c:\windows\soundman.exe
    2009-02-15 17:01 . 2006-07-31 11:19 315,392 --a------ c:\windows\alcupd.exe
    2009-02-15 17:01 . 2006-07-31 11:27 217,088 --a------ c:\windows\Alcrmv.exe
    2009-02-15 17:01 . 2006-10-18 02:53 147,456 --a------ c:\windows\system32\RtlCPAPI.dll
    2009-02-15 17:01 . 2002-02-05 13:54 141,016 --a------ c:\windows\system32\alsndmgr.wav
    2009-02-15 17:01 . 2006-08-01 15:02 49,152 --a------ c:\windows\system32\ChCfg.exe
    2009-02-15 16:44 . 2009-02-15 16:44 <KANSIO> d-------- c:\program files\Teamspeak2_RC2
    2009-02-15 16:44 . 2009-02-16 19:57 <KANSIO> d-------- c:\documents and settings\Miro Nieminen\Application Data\teamspeak2
    2009-02-15 16:44 . 2009-02-15 16:44 34,064 --a------ c:\windows\system32\lhacm.acm
    2009-02-15 16:40 . 2009-02-15 16:40 0 --a------ c:\windows\nsreg.dat
    2009-02-15 16:34 . 2009-02-15 16:34 <KANSIO> d-------- c:\documents and settings\Miro Nieminen\Application Data\ATI
    2009-02-15 16:34 . 2009-02-15 16:34 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\ATI
    2009-02-15 16:33 . 2009-02-15 16:33 <KANSIO> d-------- c:\program files\My Company Name
    2009-02-15 16:29 . 2009-02-15 16:29 <KANSIO> d-------- c:\program files\Alwil Software
    2009-02-15 16:29 . 2003-03-18 22:20 1,060,864 --a------ c:\windows\system32\MFC71.dll
    2009-02-15 16:29 . 2003-03-18 21:14 499,712 --a------ c:\windows\system32\MSVCP71.dll
    2009-02-15 16:29 . 2003-02-21 05:42 348,160 --a------ c:\windows\system32\MSVCR71.dll
    2009-02-15 16:27 . 2009-02-15 16:27 <KANSIO> d-------- c:\program files\Common Files\ATI Technologies
    2009-02-15 16:21 . 2009-02-15 16:31 <KANSIO> d-------- c:\program files\ATI Technologies
    2009-02-15 16:21 . 2007-10-16 15:33 3,107,788 -ra------ c:\windows\system32\ativvaxx.dat
    2009-02-15 16:21 . 2007-10-16 15:33 3,107,788 -ra------ c:\windows\system32\ativva5x.dat
    2009-02-15 16:21 . 2007-04-18 02:19 1,311,202 -ra------ c:\windows\system32\drivers\ativcaxx.cpa
    2009-02-15 16:21 . 2007-09-14 03:03 157,034 -ra------ c:\windows\system32\atiicdxx.dat
    2009-02-15 16:21 . 2007-09-08 16:37 47,360 -ra------ c:\windows\system32\drivers\ativvpxx.vp
    2009-02-15 16:21 . 2007-04-18 02:19 2,096 -ra------ c:\windows\system32\drivers\ativdkxx.vp
    2009-02-15 16:21 . 2007-05-30 06:43 2,096 -ra------ c:\windows\system32\drivers\ativckxx.vp
    2009-02-15 16:21 . 2007-04-18 02:19 929 -ra------ c:\windows\system32\drivers\ativcaxx.vp
    2009-02-15 16:14 . 2001-08-17 21:53 4,992 --a------ c:\windows\system32\drivers\loop.sys
    2009-02-15 16:14 . 2001-08-17 21:53 4,992 --a--c--- c:\windows\system32\dllcache\loop.sys
    2009-02-15 16:09 . 2009-02-15 16:09 <KANSIO> d-------- c:\program files\ZyXEL
    2009-02-15 16:09 . 2009-02-15 17:01 <KANSIO> d--h----- c:\program files\InstallShield Installation Information
    2009-02-15 16:09 . 2009-02-15 16:09 <KANSIO> d-------- c:\program files\Funk Software
    2009-02-15 16:09 . 2009-02-15 16:22 <KANSIO> d-------- c:\program files\Common Files\InstallShield
    2009-02-15 16:09 . 2009-02-15 16:09 <KANSIO> d-------- c:\program files\Common Files\Funk Software
    2009-02-15 16:09 . 2004-12-01 18:30 481,664 --a------ c:\windows\system32\drivers\tnet1130x.sys
    2009-02-15 16:09 . 2004-12-01 18:31 481,248 --a------ c:\windows\system32\drivers\tnet1130.sys
    2009-02-15 16:09 . 2003-07-16 22:43 94,208 --a------ c:\windows\system32\W32N50CT.dll
    2009-02-15 16:09 . 2004-11-04 18:55 94,192 --a------ c:\windows\system32\drivers\FwRad17.bin
    2009-02-15 16:09 . 2004-11-04 18:55 92,836 --a------ c:\windows\system32\drivers\FwRad16.bin
    2009-02-15 16:09 . 2004-12-01 18:29 69,632 --a------ c:\windows\system32\TnetWCoInst.dll
    2009-02-15 16:09 . 2004-12-01 18:29 69,632 --a------ c:\windows\system32\drivers\tnetwcoinst.dll
    2009-02-15 16:09 . 2003-07-16 22:28 17,142 --a------ c:\windows\system32\CBTNDIS5.sys
    2009-02-15 16:09 . 2005-05-25 16:59 13,235 --a------ c:\windows\system32\drivers\tnet1130.INF
    2009-02-15 16:09 . 2005-06-22 01:10 9,692 --a------ c:\windows\system32\drivers\tnet1130.cat
    2009-02-15 16:09 . 1998-05-13 00:00 4,716 --a------ c:\windows\system32\VERSION.LIB
    2009-02-15 16:09 . 2009-02-15 16:09 64 --a------ c:\windows\init.ini
    2009-02-15 16:07 . 2009-02-15 14:37 <KANSIO> d--h----- c:\documents and settings\Miro Nieminen\Verkkoympäristö
    2009-02-15 16:07 . 2009-02-16 22:18 <KANSIO> d-------- c:\documents and settings\Miro Nieminen\Työpöytä
    2009-02-15 16:07 . 2009-02-15 14:37 <KANSIO> d--h----- c:\documents and settings\Miro Nieminen\Tulostinympäristö
    2009-02-15 16:07 . 2009-02-15 17:36 <KANSIO> dr------- c:\documents and settings\Miro Nieminen\Suosikit
    2009-02-15 16:07 . 2009-02-16 21:57 <KANSIO> dr------- c:\documents and settings\Miro Nieminen\Omat tiedostot
    2009-02-15 16:07 . 2009-02-15 15:52 <KANSIO> d--h----- c:\documents and settings\Miro Nieminen\Mallit
    2009-02-15 16:07 . 2009-02-15 23:19 <KANSIO> dr------- c:\documents and settings\Miro Nieminen\Käynnistä-valikko
    2009-02-15 16:07 . 2009-02-15 17:42 <KANSIO> d-------- c:\documents and settings\Miro Nieminen

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-02-06 16:52 49,504 ----a-w c:\windows\system32\sirenacm.dll
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-02-16_22.24.36,75 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-02-16 20:27:53 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_798.dat
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
    "Steam"="c:\program files\Steam\Steam.exe" [2009-02-15 1410296]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
    "SoundMan"="SOUNDMAN.EXE" [2007-04-16 c:\windows\soundman.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

    c:\documents and settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    ZyXEL G-360 Wireless Adapter Utility.lnk - c:\program files\ZyXEL\G360\Gcc.exe [2009-02-15 36864]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
    "c:\\ijji\\ENGLISH\\u_skid.exe"=
    "c:\\Program Files\\DriftCity\\DriftCity.exe"=
    "c:\\ijji\\ENGLISH\\u_gunz.exe"=
    "c:\\ijji\\ENGLISH\\Gunz\\Gunz.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\Savage 2 - A Tortured Soul\\savage2.exe"=

    R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-02-15 114768]
    R2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;c:\program files\ASTRA32\astra32.sys [2007-02-22 30864]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-02-15 20560]
    R3 TNET1130;ZyXEL 802.11b/g Wireless Card;c:\windows\system32\drivers\tnet1130.sys [2009-02-15 481248]
    .
    .
    ------- Täydentävä tarkistus -------
    .
    FF - ProfilePath - c:\documents and settings\Miro Nieminen\Application Data\Mozilla\Firefox\Profiles\grg5an10.default\
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiCHPlugin.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-16 22:31:03
    Windows 5.1.2600 Service Pack 3 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    --------------------- LUKITUT REKISTERIAVAIMET ---------------------

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\�•€|ÿÿÿÿ"•€|þ»Ów*]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\PUBPLACE.HTT"
    .
    --------------------- Prosesseihin ladatut DLLt ---------------------

    - - - - - - - > 'winlogon.exe'(1028)
    c:\windows\system32\Ati2evxx.dll
    c:\program files\Funk Software\Funk Client\odLogin.dll
    .
    Valmistumisajankohta: 2009-02-16 22:31:52
    ComboFix-quarantined-files.txt 2009-02-16 20:31:43
    ComboFix2.txt 2009-02-16 20:25:13

    Ennen ajoa: 168 456 912 896 tavua vapaana
    Ajon jälkeen: 168,444,620,800 tavua vapaana

    207 --- E O F --- 2009-02-16 01:02:40
     
    Last edited: Feb 16, 2009
    maakari, Feb 16, 2009
    #9
  10. Hujo

    Hujo Guest

    Hujo, Feb 16, 2009
    #10

Share This Page