F-Secure löytää, mutta ei poista. Adware, spybot ja troijan guard kokeiltu edelleen ongelmia.

Ongelmana kone hyytyy ja on muutenkin hidasta tehdä mitä tahansa. Madot löytyy mutta mikään ei onnistu poistaa niitä. Kiitos etukäteen neuvoista...

-shoc

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:48:03, on 21.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5346.0005)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
C:\Program Files\Saunalahti Turvapaketti\Common\FSM32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\TrojanHunter 5.0\THGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\fsgk32st.exe
C:\Program Files\Saunalahti Turvapaketti\Common\FSMA32.EXE
C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\FSGK32.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Saunalahti Turvapaketti\Common\FSMB32.EXE
C:\Program Files\Saunalahti Turvapaketti\Common\FCH32.EXE
C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\fsqh.exe
C:\Program Files\Saunalahti Turvapaketti\Common\FAMEH32.EXE
C:\Program Files\Saunalahti Turvapaketti\FSGUI\fsguidll.exe
C:\Program Files\Saunalahti Turvapaketti\FSAUA\program\fsaua.exe
C:\Program Files\Saunalahti Turvapaketti\FWES\Program\fsdfwd.exe
C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\fssm32.exe
C:\Program Files\Saunalahti Turvapaketti\FSAUA\program\fsus.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {377EBF2E-DDA1-4395-99D3-902344659A9E} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {82015BB3-BC77-4A8F-94BA-D6BB5E849C77} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: {1f25a7ce-2305-202b-3bf4-88b5ff77472e} - {e27477ff-5b88-4fb3-b202-5032ec7a52f1} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Saunalahti Turvapaketti\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Saunalahti Turvapaketti\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O4 - HKLM\..\Run: [ac89baf8] rundll32.exe "C:\WINDOWS\system32\rxbfynuk.dll",b
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKLM\..\Run: [BMafba8964] Rundll32.exe "C:\WINDOWS\system32\dyviwpxv.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\APCMain.exe -m
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: World Time.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/WebsiteAccess/ie/Bridge-c139.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {E1E73B44-2D20-47A9-9CA2-B534CEBBF856} (F-Secure Health Check 1.0) - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: F-Secure BlackLight Sensor - Unknown owner - C:\WINDOWS\TEMP\F-Secure\Anti-Virus\fsblsrv.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Saunalahti Turvapaketti\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Saunalahti Turvapaketti\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Saunalahti Turvapaketti\Common\FSMA32.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

--
End of file - 8653 bytes

 

1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

 

Tuollaisen antoi, pahoittelut että kesti piti käydä välillä vähän mökkeilemässä.

ComboFix 08-06-20.4 - satu 2008-06-24 20:08:03.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.157 [GMT 3:00]
Running from: C:\Documents and Settings\satu\Työpöytä\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BMafba8964.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bpehyeno.ini
C:\WINDOWS\system32\govjtbkk.ini
C:\Windows\system32\HRCJRqru.ini
C:\Windows\system32\HRCJRqru.ini2
C:\WINDOWS\system32\imlnfewg.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mdm.exe
C:\Windows\system32\uxEgPqss.ini
C:\Windows\system32\uxEgPqss.ini2
C:\WINDOWS\system32\voijkemi.ini

.
((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-05-24 to 2008-06-24 )))))))))))))))))
.

2008-06-21 21:12 . 2008-06-21 21:12 <KANSIO> d-------- C:\Documents and Settings\satu\Application Data\Malwarebytes
2008-06-21 21:11 . 2008-06-21 21:12 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-21 21:11 . 2008-06-21 21:11 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-21 21:11 . 2008-06-19 17:48 34,296 --a------ C:\Windows\system32\drivers\mbamcatchme.sys
2008-06-21 21:11 . 2008-06-19 17:47 17,144 --a------ C:\Windows\system32\drivers\mbam.sys
2008-06-21 20:45 . 2008-06-21 20:45 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-06-21 13:51 . 2008-06-21 13:51 <KANSIO> d-------- C:\Documents and Settings\satu\Application Data\TrojanHunter
2008-06-21 12:24 . 2008-06-21 12:25 <KANSIO> d-------- C:\Program Files\TrojanHunter 5.0
2008-06-20 20:12 . 2008-06-20 21:39 <KANSIO> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-20 19:57 . 2008-06-20 21:00 <KANSIO> d-------- C:\Windows\BDOSCAN8
2008-06-20 17:02 . 2008-06-20 17:02 98 --a------ C:\Windows\wininit.ini
2008-06-20 15:16 . 2008-06-20 15:16 <KANSIO> d-------- C:\Program Files\CCleaner
2008-06-20 15:08 . 2008-06-20 21:42 <KANSIO> d-------- C:\Documents and Settings\J„rjestelm„nvalvoja
2008-06-17 02:23 . 2008-06-14 20:59 272,128 --------- C:\Windows\system32\drivers\bthport.sys
2008-06-17 02:23 . 2008-06-14 20:59 272,128 --------- C:\Windows\system32\dllcache\bthport.sys
2008-06-17 00:25 . 2008-06-17 00:25 <KANSIO> d-------- C:\Program Files\Lavasoft
2008-06-17 00:25 . 2008-06-17 00:31 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-17 00:23 . 2008-06-17 00:23 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-11 22:36 . 2008-06-11 22:36 98,816 --------- C:\Windows\system32\qfudmxir.0ll
2008-06-11 21:31 . 2008-06-11 21:31 33,280 --------- C:\Windows\system32\iifedbxw.0ll
2008-05-29 23:03 . 2008-05-29 23:04 <KANSIO> d-------- C:\Windows\SxsCaPendDel
2008-05-25 21:06 . 2008-05-29 23:00 <KANSIO> d-------- C:\Program Files\Laskutus

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-20 13:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-20 13:09 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-06-16 21:29 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-06-16 21:29 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2008-06-09 18:21 --------- d-----w C:\Program Files\RevConnect
2008-05-29 20:04 --------- d-----w C:\Program Files\MSN Messenger
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
.

(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{377EBF2E-DDA1-4395-99D3-902344659A9E}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{82015BB3-BC77-4A8F-94BA-D6BB5E849C77}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e27477ff-5b88-4fb3-b202-5032ec7a52f1}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [ ]
"Performance Center"="C:\Program Files\Ascentive\Performance Center\APCMain.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-03-19 21:37 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-03-19 21:33 118784]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-07 20:49 98304]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-07 20:49 536576]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe" [2004-12-06 21:31 36975]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 21:41 33792]
"YeppStudioAgent"="C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe" [2005-09-12 14:21 40960]
"F-Secure Manager"="C:\Program Files\Saunalahti Turvapaketti\Common\FSM32.EXE" [2007-04-26 20:12 183208]
"F-Secure TNB"="C:\Program Files\Saunalahti Turvapaketti\FSGUI\TNBUtil.exe" [2007-04-26 20:10 740208]
"THGuard"="C:\Program Files\TrojanHunter 5.0\THGuard.exe" [2008-03-25 19:08 1047712]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\RevConnect\\DCPlusPlus.exe"=

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-17 18:34]
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Saunalahti Turvapaketti\HIPS\fshs.sys [2008-02-13 14:43]
R3 CONAN;CONAN;C:\WINDOWS\system32\drivers\o2mmb.sys [2004-02-12 11:18]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\minifilter\fsgk.sys [2007-04-26 20:07]
R3 MbxStby;MbxStby;C:\WINDOWS\system32\drivers\MbxStby.sys [2004-01-28 09:00]
S3 F-Secure BlackLight Sensor;F-Secure BlackLight Sensor;C:\WINDOWS\TEMP\F-Secure\Anti-Virus\fsblsrv.exe []
S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-06-19 17:48]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\Win2K\FSfilter.sys [2007-04-26 20:08]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\Win2K\FSrec.sys [2007-04-26 20:08]

.
'Ajoitetut teht„v„t'-kansion sis„lt”
"2008-06-24 16:55:39 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\SAUNAL~2\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\SAUNAL~2\ANTI-V~1\report.txt
"2008-06-24 17:02:04 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"

 

Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

Tallenna se nimellä CFScript.txt

Sitten raahaa CFScript ComboFix.exeen kuten alla.


Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

========

scannaa uusi hjt:n loki

 

Noniin nyt tuli tuollaiset logit.

ComboFix 08-06-20.4 - satu 2008-06-25 11:37:54.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.110 [GMT 3:00]
Running from: C:\Documents and Settings\satu\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\satu\Työpöytä\CFScript.txt
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Windows\system32\iifedbxw.0ll
C:\Windows\system32\qfudmxir.0ll
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\iifedbxw.0ll
C:\Windows\system32\qfudmxir.0ll
.
---- Previous Run -------
.
C:\WINDOWS\BMafba8964.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bpehyeno.ini
C:\WINDOWS\system32\govjtbkk.ini
C:\Windows\system32\HRCJRqru.ini
C:\Windows\system32\HRCJRqru.ini2
C:\WINDOWS\system32\imlnfewg.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mdm.exe
C:\Windows\system32\uxEgPqss.ini
C:\Windows\system32\uxEgPqss.ini2
C:\WINDOWS\system32\voijkemi.ini

.
((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-05-25 to 2008-06-25 )))))))))))))))))
.

2008-06-21 21:12 . 2008-06-21 21:12 <KANSIO> d-------- C:\Documents and Settings\satu\Application Data\Malwarebytes
2008-06-21 21:11 . 2008-06-21 21:12 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-21 21:11 . 2008-06-21 21:11 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-21 21:11 . 2008-06-19 17:48 34,296 --a------ C:\Windows\system32\drivers\mbamcatchme.sys
2008-06-21 21:11 . 2008-06-19 17:47 17,144 --a------ C:\Windows\system32\drivers\mbam.sys
2008-06-21 20:45 . 2008-06-21 20:45 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-06-21 13:51 . 2008-06-21 13:51 <KANSIO> d-------- C:\Documents and Settings\satu\Application Data\TrojanHunter
2008-06-21 12:24 . 2008-06-21 12:25 <KANSIO> d-------- C:\Program Files\TrojanHunter 5.0
2008-06-20 20:12 . 2008-06-20 21:39 <KANSIO> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-20 19:57 . 2008-06-20 21:00 <KANSIO> d-------- C:\Windows\BDOSCAN8
2008-06-20 17:02 . 2008-06-20 17:02 98 --a------ C:\Windows\wininit.ini
2008-06-20 15:16 . 2008-06-20 15:16 <KANSIO> d-------- C:\Program Files\CCleaner
2008-06-20 15:08 . 2008-06-20 21:42 <KANSIO> d-------- C:\Documents and Settings\J„rjestelm„nvalvoja
2008-06-17 02:23 . 2008-06-14 20:59 272,128 --------- C:\Windows\system32\drivers\bthport.sys
2008-06-17 02:23 . 2008-06-14 20:59 272,128 --------- C:\Windows\system32\dllcache\bthport.sys
2008-06-17 00:25 . 2008-06-17 00:25 <KANSIO> d-------- C:\Program Files\Lavasoft
2008-06-17 00:25 . 2008-06-17 00:31 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-17 00:23 . 2008-06-17 00:23 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-29 23:03 . 2008-05-29 23:04 <KANSIO> d-------- C:\Windows\SxsCaPendDel
2008-05-25 21:06 . 2008-05-29 23:00 <KANSIO> d-------- C:\Program Files\Laskutus

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-20 13:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-20 13:09 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-06-16 21:29 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-06-16 21:29 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2008-06-09 18:21 --------- d-----w C:\Program Files\RevConnect
2008-05-29 20:04 --------- d-----w C:\Program Files\MSN Messenger
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
.

((((((((((((((((((((((((((((( snapshot@2008-06-24_20.25.27.07 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-24 17:19:43 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-25 08:46:13 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{377EBF2E-DDA1-4395-99D3-902344659A9E}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{82015BB3-BC77-4A8F-94BA-D6BB5E849C77}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e27477ff-5b88-4fb3-b202-5032ec7a52f1}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [ ]
"Performance Center"="C:\Program Files\Ascentive\Performance Center\APCMain.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-03-19 21:37 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-03-19 21:33 118784]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-07 20:49 98304]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-07 20:49 536576]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe" [2004-12-06 21:31 36975]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 21:41 33792]
"YeppStudioAgent"="C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe" [2005-09-12 14:21 40960]
"F-Secure Manager"="C:\Program Files\Saunalahti Turvapaketti\Common\FSM32.EXE" [2007-04-26 20:12 183208]
"F-Secure TNB"="C:\Program Files\Saunalahti Turvapaketti\FSGUI\TNBUtil.exe" [2007-04-26 20:10 740208]
"THGuard"="C:\Program Files\TrojanHunter 5.0\THGuard.exe" [2008-03-25 19:08 1047712]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\RevConnect\\DCPlusPlus.exe"=

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-17 18:34]
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Saunalahti Turvapaketti\HIPS\fshs.sys [2008-02-13 14:43]
R3 CONAN;CONAN;C:\WINDOWS\system32\drivers\o2mmb.sys [2004-02-12 11:18]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\minifilter\fsgk.sys [2007-04-26 20:07]
R3 MbxStby;MbxStby;C:\WINDOWS\system32\drivers\MbxStby.sys [2004-01-28 09:00]
S3 F-Secure BlackLight Sensor;F-Secure BlackLight Sensor;C:\WINDOWS\TEMP\F-Secure\Anti-Virus\fsblsrv.exe []
S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-06-19 17:48]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\Win2K\FSfilter.sys [2007-04-26 20:08]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\Win2K\FSrec.sys [2007-04-26 20:08]

.
'Ajoitetut teht„v„t'-kansion sis„lt”
"2008-06-25 08:28:15 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\SAUNAL~2\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\SAUNAL~2\ANTI-V~1\report.txt
"2008-06-24 17:02:04 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"

_____________________________________________________________________


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:59, on 2008-06-25
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5346.0005)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\fsgk32st.exe
C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\FSGK32.EXE
C:\Program Files\Saunalahti Turvapaketti\Common\FSMA32.EXE
C:\Program Files\Saunalahti Turvapaketti\Common\FSMB32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Saunalahti Turvapaketti\Common\FCH32.EXE
C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\fsqh.exe
C:\Program Files\Saunalahti Turvapaketti\Common\FAMEH32.EXE
C:\Program Files\Saunalahti Turvapaketti\FSAUA\program\fsaua.exe
C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\fssm32.exe
C:\Program Files\Saunalahti Turvapaketti\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
C:\Program Files\Saunalahti Turvapaketti\Common\FSM32.EXE
C:\Program Files\TrojanHunter 5.0\THGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Saunalahti Turvapaketti\FSAUA\program\fsus.exe
C:\Program Files\Saunalahti Turvapaketti\FSGUI\fsguidll.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\fsav32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {377EBF2E-DDA1-4395-99D3-902344659A9E} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {82015BB3-BC77-4A8F-94BA-D6BB5E849C77} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: {1f25a7ce-2305-202b-3bf4-88b5ff77472e} - {e27477ff-5b88-4fb3-b202-5032ec7a52f1} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Saunalahti Turvapaketti\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Saunalahti Turvapaketti\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\APCMain.exe -m
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: World Time.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/WebsiteAccess/ie/Bridge-c139.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {E1E73B44-2D20-47A9-9CA2-B534CEBBF856} (F-Secure Health Check 1.0) - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: F-Secure BlackLight Sensor - Unknown owner - C:\WINDOWS\TEMP\F-Secure\Anti-Virus\fsblsrv.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Saunalahti Turvapaketti\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Saunalahti Turvapaketti\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Saunalahti Turvapaketti\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Saunalahti Turvapaketti\Common\FSMA32.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

--

End of file - 8533 bytes

 

scannaa hjt:llä merkkaa paina Fix checked

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
O2 - BHO: (no name) - {377EBF2E-DDA1-4395-99D3-902344659A9E} - (no file)
O2 - BHO: (no name) - {82015BB3-BC77-4A8F-94BA-D6BB5E849C77} - (no file)
O2 - BHO: {1f25a7ce-2305-202b-3bf4-88b5ff77472e} - {e27477ff-5b88-4fb3-b202-5032ec7a52f1} - (no file)

=============

Lataa Malwarebytes' Anti-Malware työpöydällesi.

1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.

 

Ilmoittelee ettei mitään löytynyt, alla loki...


Malwarebytes' Anti-Malware 1.18

Tietokantaversio: 890

18:08:05 2008-06-25
mbam-log-6-25-2008 (18-08-05).txt

Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 80375
Kulunut aika: 58 minute(s), 17 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)

 

F-Secure löytää edelleen nämä :

Trojan.Win32.Monder.gen (virus)

* C:\QooBox\Quarantine\catchme2008-06-25_114441.53.zip\iifedbxw.0ll

Trojan.Win32.Monder.pt (virus)

* C:\QooBox\Quarantine\catchme2008-06-25_114441.53.zip\qfudmxir.0ll

 

Lataa OTMoveIt
OTMoveIt ja tallenna se työpöydällesi.

Tuplaklikkaa OTMoveIt.exe.
Klikkaa CleanUp!.
Valitse Yes kun kysytään "Begin cleanup Process?".
Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.

HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.

 

Kone vaikuttaisi puhtaalta nyt, ISO kiitos ja kumarrus avusta. Palailen jos ongelmia esiintyy...

-shoc