HijackThis logi!

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by GGGL, Sep 16, 2007.

  1. GGGL

    GGGL Member

    Joined:
    Oct 6, 2006
    Messages:
    27
    Likes Received:
    0
    Trophy Points:
    11
    Miltäs näyttää?
    Logfile of HijackThis v1.99.1
    Scan saved at 21:28:29, on 16.9.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Norman\Npm\bin\ELOGSVC.EXE
    C:\Norman\Npm\Bin\Zanda.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\MaxMusic\Bin\scServer.exe
    C:\WINDOWS\System32\PAStiSvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Norman\Npm\bin\NJEEVES.EXE
    C:\Norman\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\Nvc\bin\nvcoas.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Norman\Npm\bin\ZLH.EXE
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\Norman\Nvc\BIN\NIP.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Norman\Nvc\bin\cclaw.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Documents and Settings\Janne\Työpöytä\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKLM\..\Run: [axis web cake second] C:\Documents and Settings\All Users\Application Data\Book Slow Axis Web\mpeg okay.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [thunk ante] C:\DOCUME~1\Janne\APPLIC~1\GLOBAL~1\FiveRemote.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/cfweb_activex.camfrogweb.com-advanced_instmodule.exe
    O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - http://nprotect.roseonlinegame.com/nProtect/Netizen/npx.cab
    O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - http://nprotect.roseonlinegame.com/nProtect/Netizen/KeyCrypt/npkcx.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Norman\Npm\bin\ELOGSVC.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - C:\Norman\Npm\Bin\Zanda.exe
    O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Norman\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: scMaxMusic - Unknown owner - C:\Program Files\MaxMusic\Bin\scServer.exe
    O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
     
    GGGL, Sep 16, 2007
    #1
  2. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O4 - HKLM\..\Run: [axis web cake second] C:\Documents and Settings\All Users\Application Data\Book Slow Axis Web\mpeg okay.exe
    O4 - HKCU\..\Run: [thunk ante] C:\DOCUME~1\Janne\APPLIC~1\GLOBAL~1\FiveRemote.exe
    O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - http://nprotect.roseonlinegame.com/nProtect/Netizen/npx.cab
    O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - http://nprotect.roseonlinegame.com/nProt...Crypt/npkcx.cab

    ================================

    Lataa NoLop työpöydällesi yhdestä seuraavista linkeistä...
    Linkki1
    Linkki2
    Linkki3

    1.Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen
    2.Tuplaklikkaa NoLop.exe ajaaksesi sen
    3.Klikkaa nappulaa "Search and Destroy"
    <<Tietokoneesi skannataan saastuneiden tiedostojen osalta>>
    4, Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK
    5. Klikkaa "REBOOT"-painiketta.
    6. NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera.
    -- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataa mscomctl.ocx ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan.


    ===============================

    Ohje AVG:n Anti-Spyware 7.5:n käyttöön
    Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.

    Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

    Lataa AVG:n Anti-Spyware 7.5:n
    ja tallenna ohjelma työpöydällesi.
    o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    o Käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

    o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

    o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".

    o Sitten "Reports" valikon alta:
    o Laita täppi kohtaan "Automatically generate report after every scan"
    o Ota täppi pois kohdasta"Only if threats were found"

    o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    o "Resident shield is", muuta tila active:sta inactive:ksi
    o Sulje ohjelma, ÄLÄ skannaa vielä.

    Käynnistä koneesi vikasietotilaan,
    sammuta ja käynnistä
    käynnistyksen yhteydessä naputtele F8
    valitse nuoli näppäimellä vikasietotila
    paina enter ja enter

    HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
    o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.

    ======================

    Lataa tuolta http://www.ccleaner.com/download/builds.aspx
    CCleaner v1.41.544 - Basic, ÄLÄ aseenna Yahoo toolbaria!

    laita asetukset näin:
    Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

    aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
    aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi
     
    Last edited by a moderator: Sep 16, 2007
    Hujo, Sep 16, 2007
    #2
  3. GGGL

    GGGL Member

    Joined:
    Oct 6, 2006
    Messages:
    27
    Likes Received:
    0
    Trophy Points:
    11
    HijackThis logi
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:20:25, on 17.9.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Norman\Npm\bin\ELOGSVC.EXE
    C:\Norman\Npm\Bin\Zanda.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\MaxMusic\Bin\scServer.exe
    C:\WINDOWS\System32\PAStiSvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Norman\Npm\bin\NJEEVES.EXE
    C:\Norman\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\Nvc\bin\nvcoas.exe
    C:\WINDOWS\System32\alg.exe
    C:\Norman\Npm\bin\ZLH.EXE
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Norman\Nvc\BIN\NIP.EXE
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\Norman\Nvc\bin\cclaw.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\WinRAR\WinRAR.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/cfweb_activex.camfrogweb.com-advanced_instmodule.exe
    O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Norman\Npm\bin\ELOGSVC.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - C:\Norman\Npm\Bin\Zanda.exe
    O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Norman\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: scMaxMusic - Unknown owner - C:\Program Files\MaxMusic\Bin\scServer.exe
    O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 9824 bytes

    Nolop logi
    NoLop! Log by Skate_Punk_21

    Please Note: any existing old logs will have now been renamed to NoLop!OLD.log

    Fix running from: C:\Documents and Settings\Janne\Työpöytä
    [17.9.2007]
    [14:12:34]

    ---Infection Files Found/Removed---
    C:\WINDOWS\tasks\A4E268F49185E78C.job

    Beginning Removal...
    Rebooting...
    Removing Lop's Leftover Files/Folders...
    Editing Registry...
    **Fix Complete!**

    ---Listing AppData sub directories---

    C:\Documents and Settings\All Users\Application Data\Adobe
    C:\Documents and Settings\All Users\Application Data\Ahead
    C:\Documents and Settings\All Users\Application Data\Ati
    C:\Documents and Settings\All Users\Application Data\Book Slow Axis Web
    C:\Documents and Settings\All Users\Application Data\Google
    C:\Documents and Settings\All Users\Application Data\Heartloadforsign
    C:\Documents and Settings\All Users\Application Data\Messenger Plus!
    C:\Documents and Settings\All Users\Application Data\Microsoft
    C:\Documents and Settings\All Users\Application Data\Quicktime
    C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
    C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
    C:\Documents and Settings\Default User\Application Data\Identities
    C:\Documents and Settings\Default User\Application Data\Microsoft
    C:\Documents and Settings\Huolto\Application Data\Ati
    C:\Documents and Settings\Huolto\Application Data\Google -- EMPTY Directory
    C:\Documents and Settings\Huolto\Application Data\Identities
    C:\Documents and Settings\Huolto\Application Data\Microsoft
    C:\Documents and Settings\Iida\Application Data\Adobe
    C:\Documents and Settings\Iida\Application Data\Adobeum -- EMPTY Directory
    C:\Documents and Settings\Iida\Application Data\Ati -- EMPTY Directory
    C:\Documents and Settings\Iida\Application Data\Google
    C:\Documents and Settings\Iida\Application Data\Help -- EMPTY Directory
    C:\Documents and Settings\Iida\Application Data\Hewlett-packard
    C:\Documents and Settings\Iida\Application Data\Identities
    C:\Documents and Settings\Iida\Application Data\Macromedia
    C:\Documents and Settings\Iida\Application Data\Microsoft
    C:\Documents and Settings\Iida\Application Data\Mozilla
    C:\Documents and Settings\Iida\Application Data\Real
    C:\Documents and Settings\Iida\Application Data\Sun
    C:\Documents and Settings\Janne\Application Data\Adobe
    C:\Documents and Settings\Janne\Application Data\Adobeum
    C:\Documents and Settings\Janne\Application Data\Ahead
    C:\Documents and Settings\Janne\Application Data\Ati
    C:\Documents and Settings\Janne\Application Data\Bioshock
    C:\Documents and Settings\Janne\Application Data\Bsplayer Pro
    C:\Documents and Settings\Janne\Application Data\Camfrogweb
    C:\Documents and Settings\Janne\Application Data\Command & Conquer 3 Tiberium Wars Demo
    C:\Documents and Settings\Janne\Application Data\Divx
    C:\Documents and Settings\Janne\Application Data\Foobar2000
    C:\Documents and Settings\Janne\Application Data\Globalbleh
    C:\Documents and Settings\Janne\Application Data\Google
    C:\Documents and Settings\Janne\Application Data\Help
    C:\Documents and Settings\Janne\Application Data\Hewlett-packard
    C:\Documents and Settings\Janne\Application Data\Identities
    C:\Documents and Settings\Janne\Application Data\Installshield
    C:\Documents and Settings\Janne\Application Data\Intervideo
    C:\Documents and Settings\Janne\Application Data\Lavasoft
    C:\Documents and Settings\Janne\Application Data\Limewire
    C:\Documents and Settings\Janne\Application Data\Macromedia
    C:\Documents and Settings\Janne\Application Data\Media Player Classic
    C:\Documents and Settings\Janne\Application Data\Microsoft
    C:\Documents and Settings\Janne\Application Data\Mozilla
    C:\Documents and Settings\Janne\Application Data\Real
    C:\Documents and Settings\Janne\Application Data\Screenshot Sender
    C:\Documents and Settings\Janne\Application Data\Securom
    C:\Documents and Settings\Janne\Application Data\Sun
    C:\Documents and Settings\Janne\Application Data\Systemrequirementslab
    C:\Documents and Settings\Janne\Application Data\Teamspeak2
    C:\Documents and Settings\Janne\Application Data\Ubi.com
    C:\Documents and Settings\Janne\Application Data\Uniblue
    C:\Documents and Settings\Janne\Application Data\Utorrent
    C:\Documents and Settings\Janne\Application Data\Ventrilo
    C:\Documents and Settings\Janne\Application Data\Vlc
    C:\Documents and Settings\Janne\Application Data\Winamp
    C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Identities
    C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Microsoft
    C:\Documents and Settings\Localservice\Application Data\Help -- EMPTY Directory
    C:\Documents and Settings\Localservice\Application Data\Microsoft
    C:\Documents and Settings\Networkservice\Application Data\Microsoft
     
    GGGL, Sep 17, 2007
    #3
  4. Hujo

    Hujo Guest

    siintä sitten vain listaa alaspäin
     
    Hujo, Sep 17, 2007
    #4
  5. GGGL

    GGGL Member

    Joined:
    Oct 6, 2006
    Messages:
    27
    Likes Received:
    0
    Trophy Points:
    11
    Juu vedin tolla AVG nytten, mut jostain syyttä ei tallentanu raporttia :S mut otin kuva
     
    Last edited: Sep 18, 2007
    GGGL, Sep 18, 2007
    #5
  6. Hujo

    Hujo Guest

    Escan
    Ohjeet tuolla sivulla.
    http://koti.mbnet.fi/pattaya1/escanmwav.htm
    lataa tuosta
    http://www.spywareinfo.dk/download/mwav.exe
    päivitä tuosta
    http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
    laita täpit merkkauksien mukaan
    http://koti.mbnet.fi/pattaya1/eScan6.jpg

    scannaa

    jos ala luukkuun tulee jotain niin kopioi se näin:
    Käytä komentoa Ctrl+A.
    Kopioi rivit komennolla Ctrl+C.
    Liitä rivit komennolla Ctrl+V.

    Laita virus log tänne.

    ====================

    Lataa Dr.Web CureIt työpöydälle:

    Tuplaklikkaa drweb-cureit.exe ja anna sen tehdä express scan
    Se skannaa käynnissä olevat ohjelmat ja jos jotain löytyy, klikkaa yes kun se kysyy haluatko poistaa sen. Tämä on vain lyhyt scan.
    Kun scan on valmis, merkkaa asemat, jotka haluat scannata.
    Valitse kaikki asemat. Punainen piste osoittaa, mitkä asemat on valittu.
    Klikaa vihreää nuolta oikealla ja scan alkaa.
    Klikkaa 'Yes to all', jos kysytään haluatko poistaa/siirtää tiedoston.
    Kun scan on valmis, katso voitko klikata next-kuvaketta löytyneiden tiedostojen vieressä: [​IMG]
    Jos asia on niin, klikkaa sitä ja sitten klikkaa next-kuvaketta oikealla alhaalla ja valitse Move incurable kuten alla olevalla kuvassa:
    [​IMG]
    Tämä siirtää sen %userprofile%\DoctorWeb\quarantine-hakemistoon.
    Tämän jälkeen klikkaa Dr.Web CureIt-valikossa file ja valitse save report list
    Tallenna raportti työpöydälle. Raportin nimi on DrWeb.csv
    Sulje Dr.Web Cureit.
    Käynnistä kone uudelleen !! Tämä siksi, että käytössä olevat tiedostot poistetaan/siirretään käynnistyksen yhteydessä.
    Käynnistyksen jälkeen liitä Dr.Web-lokin, jonka tallensit aiemmin, sisältö seuraavaan vastaukseesi.
     
    Hujo, Sep 18, 2007
    #6
  7. GGGL

    GGGL Member

    Joined:
    Oct 6, 2006
    Messages:
    27
    Likes Received:
    0
    Trophy Points:
    11
    escan
    File C:\Documents and Settings\All Users\Application Data\HeartLoadForSign\Amen Phone.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\All Users\Application Data\HeartLoadForSign\Ante Trust.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\All Users\Application Data\HeartLoadForSign\SurfGlue.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Janne\Application Data\GLOBALBLEH\Face Owns Part Dumb.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Janne\Application Data\GLOBALBLEH\findmfcdhtm.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Janne\Application Data\GLOBALBLEH\FiveRemote.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Janne\Application Data\GLOBALBLEH\ozurmkad.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Janne\Application Data\SecuROM\UserData\???????????p????????? infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\Documents and Settings\Janne\Application Data\SecuROM\UserData\???????????p????????? infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\Documents and Settings\Janne\Omat tiedostot\Vastaanotetut tiedostot\Jope Ruonansuu - Traktorinpyo¨ra¨ on traktorinpyo¨ra¨.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP33\A0139528.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP33\A0139529.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP33\A0139530.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP33\A0139531.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP33\A0139532.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP34\A0140400.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP34\A0140401.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP34\A0140402.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP34\A0140403.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP34\A0140404.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37\A0146332.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37\A0146333.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37\A0146334.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37\A0146336.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37\A0146337.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37\A0146338.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37\A0146339.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
     
    GGGL, Sep 18, 2007
    #7
  8. Hujo

    Hujo Guest

    1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
    2. Valitse ominaisuudet
    3. Valitse järjestelmän palauttaminen välilehti
    4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
    5. Paina Käytä
    6. Paina ok
    7. Sammuta ja käynnistä
    8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
    9. Käytä ja OK
     
    Hujo, Sep 18, 2007
    #8
  9. GGGL

    GGGL Member

    Joined:
    Oct 6, 2006
    Messages:
    27
    Likes Received:
    0
    Trophy Points:
    11
    dr.curei logi
    zanda.exe;c:\norman\npm\bin;Probably BACKDOOR.Trojan;Incurable.Moved.;
    Bib Save.exe;C:\Documents and Settings\All Users\Application Data\Book Slow Axis Web;Trojan.Packed.149;Incurable.Moved.;
    mpeg okay.exe;C:\Documents and Settings\All Users\Application Data\Book Slow Axis Web;Trojan.Packed.149;Incurable.Moved.;
    mhugxsdv.exe;C:\Documents and Settings\Janne\Application Data\GLOBALBLEH;Trojan.Packed.149;Incurable.Moved.;
    Face Owns Part Dumb.exe;C:\Documents and Settings\Krisse\Application Data\GLOBALBLEH;Trojan.Packed.149;Incurable.Moved.;
    findmfcdhtm.exe;C:\Documents and Settings\Krisse\Application Data\GLOBALBLEH;Trojan.Packed.149;Incurable.Moved.;
    hyrebwzj.exe;C:\Documents and Settings\Krisse\Application Data\GLOBALBLEH;Trojan.Packed.149;Incurable.Moved.;
    imirurwq.exe;C:\Documents and Settings\Krisse\Application Data\GLOBALBLEH;Trojan.Packed.149;Incurable.Moved.;
    nudwgzpw.exe;C:\Documents and Settings\Krisse\Application Data\GLOBALBLEH;Trojan.Packed.149;Incurable.Moved.;
    tkcgjccn.exe;C:\Documents and Settings\Krisse\Application Data\GLOBALBLEH;Trojan.Packed.149;Incurable.Moved.;
    vhzrmcju.exe;C:\Documents and Settings\Krisse\Application Data\GLOBALBLEH;Trojan.Packed.149;Incurable.Moved.;
    bis1.exe;C:\Documents and Settings\Krisse\Local Settings\Temp;Trojan.Packed.149;Incurable.Moved.;
    bis2E.exe;C:\Documents and Settings\Krisse\Local Settings\Temp;Trojan.Packed.149;Incurable.Moved.;
    bis4E.exe;C:\Documents and Settings\Krisse\Local Settings\Temp;Trojan.Packed.149;Incurable.Moved.;
    Zanda.exe;C:\Norman\npm\bin;Probably BACKDOOR.Trojan;Incurable.Will be moved after reboot.;
    Zanda.exe;C:\Norman\NVC\Bin;Probably BACKDOOR.Trojan;Incurable.Moved.;
    A0139734.exe;C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP34;Trojan.Packed.149;Incurable.Moved.;
    A0140397.exe;C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP34;Trojan.Packed.149;Incurable.Moved.;
    A0140604.exe;C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP34;Trojan.Packed.149;Incurable.Moved.;
    A0140715.exe;C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP34;Trojan.Packed.149;Incurable.Moved.;
    A0146151.exe;C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP35;Trojan.Packed.149;Incurable.Moved.;
    A0146307.exe;C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37;Trojan.Packed.149;Incurable.Moved.;
    A0146372.exe;C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37;Trojan.Packed.149;Incurable.Moved.;
    A0146374.exe;C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37;Trojan.Packed.149;Incurable.Moved.;
    A0146379.exe;C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37;Trojan.Packed.149;Incurable.Moved.;
    A0146380.exe;C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37;Trojan.Packed.149;Incurable.Moved.;
    A0146381.exe;C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37;Trojan.Packed.149;Incurable.Moved.;
    A0146382.exe;C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37;Trojan.Packed.149;Incurable.Moved.;
    A0146383.exe;C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37;Trojan.Packed.149;Incurable.Moved.;
    A0146384.exe;C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37;Trojan.Packed.149;Incurable.Moved.;
    A0146385.exe;C:\System Volume Information\_restore{4755E069-E0CA-42EF-B5F9-F2A05494D266}\RP37;Trojan.Packed.149;Incurable.Moved.;
    ja tein ton poista järjestelmän palauttaminen kaikissa asemissa jutun kanssa
     
    Last edited: Sep 18, 2007
    GGGL, Sep 18, 2007
    #9
  10. Hujo

    Hujo Guest

    1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
    2. Valitse ominaisuudet
    3. Valitse järjestelmän palauttaminen välilehti
    4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
    5. Paina Käytä
    6. Paina ok
    7. Sammuta ja käynnistä
    8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
    9. Käytä ja OK
     
    Hujo, Sep 19, 2007
    #10
  11. GGGL

    GGGL Member

    Joined:
    Oct 6, 2006
    Messages:
    27
    Likes Received:
    0
    Trophy Points:
    11
    tein jo
     
    GGGL, Sep 19, 2007
    #11
  12. Hujo

    Hujo Guest

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:
    " Käynnistä tietokone
    " Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
    " Seuraavaksi pitäisi ilmestyä valikko
    " Valitse valikosta vikasietotila.

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Hujo, Sep 19, 2007
    #12
  13. GGGL

    GGGL Member

    Joined:
    Oct 6, 2006
    Messages:
    27
    Likes Received:
    0
    Trophy Points:
    11
    sdfix logi:

    SDFix: Version 1.105

    Run by Janne on ke 19.09.2007 at 21:33

    Microsoft Windows XP [versio 5.1.2600]

    Running From: C:\SDFix

    Safe Mode:
    Checking Services:


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting...


    Normal Mode:
    Checking Files:

    Trojan Files Found:

    C:\Documents and Settings\Janne\Application Data\Install.dat - Deleted



    Removing Temp Files...

    ADS Check:

    C:\WINDOWS
    No streams found.

    C:\WINDOWS\system32
    No streams found.

    C:\WINDOWS\system32\svchost.exe
    No streams found.

    C:\WINDOWS\system32\ntoskrnl.exe
    No streams found.



    Final Check:

    Remaining Services:
    ------------------




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DC++"
    "C:\\Program Files\\World of Warcraft\\WoW-1.8.0-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.8.0-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Program Files\\Microsoft Games\\Halo\\halo.exe"="C:\\Program Files\\Microsoft Games\\Halo\\halo.exe:*:Enabled:Halo"
    "C:\\Program Files\\World of Warcraft\\WoW-1.8.3.4807-to-1.8.4.4878-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.8.3.4807-to-1.8.4.4878-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
    "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
    "C:\\Program Files\\World of Warcraft\\WoW-1.8.4.4878-to-1.9.0.4937-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.8.4.4878-to-1.9.0.4937-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Program Files\\Soldier of Fortune II - Double Helix MP TEST\\SoF2MP-Test.exe"="C:\\Program Files\\Soldier of Fortune II - Double Helix MP TEST\\SoF2MP-Test.exe:*:Enabled:SoF2MP-Test"
    "C:\\Program Files\\World of Warcraft\\WoW-1.6.1.4544-to-1.9.0.4937-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.6.1.4544-to-1.9.0.4937-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Program Files\\ubi.com\\Core\\GS4.exe"="C:\\Program Files\\ubi.com\\Core\\GS4.exe:*:Enabled:ubi.com Game Service"
    "C:\\Program Files\\Soldier of Fortune II - Double Helix\\SoF2MP.exe"="C:\\Program Files\\Soldier of Fortune II - Double Helix\\SoF2MP.exe:*:Enabled:SoF2MP"
    "C:\\Program Files\\Red Storm Entertainment\\Ghost Recon\\GhostRecon.exe"="C:\\Program Files\\Red Storm Entertainment\\Ghost Recon\\GhostRecon.exe:*:Enabled:GhostRecon"
    "C:\\Documents and Settings\\Janne\\Ty”p”yt„\\WOW_Rain_EG-downloader.exe"="C:\\Documents and Settings\\Janne\\Ty”p”yt„\\WOW_Rain_EG-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Documents and Settings\\Janne\\Local Settings\\Temporary Internet Files\\Content.IE5\\GHIVKLAZ\\WOW_Snow_EG-downloader[1].exe"="C:\\Documents and Settings\\Janne\\Local Settings\\Temporary Internet Files\\Content.IE5\\GHIVKLAZ\\WOW_Snow_EG-downloader[1].exe:*:Enabled:Blizzard Downloader"
    "C:\\Program Files\\World of Warcraft\\WoW-1.9.2.4996-to-1.9.3.5059-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.9.2.4996-to-1.9.3.5059-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
    "C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Suorita DLL sovelluksena"
    "C:\\Program Files\\Steam\\SteamApps\\tseitsei\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\tseitsei\\counter-strike source\\hl2.exe:*:Enabled:hl2"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Documents and Settings\\Janne\\Ty”p”yt„\\WoW-1.9.4.5086-to-0.10.0.5140-enGB-downloader.exe"="C:\\Documents and Settings\\Janne\\Ty”p”yt„\\WoW-1.9.4.5086-to-0.10.0.5140-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Program Files\\Warcraft III\\World Editor.exe"="C:\\Program Files\\Warcraft III\\World Editor.exe:*:Enabled:Warcraft III World Editor"
    "C:\\Program Files\\Lavasoft\\Ad-Aware SE Personal\\Ad-Aware.exe"="C:\\Program Files\\Lavasoft\\Ad-Aware SE Personal\\Ad-Aware.exe:*:Enabled:Ad-Aware SE Personal"
    "C:\\Program Files\\Warcraft III\\Warcraft III.exe"="C:\\Program Files\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III"
    "C:\\Program Files\\Warcraft III\\Frozen Throne.exe"="C:\\Program Files\\Warcraft III\\Frozen Throne.exe:*:Enabled:Warcraft III - The Frozen Throne"
    "C:\\Program Files\\World of Warcraft\\Launcher.exe"="C:\\Program Files\\World of Warcraft\\Launcher.exe:*:Enabled:World of Warcraft"
    "C:\\Program Files\\World of Warcraft\\WoW-1.9.4.5086-to-1.10.0.5195-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.9.4.5086-to-1.10.0.5195-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Program Files\\World of Warcraft\\WoW-1.10.0-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.10.0-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Program Files\\The All-Seeing Eye\\eye.exe"="C:\\Program Files\\The All-Seeing Eye\\eye.exe:*:Enabled:Yahoo! All-Seeing Eye"
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
    "C:\\Documents and Settings\\Janne\\Ty”p”yt„\\WEB-WOWEx-E3-downloader.exe"="C:\\Documents and Settings\\Janne\\Ty”p”yt„\\WEB-WOWEx-E3-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Documents and Settings\\Janne\\Ty”p”yt„\\DarkmooneFaire_English-downloader.exe"="C:\\Documents and Settings\\Janne\\Ty”p”yt„\\DarkmooneFaire_English-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"="C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Documents and Settings\\Janne\\Ty”p”yt„\\WoW-1.10.2.5302-to-0.11.0.5344-enGB-downloader.exe"="C:\\Documents and Settings\\Janne\\Ty”p”yt„\\WoW-1.10.2.5302-to-0.11.0.5344-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Program Files\\World of Warcraft\\WoWTest\\WoW-0.11.0.5383-to-0.11.0.5413-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoWTest\\WoW-0.11.0.5383-to-0.11.0.5413-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Program Files\\World of Warcraft\\WoWTest\\WoW-0.11.0.5413-to-0.11.0.5428-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoWTest\\WoW-0.11.0.5413-to-0.11.0.5428-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Program Files\\World of Warcraft\\WoW-1.10.2.5302-to-1.11.0.5428-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.10.2.5302-to-1.11.0.5428-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Program Files\\World of Warcraft\\WoW-1.11.1.5462-to-1.11.2.5464-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.11.1.5462-to-1.11.2.5464-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Program Files\\Steam\\SteamApps\\bulsu\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\bulsu\\counter-strike source\\hl2.exe:*:Enabled:hl2"
    "C:\\Program Files\\Midway Home Entertainment\\Rise and Fall Demo\\Bin\\RiseAndFallDemo.exe"="C:\\Program Files\\Midway Home Entertainment\\Rise and Fall Demo\\Bin\\RiseAndFallDemo.exe:*:Disabled:Application"
    "C:\\Program Files\\World of Warcraft\\WoW-1.11.2.5464-to-1.12.0.5595-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.11.2.5464-to-1.12.0.5595-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\\Documents and Settings\\Janne\\Ty”p”yt„\\LieroX_v0.56_Pack_1.8\\LieroX v0.56 Pack 1.8\\LieroX.exe"="C:\\Documents and Settings\\Janne\\Ty”p”yt„\\LieroX_v0.56_Pack_1.8\\LieroX v0.56 Pack 1.8\\LieroX.exe:*:Enabled:LieroX"
    "C:\\Documents and Settings\\Janne\\Ty”p”yt„\\lxsp\\LieroXSuperPack\\LieroX.exe"="C:\\Documents and Settings\\Janne\\Ty”p”yt„\\lxsp\\LieroXSuperPack\\LieroX.exe:*:Enabled:LieroX"
    "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"="C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe:*:Enabled:Battlefield 2"
    "C:\\Program Files\\Sierra\\FEARCombat\\FEARMP.exe"="C:\\Program Files\\Sierra\\FEARCombat\\FEARMP.exe:*:Enabled:FEAR Combat"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
    "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
    "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe:*:Enabled:Et„tuki - Windows Messenger ja „„niyhteys"
    "C:\\Program Files\\Midway Games\\Rise and Fall\\RiseAndFall.exe"="C:\\Program Files\\Midway Games\\Rise and Fall\\RiseAndFall.exe:*:Enabled:Rise and Fall: Civilizations at War"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

    Remaining Files:
    ---------------

    File Backups: - C:\SDFix\backups\backups.zip

    Files with Hidden Attributes:

    C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp
    C:\Documents and Settings\Iida\Local Settings\Temp\Z@R1.tmp
    C:\Documents and Settings\Iida\Local Settings\Temp\Z@R3.tmp
    C:\Documents and Settings\Iida\Local Settings\Temp\Z@R5.tmp
    C:\Documents and Settings\Iida\Local Settings\Temp\Z@S2.tmp
    C:\Documents and Settings\Iida\Local Settings\Temp\Z@S4.tmp
    C:\Documents and Settings\Iida\Local Settings\Temp\Z@S6.tmp

    Finished!
    hijackthis logi
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:51:43, on 19.9.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Norman\Npm\bin\ELOGSVC.EXE
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\MaxMusic\Bin\scServer.exe
    C:\WINDOWS\System32\PAStiSvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Norman\Npm\bin\ZLH.EXE
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/cfweb_activex.camfrogweb.com-advanced_instmodule.exe
    O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Norman\Npm\bin\ELOGSVC.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Norman\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: scMaxMusic - Unknown owner - C:\Program Files\MaxMusic\Bin\scServer.exe
    O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 9715 bytes
     
    GGGL, Sep 19, 2007
    #13
  14. Hujo

    Hujo Guest

    Scannaa koneesi Kaspersky Online Scannerin

    Ohjelman käynnistyessä kysytään sallitaanko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
    " Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
    " Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
    " Klikkaa nyt asetuksia, Scan Settings
    " Tarkista asetuksista, että seuraavat ovat valittuina:
    o Scan using the following Anti-Virus database:
    + Extended (Jos valittavissa, muuten valitse Standard)
    o Scan Options:
    + Scan Archives
    + Scan Mail Bases
    " Klikkaa OK
    " Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
    " Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
    " Klikkaa nyt Save as Text-painiketta.
    " Tallenna tiedosto työpöydällesi.
    " Mikäli haluat jatkaa asian käsittelyä foorumissa niin kopioi tiedoston sisältö viestiisi.
     
    Hujo, Sep 19, 2007
    #14
  15. GGGL

    GGGL Member

    Joined:
    Oct 6, 2006
    Messages:
    27
    Likes Received:
    0
    Trophy Points:
    11
    Tota ei pysty vetää firefoxilla näköjään ja sitten kun koitan mennä IE http://www.kaspersky.com/virusscanner sivulle niin se linkkaa sen firefoxilla :S joku ihme asetus .. tiedätääs kukaan miten sais otettuu pois / muutettuu?
     
    GGGL, Sep 19, 2007
    #15
  16. Hujo

    Hujo Guest

    Hujo, Sep 20, 2007
    #16
  17. GGGL

    GGGL Member

    Joined:
    Oct 6, 2006
    Messages:
    27
    Likes Received:
    0
    Trophy Points:
    11
    ComboFix 07-09-20.1 - "Janne" 2007-09-20 23:15:52.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.358.1035.18.731 [GMT 3:00]
    * Created a new restore point
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2007-08-20 to 2007-09-20 )))))))))))))))))
    .

    2007-09-20 23:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2007-09-20 14:55 116,768 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2007-09-20 14:41 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
    2007-09-19 21:33 <KANSIO> d-------- C:\WINDOWS\ERUNT
    2007-09-18 22:07 <KANSIO> d-------- C:\DOCUME~1\Janne\DoctorWeb
    2007-09-18 19:23 <KANSIO> d-------- C:\Downloads
    2007-09-18 19:23 <KANSIO> d-------- C:\Bases
    2007-09-18 19:19 <KANSIO> d-------- C:\Kaspersky
    2007-09-17 14:26 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2007-09-17 14:19 <KANSIO> d-------- C:\Program Files\Trend Micro
    2007-09-16 17:00 <KANSIO> dr-h----- C:\DOCUME~1\Janne\APPLIC~1\SecuROM
    2007-09-15 10:21 <KANSIO> d-------- C:\Program Files\GLOBALBLEH
    2007-09-14 14:34 <KANSIO> d-------- C:\DOCUME~1\Janne\APPLIC~1\vlc
    2007-09-14 14:31 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll
    2007-09-14 14:31 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
    2007-09-14 14:31 <KANSIO> d-------- C:\Program Files\ffdshow
    2007-09-14 14:30 <KANSIO> d-------- C:\Program Files\VideoLAN
    2007-09-14 14:20 <KANSIO> d-------- C:\Program Files\AC3Filter
    2007-09-14 14:07 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Book Slow Axis Web
    2007-09-12 16:17 <KANSIO> d-------- C:\DOCUME~1\Janne\APPLIC~1\Bioshock
    2007-09-11 20:26 <KANSIO> d-------- C:\DOCUME~1\Janne\APPLIC~1\Command & Conquer 3 Tiberium Wars Demo
    2007-09-11 20:23 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
    2007-09-09 20:37 <KANSIO> d-------- C:\Program Files\GameSpy Arcade
    2007-09-09 19:33 <KANSIO> d-------- C:\NoLopBackups
    2007-09-08 11:49 <KANSIO> d-------- C:\Program Files\Acclaim
    2007-09-05 19:07 <KANSIO> dr------- C:\DOCUME~1\JRJEST~1\Suosikit
    2007-09-05 19:07 <KANSIO> dr------- C:\DOCUME~1\JRJEST~1\Omat tiedostot
    2007-09-05 19:07 <KANSIO> dr------- C:\DOCUME~1\JRJEST~1\K„ynnist„-valikko
    2007-09-05 19:07 <KANSIO> d--h----- C:\DOCUME~1\JRJEST~1\Verkkoymp„rist”
    2007-09-05 19:07 <KANSIO> d--h----- C:\DOCUME~1\JRJEST~1\Tulostinymp„rist”
    2007-09-05 19:07 <KANSIO> d--h----- C:\DOCUME~1\JRJEST~1\Mallit
    2007-09-05 19:07 <KANSIO> d-------- C:\DOCUME~1\JRJEST~1\Ty”p”yt„
    2007-09-05 14:21 <KANSIO> d-------- C:\Program Files\MSXML 4.0

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-09-20 22:12 --------- d-------- C:\Program Files\Steam
    2007-09-20 19:40 --------- d-------- C:\DOCUME~1\Janne\APPLIC~1\foobar2000
    2007-09-20 14:55 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
    2007-09-18 22:18 --------- d-------- C:\DOCUME~1\Janne\APPLIC~1\GLOBALBLEH
    2007-09-18 20:33 --------- d-------- C:\DOCUME~1\Janne\APPLIC~1\Ventrilo
    2007-09-18 19:36 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\HeartLoadForSign
    2007-09-17 22:07 --------- d-------- C:\Program Files\MSN Messenger
    2007-09-17 22:07 --------- d-------- C:\Program Files\Messenger Plus! Live
    2007-09-17 22:06 --------- d--h----- C:\Program Files\InstallShield Installation Information
    2007-09-15 09:06 --------- d-------- C:\DOCUME~1\Janne\APPLIC~1\uTorrent
    2007-09-12 16:17 107888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
    2007-09-11 23:04 --------- d-------- C:\Program Files\Microsoft Games
    2007-09-11 20:20 --------- d-------- C:\Program Files\Electronic Arts
    2007-09-09 00:56 --------- d-------- C:\Program Files\SpywareBlaster
    2007-09-06 16:14 75248 --a------ C:\WINDOWS\zllsputility.exe
    2007-09-06 16:14 1086952 --a------ C:\WINDOWS\system32\zpeng24.dll
    2007-08-02 16:24 --------- d-------- C:\Program Files\World of Warcraft
    2007-08-02 02:29 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\ATI
    2007-08-02 02:19 --------- d-------- C:\Program Files\ATI Technologies
    2007-08-02 01:41 --------- d-------- C:\Program Files\DC++
    2007-08-02 01:20 --------- d-------- C:\DOCUME~1\Janne\APPLIC~1\LimeWire
    2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
    2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
    2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
    2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
    2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
    2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
    2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
    2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
    2007-07-26 17:36 --------- d-------- C:\Program Files\EA Games
    2007-07-18 13:08 103736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
    2007-07-12 14:02 139264 --a------ C:\WINDOWS\War3Unin.exe
    2007-06-29 21:05 520192 --------- C:\WINDOWS\system32\ati2sgag.exe
    2007-06-27 04:59 344064 --a------ C:\WINDOWS\system32\ATIDEMGX.dll
    2007-06-27 04:58 269312 --a------ C:\WINDOWS\system32\ati2dvag.dll
    2007-06-27 04:56 307200 --a------ C:\WINDOWS\system32\atiiiexx.dll
    2007-06-27 04:51 26112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe
    2007-06-27 04:51 143360 --a------ C:\WINDOWS\system32\atipdlxx.dll
    2007-06-27 04:51 122880 --a------ C:\WINDOWS\system32\Oemdspif.dll
    2007-06-27 04:50 43520 --a------ C:\WINDOWS\system32\ati2edxx.dll
    2007-06-27 04:50 118784 --a------ C:\WINDOWS\system32\ati2evxx.dll
    2007-06-27 04:49 483328 --a------ C:\WINDOWS\system32\ati2evxx.exe
    2007-06-27 04:48 53248 --a------ C:\WINDOWS\system32\ATIDDC.DLL
    2007-06-27 04:44 8232960 --a------ C:\WINDOWS\system32\atioglx2.dll
    2007-06-27 04:41 2940992 --a------ C:\WINDOWS\system32\ati3duag.dll
    2007-06-27 04:31 1519744 --a------ C:\WINDOWS\system32\ativvaxx.dll
    2007-06-27 04:19 5435392 --a------ C:\WINDOWS\system32\atioglxx.dll
    2007-06-27 04:17 266240 --a------ C:\WINDOWS\system32\atikvmag.dll
    2007-06-27 04:16 17408 --a------ C:\WINDOWS\system32\atitvo32.dll
    2007-06-27 04:14 176128 --a------ C:\WINDOWS\system32\atiok3x2.dll
    2007-06-27 04:10 376832 --a------ C:\WINDOWS\system32\ati2cqag.dll
    2007-06-26 09:09 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .

    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-07 21:05]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
    "Norman ZANDA"="C:\Norman\Npm\bin\ZLH.exe" [2007-08-09 14:40]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-27 11:46]
    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-09-15 15:00]
    "IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2004-09-15 15:00]
    "SoundMan"="SOUNDMAN.EXE" [2005-07-22 16:00 C:\WINDOWS\SOUNDMAN.EXE]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25]
    "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-02-01 11:07]

    C:\DOCUME~1\ALLUSE~1\KYNNIS~1\Ohjelmat\KYNNIS~1\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
    hp psc 1000 series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2002-12-02 22:08:34]
    hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2002-12-02 21:56:10]

    R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys
    R2 Ndiskio;Ndiskio;\??\C:\Norman\Nse\bin\NDISKIO.SYS
    R2 scMaxMusic;scMaxMusic;C:\Program Files\MaxMusic\Bin\scServer.exe
    S1 ATITool;ATITool Overclocking Utility;C:\WINDOWS\system32\DRIVERS\ATITool.sys
    S3 nvcfsr;nvcfsr;\??\C:\Norman\Nvc\bin\nvcfsr.sys
    S3 NvcMFlt;NvcMFlt;C:\WINDOWS\system32\DRIVERS\nvcw32mf.sys
    S3 nvcoafl51;nvcoafl51;\??\C:\Norman\Nvc\bin\nvcoafl51.sys
    S3 nvcoaft51;nvcoaft51;\??\C:\Norman\Nvc\bin\nvcoaft51.sys
    S3 nvcoarc51;nvcoarc51;\??\C:\Norman\Nvc\bin\nvcoarc51.sys
    S3 nvcoas;Norman Virus Control on-access component;C:\Norman\Nvc\bin\nvcoas.exe
    S3 NVCScheduler;Norman Virus Control Scheduler;C:\Norman\Nvc\BIN\NVCSCHED.EXE
    S3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
    AutoRun\command- E:\AUTORUN.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    AutoRun\command- F:\Autorun.exe

    *Newly Created Service* - CATCHME
    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2007-09-20 15:08:00 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1132243674.job"
    .
    **************************************************************************

    catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-09-20 23:18:26
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-09-20 23:19:16
    .
    --- E O F ---
     
    GGGL, Sep 20, 2007
    #17

Share This Page