Esim. battlefield 2142 ping on päälle 300, ennen ollut siinä 50 tienoilla. Muuta oiretta en ole havainnut. Jos joku viisaampi voisi neuvoa mitä tehdä. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:40:20, on 17.9.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\uTorrent\uTorrent.exe C:\Program Files\Lavalys\EVEREST Corporate + Ultimate Edition\everest.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\FRAPS\FRAPS.EXE C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.09\RivaTuner.exe" /S O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.09\RivaTuner.exe" /T O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [EVEREST AutoStart] C:\Program Files\Lavalys\EVEREST Corporate + Ultimate Edition\everest.exe O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 6549 bytes
Lataa Malwarebytes' Anti-Malware työpöydällesi. 1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. 2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish. 3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. 4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan. 5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset. 6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected. 7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt 8. Lähetä lokin sisältö seuraavassa viestissäsi.
Nuo 2 haittaohjelmaa onnistui poistamaan mutta ongelma ei kadonnut, tässä loki: Malwarebytes' Anti-Malware 1.28 Tietokantaversio: 1164 Windows 5.1.2600 Service Pack 2 17.9.2008 21:14:43 mbam-log-2008-09-17 (21-14-43).txt Tarkistustyyppi: Täysi tarkistus (C:\|D:\|) Tarkistetut kohteet: 83991 Kulunut aika: 26 minute(s), 49 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 0 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 2 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: D:\Ohjelmat\EvID4226Patch.exe (Adware.Agent) -> Quarantined and deleted successfully. D:\System Volume Information\_restore{14329392-94CE-4A90-A04B-6115B64E7F72}\RP130\A0014737.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
1.Lataa combofix.exe työpöydällesi yhdestä linkistä: combofix1 combofix2 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Elikkä tässä ois combofix loki: ComboFix 08-09-16.05 - jari 2008-09-18 16:31:10.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1593 [GMT 3:00] Sijainti: C:\Documents and Settings\jari\Työpöytä\ComboFix.exe VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !! . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-08-18 to 2008-09-18 ))))))))))))))))) . 2008-09-18 16:20 . 2008-09-18 16:21 <KANSIO> d-------- C:\WINDOWS\LastGood 2008-09-17 22:34 . 2008-09-17 22:34 <KANSIO> d-------- C:\WINDOWS\ERUNT 2008-09-17 21:40 . 2008-09-17 21:40 <KANSIO> d-------- C:\Program Files\Trend Micro 2008-09-17 20:33 . 2008-09-17 20:34 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-09-17 20:33 . 2008-09-17 20:33 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\Malwarebytes 2008-09-17 20:33 . 2008-09-17 20:33 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-09-17 20:33 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-09-17 20:33 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-09-17 19:49 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-09-17 19:49 . 2008-09-08 23:38 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-09-17 19:49 . 2008-09-15 18:51 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe 2008-09-17 19:48 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-09-14 13:45 . 2008-09-14 13:45 <KANSIO> d--hs---- C:\WINDOWS\ftpcache 2008-09-14 13:44 . 2008-09-14 13:44 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\Activision 2008-09-14 13:44 . 2008-09-14 13:44 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Activision 2008-09-13 17:00 . 2008-09-13 17:00 <KANSIO> d-------- C:\Program Files\CCleaner 2008-09-11 22:13 . 2008-09-12 17:04 <KANSIO> d-------- C:\Program Files\UltraStar Deluxe 2008-09-06 09:31 . 2008-09-06 09:31 287 --a------ C:\WINDOWS\game.ini 2008-09-06 09:28 . 2008-09-06 09:28 <KANSIO> d-------- C:\Program Files\Activision 2008-09-05 06:27 . 2008-09-05 06:27 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite 2008-09-05 06:27 . 2008-09-05 06:27 <KANSIO> d-------- C:\Program Files\Common Files\Nokia 2008-09-05 06:26 . 2008-09-05 06:26 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution 2008-09-04 21:09 . 2008-09-04 21:11 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\SPORE 2008-09-04 20:57 . 2008-09-04 20:57 <KANSIO> d-------- C:\Program Files\D-Tools 2008-09-04 20:57 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2008-09-04 20:57 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2008-09-04 20:56 . 2008-09-04 20:56 <KANSIO> d-------- C:\WINDOWS\Downloaded Installations 2008-09-03 17:12 . 2008-09-18 16:29 <KANSIO> d-------- C:\Program Files\Teamspeak2_RC2 2008-09-03 17:05 . 2008-09-18 16:28 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\teamspeak2 2008-09-03 17:05 . 2008-09-03 17:05 34,064 --a------ C:\WINDOWS\system32\lhacm.acm 2008-09-02 16:49 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2008-09-02 16:49 . 2004-08-03 23:08 25,600 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys 2008-09-02 16:49 . 2008-09-02 16:49 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-09-02 16:49 . 2008-09-02 16:49 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-09-02 16:46 . 2008-09-12 20:05 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\PC Suite 2008-09-02 16:46 . 2008-09-02 16:51 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\Nokia 2008-09-02 16:46 . 2008-09-02 16:46 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite 2008-09-02 16:42 . 2008-09-05 06:27 <KANSIO> d-------- C:\Program Files\Nokia 2008-09-02 16:42 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-09-02 16:42 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-09-02 16:42 . 2008-05-07 07:38 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-09-02 16:42 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys 2008-09-02 16:42 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys 2008-09-02 16:42 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys 2008-09-02 16:42 . 2008-05-07 07:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys 2008-09-02 16:42 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys 2008-09-02 16:38 . 2008-09-05 06:26 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Installations 2008-08-31 18:25 . 2008-08-31 18:25 <KANSIO> d-------- C:\WINDOWS\Sun 2008-08-31 18:23 . 2008-08-31 18:23 <KANSIO> d-------- C:\Program Files\Sun 2008-08-31 18:23 . 2008-08-31 18:23 <KANSIO> d-------- C:\Program Files\Java 2008-08-31 18:23 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-08-31 18:22 . 2008-08-31 18:22 <KANSIO> d-------- C:\Program Files\Common Files\Java 2008-08-29 18:57 . 2008-08-29 18:57 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles 2008-08-29 18:56 . 2008-08-29 18:56 <KANSIO> d-------- C:\WINDOWS\nview 2008-08-29 18:56 . 2008-09-18 16:19 190,661 --a------ C:\WINDOWS\system32\nvapps.xml 2008-08-29 18:56 . 2008-05-16 14:01 18,070 --a------ C:\WINDOWS\system32\nvdisp.nvu 2008-08-29 18:53 . 2008-08-29 18:53 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-08-29 18:53 . 2008-08-29 18:53 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-08-28 22:19 . 2008-08-28 22:19 <KANSIO> d-------- C:\Program Files\NVIDIA Corporation 2008-08-28 22:19 . 2006-09-11 17:27 356,352 --a------ C:\WINDOWS\system32\nvusmb.exe 2008-08-28 22:19 . 2006-09-11 16:14 1,864 --a------ C:\WINDOWS\system32\nvsmb.nvu 2008-08-28 00:03 . 2008-08-28 00:03 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll 2008-08-27 21:40 . 2008-08-27 21:40 <KANSIO> dr-h----- C:\Documents and Settings\jari\Application Data\SecuROM 2008-08-27 21:40 . 2008-09-05 18:53 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-08-27 21:32 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2008-08-27 20:51 . 2008-08-27 20:51 <KANSIO> d-------- C:\Program Files\Astonsoft 2008-08-27 20:51 . 2008-08-27 20:51 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\DeepBurner 2008-08-27 20:26 . 2008-08-27 20:26 <KANSIO> d-------- C:\ProgramData 2008-08-27 20:26 . 2008-09-04 21:02 <KANSIO> d-------- C:\Program Files\Electronic Arts 2008-08-27 20:26 . 2008-08-27 20:26 662 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg 2008-08-26 17:20 . 2008-08-26 17:20 1,236,992 --a------ C:\WINDOWS\system32\cpuz142.exe 2008-08-26 17:20 . 2008-08-26 17:20 136 --a------ C:\WINDOWS\system32\cpuz.ini 2008-08-24 20:23 . 2008-09-15 17:12 <KANSIO> d-------- C:\Program Files\Webteh 2008-08-24 15:01 . 2008-09-11 16:41 <KANSIO> d-------- C:\Program Files\FileZilla FTP Client 2008-08-24 15:01 . 2008-09-11 16:47 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\FileZilla 2008-08-24 14:58 . 2008-08-24 14:58 <KANSIO> d-------- C:\Program Files\Quick Screen Capture 2008-08-24 14:58 . 2008-08-24 14:58 <KANSIO> d-------- C:\MyCaptures 2008-08-24 13:54 . 2008-08-24 13:54 <KANSIO> d-------- C:\Program Files\URUSoft 2008-08-21 22:42 . 2008-08-21 22:42 360,320 --a------ C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL 2008-08-20 20:15 . 2008-09-09 17:34 <KANSIO> d-------- C:\Fraps 2008-08-20 20:15 . 2008-09-18 16:31 <KANSIO> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-08-20 19:52 . 2008-08-20 19:52 <KANSIO> d-------- C:\Documents and Settings\LocalService\Application Data\Xfire 2008-08-19 18:09 . 2008-08-19 18:09 <KANSIO> d-------- C:\WINDOWS\system32\LogFiles 2008-08-19 18:09 . 2008-09-17 22:46 139,664 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-08-19 18:09 . 2008-09-17 22:45 111,928 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-08-19 18:09 . 2008-08-19 18:09 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-08-18 22:53 . 2008-08-18 22:53 <KANSIO> d-------- C:\WINDOWS\system32\Futuremark 2008-08-18 22:53 . 2007-09-07 14:55 27,672 --a------ C:\WINDOWS\system32\drivers\Entech.sys 2008-08-18 22:53 . 2007-09-07 14:55 12,744 --a------ C:\WINDOWS\system32\drivers\Entech64.sys 2008-08-18 22:53 . 2007-09-07 14:55 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd 2008-08-18 22:53 . 2001-11-19 20:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys 2008-08-18 22:52 . 2008-08-18 22:52 <KANSIO> d-------- C:\Program Files\Futuremark 2008-08-18 21:23 . 2008-08-18 21:23 <KANSIO> d-------- C:\Program Files\RivaTuner v2.09 2008-08-18 17:46 . 2008-08-18 17:45 729,088 --a------ C:\WINDOWS\iun6002.exe 2008-08-18 16:17 . 2008-08-18 16:17 531 --a------ C:\WINDOWS\eReg.dat 2008-08-18 16:14 . 2008-08-18 16:14 <KANSIO> d-------- C:\Documents and Settings\NetworkService\Application Data\Xfire 2008-08-18 16:10 . 2008-08-18 16:12 <KANSIO> d-------- C:\Program Files\EA GAMES . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-18 13:27 --------- d-----w C:\Documents and Settings\jari\Application Data\mIRC 2008-09-18 13:26 --------- d-----w C:\Program Files\mIRC 2008-09-18 13:26 --------- d-----w C:\Documents and Settings\jari\Application Data\uTorrent 2008-09-17 19:41 --------- d-----w C:\Documents and Settings\jari\Application Data\Xfire 2008-09-17 18:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-09-17 15:43 --------- d-----w C:\Program Files\Xfire 2008-09-17 14:48 --------- d-----w C:\Program Files\Creative 2008-09-17 14:47 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2008-09-17 14:47 114,688 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2008-09-17 14:47 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-16 18:09 --------- d-----w C:\Documents and Settings\jari\Application Data\Vso 2008-09-10 06:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-09-06 06:39 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-09-02 13:42 --------- d-----w C:\Program Files\DIFX 2008-08-27 17:26 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-08-21 19:42 360,320 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS 2008-08-21 03:32 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-08-17 20:49 --------- d-----w C:\Program Files\Lavalys 2008-08-17 18:28 --------- d-----w C:\Program Files\DVDFab 5 2008-08-17 18:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\vsosdk 2008-08-17 16:46 --------- d-----w C:\Program Files\ffdshow 2008-08-17 16:44 --------- d-----w C:\Program Files\AC3Filter 2008-08-17 16:40 --------- d-----w C:\Documents and Settings\jari\Application Data\vlc 2008-08-17 16:39 --------- d-----w C:\Program Files\VideoLAN 2008-08-17 16:34 --------- d-----w C:\Documents and Settings\jari\Application Data\Winamp 2008-08-17 16:26 --------- d-----w C:\Program Files\Winamp 2008-08-17 15:26 --------- d-----w C:\Program Files\Windows Live 2008-08-17 15:25 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys 2008-08-17 15:25 47,360 ----a-w C:\Documents and Settings\jari\Application Data\pcouffin.sys 2008-08-17 15:25 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-08-17 15:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-08-17 11:46 --------- d-----w C:\Program Files\Logitech 2008-08-17 11:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech 2008-08-17 11:37 --------- d-----w C:\Program Files\MSBuild 2008-08-17 11:37 --------- d-----w C:\Program Files\Microsoft Works 2008-08-17 11:27 --------- d-----w C:\Program Files\uTorrent 2008-08-17 11:11 --------- d-----w C:\Program Files\Alwil Software 2008-08-17 10:55 --------- d-----w C:\Documents and Settings\jari\Application Data\InstallShield 2008-08-17 10:41 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-08-17 10:35 --------- d-----w C:\Program Files\microsoft frontpage 2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-18 19:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll 2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll 2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 15:40 659,456 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:41 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll . ------- Sigcheck ------- 2008-06-20 13:44 360960 744e57c99232201ae98c49168b918f48 C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys 2008-06-20 14:51 361600 9aefa14bd6b182d61e3119fa5f436d3d C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys 2008-06-20 14:59 361600 ad978a1b783b5719720cff204b666c8e C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys 2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys 2008-08-21 22:42 360320 3adce4790f591bf160a94f6f08039577 C:\WINDOWS\system32\dllcache\TCPIP.SYS 2008-08-21 22:42 360320 3adce4790f591bf160a94f6f08039577 C:\WINDOWS\system32\drivers\TCPIP.SYS . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 15360] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-08-17 267056] "EVEREST AutoStart"="C:\Program Files\Lavalys\EVEREST Corporate + Ultimate Edition\everest.exe" [2008-01-17 2057312] "NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-07-20 81920] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-08-11 1124352] "Fraps"="C:\FRAPS\FRAPS.EXE" [2008-01-14 913064] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "Launch LCDMon"="C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-12-13 2051096] "Launch LGDCore"="C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-12-13 2095640] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-04 36352] "RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.09\RivaTuner.exe" [2008-04-28 2707456] "RivaTuner"="C:\Program Files\RivaTuner v2.09\RivaTuner.exe" [2008-04-28 2707456] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "P17Helper"="P17.dll" [2005-05-03 C:\WINDOWS\system32\P17.dll] "nwiz"="nwiz.exe" [2008-05-16 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll "msacm.ac3filter"= ac3filter.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Xfire\\xfire.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\Program Files\\Teamspeak2_RC2\\server_windows.exe"= "C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"= "C:\\Program Files\\Electronic Arts\\Battlefield 2142 Deluxe Edition\\BF2142+szx 1280 +szy 1024.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R3 EverestDriver;Lavalys EVEREST Kernel Driver;C:\Program Files\Lavalys\EVEREST Corporate + Ultimate Edition\kerneld.wnt [2007-12-14 22640] S3 bdacap;PC-DTV Receiver;C:\WINDOWS\system32\drivers\bdacap.sys [2006-02-14 217728] S3 GLHIDKBFILTER;GLHIDKBFILTER;C:\WINDOWS\system32\DRIVERS\GLKbFilter.sys [ ] S3 p17filt;p17filt;C:\WINDOWS\system32\drivers\p17filt.sys [2006-03-20 1452032] S3 zlportio;zlportio;D:\Asennetut\UltraStar Deluxe\zlportio.sys [ ] *Newly Created Service* - EVERESTDRIVER . . ------- Täydentävä tarkistus ------- . FireFox -: Profile - C:\Documents and Settings\jari\Application Data\Mozilla\Firefox\Profiles\zcn53o3o.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fi/ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-18 16:31:50 Windows 5.1.2600 Service Pack 2 NTFS tarkistaa piilotettuja prosesseja ... tarkistaa piilotettuja käynnistysarvoja ... tarkistaa piilotettuja tiedostoja ... tarkistus on valmis piilotetut tiedostot: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EverestDriver] "ImagePath"="\??\C:\Program Files\Lavalys\EVEREST Corporate + Ultimate Edition\kerneld.wnt" . Valmistumisajankohta: 2008-09-18 16:32:15 ComboFix-quarantined-files.txt 2008-09-18 13:32:12 Pre-Run: 24,748,126,208 tavua vapaana Post-Run: 24,739,188,736 tavua vapaana 248 --- E O F --- 2008-09-10 06:52:33
Lataa Tästä Ccleaner CCleaner v 2.11.636.- Standard Build, ÄLÄ aseenna Yahoo toolbaria! Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki". Asennuksen jälkeen aukaise CCleaner. Valitse vasemmalta pystyrivistä Options. Valitse viereisestä pystyrivistä Settings. Language kohtaan valitse Suomi. Puhdistaja Valitse vasemmalta pystyrivistä Puhdistaja. Paina alhaalta Tutki. Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.). Kun tutkiminen on valmis, paina Aja CCleaner. Nyt CCleaner poistaa löydetyt tempit, cookiessit jne. Rekisterin virheiden korjaus Valitse vasemmalta pystyrivistä Rekisteri. Paina alhaalta Etsi rekisterin virheitä. Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet. Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon. Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet. Saat vielä varmistus kysymyksen, paina Ok. Kun virheet on korjattu, paina Sulje. Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
