HJT logi, haastetta kerrakseen;

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by kasperika, Oct 21, 2008.

  1. kasperika

    kasperika Guest

    Olen ilmeisesti ainakin seuraavien viruksien tartuttama;

    win32/adware.virtumondo
    win32/privacy.remover.m64

    taustakuvan tilalle tulee sinipohjainen varoitusteksti;
    sekä ed. mainitut ohjelmat ja " please activate your antivirus "jne.

    tunnistaako ketään mikä on homman nimi; onko winukan päivityksillä (mm. sp3 ym. as. hiljattain) mitään tekemistä tämän kanssa, jos on niin miksi ja miten, liittyykö mitenkään winukan rekisteröintiin?

    Lisäksi sekä fsecure että antivir ei installoidu koska eivät tunnista verkkoyhteyttä, saatika installoidu että päivittyisi, jotta pääsisin viruscannaamaan jne.

    Ilmoittavat ettei nettiyhteyttä ole, vaikka onkin (koska kirjoitan paraikaa tätäkin), lisäksi selain(firefox)toimii vikasietotilassa, mistä sitten johtuukaan?

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:39:26, on 21.10.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\cisvc.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
    C:\WINDOWS\System32\inetsrv\inetinfo.exe
    C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\vssvc.exe
    C:\WINDOWS\System32\dmadmin.exe
    C:\WINDOWS\system32\mqsvc.exe
    C:\WINDOWS\system32\mqtgsvc.exe
    C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\EPOX\USDM\USDM.EXE
    C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Plextor\PlexTool.exe
    C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\WinRAR\WinRAR.exe
    C:\WINDOWS\system32\ntvdm.exe
    C:\ROR\HIJACK.EXE

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: {558b5fe9-5cb9-94ab-2834-126dff135563} - {365531ff-d621-4382-ba49-9bc59ef5b855} - C:\WINDOWS\system32\qdmgep.dll
    O2 - BHO: (no name) - {79163723-7935-46BE-90CE-C9E9719F8C66} - C:\WINDOWS\system32\iifedaXO.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {D719D475-E462-4ABA-8AA8-0FACE9D15A15} - C:\WINDOWS\system32\nnnoNfGx.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s
    O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [EPoXUSDM] "C:\Program Files\EPOX\USDM\USDM.EXE" "5000"
    O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
    O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
    O4 - HKLM\..\Run: [70c1aa88] rundll32.exe "C:\WINDOWS\system32\olncqlhc.dll",b
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: PlexTools Professional.lnk = C:\Program Files\Plextor\PlexTool.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?c80b606f39b343d686ad14018e5f0641
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?c80b606f39b343d686ad14018e5f0641
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O15 - Trusted Zone: http://*.mcafee.com
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1194307287617
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1194307736172
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {B9F79165-A264-4C4A-A211-133A5E8D647F} (F-Secure Health Check 1.1) - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: karna.dat
    O20 - Winlogon Notify: iifedaXO - C:\WINDOWS\SYSTEM32\iifedaXO.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\ORSP Client\fsorsp.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
    O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
    O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
    O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
    O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
    O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - Unknown owner - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe (file missing)
    O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - Unknown owner - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe (file missing)
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe

    --
    End of file - 10656 bytes

    Suurkiitos etukäteen!
     
    kasperika, Oct 21, 2008
    #1
  2. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä:
    Combofix.exe
    Combofix.exe

    Avaa Combofix.exe ja seuraa näyttöön tulevia ohjeita

    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
    Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.

    Tyhjennä roskakori ja käynnistä koneesi uudelleen.

    Postita tänne seuraavat lokit:
    * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
    * (C:\ComboFix.txt) raportti
    *

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    * Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    * Lopuksi varmistu, että seuraavat on valittu: Päivitä Malwarebytes' Anti-Malware ja Käynnistä Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Lopeta.
    * Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    * Kun ohjelma on latautunut, valitse Suorita täysi tarkistus ja klikkaa Tarkista.
    * Kun skanni on valmis, klikkaa OK ja sitten Näytä tulokset nähdäksesi tulokset.
    * Varmistu, että kaikki on merkitty ja klikkaa Poista valitut.
    * Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös
    täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    * Lähetä lokin sisältö seuraavassa viestissäsi + uusi hjt-loki.
     
    yaht, Oct 21, 2008
    #2
  3. kasperika

    kasperika Guest

    Ensinnäkin suurkiitos, minusta on vaikea ymmärtää että joku auttaa toista, ilman että hyötyy siitä suoranaisesti, varsinkin tänäpäivänä tässä maailmassa.

    combofix ei lähtenyt ollenkaan pyörimään ennenkuin ajoin tuon malwaresin, sittenkin siihen tuli vaan pikku ikkuna joka jonkun aikaa oli "käynnissä" ja sitten vaan katosi, eli en saa normaalisti vieläkään ajettua sitä,

    lisäksi huomasin ajaessani ilmeisesti jälkimmäistä, että panda-palomuurini, joka yllättäen ilmeisesti lähti taas toimimaan, niin ilmeisesti esti joitain hjt:n toimintoja, koska olin unohtanut palomuurisalasanani, en siis voinut antaa lupaa ao. toiminnoille, se ilmeisesti käy ilmi ao. logeista, mutta jatketaanko näillä;


    Tässä viimeisin hjt logi;

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:45:18, on 22.10.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\cisvc.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
    C:\WINDOWS\System32\inetsrv\inetinfo.exe
    C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
    C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
    C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
    C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
    c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
    C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\vssvc.exe
    C:\WINDOWS\System32\dmadmin.exe
    C:\WINDOWS\system32\mqsvc.exe
    C:\WINDOWS\system32\mqtgsvc.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\EPOX\USDM\USDM.EXE
    C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
    C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
    C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Plextor\PlexTool.exe
    C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
    C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\SRVLOAD.EXE
    C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe
    C:\Program Files\F-Secure Internet Security\FSGUI\fsavgui.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\ror\hijack.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\avciman.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\psimreal.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s
    O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [EPoXUSDM] "C:\Program Files\EPOX\USDM\USDM.EXE" "5000"
    O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
    O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: PlexTools Professional.lnk = C:\Program Files\Plextor\PlexTool.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?c80b606f39b343d686ad14018e5f0641
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?c80b606f39b343d686ad14018e5f0641
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O15 - Trusted Zone: http://*.mcafee.com
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1194307287617
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1194307736172
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {B9F79165-A264-4C4A-A211-133A5E8D647F} (F-Secure Health Check 1.1) - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\ORSP Client\fsorsp.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
    O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
    O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
    O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
    O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
    O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - Unknown owner - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe (file missing)
    O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - Unknown owner - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe (file missing)
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe

    --
    End of file - 11294 bytes
    ______________________________________________________________________
    Malwarebytes' Anti-Malware 1.29
    Tietokantaversio: 1276
    Windows 5.1.2600 Service Pack 3

    22.10.2008 10:02:29
    mbam-log-2008-10-22 (10-02-29).txt

    Tarkistustyyppi: Täysi tarkistus (A:\|C:\|D:\|)
    Tarkistetut kohteet: 121068
    Kulunut aika: 2 hour(s), 51 minute(s), 44 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 4
    Saastuneita rekisteriavaimia: 16
    Saastuneita rekisteriarvoja: 5
    Saastuneita rekisterikohteita: 4
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 52

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    C:\WINDOWS\system32\nnnoNfGx.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\qlknlrbi.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\iifedaXO.dll (Trojan.Vundo) -> Delete on reboot.
    C:\WINDOWS\system32\qdmgep.dll (Trojan.Vundo) -> Delete on reboot.

    Saastuneita rekisteriavaimia:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{365531ff-d621-4382-ba49-9bc59ef5b855} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{365531ff-d621-4382-ba49-9bc59ef5b855} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{79163723-7935-46be-90ce-c9e9719f8c66} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\iifedaxo (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{79163723-7935-46be-90ce-c9e9719f8c66} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d719d475-e462-4aba-8aa8-0face9d15a15} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{d719d475-e462-4aba-8aa8-0face9d15a15} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{4f05016a-1669-4df1-bf89-f2ecce12c151} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{fe83b2ce-8fd5-475d-bc98-4cb07a68409c} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{79163723-7935-46be-90ce-c9e9719f8c66} (Trojan.Vundo) -> Delete on reboot.
    HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

    Saastuneita rekisterikohteita:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\nnnonfgx -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\nnnonfgx -> Delete on reboot.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    C:\WINDOWS\system32\qdmgep.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\iifedaXO.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\nnnoNfGx.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\xGfNonnn.ini (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\xGfNonnn.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\atlsyjgs.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\sgjyslta.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\gixtiwnk.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\knwitxig.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ifulpemx.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\xmeplufi.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ngfjlgby.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ybgljfgn.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\olncqlhc.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\chlqcnlo.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\qlknlrbi.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\ibrlnklq.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{34BECEBD-2641-404F-900E-6898B81B18DB}\RP240\A0357920.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{34BECEBD-2641-404F-900E-6898B81B18DB}\RP240\A0357921.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{34BECEBD-2641-404F-900E-6898B81B18DB}\RP240\A0357922.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{34BECEBD-2641-404F-900E-6898B81B18DB}\RP240\A0357933.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{34BECEBD-2641-404F-900E-6898B81B18DB}\RP241\A0357964.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{34BECEBD-2641-404F-900E-6898B81B18DB}\RP241\A0357965.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{34BECEBD-2641-404F-900E-6898B81B18DB}\RP241\A0357966.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\karna.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\fccbBUOh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\uffjdqco.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\gwjikc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\hbclonkp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\qcaavl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\vnmrhv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\bsbgkbhf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\laynatap.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\lbeusssf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\jwezeo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\karna.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jan\Local Settings\Temporary Internet Files\Content.IE5\2O04ULVB\upd105320[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jan\Local Settings\Temporary Internet Files\Content.IE5\8UWQXMSA\file[1].exe (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jan\Local Settings\Temporary Internet Files\Content.IE5\LDQT4PZO\cntr[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\beep.sys (Fake.Beep.Sys) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\dllcache\beep.sys (Fake.Beep.Sys) -> Quarantined and deleted successfully.
    C:\WINDOWS\brastk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\blphcc3mj0e3cp.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\lphcc3mj0e3cp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\phcc3mj0e3cp.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\brastk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jan\Local Settings\Temp\.ttE.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jan\Local Settings\Temp\.tt20.tmp.vbs (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jan\Local Settings\Temp\.tt28.tmp.vbs (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jan\Local Settings\Temp\.ttB.tmp.vbs (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jan\Local Settings\Temp\.ttE.tmp.vbs (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Jan\Local Settings\Temp\myconfig.php (Trojan.FakeAlert) -> Quarantined and deleted successfully.
     
    kasperika, Oct 22, 2008
    #3
  4. kasperika

    kasperika Guest

    Noniin sainpa vihdoin combon ajettua, siitä logi ohessa jälkimmäisenä, ensiksi tuorein hjt:n logi.

    HUOM!!!
    Toivottavasti jollain vielä riittää aikaa tämän tutkimiseen koska kone on todella hidas, kirjoituskin tulee "viiveellä"
    HUOM!!

    Tällaisen vapaan suomennuksen imoitti tuo hjt; siis heti alussa kun rekisterimerkintöjä kävi läpi, johtuuko kenties pandasta, vai onko oikeasti jotain vakavampaa ja kannattaako toimia ohjeiden mukaisesti?!?
    Siis hjt file redirectioneita tsekatessa panda ilmoitti jotain hämärää olevan tekeillään vapaa hjt:n suomennos tästä;

    "Jostain syystä systeeemi ei suostunut antamaan oikeutta kirjoittaa Hosts tietueeseen.
    Jos jotain kaapattuja domaineja on tässä tietueessa hjt EI ehkä pysty korjaamaan tätä
    Jos näin tapahtuu; sinun pitää editoida tietue itse; tehdäksesi sen; click start, run ja kirjoita;

    notepad c:\WINDOWS\System32\drivers\etc\hosts

    ja paina enter. etsi kyseisen RIVI(t) hjt ilmoittaa ja deletoi ne.
    tallenna tietue ´hosts.´ (heittomerkkejen kanssa?!) ja sen jälkeen REBOOT."

    Samalla kuin HJT aloitti rekisterimerkintöjen läpikäymisen heti alussa panda ilmoitti; "vaaralinen toiminto estetty"

    onko normaalia?!?

    tässä sitten tuo hjt tuorein logi;

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 0:00:56, on 23.10.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
    C:\WINDOWS\System32\inetsrv\inetinfo.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
    C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
    C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
    C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
    C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
    c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
    C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\vssvc.exe
    C:\WINDOWS\System32\dmadmin.exe
    C:\WINDOWS\system32\mqsvc.exe
    C:\WINDOWS\system32\mqtgsvc.exe
    C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
    C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\ApvxdWin.exe
    C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
    C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Plextor\PlexTool.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\SRVLOAD.EXE
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\F-Secure Internet Security\FSGUI\fsavgui.exe
    C:\WINDOWS\system32\ntvdm.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\ror\hijack.exe
    C:\WINDOWS\SYSTEM32\NOTEPAD.EXE

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [EPoXUSDM] "C:\Program Files\EPOX\USDM\USDM.EXE" "5000"
    O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
    O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: PlexTools Professional.lnk = C:\Program Files\Plextor\PlexTool.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?c80b606f39b343d686ad14018e5f0641
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?c80b606f39b343d686ad14018e5f0641
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O15 - Trusted Zone: http://*.mcafee.com
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1194307287617
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1194307736172
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {B9F79165-A264-4C4A-A211-133A5E8D647F} (F-Secure Health Check 1.1) - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\ORSP Client\fsorsp.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
    O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
    O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
    O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
    O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
    O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - Unknown owner - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe (file missing)
    O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - Unknown owner - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe (file missing)
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe

    --
    End of file - 10884 bytes
    ______________________________________________________________________



    TÄSSÄ VIHDOINKIN COMBOFIXIN RAPORTTI, KUN SENKIN SAIN AJETTUA;

    ComboFix 08-10-21.04 - Jan 2008-10-22 18:19:26.1 - NTFSx86
    Running from: C:\DOCUME~1\JAN\DESKTOP\COMBOFIX.EXE
    * Resident AV is active

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\_000007_.tmp.dll
    C:\WINDOWS\system32\Cache
    C:\WINDOWS\system32\drivers\npf.sys
    C:\WINDOWS\system32\kctfbhug.ini
    C:\WINDOWS\system32\packet.dll
    C:\WINDOWS\system32\pthreadVC.dll
    C:\WINDOWS\system32\wanpacket.dll
    C:\WINDOWS\system32\wpcap.dll

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_NPF
    -------\Service_NPF


    ((((((((((((((((((((((((( Files Created from 2008-09-22 to 2008-10-22 )))))))))))))))))))))))))))))))
    .

    2008-10-21 23:42 . 2008-10-21 23:42 <DIR> d-------- C:\DOCUME~1\Jan\Application Data\Malwarebytes
    2008-10-21 23:42 . 2008-10-21 23:42 <DIR> d-------- C:\DOCUME~1\Jan\Application Data\Malwarebytes
    2008-10-21 23:42 . 2008-10-16 20:25 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-10-21 23:41 . 2008-10-21 23:42 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-10-21 23:41 . 2008-10-21 23:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-10-21 23:41 . 2008-10-16 20:25 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-10-21 22:14 . 2008-10-21 22:14 132,096 --a------ C:\WINDOWS\system32\udnollig.dll
    2008-10-21 17:53 . 2008-10-21 17:53 <DIR> d-------- C:\Program Files\Trend Micro
    2008-10-21 14:01 . 2008-10-21 14:01 132,096 --a------ C:\WINDOWS\system32\fsvhgtgi.dll
    2008-10-21 12:23 . 2008-10-21 12:23 <DIR> d-------- C:\DOCUME~1\Jan\Application Data\WinPatrol
    2008-10-21 12:23 . 2008-10-21 12:23 <DIR> d-------- C:\DOCUME~1\Jan\Application Data\WinPatrol
    2008-10-21 12:21 . 2008-10-21 12:21 <DIR> d-------- C:\Program Files\BillP Studios
    2008-10-20 19:54 . 2008-10-20 19:54 23,040 --a------ C:\WINDOWS\system32\drivers\fsbts.sys
    2008-10-17 10:41 . 2008-06-25 16:41 79,904 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
    2008-10-17 10:29 . 2008-10-22 16:36 <DIR> d-------- C:\Program Files\F-Secure Internet Security
    2008-10-17 09:49 . 2008-10-17 09:49 38 --a------ C:\WINDOWS\system32\DELCPL.BAT
    2008-10-17 09:43 . 2008-10-17 10:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\f-secure
    2008-10-16 02:14 . 2008-10-16 02:14 <DIR> d-------- C:\DOCUME~1\Jan\Application Data\PCF-VLC
    2008-10-16 02:14 . 2008-10-16 02:14 <DIR> d-------- C:\DOCUME~1\Jan\Application Data\PCF-VLC
    2008-10-16 02:14 . 2008-10-16 02:14 6,343,734 --a------ C:\Nordean verkkopankki.bmp
    2008-10-16 00:23 . 2008-10-22 11:39 <DIR> d-------- C:\ror
    2008-10-15 23:27 . 2008-10-15 23:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\efejmfgh
    2008-10-15 22:24 . 2008-10-15 22:24 <DIR> d-------- C:\Nordean verkkopankki_files
    2008-10-15 22:24 . 2008-10-15 22:24 18,022 --a------ C:\Nordean verkkopankki.htm
    2008-10-15 21:16 . 2008-10-15 21:21 <DIR> d-------- C:\Program Files\LEAD Technologies, Inc
    2008-10-14 12:53 . 2008-10-14 12:53 <DIR> d-------- C:\DOCUME~1\Jan\Application Data\Participatory Culture Foundation
    2008-10-14 12:53 . 2008-10-14 12:53 <DIR> d-------- C:\DOCUME~1\Jan\Application Data\Participatory Culture Foundation
    2008-10-14 12:50 . 2008-10-14 12:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Participatory Culture Foundation
    2008-10-14 12:10 . 2008-10-14 12:10 92,752 --a------ C:\WINDOWS\74m.dll
    2008-10-14 07:58 . 2008-10-15 12:08 67,396 --a------ C:\WINDOWS\system32\FontInfo.bin
    2008-10-14 07:58 . 2008-10-15 12:08 21,524 --a------ C:\WINDOWS\system32\GlyphInfo.bin
    2008-10-14 07:55 . 2002-06-26 13:17 26,624 --a------ C:\WINDOWS\system32\AWRESX32.DLL
    2008-10-14 07:55 . 2002-06-26 13:17 24,576 --a------ C:\WINDOWS\system32\AWCODC32.DLL
    2008-10-14 07:55 . 2002-06-26 13:17 11,776 --a------ C:\WINDOWS\system32\AWDENC32.DLL
    2008-10-14 07:55 . 2002-06-26 13:17 10,240 --a------ C:\WINDOWS\system32\AWVIEW32.DLL
    2008-10-14 07:55 . 2002-06-26 13:17 6,144 --a------ C:\WINDOWS\system32\AWDCXC32.DLL
    2008-10-14 07:19 . 2008-10-14 07:19 93,262 --a------ C:\WINDOWS\system32\tiliote2.htm
    2008-10-14 06:53 . 2008-10-14 06:53 93,253 --a------ C:\WINDOWS\system32\tiliote
    2008-10-09 03:33 . 2008-10-09 03:33 <DIR> d-------- C:\Program Files\Sun
    2008-10-02 02:05 . 2008-10-02 02:07 <DIR> d-------- C:\Program Files\QuickTime
    2008-10-02 02:05 . 2008-10-02 02:05 <DIR> d-------- C:\Program Files\Common Files\Apple
    2008-10-02 02:04 . 2008-10-02 02:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-10-02 02:02 . 2008-10-02 02:02 <DIR> d-------- C:\Program Files\Apple Software Update
    2008-10-02 02:02 . 2008-10-02 02:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
    2008-10-01 00:12 . 2008-10-01 00:12 <DIR> d-------- C:\Documents and Settings\Maarit\Application Data\ATI
    2008-09-25 20:56 . 2008-10-22 16:00 <DIR> d-------- C:\DOCUME~1\Jan\Application Data\skypePM
    2008-09-25 20:56 . 2008-10-22 16:00 <DIR> d-------- C:\DOCUME~1\Jan\Application Data\skypePM
    2008-09-25 20:56 . 2008-09-25 20:56 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
    2008-09-25 20:53 . 2008-09-25 20:53 <DIR> d-------- C:\Program Files\Skype
    2008-09-25 20:52 . 2008-09-25 20:53 <DIR> d-------- C:\Program Files\Common Files\Skype
    2008-09-25 20:47 . 2008-09-25 20:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype
    2008-09-24 22:47 . 2008-09-24 22:47 <DIR> d-------- C:\DOCUME~1\Jan\Application Data\ATI
    2008-09-24 22:47 . 2008-09-24 22:47 <DIR> d-------- C:\DOCUME~1\Jan\Application Data\ATI
    2008-09-24 21:27 . 2006-05-03 11:57 520,192 --a------ C:\WINDOWS\system32\ati2sgag.exe
    2008-09-24 15:29 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
    2008-09-24 15:29 . 2006-09-28 16:05 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
    2008-09-24 15:29 . 2006-12-08 12:02 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll
    2008-09-24 15:29 . 2006-09-28 16:05 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
    2008-09-24 15:29 . 2006-07-28 09:30 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
    2008-09-24 15:29 . 2006-09-28 16:04 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll
    2008-09-24 15:29 . 2006-07-28 09:30 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll
    2008-09-24 15:29 . 2006-11-15 11:38 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
    2008-09-24 15:28 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
    2008-09-23 22:05 . 2008-10-16 05:29 <DIR> d-------- C:\Program Files\anysee

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-10-22 16:38 --------- d-----w C:\DOCUME~1\Jan\Application Data\Skype
    2008-10-22 16:38 --------- d-----w C:\DOCUME~1\Jan\Application Data\Skype
    2008-10-22 15:36 --------- d-----w C:\Program Files\Common Files
    2008-10-22 14:55 --------- d-----w C:\Program Files\Mozilla Firefox
    2008-10-22 13:17 319,820 ----a-w C:\WINDOWS\system32\drivers\APPFCONT.DAT.bck
    2008-10-22 13:17 319,820 ----a-w C:\WINDOWS\system32\drivers\APPFCONT.DAT
    2008-10-22 13:17 1,244 ----a-w C:\WINDOWS\system32\drivers\APPFLTR.CFG.bck
    2008-10-22 13:17 1,244 ----a-w C:\WINDOWS\system32\drivers\APPFLTR.CFG
    2008-10-22 12:04 13,880 ----a-w C:\WINDOWS\system32\drivers\COMFiltr.sys
    2008-10-21 07:37 --------- d-----w C:\DOCUME~1\Jan\Application Data\MSN6
    2008-10-21 07:37 --------- d-----w C:\DOCUME~1\Jan\Application Data\MSN6
    2008-10-17 08:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\fssg
    2008-10-17 08:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
    2008-10-17 06:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-10-16 03:26 --------- d-----w C:\Program Files\Yahoo!
    2008-10-16 03:12 --------- d-----w C:\Program Files\SiSoftware
    2008-10-09 00:30 --------- d-----w C:\Program Files\Java
    2008-10-08 05:45 --------- d-----w C:\Documents and Settings\LocalService\Application Data\SACore
    2008-09-24 19:16 --------- d-----w C:\Program Files\ATI Technologies
    2008-09-18 05:51 --------- d-----w C:\Program Files\HD Tune Pro
    2008-09-18 05:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
    2008-09-17 15:01 --------- d-----w C:\Program Files\Common Files\xing shared
    2008-09-17 14:58 --------- d-----w C:\Program Files\Common Files\Real
    2008-09-17 14:37 --------- d-----w C:\Program Files\Sitecom
    2008-09-05 16:31 --------- d-----w C:\Program Files\MSN
    2008-09-01 09:11 --------- d-----w C:\Program Files\Network Chemistry
    2008-09-01 08:54 0 ----a-w C:\WINDOWS\system32\drivers\wnmsav.dat
    2008-08-28 07:46 74,752 ----a-w C:\WINDOWS\system32\msw3prt.dll
    2008-08-28 07:46 104,960 ----a-w C:\WINDOWS\system32\win32spl.dll
    2008-08-23 13:39 --------- d-----w C:\DOCUME~1\Jan\Application Data\PC Suite
    2008-08-23 13:39 --------- d-----w C:\DOCUME~1\Jan\Application Data\PC Suite
    2008-08-23 10:29 --------- d-----w C:\Program Files\IObit
    2008-08-22 17:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Bluetooth
    2007-06-18 15:21 519,965 -c--a-w C:\Documents and Settings\Jan\lokit.zip
    2007-02-28 05:45 2,574 -c--a-w C:\Documents and Settings\Jan\AUTOEXEC.BAT
    2007-01-26 08:30 119 -c--a-w C:\Documents and Settings\Jan\CONFIG.SYS
    2003-12-10 02:49 93,963 ----a-w C:\Documents and Settings\Jan\COMMAND.COM
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
    "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-08-11 21741864]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "EPoXUSDM"="C:\Program Files\EPOX\USDM\USDM.EXE" [2005-06-17 1297408]
    "NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" [2005-01-18 532480]
    "SmartDefrag"="C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" [2008-08-14 2235720]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
    "F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" [2008-06-25 182936]
    "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2008-06-25 957024]
    "WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2008-10-09 333120]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
    PlexTools Professional.lnk - C:\Program Files\Plextor\PlexTool.exe [2004-07-28 5210112]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
    2007-02-15 21:02 50736 C:\WINDOWS\system32\avldr.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.FFDS"= ffdshow.ax
    "msacm.ac3filter"= ac3filter.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    "UpdatesDisableNotify"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "C:\\WINDOWS\\system32\\sessmgr.exe"=
    "C:\\WINDOWS\\system32\\ftp.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Documents and Settings\\Jan\\Desktop\\true\\AirDC++.1.03 client\\AirDC.exe"=
    "C:\\WINDOWS\\system32\\mqsvc.exe"=
    "C:\\WINDOWS\\system32\\mmc.exe"=
    "C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\MSN Messenger\\livecall.exe"=
    "C:\\Program Files\\F-Secure Internet Security\\FSGUI\\fsavgui.exe"=
    "C:\\Program Files\\F-Secure Internet Security\\FSGUI\\fssw.exe"=
    "C:\\Program Files\\F-Secure Internet Security\\FSGUI\\FsDiagUi.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "1723:TCP"= 1723:TCP:*:Disabled:mad:xpsp2res.dll,-22015
    "1701:UDP"= 1701:UDP:*:Disabled:mad:xpsp2res.dll,-22016
    "500:UDP"= 500:UDP:mad:xpsp2res.dll,-22017

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)
    "AllowInboundTimestampRequest"= 0 (0x0)
    "AllowInboundMaskRequest"= 0 (0x0)
    "AllowInboundRouterRequest"= 1 (0x1)
    "AllowOutboundDestinationUnreachable"= 1 (0x1)
    "AllowOutboundSourceQuench"= 1 (0x1)
    "AllowOutboundParameterProblem"= 0 (0x0)
    "AllowOutboundTimeExceeded"= 1 (0x1)
    "AllowRedirect"= 1 (0x1)
    "AllowOutboundPacketTooBig"= 1 (0x1)

    R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\system32\DRIVERS\bsstor.sys [2002-06-06 9344]
    R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-06-25 79904]
    R1 APPFLT;App Filter Plugin;C:\WINDOWS\system32\Drivers\APPFLT.SYS [2007-05-11 71736]
    R1 DSAFLT;DSA Filter Plugin;C:\WINDOWS\system32\Drivers\DSAFLT.SYS [2007-05-11 51256]
    R1 F-Secure HIPS;F-Secure HIPS Driver;C:\Program Files\F-Secure Internet Security\HIPS\drivers\fshs.sys [2008-06-25 66720]
    R1 FNETMON;NetMon Filter Plugin;C:\WINDOWS\system32\Drivers\fnetmon.SYS [2007-05-11 22072]
    R1 IDSFLT;Ids Filter Plugin;C:\WINDOWS\system32\Drivers\IDSFLT.SYS [2007-07-11 191672]
    R1 NETFLTDI;Panda Net Driver [TDI Layer];C:\WINDOWS\system32\Drivers\NETFLTDI.SYS [2007-05-11 10:33 132920]
    R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\DRIVERS\ShlDrv51.sys [2007-05-23 38968]
    R1 SMSFLT;SMS Filter Plugin;C:\WINDOWS\system32\Drivers\SMSFLT.SYS [2007-05-11 37304]
    R1 WNMFLT;Wifi Monitor Filter Plugin;C:\WINDOWS\system32\Drivers\WNMFLT.SYS [2007-05-11 30648]
    R2 cpoint;Panda CPoint Driver;C:\WINDOWS\system32\Drivers\cpoint.sys [2007-06-08 24760]
    R2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [2007-07-12 178872]
    R3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys [ ]
    R3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\system32\DRIVERS\COMFiltr.sys [2008-10-22 13880]
    R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2008-06-25 72288]
    R3 FSORSPClient;F-Secure ORSP Client;C:\Program Files\F-Secure Internet Security\ORSP Client\fsorsp.exe [2008-06-25 55904]
    R3 NETIMFLT;PANDA NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\netimflt.sys [2007-04-24 142128]
    R3 PavSRK.sys;PavSRK.sys;C:\WINDOWS\system32\PavSRK.sys [ ]
    R3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\system32\PavTPK.sys [ ]
    S0 dhkfceg;dhkfceg;C:\WINDOWS\system32\drivers\gtrbvqn.sys [ ]
    S1 AMTBDA_P861F;anysee Capture Service;C:\WINDOWS\system32\DRIVERS\anyseeTU.SYS [ ]
    S3 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2004-08-03 327040]
    S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\NSNDIS5.SYS [2004-03-24 17280]
    S3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [ ]
    S3 ZD1211U(Acer);Acer WLAN 11g USB adapter(Acer);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2004-05-17 210944]
    S4 BsUDF;InCD UDF Driver;C:\WINDOWS\system32\drivers\BsUDF.sys [2002-09-13 448640]
    S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2008-06-25 39776]
    S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2008-06-25 25184]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{88613be8-d963-11db-8200-0013d414a9d8}]
    \Shell\AutoRun\command - G:\setupSNK.exe

    *Newly Created Service* - COMFILTR
    .
    Contents of the 'Scheduled Tasks' folder

    2008-10-20 C:\WINDOWS\Tasks\Peruspuhdistus.job
    - C:\Program Files\Panda Security\Panda Internet Security 2008\PlaTasks.exe [2007-07-17 16:13]

    2008-10-22 C:\WINDOWS\Tasks\Scheduled scanning task.job
    - C:\PROGRA~1\F-SECU~1\ANTI-V~1\fsav.exe [2008-06-25 16:41]

    2008-10-22 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]
    .
    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\DOCUME~1\Jan\Application Data\Mozilla\Firefox\Profiles\8phxbsz1.default\
    FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
    FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
    .
    .
    ------- File Associations -------
    .
    JSEFile=C:\PROGRA~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %*
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-10-22 19:07:17
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32.exe
    C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
    C:\WINDOWS\system32\inetsrv\inetinfo.exe
    C:\WINDOWS\system32\msdtc.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrlS.exe
    C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
    C:\Program Files\Panda Security\Panda Internet Security 2008\PAVFNSVR.EXE
    C:\Program Files\Common Files\Panda Software\PavShld\PavPrSrv.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\PAVSRV51.EXE
    C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
    C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\FIREWALL\PSHost.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
    C:\WINDOWS\system32\locator.exe
    C:\WINDOWS\system32\snmp.exe
    C:\WINDOWS\system32\vssvc.exe
    C:\WINDOWS\system32\mqsvc.exe
    C:\WINDOWS\system32\mqtgsvc.exe
    C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
    C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
    C:\Program Files\F-Secure Internet Security\FWES\program\fsdfwd.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\apvxdwin.exe
    C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
    C:\PROGRA~1\Internet Explorer\iexplore.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\SrvLoad.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
    .
    **************************************************************************
    .
    Completion time: 2008-10-22 20:00:39 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-10-22 16:59:38

    Pre-Run: 2 791 440 384 bytes free
    Post-Run: 3,021,197,312 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(1)partition(1)\WINDOWS
    [operating systems]
    C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

    308 --- E O F --- 2008-10-22 14:39:52

    ______________________________________________________________________

    SUURKIITOS ETUKÄTEEN JOLLEKIN SUURESTA VAIVASTA!
     
    kasperika, Oct 22, 2008
    #4
  5. kasperika

    kasperika Guest

    Tässä vielä tämä, jos joku viitsisi tarkistaa tuon combon ja hjt:n login edellisessä viestissäni, olisin kiitollinen, KOSKA f-secure ei päivity, onko panda tai joku muu nyt sellainen joka estää tuon päivityksen kenties?

    Kiitos etukäteen.

    Malwarebytes' Anti-Malware 1.29
    Tietokantaversio: 1276
    Windows 5.1.2600 Service Pack 3

    23.10.2008 8:54:28
    mbam-log-2008-10-23 (08-54-28).txt

    Tarkistustyyppi: Täysi tarkistus (A:\|C:\|D:\|)
    Tarkistetut kohteet: 118718
    Kulunut aika: 2 hour(s), 52 minute(s), 6 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)
     
    kasperika, Oct 23, 2008
    #5
  6. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Poista F-Secure tai Panda vain yksi palomuuri ja viruksentorjunta koneella.

    Ja ei ihmekkään että kone on hitaalla kun 2 raskasta viruksentorjuntaa koneella.

    Lataa CCleaner tästä

    - Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
    - Asennuksen jälkeen aukaise CCleaner.
    - Valitse vasemmalta pystyrivistä Options.
    - Valitse viereisestä pystyrivistä Settings.
    - Language kohtaan valitse Suomi.

    - Käynnistä CCleaner.
    - Valitse Valinnat.
    - Paina Lisäasetukset.
    - Ota ruksi pois kohdasta "Poista vain yli 48 tuntia vanhat tiedostot Windowsin tilapäiskansioista".

    Puhdistaja

    - Valitse vasemmalta pystyrivistä Puhdistaja.
    - Paina alhaalta Tutki.
    Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
    - Kun tutkiminen on valmis, paina Aja CCleaner.
    Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.

    Rekisterin virheiden korjaus

    - Valitse vasemmalta pystyrivistä Rekisteri.
    - Paina alhaalta Etsi rekisterin virheitä.
    - Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
    - Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
    - Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
    - Saat vielä varmistus kysymyksen, paina Ok.
    - Kun virheet on korjattu, paina Sulje.

    Nyt voit suljea CCleanerin painamalla oikealta ylhäältä punaista rastia.

    Lähetä myös uusi Hijackthis loki.
     
    yaht, Oct 23, 2008
    #6

Share This Page