Joo elikkä tässä nyt on puolisen vuotta koluttu kaikenlaisia foorumeita läpitte ja aattelin nyt sitten ottaa yhteyttä tämän hijackthis-login myötä. Kone on temppuillut jo liian pitkään joten katsotaan liikenisikö täältä apua: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:49:15, on 14.9.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Belkin\F5D9050\Belkinwcui.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\Winamp\winamp.exe C:\WINDOWS\system32\mmc.exe C:\Program Files\Last.fm\LastFM.exe C:\Documents and Settings\Ossi Nieminen\Työpöytä\nutty.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.finderg.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = >>> 'Full Speed' Enabled <<< R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\2.bin\SPYBLOCK.DLL O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\2.bin\SPYBLOCK.DLL O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [F5D9050] C:\Program Files\Belkin\F5D9050\Belkinwcui.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [c0.exe] "C:\aidualc3\c0.exe" O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: Aero Sidebar.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7B8982D2-99CF-44A1-A551-4524411B7EB0}: NameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{80F70A5E-276C-41F1-BB33-F3D53312BB00}: NameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{E617A8CF-147A-41CE-A7FE-D177661F0E2B}: NameServer = 198.162.2.1 O20 - AppInit_DLLs: WIKI.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 6709 bytes
poista lisää poista sovelutuksesta ZoneAlarm Spy Blocker poista vikasiedossa kansio C:\Program Files\ZoneAlarmSB Scannaa hjt:llä merkkaa paina Fix checked R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.finderg.com O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) - ====================== 1.Lataa combofix.exe työpöydällesi yhdestä linkistä: combofix1 combofix2 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. =============== Lataa Malwarebytes' Anti-Malware työpöydällesi. 1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. 2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish. 3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. 4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan. 5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset. 6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected. 7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt 8. Lähetä lokin sisältö seuraavassa viestissäsi.
ComboFix 08-09-13.05 - Ossi Nieminen 2008-09-14 19:53:18.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.672 [GMT 3:00] Sijainti: C:\Documents and Settings\Ossi Nieminen\Työpöytä\ComboFix.exe * Uusi palautuspiste luotu VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !! . (((((((((((((((((((((((((((((((((((((( Muut poistot )))))))))))))))))))))))))))))))))))))))))))))))))))))))) . D:\Autorun.inf . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-08-14 to 2008-09-14 ))))))))))))))))) . 2008-09-14 19:37 . 2008-06-11 10:30 262,144 --a------ C:\Program Files\Uninstall Spy Blocker.dll 2008-09-09 21:30 . 2008-09-10 03:02 1,374 --a------ C:\WINDOWS\imsins.BAK 2008-09-09 21:23 . 2008-09-09 21:24 <KANSIO> d-------- C:\WINDOWS\system32\NtmsData 2008-09-09 21:11 . 2008-07-28 11:29 160,792 --a------ C:\WINDOWS\system32\drivers\pctfw2.sys 2008-09-09 21:10 . 2008-09-10 09:04 <KANSIO> d-------- C:\Program Files\Spyware Doctor 2008-09-09 21:10 . 2008-09-09 21:13 <KANSIO> d-------- C:\Program Files\Common Files\PC Tools 2008-09-09 21:10 . 2008-09-09 21:10 <KANSIO> d-------- C:\Documents and Settings\Ossi Nieminen\Application Data\PC Tools 2008-09-09 21:10 . 2008-09-10 09:04 <KANSIO> d-a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP 2008-09-09 21:10 . 2008-09-09 21:10 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Tools 2008-09-09 21:10 . 2008-08-25 11:36 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-09-09 21:10 . 2008-08-25 11:36 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-09-09 21:10 . 2008-08-25 11:36 40,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-09-09 21:10 . 2008-06-02 15:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-09-09 15:55 . 2003-10-01 18:38 159,744 -ra------ C:\WINDOWS\system32\igfxres.dll 2008-09-09 15:38 . 2008-09-09 15:38 24,064 --a------ C:\WINDOWS\autoload.exe 2008-09-06 21:17 . 2008-09-06 21:17 <KANSIO> d-------- C:\Documents and Settings\Ossi Nieminen\Application Data\Apple Computer 2008-09-04 13:49 . 2008-09-04 13:49 <KANSIO> d-------- C:\WINDOWS\system32\FlashAX 2008-09-04 13:49 . 2008-09-04 13:49 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microgaming 2008-09-04 13:49 . 2008-09-04 13:52 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\MGS 2008-09-04 13:48 . 2008-09-04 13:48 <KANSIO> d-------- C:\MicroGaming 2008-08-27 20:36 . 2008-08-27 20:36 <KANSIO> d-------- C:\WINDOWS\'Full Speed' Internet Booster + Performance Tests 2008-08-27 20:36 . 2008-08-27 20:37 <KANSIO> d-------- C:\Documents and Settings\Ossi Nieminen\Application Data\MozillaControl 2008-08-27 20:35 . 2008-09-14 15:55 <KANSIO> d-------- C:\aidualc3 2008-08-21 19:59 . 2008-08-21 19:59 <KANSIO> d-------- C:\Program Files\Sun 2008-08-14 03:00 . 2008-05-01 17:32 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-14 16:58 5,052,448 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-09-14 16:40 59,708 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-09-14 11:49 169,472 ----a-w C:\WINDOWS\Internet Logs\xDB34.tmp 2008-09-14 11:34 --------- d-----w C:\Program Files\Steam 2008-09-11 13:19 --------- d-----w C:\Documents and Settings\Ossi Nieminen\Application Data\uTorrent 2008-09-11 12:26 --------- d-----w C:\Program Files\Warcraft III 2008-09-09 11:11 --------- d-----w C:\Program Files\mIRC 2008-09-09 02:19 40,448 ----a-w C:\WINDOWS\Internet Logs\xDB32.tmp 2008-09-09 02:19 1,725,440 ----a-w C:\WINDOWS\Internet Logs\xDB33.tmp 2008-09-08 11:02 --------- d-----w C:\Program Files\LEFFAT 2008-09-08 02:30 130,048 ----a-w C:\WINDOWS\Internet Logs\xDB30.tmp 2008-09-08 02:30 1,721,344 ----a-w C:\WINDOWS\Internet Logs\xDB31.tmp 2008-09-04 14:44 --------- d-----w C:\Program Files\HyCam2 2008-09-03 12:26 1,697,792 ----a-w C:\WINDOWS\Internet Logs\xDB2F.tmp 2008-09-02 01:53 61,952 ----a-w C:\WINDOWS\Internet Logs\xDB2D.tmp 2008-09-02 01:53 1,691,648 ----a-w C:\WINDOWS\Internet Logs\xDB2E.tmp 2008-08-29 21:16 115,712 ----a-w C:\WINDOWS\Internet Logs\xDB2B.tmp 2008-08-29 21:16 1,687,552 ----a-w C:\WINDOWS\Internet Logs\xDB2C.tmp 2008-08-26 20:03 --------- d-----w C:\Program Files\Java 2008-08-21 05:08 78,336 ----a-w C:\WINDOWS\Internet Logs\xDB2A.tmp 2008-08-19 09:48 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-08-16 21:06 73,216 ----a-w C:\WINDOWS\Internet Logs\xDB29.tmp 2008-08-15 00:08 235,008 ----a-w C:\WINDOWS\Internet Logs\xDB27.tmp 2008-08-15 00:08 1,620,992 ----a-w C:\WINDOWS\Internet Logs\xDB28.tmp 2008-08-15 00:07 --------- d-----w C:\Program Files\uTorrent 2008-08-14 10:10 --------- d-----w C:\Documents and Settings\Ossi Nieminen\Application Data\gtk-2.0 2008-07-29 21:40 45,580 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_07_29_22_24_55_small.dmp.zip 2008-07-29 21:40 43,592 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_07_29_22_24_41_small.dmp.zip 2008-07-29 19:25 79,872 ----a-w C:\WINDOWS\Internet Logs\xDB25.tmp 2008-07-29 19:25 1,580,032 ----a-w C:\WINDOWS\Internet Logs\xDB26.tmp 2008-07-22 22:29 38,400 ----a-w C:\WINDOWS\Internet Logs\xDB23.tmp 2008-07-22 22:29 1,573,376 ----a-w C:\WINDOWS\Internet Logs\xDB24.tmp 2008-07-22 11:57 220,160 ----a-w C:\WINDOWS\Internet Logs\xDB22.tmp 2008-07-21 14:48 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-07-21 14:48 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-07-21 14:48 --------- d-----w C:\Documents and Settings\Ossi Nieminen\Application Data\PC Suite 2008-07-21 14:48 --------- d-----w C:\Documents and Settings\Ossi Nieminen\Application Data\Nokia 2008-07-21 14:46 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Suite 2008-07-21 14:44 --------- d-----w C:\Program Files\Nokia 2008-07-21 14:44 --------- d-----w C:\Program Files\Common Files\PCSuite 2008-07-21 14:44 --------- d-----w C:\Program Files\Common Files\Nokia 2008-07-21 14:43 --------- d-----w C:\Program Files\PC Connectivity Solution 2008-07-21 14:41 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Installations 2008-07-19 23:20 2,014,074 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2008-07-09 06:05 75,248 ----a-w C:\WINDOWS\zllsputility.exe 2008-07-09 06:05 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll 2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-05 10:05 23 ----a-w C:\Documents and Settings\Ossi Nieminen\jagex_runescape_preferences.dat 2008-06-30 20:04 49,664 ----a-w C:\WINDOWS\Internet Logs\xDB20.tmp 2008-06-30 20:04 1,516,032 ----a-w C:\WINDOWS\Internet Logs\xDB21.tmp 2008-06-29 10:25 45,568 ----a-w C:\WINDOWS\Internet Logs\xDB1E.tmp 2008-06-29 10:25 1,505,792 ----a-w C:\WINDOWS\Internet Logs\xDB1F.tmp 2008-06-28 22:15 183,296 ----a-w C:\WINDOWS\Internet Logs\xDB1C.tmp 2008-06-28 22:15 1,501,696 ----a-w C:\WINDOWS\Internet Logs\xDB1D.tmp 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:29 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-22 12:43 1,478,656 ----a-w C:\WINDOWS\Internet Logs\xDB1B.tmp 2008-06-20 17:41 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-19 13:17 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2008-06-19 13:17 249,856 ------w C:\WINDOWS\Setup1.exe 2008-06-14 17:16 28,160 ----a-w C:\WINDOWS\Internet Logs\xDB19.tmp 2008-06-14 17:16 1,440,768 ----a-w C:\WINDOWS\Internet Logs\xDB1A.tmp 2002-12-06 14:54 207,360 ----a-w C:\Documents and Settings\WindowsXP.Reactivator.v1.0.&.Key.Recovererand.Discoverer.v5.12\WinXP_RA.exe 2002-01-11 22:00 49,152 ----a-w C:\Documents and Settings\WindowsXP.Reactivator.v1.0.&.Key.Recovererand.Discoverer.v5.12\XPKey.exe . ------- Sigcheck ------- 2005-03-02 21:08 2181632 ae8d156d1028fba3939609f4c39eb1f1 C:\WINDOWS\$hf_mig$\KB890859\SP2GDR\ntoskrnl.exe 2005-03-02 21:13 2181888 6e55b15ee58a0eaaaf20db1f4da39add C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe 2007-02-28 19:08 2184448 7ff07a634379ee2fd2b097fd76c49bfc C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe 2005-03-02 21:18 2043136 e1a81df74102acba9b35901719a26e6c C:\WINDOWS\$NtServicePackUninstall$\ntoskrnl.exe 2004-09-15 02:08 2183296 2a8e38e78177bf83c73897511a4eecd0 C:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe 2003-04-25 15:00 2044544 d9b2a5d5fb22e6c4a7bd4d3e2c2c85d8 C:\WINDOWS\$NtUninstallKB890859_0$\ntoskrnl.exe 2005-03-02 21:08 2181632 ae8d156d1028fba3939609f4c39eb1f1 C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe 2007-02-28 19:02 2338560 52d366edae781b387701433c38436b60 C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe 2007-02-28 19:02 2338560 52d366edae781b387701433c38436b60 C:\WINDOWS\ServicePackFiles\i386\ntoskrnl.exe 2007-02-28 19:02 2338560 52d366edae781b387701433c38436b60 C:\WINDOWS\system32\ntoskrnl.exe 2007-02-28 19:02 2338560 52d366edae781b387701433c38436b60 C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2007-02-28 19:02 2182656 6a51f190523074b729702923fac865f4 C:\WINDOWS\VIPv3\backup\ntoskrnl.exe 2007-06-13 16:22 1404928 4e89c126398f28d92d09d4db71e1da1f C:\WINDOWS\explorer.exe 2007-06-13 16:10 1033728 fb53c3b1e17f62e8fcb07caaf4c4272e C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2003-04-25 15:00 1004544 d6c6bfea41800fd67d3c08f73478065e C:\WINDOWS\$NtServicePackUninstall$\explorer.exe 2004-09-15 02:12 1032704 43c0b3d357f319875a51bc111f393147 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2007-06-13 16:22 1404928 4e89c126398f28d92d09d4db71e1da1f C:\WINDOWS\ServicePackFiles\i386\explorer.exe 2007-06-13 16:22 1404928 4e89c126398f28d92d09d4db71e1da1f C:\WINDOWS\system32\dllcache\explorer.exe 2007-06-13 16:22 1404928 4e89c126398f28d92d09d4db71e1da1f C:\WINDOWS\VIPv3\backup\explorer.exe 2007-07-30 20:19 80216 1fa4b5a2899a41df1b0068e96b55e9c2 C:\WINDOWS\ServicePackFiles\i386\wuauclt.exe 2007-07-30 20:19 80216 1fa4b5a2899a41df1b0068e96b55e9c2 C:\WINDOWS\system32\wuauclt.exe 2007-07-30 20:19 80216 1fa4b5a2899a41df1b0068e96b55e9c2 C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 20:19 80216 1fa4b5a2899a41df1b0068e96b55e9c2 C:\WINDOWS\VIPv3\backup\wuauclt.exe . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 79224] "F5D9050"="C:\Program Files\Belkin\F5D9050\Belkinwcui.exe" [2006-07-20 1617920] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-10-01 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-10-01 118784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 15360] C:\Documents and Settings\Ossi Nieminen\K„ynnist„-valikko\Ohjelmat\K„ynnistys\ Aero Sidebar.lnk - C:\Documents and Settings\Ossi Nieminen\Ty”p”yt„\Aero Sidebar Longhorn.exe [2008-04-10 1546240] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= WIKI.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll "msacm.divxa32"= msaud32_divx.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\WINDOWS\\system32\\dplaysvr.exe"= "C:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\Steam\\steamapps\\sly_bloody\\counter-strike\\hl.exe"= "C:\\WINDOWS\\system32\\mmc.exe"= "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "C:\\Program Files\\TVAnts\\Tvants.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 78416] R1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.sys [2008-07-28 160792] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 20560] R3 StreamSurge;StreamSurge Driver (miniport);C:\WINDOWS\system32\DRIVERS\ss.sys [2005-06-18 19968] S3 NBAG7053;NB 802.11a/g XG705 SP3 Driver;C:\WINDOWS\system32\DRIVERS\WlanUIG.sys [2006-02-07 357792] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\Auto\command - ictknbqas.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ictknbqas.exe *Newly Created Service* - PROCEXP90 . 'Ajoitetut tehtävät'-kansion sisältö . - - - - POISTETUT JÄMÄRIVIT - - - - HKLM-Run-RegistryMechanic - (no file) HKLM-Run-VIPv3_Auto_Update - (no file) HKLM-Run-Vistadrv - (no file) HKLM-Run-VisualTooltip - (no file) . ------- Täydentävä tarkistus ------- . FireFox -: Profile - C:\Documents and Settings\Ossi Nieminen\Application Data\Mozilla\Firefox\Profiles\ha1g1iju.default\ FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npmozax.dll FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-14 19:57:31 Windows 5.1.2600 Service Pack 2 NTFS tarkistaa piilotettuja prosesseja ... tarkistaa piilotettuja käynnistysarvoja ... tarkistaa piilotettuja tiedostoja ... tarkistus on valmis piilotetut tiedostot: 0 ************************************************************************** . Valmistumisajankohta: 2008-09-14 20:00:40 ComboFix-quarantined-files.txt 2008-09-14 17:00:30 Pre-Run: 11,097,137,152 tavua vapaana Post-Run: 11,082,043,392 tavua vapaana 215 --- E O F --- 2008-09-10 00:03:30
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne: Tallenna se nimellä CFScript.txt Sitten raahaa CFScript ComboFix.exeen kuten alla. Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
Malwarebytes' Anti-Malware 1.28 Tietokantaversio: 1151 Windows 5.1.2600 Service Pack 2 14.9.2008 22:06:13 mbam-log-2008-09-14 (22-06-13).txt Tarkistustyyppi: Täysi tarkistus (C:\|D:\|) Tarkistetut kohteet: 163959 Kulunut aika: 1 hour(s), 59 minute(s), 28 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 0 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 4 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: C:\Documents and Settings\WindowsXP.Reactivator.v1.0.&.Key.Recovererand.Discoverer.v5.12\XPKey.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{8E44AED8-4840-4583-A4E2-AF95FBE87F2E}\RP96\A0032968.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{8E44AED8-4840-4583-A4E2-AF95FBE87F2E}\RP96\A0033516.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\explorer.backup (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
ComboFix 08-09-13.05 - Ossi Nieminen 2008-09-14 23:31:34.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.618 [GMT 3:00] Sijainti: C:\Documents and Settings\Ossi Nieminen\Työpöytä\ComboFix.exe Command switches used :: C:\Documents and Settings\Ossi Nieminen\Työpöytä\CFScript.txt * Uusi palautuspiste luotu VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !! . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-08-14 to 2008-09-14 ))))))))))))))))) . 2008-09-14 20:04 . 2008-09-14 20:04 <KANSIO> d-------- C:\Documents and Settings\Ossi Nieminen\Application Data\Malwarebytes 2008-09-14 20:04 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-09-14 20:04 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-09-14 20:03 . 2008-09-14 22:05 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-09-14 20:03 . 2008-09-14 20:03 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes 2008-09-14 19:37 . 2008-06-11 10:30 262,144 --a------ C:\Program Files\Uninstall Spy Blocker.dll 2008-09-09 21:30 . 2008-09-10 03:02 1,374 --a------ C:\WINDOWS\imsins.BAK 2008-09-09 21:23 . 2008-09-09 21:24 <KANSIO> d-------- C:\WINDOWS\system32\NtmsData 2008-09-09 21:11 . 2008-07-28 11:29 160,792 --a------ C:\WINDOWS\system32\drivers\pctfw2.sys 2008-09-09 21:10 . 2008-09-10 09:04 <KANSIO> d-------- C:\Program Files\Spyware Doctor 2008-09-09 21:10 . 2008-09-09 21:13 <KANSIO> d-------- C:\Program Files\Common Files\PC Tools 2008-09-09 21:10 . 2008-09-09 21:10 <KANSIO> d-------- C:\Documents and Settings\Ossi Nieminen\Application Data\PC Tools 2008-09-09 21:10 . 2008-09-10 09:04 <KANSIO> d-a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP 2008-09-09 21:10 . 2008-09-09 21:10 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Tools 2008-09-09 21:10 . 2008-08-25 11:36 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-09-09 21:10 . 2008-08-25 11:36 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-09-09 21:10 . 2008-08-25 11:36 40,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-09-09 21:10 . 2008-06-02 15:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-09-09 15:55 . 2003-10-01 18:38 159,744 -ra------ C:\WINDOWS\system32\igfxres.dll 2008-09-09 15:38 . 2008-09-09 15:38 24,064 --a------ C:\WINDOWS\autoload.exe 2008-09-06 21:17 . 2008-09-06 21:17 <KANSIO> d-------- C:\Documents and Settings\Ossi Nieminen\Application Data\Apple Computer 2008-09-04 13:49 . 2008-09-04 13:49 <KANSIO> d-------- C:\WINDOWS\system32\FlashAX 2008-09-04 13:49 . 2008-09-04 13:49 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microgaming 2008-09-04 13:49 . 2008-09-04 13:52 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\MGS 2008-09-04 13:48 . 2008-09-04 13:48 <KANSIO> d-------- C:\MicroGaming 2008-08-27 20:36 . 2008-08-27 20:36 <KANSIO> d-------- C:\WINDOWS\'Full Speed' Internet Booster + Performance Tests 2008-08-27 20:36 . 2008-08-27 20:37 <KANSIO> d-------- C:\Documents and Settings\Ossi Nieminen\Application Data\MozillaControl 2008-08-27 20:35 . 2008-09-14 15:55 <KANSIO> d-------- C:\aidualc3 2008-08-21 19:59 . 2008-08-21 19:59 <KANSIO> d-------- C:\Program Files\Sun 2008-08-14 03:00 . 2008-05-01 17:32 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-14 20:36 5,120,032 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-09-14 16:40 59,708 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-09-14 11:49 169,472 ----a-w C:\WINDOWS\Internet Logs\xDB34.tmp 2008-09-14 11:34 --------- d-----w C:\Program Files\Steam 2008-09-11 13:19 --------- d-----w C:\Documents and Settings\Ossi Nieminen\Application Data\uTorrent 2008-09-11 12:26 --------- d-----w C:\Program Files\Warcraft III 2008-09-09 11:11 --------- d-----w C:\Program Files\mIRC 2008-09-09 02:19 40,448 ----a-w C:\WINDOWS\Internet Logs\xDB32.tmp 2008-09-09 02:19 1,725,440 ----a-w C:\WINDOWS\Internet Logs\xDB33.tmp 2008-09-08 11:02 --------- d-----w C:\Program Files\LEFFAT 2008-09-08 02:30 130,048 ----a-w C:\WINDOWS\Internet Logs\xDB30.tmp 2008-09-08 02:30 1,721,344 ----a-w C:\WINDOWS\Internet Logs\xDB31.tmp 2008-09-04 14:44 --------- d-----w C:\Program Files\HyCam2 2008-09-03 12:26 1,697,792 ----a-w C:\WINDOWS\Internet Logs\xDB2F.tmp 2008-09-02 01:53 61,952 ----a-w C:\WINDOWS\Internet Logs\xDB2D.tmp 2008-09-02 01:53 1,691,648 ----a-w C:\WINDOWS\Internet Logs\xDB2E.tmp 2008-08-29 21:16 115,712 ----a-w C:\WINDOWS\Internet Logs\xDB2B.tmp 2008-08-29 21:16 1,687,552 ----a-w C:\WINDOWS\Internet Logs\xDB2C.tmp 2008-08-26 20:03 --------- d-----w C:\Program Files\Java 2008-08-21 05:08 78,336 ----a-w C:\WINDOWS\Internet Logs\xDB2A.tmp 2008-08-19 09:48 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-08-16 21:06 73,216 ----a-w C:\WINDOWS\Internet Logs\xDB29.tmp 2008-08-15 00:08 235,008 ----a-w C:\WINDOWS\Internet Logs\xDB27.tmp 2008-08-15 00:08 1,620,992 ----a-w C:\WINDOWS\Internet Logs\xDB28.tmp 2008-08-15 00:07 --------- d-----w C:\Program Files\uTorrent 2008-08-14 10:10 --------- d-----w C:\Documents and Settings\Ossi Nieminen\Application Data\gtk-2.0 2008-07-29 21:40 45,580 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_07_29_22_24_55_small.dmp.zip 2008-07-29 21:40 43,592 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_07_29_22_24_41_small.dmp.zip 2008-07-29 19:25 79,872 ----a-w C:\WINDOWS\Internet Logs\xDB25.tmp 2008-07-29 19:25 1,580,032 ----a-w C:\WINDOWS\Internet Logs\xDB26.tmp 2008-07-22 22:29 38,400 ----a-w C:\WINDOWS\Internet Logs\xDB23.tmp 2008-07-22 22:29 1,573,376 ----a-w C:\WINDOWS\Internet Logs\xDB24.tmp 2008-07-22 11:57 220,160 ----a-w C:\WINDOWS\Internet Logs\xDB22.tmp 2008-07-21 14:48 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-07-21 14:48 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-07-21 14:48 --------- d-----w C:\Documents and Settings\Ossi Nieminen\Application Data\PC Suite 2008-07-21 14:48 --------- d-----w C:\Documents and Settings\Ossi Nieminen\Application Data\Nokia 2008-07-21 14:46 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Suite 2008-07-21 14:44 --------- d-----w C:\Program Files\Nokia 2008-07-21 14:44 --------- d-----w C:\Program Files\Common Files\PCSuite 2008-07-21 14:44 --------- d-----w C:\Program Files\Common Files\Nokia 2008-07-21 14:43 --------- d-----w C:\Program Files\PC Connectivity Solution 2008-07-21 14:41 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Installations 2008-07-19 23:20 2,014,074 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2008-07-09 06:05 75,248 ----a-w C:\WINDOWS\zllsputility.exe 2008-07-09 06:05 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll 2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-05 10:05 23 ----a-w C:\Documents and Settings\Ossi Nieminen\jagex_runescape_preferences.dat 2008-06-30 20:04 49,664 ----a-w C:\WINDOWS\Internet Logs\xDB20.tmp 2008-06-30 20:04 1,516,032 ----a-w C:\WINDOWS\Internet Logs\xDB21.tmp 2008-06-29 10:25 45,568 ----a-w C:\WINDOWS\Internet Logs\xDB1E.tmp 2008-06-29 10:25 1,505,792 ----a-w C:\WINDOWS\Internet Logs\xDB1F.tmp 2008-06-28 22:15 183,296 ----a-w C:\WINDOWS\Internet Logs\xDB1C.tmp 2008-06-28 22:15 1,501,696 ----a-w C:\WINDOWS\Internet Logs\xDB1D.tmp 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:29 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-22 12:43 1,478,656 ----a-w C:\WINDOWS\Internet Logs\xDB1B.tmp 2008-06-20 17:41 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-19 13:17 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2008-06-19 13:17 249,856 ------w C:\WINDOWS\Setup1.exe 2008-06-14 17:16 28,160 ----a-w C:\WINDOWS\Internet Logs\xDB19.tmp 2008-06-14 17:16 1,440,768 ----a-w C:\WINDOWS\Internet Logs\xDB1A.tmp 2002-12-06 14:54 207,360 ----a-w C:\Documents and Settings\WindowsXP.Reactivator.v1.0.&.Key.Recovererand.Discoverer.v5.12\WinXP_RA.exe . ------- Sigcheck ------- 2005-03-02 21:08 2181632 ae8d156d1028fba3939609f4c39eb1f1 C:\WINDOWS\$hf_mig$\KB890859\SP2GDR\ntoskrnl.exe 2005-03-02 21:13 2181888 6e55b15ee58a0eaaaf20db1f4da39add C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe 2007-02-28 19:08 2184448 7ff07a634379ee2fd2b097fd76c49bfc C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe 2005-03-02 21:18 2043136 e1a81df74102acba9b35901719a26e6c C:\WINDOWS\$NtServicePackUninstall$\ntoskrnl.exe 2004-09-15 02:08 2183296 2a8e38e78177bf83c73897511a4eecd0 C:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe 2003-04-25 15:00 2044544 d9b2a5d5fb22e6c4a7bd4d3e2c2c85d8 C:\WINDOWS\$NtUninstallKB890859_0$\ntoskrnl.exe 2005-03-02 21:08 2181632 ae8d156d1028fba3939609f4c39eb1f1 C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe 2007-02-28 19:02 2338560 52d366edae781b387701433c38436b60 C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe 2007-02-28 19:02 2338560 52d366edae781b387701433c38436b60 C:\WINDOWS\ServicePackFiles\i386\ntoskrnl.exe 2007-02-28 19:02 2338560 52d366edae781b387701433c38436b60 C:\WINDOWS\system32\ntoskrnl.exe 2007-02-28 19:02 2338560 52d366edae781b387701433c38436b60 C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2007-02-28 19:02 2182656 6a51f190523074b729702923fac865f4 C:\WINDOWS\VIPv3\backup\ntoskrnl.exe 2007-06-13 16:22 1404928 4e89c126398f28d92d09d4db71e1da1f C:\WINDOWS\explorer.exe 2007-06-13 16:10 1033728 fb53c3b1e17f62e8fcb07caaf4c4272e C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2003-04-25 15:00 1004544 d6c6bfea41800fd67d3c08f73478065e C:\WINDOWS\$NtServicePackUninstall$\explorer.exe 2004-09-15 02:12 1032704 43c0b3d357f319875a51bc111f393147 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2007-06-13 16:22 1404928 4e89c126398f28d92d09d4db71e1da1f C:\WINDOWS\ServicePackFiles\i386\explorer.exe 2007-06-13 16:22 1404928 4e89c126398f28d92d09d4db71e1da1f C:\WINDOWS\system32\dllcache\explorer.exe 2007-06-13 16:22 1404928 4e89c126398f28d92d09d4db71e1da1f C:\WINDOWS\VIPv3\backup\explorer.exe 2007-07-30 20:19 80216 1fa4b5a2899a41df1b0068e96b55e9c2 C:\WINDOWS\ServicePackFiles\i386\wuauclt.exe 2007-07-30 20:19 80216 1fa4b5a2899a41df1b0068e96b55e9c2 C:\WINDOWS\system32\wuauclt.exe 2007-07-30 20:19 80216 1fa4b5a2899a41df1b0068e96b55e9c2 C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 20:19 80216 1fa4b5a2899a41df1b0068e96b55e9c2 C:\WINDOWS\VIPv3\backup\wuauclt.exe . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 79224] "F5D9050"="C:\Program Files\Belkin\F5D9050\Belkinwcui.exe" [2006-07-20 1617920] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-10-01 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-10-01 118784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 15360] C:\Documents and Settings\Ossi Nieminen\K„ynnist„-valikko\Ohjelmat\K„ynnistys\ Aero Sidebar.lnk - C:\Documents and Settings\Ossi Nieminen\Ty”p”yt„\Aero Sidebar Longhorn.exe [2008-04-10 1546240] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= WIKI.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll "msacm.divxa32"= msaud32_divx.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\WINDOWS\\system32\\dplaysvr.exe"= "C:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\Steam\\steamapps\\sly_bloody\\counter-strike\\hl.exe"= "C:\\WINDOWS\\system32\\mmc.exe"= "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "C:\\Program Files\\TVAnts\\Tvants.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 78416] R1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.sys [2008-07-28 160792] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 20560] R3 StreamSurge;StreamSurge Driver (miniport);C:\WINDOWS\system32\DRIVERS\ss.sys [2005-06-18 19968] S3 NBAG7053;NB 802.11a/g XG705 SP3 Driver;C:\WINDOWS\system32\DRIVERS\WlanUIG.sys [2006-02-07 357792] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\Auto\command - ictknbqas.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ictknbqas.exe *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . 'Ajoitetut tehtävät'-kansion sisältö . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-14 23:35:21 Windows 5.1.2600 Service Pack 2 NTFS tarkistaa piilotettuja prosesseja ... tarkistaa piilotettuja käynnistysarvoja ... tarkistaa piilotettuja tiedostoja ... tarkistus on valmis piilotetut tiedostot: 0 ************************************************************************** . Valmistumisajankohta: 2008-09-14 23:38:23 ComboFix-quarantined-files.txt 2008-09-14 20:38:12 ComboFix2.txt 2008-09-14 17:00:42 Pre-Run: 12,193,206,272 tavua vapaana Post-Run: 12,184,776,704 tavua vapaana 204 --- E O F --- 2008-09-10 00:03:30
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi. Käynnistä koneesi vikasietotilaan: sammuta ja käynnistä käynnistyksen yhteydessä hakkaa F8 nappia valitse nuolinäppäimellä vikasietotila paina enter ja enter valitse käyttäjätilisi paina kyllä Jossakin koneissa hakataan F8:sin sijasta F5:tä " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix. " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman. " Paina Y käynnistääksesi skriptin. " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot". " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen. " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta. " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished". " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle. " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera. ================= Lataa Tästä Ccleaner CCleaner v2.05.555- Standard Build, ÄLÄ aseenna Yahoo toolbaria! Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki". Asennuksen jälkeen aukaise CCleaner. Valitse vasemmalta pystyrivistä Options. Valitse viereisestä pystyrivistä Settings. Language kohtaan valitse Suomi. Puhdistaja Valitse vasemmalta pystyrivistä Puhdistaja. Paina alhaalta Tutki. Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.). Kun tutkiminen on valmis, paina Aja CCleaner. Nyt CCleaner poistaa löydetyt tempit, cookiessit jne. Rekisterin virheiden korjaus Valitse vasemmalta pystyrivistä Rekisteri. Paina alhaalta Etsi rekisterin virheitä. Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet. Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon. Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet. Saat vielä varmistus kysymyksen, paina Ok. Kun virheet on korjattu, paina Sulje. Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent" "C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC" "C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper" "C:\\Program Files\\SopCast\\SopCast.exe"="C:\\Program Files\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application" "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"="C:\\Program Files\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver" "C:\\Program Files\\Steam\\steamapps\\sly_bloody\\counter-strike\\hl.exe"="C:\\Program Files\\Steam\\steamapps\\sly_bloody\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\WINDOWS\\system32\\mmc.exe"="C:\\WINDOWS\\system32\\mmc.exe:*:Enabled:Microsoft Management Console" "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"="C:\\Program Files\\TVUPlayer\\TVUPlayer.exe:*:Enabled:TVUPlayer Component" "C:\\Program Files\\TVAnts\\Tvants.exe"="C:\\Program Files\\TVAnts\\Tvants.exe:*:Enabled:TVAnts" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" Remaining Files : Files with Hidden Attributes : Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe" Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" Sat 13 Oct 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sat 13 Oct 2007 401 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv19.bak" Sat 8 Mar 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak" Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0045d90d3c637c74f834c75fe192b558\BIT5.tmp" Fri 21 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4967d9f6f454587202f77c6a59503d8e\BIT12.tmp" Finished! ogfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:20:41, on 15.9.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\system32\notepad.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Belkin\F5D9050\Belkinwcui.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (file missing) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [F5D9050] C:\Program Files\Belkin\F5D9050\Belkinwcui.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: Aero Sidebar.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7B8982D2-99CF-44A1-A551-4524411B7EB0}: NameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{80F70A5E-276C-41F1-BB33-F3D53312BB00}: NameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{E617A8CF-147A-41CE-A7FE-D177661F0E2B}: NameServer = 198.162.2.1 O20 - AppInit_DLLs: WIKI.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 5787 bytes
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne: Tallenna se nimellä CFScript.txt Sitten raahaa CFScript ComboFix.exeen kuten alla. Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne. === Nyt tuon punasella merkityn laitat tyhjään muistioon käynnistä nappi >apuohjelmat > muistio Kohde: työpöytä sittten vasemmasta ylä reunasta tiedosto > tallenna nimellä CFScript.txt tallenusmuoto kaikki tiedostot sitten raahaat sen kuvan osoitamalla tavalla Klikkaat siis CFScript.txt kiinni hiiren vasemanpuoleisella napilla vedät sen Combofix.exen päälle ja irotat hiiren napista putos combofix työstää tulee sininen taulu paina numeroa 1 ja enter
ComboFix 08-09-14.06 - Ossi Nieminen 2008-09-15 20:54:48.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.630 [GMT 3:00] Sijainti: C:\Documents and Settings\Ossi Nieminen\Työpöytä\ComboFix.exe Command switches used :: C:\Documents and Settings\Ossi Nieminen\Työpöytä\CFScript.txt * Uusi palautuspiste luotu VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !! . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-08-15 to 2008-09-15 ))))))))))))))))) . 2008-09-15 15:05 . 2008-09-15 15:05 <KANSIO> d-------- C:\WINDOWS\ERUNT 2008-09-15 15:04 . 2008-09-14 04:48 <KANSIO> d-------- C:\SDFix 2008-09-14 20:04 . 2008-09-14 20:04 <KANSIO> d-------- C:\Documents and Settings\Ossi Nieminen\Application Data\Malwarebytes 2008-09-14 20:04 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-09-14 20:04 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-09-14 20:03 . 2008-09-14 22:05 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-09-14 20:03 . 2008-09-14 20:03 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes 2008-09-09 21:23 . 2008-09-09 21:24 <KANSIO> d-------- C:\WINDOWS\system32\NtmsData 2008-09-09 21:11 . 2008-07-28 11:29 160,792 --a------ C:\WINDOWS\system32\drivers\pctfw2.sys 2008-09-09 21:10 . 2008-09-10 09:04 <KANSIO> d-------- C:\Program Files\Spyware Doctor 2008-09-09 21:10 . 2008-09-09 21:13 <KANSIO> d-------- C:\Program Files\Common Files\PC Tools 2008-09-09 21:10 . 2008-09-09 21:10 <KANSIO> d-------- C:\Documents and Settings\Ossi Nieminen\Application Data\PC Tools 2008-09-09 21:10 . 2008-09-10 09:04 <KANSIO> d-a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP 2008-09-09 21:10 . 2008-09-09 21:10 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Tools 2008-09-09 21:10 . 2008-08-25 11:36 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-09-09 21:10 . 2008-08-25 11:36 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-09-09 21:10 . 2008-08-25 11:36 40,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-09-09 21:10 . 2008-06-02 15:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-09-09 15:55 . 2003-10-01 18:38 159,744 -ra------ C:\WINDOWS\system32\igfxres.dll 2008-09-09 15:38 . 2008-09-09 15:38 24,064 --a------ C:\WINDOWS\autoload.exe 2008-09-06 21:17 . 2008-09-06 21:17 <KANSIO> d-------- C:\Documents and Settings\Ossi Nieminen\Application Data\Apple Computer 2008-09-04 13:49 . 2008-09-04 13:49 <KANSIO> d-------- C:\WINDOWS\system32\FlashAX 2008-09-04 13:49 . 2008-09-04 13:49 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microgaming 2008-09-04 13:49 . 2008-09-04 13:52 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\MGS 2008-09-04 13:48 . 2008-09-04 13:48 <KANSIO> d-------- C:\MicroGaming 2008-08-27 20:36 . 2008-08-27 20:36 <KANSIO> d-------- C:\WINDOWS\'Full Speed' Internet Booster + Performance Tests 2008-08-27 20:36 . 2008-08-27 20:37 <KANSIO> d-------- C:\Documents and Settings\Ossi Nieminen\Application Data\MozillaControl 2008-08-27 20:35 . 2008-09-14 15:55 <KANSIO> d-------- C:\aidualc3 2008-08-21 19:59 . 2008-08-21 19:59 <KANSIO> d-------- C:\Program Files\Sun . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-15 17:59 5,302,304 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-09-15 12:13 3,823,270 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2008-09-15 12:02 63,488 ----a-w C:\WINDOWS\Internet Logs\xDB35.tmp 2008-09-15 12:02 62,372 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-09-15 09:47 --------- d-----w C:\Program Files\LEFFAT 2008-09-15 09:42 --------- d-----w C:\Documents and Settings\Ossi Nieminen\Application Data\uTorrent 2008-09-14 11:49 169,472 ----a-w C:\WINDOWS\Internet Logs\xDB34.tmp 2008-09-14 11:34 --------- d-----w C:\Program Files\Steam 2008-09-11 12:26 --------- d-----w C:\Program Files\Warcraft III 2008-09-09 11:11 --------- d-----w C:\Program Files\mIRC 2008-09-09 02:19 40,448 ----a-w C:\WINDOWS\Internet Logs\xDB32.tmp 2008-09-09 02:19 1,725,440 ----a-w C:\WINDOWS\Internet Logs\xDB33.tmp 2008-09-08 02:30 130,048 ----a-w C:\WINDOWS\Internet Logs\xDB30.tmp 2008-09-08 02:30 1,721,344 ----a-w C:\WINDOWS\Internet Logs\xDB31.tmp 2008-09-04 14:44 --------- d-----w C:\Program Files\HyCam2 2008-09-03 12:26 1,697,792 ----a-w C:\WINDOWS\Internet Logs\xDB2F.tmp 2008-09-02 01:53 61,952 ----a-w C:\WINDOWS\Internet Logs\xDB2D.tmp 2008-09-02 01:53 1,691,648 ----a-w C:\WINDOWS\Internet Logs\xDB2E.tmp 2008-08-29 21:16 115,712 ----a-w C:\WINDOWS\Internet Logs\xDB2B.tmp 2008-08-29 21:16 1,687,552 ----a-w C:\WINDOWS\Internet Logs\xDB2C.tmp 2008-08-26 20:03 --------- d-----w C:\Program Files\Java 2008-08-21 05:08 78,336 ----a-w C:\WINDOWS\Internet Logs\xDB2A.tmp 2008-08-19 09:48 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-08-16 21:06 73,216 ----a-w C:\WINDOWS\Internet Logs\xDB29.tmp 2008-08-15 00:08 235,008 ----a-w C:\WINDOWS\Internet Logs\xDB27.tmp 2008-08-15 00:08 1,620,992 ----a-w C:\WINDOWS\Internet Logs\xDB28.tmp 2008-08-15 00:07 --------- d-----w C:\Program Files\uTorrent 2008-08-14 10:10 --------- d-----w C:\Documents and Settings\Ossi Nieminen\Application Data\gtk-2.0 2008-07-29 21:40 45,580 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_07_29_22_24_55_small.dmp.zip 2008-07-29 21:40 43,592 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_07_29_22_24_41_small.dmp.zip 2008-07-29 19:25 79,872 ----a-w C:\WINDOWS\Internet Logs\xDB25.tmp 2008-07-29 19:25 1,580,032 ----a-w C:\WINDOWS\Internet Logs\xDB26.tmp 2008-07-22 22:29 38,400 ----a-w C:\WINDOWS\Internet Logs\xDB23.tmp 2008-07-22 22:29 1,573,376 ----a-w C:\WINDOWS\Internet Logs\xDB24.tmp 2008-07-22 11:57 220,160 ----a-w C:\WINDOWS\Internet Logs\xDB22.tmp 2008-07-21 14:48 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-07-21 14:48 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-07-21 14:48 --------- d-----w C:\Documents and Settings\Ossi Nieminen\Application Data\PC Suite 2008-07-21 14:48 --------- d-----w C:\Documents and Settings\Ossi Nieminen\Application Data\Nokia 2008-07-21 14:46 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Suite 2008-07-21 14:44 --------- d-----w C:\Program Files\Nokia 2008-07-21 14:44 --------- d-----w C:\Program Files\Common Files\PCSuite 2008-07-21 14:44 --------- d-----w C:\Program Files\Common Files\Nokia 2008-07-21 14:43 --------- d-----w C:\Program Files\PC Connectivity Solution 2008-07-21 14:41 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Installations 2008-07-09 06:05 75,248 ----a-w C:\WINDOWS\zllsputility.exe 2008-07-09 06:05 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll 2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-05 10:05 23 ----a-w C:\Documents and Settings\Ossi Nieminen\jagex_runescape_preferences.dat 2008-06-30 20:04 49,664 ----a-w C:\WINDOWS\Internet Logs\xDB20.tmp 2008-06-30 20:04 1,516,032 ----a-w C:\WINDOWS\Internet Logs\xDB21.tmp 2008-06-29 10:25 45,568 ----a-w C:\WINDOWS\Internet Logs\xDB1E.tmp 2008-06-29 10:25 1,505,792 ----a-w C:\WINDOWS\Internet Logs\xDB1F.tmp 2008-06-28 22:15 183,296 ----a-w C:\WINDOWS\Internet Logs\xDB1C.tmp 2008-06-28 22:15 1,501,696 ----a-w C:\WINDOWS\Internet Logs\xDB1D.tmp 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:29 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-22 12:43 1,478,656 ----a-w C:\WINDOWS\Internet Logs\xDB1B.tmp 2008-06-20 17:41 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-19 13:17 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2008-06-19 13:17 249,856 ------w C:\WINDOWS\Setup1.exe 2002-12-06 14:54 207,360 ----a-w C:\Documents and Settings\WindowsXP.Reactivator.v1.0.&.Key.Recovererand.Discoverer.v5.12\WinXP_RA.exe . ------- Sigcheck ------- 2005-03-02 21:08 2181632 ae8d156d1028fba3939609f4c39eb1f1 C:\WINDOWS\$hf_mig$\KB890859\SP2GDR\ntoskrnl.exe 2005-03-02 21:13 2181888 6e55b15ee58a0eaaaf20db1f4da39add C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe 2007-02-28 19:08 2184448 7ff07a634379ee2fd2b097fd76c49bfc C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe 2005-03-02 21:18 2043136 e1a81df74102acba9b35901719a26e6c C:\WINDOWS\$NtServicePackUninstall$\ntoskrnl.exe 2004-09-15 02:08 2183296 2a8e38e78177bf83c73897511a4eecd0 C:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe 2003-04-25 15:00 2044544 d9b2a5d5fb22e6c4a7bd4d3e2c2c85d8 C:\WINDOWS\$NtUninstallKB890859_0$\ntoskrnl.exe 2005-03-02 21:08 2181632 ae8d156d1028fba3939609f4c39eb1f1 C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe 2007-02-28 19:02 2338560 52d366edae781b387701433c38436b60 C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe 2007-02-28 19:02 2338560 52d366edae781b387701433c38436b60 C:\WINDOWS\ServicePackFiles\i386\ntoskrnl.exe 2007-02-28 19:02 2338560 52d366edae781b387701433c38436b60 C:\WINDOWS\system32\ntoskrnl.exe 2007-02-28 19:02 2338560 52d366edae781b387701433c38436b60 C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2007-02-28 19:02 2182656 6a51f190523074b729702923fac865f4 C:\WINDOWS\VIPv3\backup\ntoskrnl.exe 2007-06-13 16:22 1404928 4e89c126398f28d92d09d4db71e1da1f C:\WINDOWS\explorer.exe 2007-06-13 16:10 1033728 fb53c3b1e17f62e8fcb07caaf4c4272e C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2003-04-25 15:00 1004544 d6c6bfea41800fd67d3c08f73478065e C:\WINDOWS\$NtServicePackUninstall$\explorer.exe 2004-09-15 02:12 1032704 43c0b3d357f319875a51bc111f393147 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2007-06-13 16:22 1404928 4e89c126398f28d92d09d4db71e1da1f C:\WINDOWS\ServicePackFiles\i386\explorer.exe 2007-06-13 16:22 1404928 4e89c126398f28d92d09d4db71e1da1f C:\WINDOWS\system32\dllcache\explorer.exe 2007-06-13 16:22 1404928 4e89c126398f28d92d09d4db71e1da1f C:\WINDOWS\VIPv3\backup\explorer.exe 2007-07-30 20:19 80216 1fa4b5a2899a41df1b0068e96b55e9c2 C:\WINDOWS\ServicePackFiles\i386\wuauclt.exe 2007-07-30 20:19 80216 1fa4b5a2899a41df1b0068e96b55e9c2 C:\WINDOWS\system32\wuauclt.exe 2007-07-30 20:19 80216 1fa4b5a2899a41df1b0068e96b55e9c2 C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 20:19 80216 1fa4b5a2899a41df1b0068e96b55e9c2 C:\WINDOWS\VIPv3\backup\wuauclt.exe . ((((((((((((((((((((((((((((( snapshot@2008-09-14_19.59.50.18 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 13:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-09-15 12:05:37 6,778,880 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT + 2008-09-15 12:05:37 188,416 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat + 2008-08-07 13:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-09-15 12:05:25 6,778,880 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT + 2008-09-15 12:05:26 188,416 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat + 2008-09-15 12:13:47 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_170.dat . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 79224] "F5D9050"="C:\Program Files\Belkin\F5D9050\Belkinwcui.exe" [2006-07-20 1617920] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-10-01 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-10-01 118784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= WIKI.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll "msacm.divxa32"= msaud32_divx.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\WINDOWS\\system32\\dplaysvr.exe"= "C:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\Steam\\steamapps\\sly_bloody\\counter-strike\\hl.exe"= "C:\\WINDOWS\\system32\\mmc.exe"= "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "C:\\Program Files\\TVAnts\\Tvants.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 78416] R1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.sys [2008-07-28 160792] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 20560] R3 StreamSurge;StreamSurge Driver (miniport);C:\WINDOWS\system32\DRIVERS\ss.sys [2005-06-18 19968] S3 NBAG7053;NB 802.11a/g XG705 SP3 Driver;C:\WINDOWS\system32\DRIVERS\WlanUIG.sys [2006-02-07 357792] . 'Ajoitetut tehtävät'-kansion sisältö . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-15 20:58:42 Windows 5.1.2600 Service Pack 2 NTFS tarkistaa piilotettuja prosesseja ... tarkistaa piilotettuja käynnistysarvoja ... tarkistaa piilotettuja tiedostoja ... tarkistus on valmis piilotetut tiedostot: 0 ************************************************************************** . Valmistumisajankohta: 2008-09-15 21:01:40 ComboFix-quarantined-files.txt 2008-09-15 18:01:32 ComboFix2.txt 2008-09-14 20:38:25 ComboFix3.txt 2008-09-14 17:00:42 Pre-Run: 3,765,071,872 tavua vapaana Post-Run: 3,727,515,648 tavua vapaana 206 --- E O F --- 2008-09-10 00:03:30
1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla 2. Valitse ominaisuudet 3. Valitse järjestelmän palauttaminen välilehti 4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa 5. Paina Käytä 6. Paina ok 7. Sammuta ja käynnistä 8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa 9. Käytä ja OK ========== Lataa Atribunen ATF Cleaner Ohjeet; Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.Main:n alla valitse: Select All Klikkaa Empty Selected valintaa. Jos käytät FireFoxia selaimenasi Klikkaa Firefox yläpuolelta ja valitse: Select All Klikkaa Empty Selected valintaa. HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy. Jos käytät Operaa selaimenasiKlikkaa Opera yläpuolelta ja valitse: Select All Klikkaa Empty Selected valintaa taas. HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy. Klikkaa Exit päävalikosta sulkeaksesi ohjelman. Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)
joo se löytyy sieltäkin Ja löytyy myös näin Käynnistä nappi > oma tietokone hiiren oikanpuoleisella napilla klikaten > kohta ominaisuudet =========== Mites kone toimii
Hei Näyttää siltä, että täällä olisi itseäni paljon osaavampia ihmisiä. Koneeni on alkanut hidastelemaan, ohjelmat aukeavat hitaasti, selain toimii hitaasti, sekä kone käynnistyy kauan.. Olisiko hijackthis:stä apua tähän ongelmaan. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:50:59, on 6.10.2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Sygate\smc.exe C:\Program Files\Ad-Aware\aawservice.exe C:\Program Files\Avast\aswUpdSv.exe C:\Program Files\Avast\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\SisoftSandra\RpcAgentSrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\PROGRA~1\Avast\ashDisp.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Wireless\Wlan.exe C:\Program Files\mIRC\mirc.exe C:\Program Files\Avast\ashMaiSv.exe C:\Program Files\Avast\ashWebSv.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast\ashDisp.exe O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\smc.exe -startgui O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\AdobeReader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O4 - Startup: Opera.lnk = C:\Program Files\Opera\opera.exe O4 - Startup: Shortcut to mirc.lnk = C:\Program Files\mIRC\mirc.exe O4 - Global Startup: WirelessLAN USB Utility.lnk = C:\Program Files\Wireless\Wlan.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Ad-Aware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast\ashWebSv.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SisoftSandra\RpcAgentSrv.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\smc.exe O24 - Desktop Component 1: (no name) - http://www.radiorock.fi/player/ -- End of file - 6243 bytes
Hei, täälä tällainen noviisi kyselee apua. Eli tällaisen login sain skannattuani koneen. Osaisko joku suomentaa tätä minulle? Kiitos paljon jo etukäteen! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:46:45, on 6.10.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\system32\svchost.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\AGRSMMSG.exe C:\WINDOWS\system32\hphmon06.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\mIRC\mirc.exe C:\WINDOWS\explorer.exe C:\Program Files\Opera\Opera.exe C:\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q305&bd=pavilion&pf=desktop R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q305&bd=pavilion&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file) O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll O2 - BHO: Alcohol Toolbar Helper - {52D06F97-5511-43FA-8FDA-C481864FD26E} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: Alcohol Toolbar - {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [EPSON Stylus DX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE /P26 "EPSON Stylus DX4800 Series" /O6 "USB001" /M "Stylus DX4800" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve') O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user') O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU) O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU) O16 - DPF: {0018A71D-26DA-4707-AF52-E0B9D39796F2} (LaFargeOnline Control) - http://lafarge.kampanj.nu/LafargeOnline.cab O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135702836921 O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe -- End of file - 14123 bytes
