Firefox käynnistyy todella hitaasti ja kone hidatestelee muutenkin. (HJT)

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Terodo, Jun 5, 2008.

  1. Terodo

    Terodo Member

    Joined:
    Jan 1, 2007
    Messages:
    92
    Likes Received:
    1
    Trophy Points:
    18
    Tässä on tämä HJT logi jos joku osaisi auttaa että onko täällä jotain ihmeellistä.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:27:20, on 5.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\ATKKBService.exe
    C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
    C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe
    C:\WINDOWS\system32\crypserv.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PnkBstrB.exe
    C:\WINDOWS\system32\svchost.exe
    C:\BMWgroup\ETKLokal\transbase\tbmux32.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Vista Start Menu\VistaStartMenu.exe
    C:\Program Files\Shock Utility\ShockAero3D\ShockAero3D.exe
    C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
    C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [VistaStartMenu] "C:\Program Files\Vista Start Menu\VistaStartMenu.exe"
    O4 - HKCU\..\Run: [ShockAero3D] C:\Program Files\Shock Utility\ShockAero3D\ShockAero3D.exe
    O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
    O4 - Global Startup: ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
    O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
    O23 - Service: Autodata Limited License Service - Autodata Limited - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
    O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
    O23 - Service: Bwsvc - BUFFALO INC. - C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe
    O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
    O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Transbase - Transaction Software, D 81737 Munich - C:\BMWgroup\ETKLokal\transbase\tbmux32.exe
    O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

    --
    End of file - 8135 bytes
     
    Terodo, Jun 5, 2008
    #1
  2. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, Jun 5, 2008
    #2
  3. Terodo

    Terodo Member

    Joined:
    Jan 1, 2007
    Messages:
    92
    Likes Received:
    1
    Trophy Points:
    18
    ComboFix 08-06-05.2 - Tero 2008-06-05 20:41:23.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1499 [GMT 3:00]
    Running from: C:\Documents and Settings\Tero\Työpöytä\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\config.ini

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-05 to 2008-06-05 )))))))))))))))))
    .

    2008-06-05 20:49 . 2008-06-05 20:50 <KANSIO> d-------- C:\Temp
    2008-06-05 20:49 . 2008-06-05 20:49 53,248 --a------ C:\Temp\catchme.dll
    2008-06-05 13:27 . 2008-06-05 13:27 <KANSIO> d-------- C:\HJT
    2008-06-04 17:31 . 2008-06-04 17:31 <KANSIO> d-------- C:\Documents and Settings\Tero\Application Data\Uniblue
    2008-06-01 17:19 . 2008-06-01 17:19 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Codemasters
    2008-06-01 13:55 . 2008-03-05 15:56 3,786,760 --a------ C:\WINDOWS\system32\D3DX9_37.dll
    2008-06-01 13:55 . 2008-03-05 15:56 1,420,824 --a------ C:\WINDOWS\system32\D3DCompiler_37.dll
    2008-06-01 13:55 . 2008-04-28 15:53 805,400 -ra------ C:\WINDOWS\system32\tmpD1.tmp
    2008-06-01 13:55 . 2008-04-28 15:53 805,400 -ra------ C:\WINDOWS\system32\tmpD0.tmp
    2008-06-01 13:55 . 2008-03-05 16:03 479,752 --a------ C:\WINDOWS\system32\XAudio2_0.dll
    2008-06-01 13:55 . 2008-02-05 23:07 462,864 --a------ C:\WINDOWS\system32\d3dx10_37.dll
    2008-06-01 13:55 . 2008-03-05 16:03 238,088 --a------ C:\WINDOWS\system32\xactengine3_0.dll
    2008-06-01 13:55 . 2008-03-05 16:00 25,608 --a------ C:\WINDOWS\system32\X3DAudio1_3.dll
    2008-06-01 13:38 . 2008-06-01 13:38 <KANSIO> d-------- C:\Program Files\Codemasters
    2008-05-30 16:37 . 2008-05-30 16:37 <KANSIO> d-------- C:\Program Files\Rhodan
    2008-05-28 22:18 . 2008-06-03 20:50 <KANSIO> d--hs---- C:\Boot
    2008-05-28 22:18 . 2008-01-19 10:45 333,203 -rahs---- C:\bootmgr
    2008-05-28 22:18 . 2008-05-28 22:18 8,192 -ra-s---- C:\BOOTSECT.BAK
    2008-05-28 11:43 . 2008-05-28 11:43 <KANSIO> d--hs---- C:\$RECYCLE.BIN
    2008-05-28 11:42 . 2007-03-17 14:41 171,136 -rahs---- C:\grldr
    2008-05-27 20:31 . 2008-05-27 21:01 1,905 --a------ C:\WINDOWS\diagwrn.xml
    2008-05-27 20:31 . 2008-05-27 21:01 1,905 --a------ C:\WINDOWS\diagerr.xml
    2008-05-22 20:11 . 2008-02-07 17:10 <KANSIO> d--h----- C:\ckis
    2008-05-22 19:35 . 2008-05-28 17:44 96,966 --a------ C:\WINDOWS\system32\drivers\klin.dat
    2008-05-22 19:35 . 2008-05-29 20:57 88,774 --a------ C:\WINDOWS\system32\drivers\klick.dat
    2008-05-22 19:34 . 2008-06-05 20:50 15,341,344 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2008-05-22 19:34 . 2008-06-05 20:49 256,032 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
    2008-05-22 19:34 . 2008-06-04 17:40 207,332 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
    2008-05-22 19:34 . 2008-06-04 17:40 28,604 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
    2008-05-15 15:31 . 2008-05-15 15:33 <KANSIO> d-------- C:\Documents and Settings\Tero\Application Data\Nikon
    2008-05-15 15:31 . 2004-09-14 16:11 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
    2008-05-15 15:31 . 2001-10-05 16:31 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
    2008-05-15 15:27 . 2008-05-15 15:27 <KANSIO> d-------- C:\Program Files\Nikon
    2008-05-15 15:27 . 2008-05-15 15:33 <KANSIO> d-------- C:\Program Files\Common Files\Nikon
    2008-05-15 15:27 . 2008-05-15 15:27 <KANSIO> d-------- C:\Program Files\Common Files\muvee Technologies
    2008-05-15 15:27 . 2008-05-15 15:27 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Ultima_T15
    2008-05-15 15:27 . 2008-05-15 15:27 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Nikon
    2008-05-15 15:27 . 2008-05-15 15:27 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\EnterNHelp
    2008-05-15 15:27 . 2008-06-05 14:05 20 ---h----- C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
    2008-05-15 06:39 . 2008-05-15 06:40 <KANSIO> d-------- C:\Program Files\GmRekTopo
    2008-05-15 06:39 . 2008-05-15 06:39 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Genimap
    2008-05-14 13:29 . 2008-05-14 13:40 <KANSIO> d-------- C:\Documents and Settings\Tero\Application Data\News to Screen
    2008-05-12 17:03 . 2008-05-12 17:03 85 --a------ C:\WINDOWS\Crypkey.ini
    2008-05-12 17:02 . 2008-05-12 17:02 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\WorkshopData
    2008-05-12 17:02 . 1999-06-19 00:49 165,888 --a------ C:\WINDOWS\Ckconfig.exe
    2008-05-12 17:02 . 2006-02-16 16:29 102,592 --a------ C:\WINDOWS\system32\corojdk11.dll
    2008-05-12 17:02 . 2006-09-22 02:33 69,632 --a------ C:\WINDOWS\system32\Crypserv.exe
    2008-05-12 17:02 . 2006-01-10 05:47 31,846 --a------ C:\WINDOWS\system32\Ckldrv.sys
    2008-05-12 17:02 . 1996-05-03 20:21 27,648 -ra------ C:\WINDOWS\Setup_ck.exe
    2008-05-12 17:02 . 1996-05-03 18:36 18,432 --a------ C:\WINDOWS\Setup_ck.dll
    2008-05-12 17:02 . 1995-07-04 21:33 11,776 --a------ C:\WINDOWS\Ckrfresh.exe
    2008-05-12 16:59 . 2008-05-12 16:59 <KANSIO> d--h----- C:\Program Files\Zero G Registry
    2008-05-12 16:59 . 2008-05-12 17:02 <KANSIO> d-------- C:\Program Files\Vivid WorkshopData ATI
    2008-05-12 16:58 . 2008-05-12 16:58 <KANSIO> d--h----- C:\Documents and Settings\Tero\InstallAnywhere
    2008-05-12 16:53 . 2008-05-12 16:54 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro
    2008-05-12 16:52 . 2008-05-12 16:53 <KANSIO> d-------- C:\Program Files\DAEMON Tools Pro
    2008-05-12 16:45 . 2008-05-12 16:45 <KANSIO> d-------- C:\Documents and Settings\Tero\Application Data\DAEMON Tools Pro
    2008-05-12 12:56 . 2008-05-12 12:57 <KANSIO> d-------- C:\Program Files\Shock Utility
    2008-05-12 12:56 . 2008-05-12 12:57 65,536 --a------ C:\WINDOWS\IFinst27.exe

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-05 16:01 --------- d-----w C:\Documents and Settings\Tero\Application Data\uTorrent
    2008-06-05 15:55 196,608 ----a-w C:\WINDOWS\system32\drivers\nAsmedia.bin
    2008-06-04 18:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-06-04 14:38 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-06-04 14:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-06-04 14:33 --------- d-----w C:\Documents and Settings\Tero\Application Data\Vista Start Menu
    2008-06-01 15:07 --------- d-----w C:\Program Files\DVDCoverPrint
    2008-06-01 10:55 444,952 ----a-w C:\WINDOWS\system32\wrap_oal.dll
    2008-06-01 10:55 109,080 ----a-w C:\WINDOWS\system32\OpenAL32.dll
    2008-06-01 10:55 --------- d-----w C:\Program Files\OpenAL
    2008-05-28 14:44 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
    2008-05-22 17:10 --------- d-----w C:\Program Files\Kaspersky Lab
    2008-05-17 04:46 --------- d-----w C:\Program Files\DC++
    2008-05-15 12:27 106,496 ----a-w C:\WINDOWS\system32\ATL71.DLL
    2008-05-15 12:26 --------- d-----w C:\Program Files\QuickTime Alternative
    2008-05-15 12:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-05-12 14:02 --------- d-----w C:\Program Files\Vivid WorkshopData ATI
    2008-04-28 12:48 --------- d-----w C:\Documents and Settings\Tero\Application Data\Touchstone
    2008-04-28 10:13 --------- d-----w C:\Program Files\Touchstone
    2008-04-28 10:13 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-04-28 10:13 --------- d-----w C:\Program Files\AGEIA Technologies
    2008-04-22 02:53 --------- d-----w C:\Program Files\Vista Start Menu
    2008-04-19 13:11 --------- d-----w C:\Program Files\THQ
    2008-04-16 16:44 --------- d-----w C:\Program Files\Your Company Name
    2008-04-16 10:00 230,664 ----a-w C:\WINDOWS\system32\PDBoot.exe
    2008-04-12 05:18 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-04-12 05:18 22,328 ----a-w C:\Documents and Settings\Tero\Application Data\PnkBstrK.sys
    2008-04-12 05:17 2,337,865 ----a-w C:\WINDOWS\system32\pbsvc.exe
    2008-04-12 05:17 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    2008-04-12 05:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ubisoft
    2008-04-12 05:05 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
    2008-04-12 04:53 --------- d-----w C:\Program Files\Ubisoft
    2008-04-10 09:08 71,184 ----a-r C:\WINDOWS\system32\drivers\DefragFS.sys
    2008-04-07 12:11 --------- d-----w C:\Program Files\Arjaloc
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-15 13:23 116,224 ----a-w C:\WINDOWS\system32\ssms.exe
    2008-03-14 05:12 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll
    2008-03-14 05:12 2,272 ----a-w C:\WINDOWS\system32\w95inf16.dll
    2008-03-12 11:53 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
    2008-03-12 11:53 286,720 ------w C:\WINDOWS\Setup1.exe
    2008-03-11 17:56 64,111 ----a-w C:\WINDOWS\BricoPackUninst.cmd
    2008-03-11 17:56 6,112 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
    2008-03-11 17:56 219,136 ----a-w C:\WINDOWS\system32\uxtheme.dll
    2008-03-10 17:44 21 ----a-w C:\ADTARC.dat
    2007-09-10 14:13 1 ----a-w C:\Documents and Settings\Tero\SI.bin
    .
    Code:
    <pre>
----a-w            48,925 2008-02-24 16:51:05  C:\Documents and Settings\Tero\Omat tiedostot\Vastaanotetut tiedostot\Windows XP Pro Serial  Key Changer .exe
</pre>

    ------- Sigcheck -------

    2007-06-13 16:22 975872 bfb589091060c9e3c5e6f55c6881ed78 C:\WINDOWS\explorer.exe
    2007-06-13 16:10 1033728 fb53c3b1e17f62e8fcb07caaf4c4272e C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
    2006-03-02 15:00 1032704 43c0b3d357f319875a51bc111f393147 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
    2007-06-13 16:22 975872 bfb589091060c9e3c5e6f55c6881ed78 C:\WINDOWS\system32\dllcache\explorer.exe
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
    "RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-19 01:05 630784]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 15:00 15360]
    "VistaStartMenu"="C:\Program Files\Vista Start Menu\VistaStartMenu.exe" [2008-04-20 23:18 2670296]
    "ShockAero3D"="C:\Program Files\Shock Utility\ShockAero3D\ShockAero3D.exe" [2008-03-03 04:39 1121792]
    "DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 16:08 136136]
    "Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [ ]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-21 12:11 925696]
    "amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 16:49 77824]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
    "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15:00 15360]
    "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 17:15 1634304]

    C:\Documents and Settings\Tero\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 22:41:18 65536]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    ClientManager3.lnk - C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe [2007-11-14 21:44:53 466944]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoResolveSearch"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
    "UIHost"="C:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.YV12"= yv12vfw.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUSGamerOSD]
    --a------ 2007-06-01 09:37 380928 C:\Program Files\ASUS\GamerOSD\GamerOSD.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2006-03-02 15:00 15360 C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
    C:\Program Files\DAEMON Tools\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001
    "UpdatesDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
    "C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
    "C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\BUFFALO\\Client Manager3\\BWSVC\\bwsvc.exe"=
    "C:\\Program Files\\BUFFALO\\Client Manager3\\AOSS\\aoss.exe"=
    "C:\\Program Files\\Activision Value\\Soldier of Fortune Payback\\sof3.exe"=
    "C:\\Program Files\\Atari\\Test Drive Unlimited\\TestDriveUnlimited.exe"=
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
    "C:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
    "C:\\Program Files\\Sega\\The Club\\Launcher.exe"=
    "C:\\Program Files\\Sega\\The Club\\TheClub.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
    "C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
    "C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
    "C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
    "C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
    "C:\\BMWgroup\\ETKLokal\\javaclient\\j2re1.4.2_01\\bin\\java.exe"=
    "C:\\BMWgroup\\ETKLokal\\javaclient\\ETK.exe"=
    "C:\\Program Files\\Touchstone\\Turok\\Binaries\\TurokGame.exe"=
    "C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.321\\English\\setup.exe"=
    "C:\\Program Files\\Codemasters\\GRID\\GRID.exe"=

    R1 BUFADPT;BUFADPT;C:\WINDOWS\system32\BUFADPT.SYS [2007-01-11 10:19]
    R2 PD91Agent;PD91Agent;"C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe" [2008-04-16 13:00]
    R2 Transbase;Transbase;C:\BMWgroup\ETKLokal\transbase\tbmux32.exe [2004-08-05 13:02]
    R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2006-03-02 15:00]
    R3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys [2007-05-31 14:29]
    R3 CBBCM43;BUFFALO WLI-CB-XXX Series Wireless LAN Adapter;C:\WINDOWS\system32\DRIVERS\CBG54.sys [2005-11-01 11:13]
    R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
    R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [2007-05-31 14:29]
    S3 BFAIFILT;BFAIFILT;C:\WINDOWS\system32\Drivers\bfaifilt.sys [2004-07-13 14:49]
    S3 PD91Engine;PD91Engine;"C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe" [2008-04-16 13:00]
    S3 rt70x86;BUFFALO RT2500 USB Wireless Driver;C:\WINDOWS\system32\DRIVERS\netr70.sys [2006-12-27 11:41]
    S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-01-04 15:10]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp

    *Newly Created Service* - CATCHME
    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-05-30 14:17:04 C:\WINDOWS\Tasks\1-Click Maintenance.job"
    - C:\Program Files\TuneUp Utilities 2008\OneClick.exe
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-05 20:49:53
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    **************************************************************************
    .
    Completion time: 2008-06-05 20:52:00
    ComboFix-quarantined-files.txt 2008-06-05 17:50:57

    Pre-Run: 8,197,152,768 tavua vapaana
    Post-Run: 8,140,161,024 tavua vapaana

    244 --- E O F --- 2008-05-15 00:00:43

    Siinä olisi loki tällä erää. Kiitos jo valmiiksi avusta. Jatkan aamulla.
     
    Terodo, Jun 5, 2008
    #3
  4. Hujo

    Hujo Guest

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
     
    Hujo, Jun 5, 2008
    #4
  5. Terodo

    Terodo Member

    Joined:
    Jan 1, 2007
    Messages:
    92
    Likes Received:
    1
    Trophy Points:
    18
    Malwarebytes' Anti-Malware 1.15
    Tietokantaversio: 831

    5:36:05 7.6.2008
    mbam-log-6-7-2008 (05-36-05).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|J:\|K:\|)
    Tarkistetut kohteet: 340724
    Kulunut aika: 1 hour(s), 13 minute(s), 35 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)


    Login sisältö näytti tältä. Sama vika vaan jatkuu. Muutkin ohjelmat on alkanu takkuamaan. Mutta yleisimmin Firefoxin kun yrittää käynnistää niin se käynnistyy prosesseihin mutta näytölle ei tule mitään eikä sovelluksissa näy mitään.
     
    Terodo, Jun 8, 2008
    #5

Share This Page