HJT-logi tarkistettavaksi

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by ocelot007, Mar 25, 2008.

  1. ocelot007

    ocelot007 Member

    Joined:
    Jun 30, 2007
    Messages:
    64
    Likes Received:
    0
    Trophy Points:
    16
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:45:13, on 25.3.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\Program Files\SiteAdvisor\6253\SAService.exe
    C:\Program Files\ThreatFire\TFService.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\lg_fwupdate\fwupdate.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\ThreatFire\TFTray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {a33fa729-d155-4b23-842b-2c665ecabdb6} - (no file)
    O2 - BHO: Burn4Free Toolbar Helper - {D187A56B-A33F-4CBE-9D77-459FC0BAE012} - C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll
    O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
    O3 - Toolbar: Burn4Free Toolbar - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - .DEFAULT User Startup: OP_CACHE.ATR (User 'Default user')
    O4 - .DEFAULT User Startup: OP_CACHE.IDX (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: ,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
    O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SiteAdvisor-palvelu (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
    O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 10554 bytes
     
    ocelot007, Mar 25, 2008
    #1
  2. Hujo

    Hujo Guest

    Poista lisää poista sovelutuksesta

    Burn4Free Toolbar Helper
    Burn4Free Toolbar
    ThreatFire

    Poista vikasiedossa kansiot

    C:\Program Files\Burn4Free Toolbar
    C:\Program Files\Burn4Free Toolbar
    C:\Program Files\ThreatFire

    Scannaaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {a33fa729-d155-4b23-842b-2c665ecabdb6} - (no file)
    O2 - BHO: Burn4Free Toolbar Helper - {D187A56B-A33F-4CBE-9D77-459FC0BAE012} - C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll
    O3 - Toolbar: Burn4Free Toolbar - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll
    O4 - .DEFAULT User Startup: OP_CACHE.ATR (User 'Default user')
    O4 - .DEFAULT User Startup: OP_CACHE.IDX (User 'Default user')
    O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe

    =============

    Kopioi / liitä seuraava teksti alapuolella tyhjään muistioFiluun
    Varmista että tiedoston tyyppi on ”all Files” ja tallenna se Poisto.bat. nimisenä
    työpöydällesi.

    @echo off
    sc stop ThreatFire
    sc delete ThreatFire

    Tupla-klikkaa Poisto.bat. filua työpöydälläsi , ikkuna avautuu ja Sulkeutuu tämä on normaalia.

    =========

    scannaa uusi hjt:n loki
     
    Last edited by a moderator: Mar 25, 2008
    Hujo, Mar 25, 2008
    #2
  3. ocelot007

    ocelot007 Member

    Joined:
    Jun 30, 2007
    Messages:
    64
    Likes Received:
    0
    Trophy Points:
    16
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:49:01, on 26.3.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\Program Files\SiteAdvisor\6253\SAService.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\lg_fwupdate\fwupdate.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {a33fa729-d155-4b23-842b-2c665ecabdb6} - (no file)
    O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - .DEFAULT User Startup: OP_CACHE.ATR (User 'Default user')
    O4 - .DEFAULT User Startup: OP_CACHE.IDX (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: ,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
    O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SiteAdvisor-palvelu (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 9510 bytes


    tos olis uusin logi
     
    ocelot007, Mar 26, 2008
    #3
  4. Hujo

    Hujo Guest

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Hujo, Mar 26, 2008
    #4
  5. ocelot007

    ocelot007 Member

    Joined:
    Jun 30, 2007
    Messages:
    64
    Likes Received:
    0
    Trophy Points:
    16
    SDFix: Version 1.162

    Run by Atte on ke 26.03.2008 at 14:58

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\DOCUME~1\Atte\TYPYT~1\SDFix

    Checking Services :


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-26 15:06:14
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s1"=dword:2df9c43f
    "s2"=dword:110480d0
    "h0"=dword:00000003

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
    "h0"=dword:00000000
    "ujdew"=hex:a8,58,8b,85,b0,cb,b9,db,5e,08,2b,3c,e2,80,de,d6,04,18,66,81,f3,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
    "h0"=dword:00000001
    "hdf12"=hex:6c,00,d0,54,e6,70,76,4c,bd,3a,16,3c,6d,e4,fd,68,cc,5f,52,fe,fe,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "h0"=dword:00000002
    "khjeh"=hex:19,4b,64,c5,d1,1f,2d,e6,cc,c6,ab,b1,bc,18,20,36,cd,06,7e,bd,37,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
    "h0"=dword:00000000
    "ujdew"=hex:a8,58,8b,85,b0,cb,b9,db,5e,08,2b,3c,e2,80,de,d6,04,18,66,81,f3,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
    "h0"=dword:00000001
    "hdf12"=hex:6c,00,d0,54,e6,70,76,4c,bd,3a,16,3c,6d,e4,fd,68,cc,5f,52,fe,fe,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "h0"=dword:00000002
    "khjeh"=hex:19,4b,64,c5,d1,1f,2d,e6,cc,c6,ab,b1,bc,18,20,36,cd,06,7e,bd,37,..

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xfe\xbb\xd3w\2]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :



    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
    "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"
    "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb"
    "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray"
    "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
    "C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\Win32\\RpcDataSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\Win32\\RpcDataSrv.exe:*:Enabled:SiSoftware Database Agent Service"
    "C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\RpcSandraSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service"
    "C:\\Program Files\\Freeciv-2.1.1-gtk2\\civserver.exe"="C:\\Program Files\\Freeciv-2.1.1-gtk2\\civserver.exe:*:Enabled:civserver"
    "C:\\Program Files\\Microsoft XNA\\XNA Game Studio Express\\v1.0\\Bin\\XnaTrans.exe"="C:\\Program Files\\Microsoft XNA\\XNA Game Studio Express\\v1.0\\Bin\\XnaTrans.exe:LocalSubNet:Enabled:XNA Game Studio Transport"
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DC++"
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath "
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    Remaining Files :


    File Backups: - C:\DOCUME~1\Atte\TYPYT~1\SDFix\backups\backups.zip

    Files with Hidden Attributes :

    Sat 9 Feb 2008 24 A.SH. --- "C:\WINDOWS\S5AB6BC3A.tmp"
    Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
    Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
    Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
    Mon 7 Jan 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Mon 7 Jan 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
    Tue 5 Jul 2005 241,664 A..H. --- "C:\Sovellukset\Ajuri\Audio\EXERUN\EXERUN.exe"
    Wed 20 Jul 2005 122,880 A..H. --- "C:\Sovellukset\Ajuri\Audio\EXERUN\Fxdrv.dll"
    Sat 3 Jul 2004 13,440 A..H. --- "C:\Sovellukset\Ajuri\Audio\EXERUN\Fxdrv.sys"
    Mon 27 Sep 2004 62,976 A..H. --- "C:\Sovellukset\Ajuri\Chipset\exerun\DSETUP.dll"
    Sat 23 Jul 2005 241,664 A..H. --- "C:\Sovellukset\Ajuri\Chipset\exerun\EXERUN.exe"
    Wed 20 Jul 2005 122,880 A..H. --- "C:\Sovellukset\Ajuri\Chipset\exerun\Fxdrv.dll"
    Sat 3 Jul 2004 13,440 A..H. --- "C:\Sovellukset\Ajuri\Chipset\exerun\Fxdrv.sys"
    Tue 5 Jul 2005 241,664 A..H. --- "C:\Sovellukset\Ajuri\Lan\EXERUN\EXERUN.exe"
    Wed 20 Jul 2005 122,880 A..H. --- "C:\Sovellukset\Ajuri\Lan\EXERUN\Fxdrv.dll"
    Sat 3 Jul 2004 13,440 A..H. --- "C:\Sovellukset\Ajuri\Lan\EXERUN\Fxdrv.sys"
    Tue 5 Jul 2005 241,664 A..H. --- "C:\Sovellukset\Ajuri\usb20\EXERUN\EXERUN.exe"
    Wed 20 Jul 2005 122,880 A..H. --- "C:\Sovellukset\Ajuri\usb20\EXERUN\Fxdrv.dll"
    Sat 3 Jul 2004 13,440 A..H. --- "C:\Sovellukset\Ajuri\usb20\EXERUN\Fxdrv.sys"
    Tue 5 Jul 2005 241,664 A..H. --- "C:\Sovellukset\Ajuri\VGA\EXERUN\EXERUN.exe"
    Wed 20 Jul 2005 122,880 A..H. --- "C:\Sovellukset\Ajuri\VGA\EXERUN\Fxdrv.dll"
    Sat 3 Jul 2004 13,440 A..H. --- "C:\Sovellukset\Ajuri\VGA\EXERUN\Fxdrv.sys"
    Sat 12 Jan 2008 857 ...HR --- "C:\Documents and Settings\Atte\Application Data\SecuROM\UserData\securom_v7_01.bak"

    Finished!




    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:24:31, on 26.3.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\Program Files\SiteAdvisor\6253\SAService.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\lg_fwupdate\fwupdate.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\BitTorrent\bittorrent.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {a33fa729-d155-4b23-842b-2c665ecabdb6} - (no file)
    O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - .DEFAULT User Startup: OP_CACHE.ATR (User 'Default user')
    O4 - .DEFAULT User Startup: OP_CACHE.IDX (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: ,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
    O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SiteAdvisor-palvelu (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 9828 bytes
     
    ocelot007, Mar 26, 2008
    #5
  6. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, Mar 26, 2008
    #6
  7. ocelot007

    ocelot007 Member

    Joined:
    Jun 30, 2007
    Messages:
    64
    Likes Received:
    0
    Trophy Points:
    16
    ComboFix 08-03-25.4 - Atte 2008-03-26 19:43:54.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.123 [GMT 2:00]
    Running from: C:\Documents and Settings\Atte\Työpöytä\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .
    TimedOut: progfile.dat
    -- Script messages for sUBs --
    Findstr -MIF:/ "\\TTC\.pdb InsertAdvertisement"
    GREP -Eisf temp00
    VFind -tf -s282624 "C:\Program Files\????????*[0-9].dll"

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Program Files\ShoppingReport

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-02-26 to 2008-03-26 )))))))))))))))))
    .

    2008-03-26 19:06 . 2008-03-26 19:06 <KANSIO> d-------- C:\Program Files\TVUPlayer
    2008-03-26 19:06 . 2008-03-26 19:06 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\TVU Networks
    2008-03-26 13:24 . 2008-03-26 13:25 <KANSIO> d-ahs---- C:\WINDOWS\Repair
    2008-03-26 13:07 . 2008-03-26 13:07 <KANSIO> d-------- C:\Program Files\XeroBank
    2008-03-26 13:07 . 2008-03-26 13:07 <KANSIO> d-------- C:\Program Files\Runtime Software
    2008-03-25 13:03 . 2002-11-02 09:53 57,344 --a------ C:\WINDOWS\system32\WNASPINT.DLL
    2008-03-25 10:23 . 2008-03-25 11:39 <KANSIO> d-------- C:\Program Files\HalfLife2
    2008-03-24 18:03 . 2008-03-24 18:03 <KANSIO> d-------- C:\Program Files\Lavasoft
    2008-03-24 17:51 . 2008-03-24 17:51 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\ImgBurn
    2008-03-24 00:07 . 2008-03-24 00:07 <KANSIO> d-------- C:\Program Files\MagicDisc
    2008-03-24 00:07 . 2008-02-18 17:29 96,256 --a------ C:\WINDOWS\system32\drivers\mcdbus.sys
    2008-03-23 19:28 . 2008-03-23 19:28 <KANSIO> d-------- C:\Program Files\DVD Decrypter
    2008-03-23 15:29 . 2008-03-23 15:29 <KANSIO> d-------- C:\eJay
    2008-03-23 13:25 . 2008-03-23 13:25 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-03-23 13:25 . 2008-03-23 13:25 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-03-22 19:36 . 2008-03-22 19:36 <KANSIO> d-------- C:\Documents and Settings\LocalService\Käynnistä-valikko
    2008-03-22 17:22 . 2008-03-22 17:26 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\VersionTracker Pro
    2008-03-22 15:54 . 2008-03-22 22:14 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Crystal Player
    2008-03-22 15:47 . 2008-03-22 15:47 <KANSIO> d-------- C:\Program Files\TechTracker
    2008-03-21 20:28 . 2008-03-21 20:28 <KANSIO> d-------- C:\Program Files\Eraser
    2008-03-21 20:28 . 2008-03-21 20:28 <KANSIO> d--h----- C:\Documents and Settings\All Users\Application Data\{A25FEDC1-F6D7-440C-BCE2-B71F595F6646}
    2008-03-21 20:12 . 2008-03-21 20:12 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\SUPERAntiSpyware.com
    2008-03-21 20:08 . 2008-03-21 20:08 <KANSIO> d-------- C:\Program Files\Axon Data
    2008-03-21 19:48 . 2008-03-21 19:48 <KANSIO> d-------- C:\Disney
    2008-03-21 19:48 . 2008-03-23 09:30 626 --a------ C:\WINDOWS\7ThLevel.ini
    2008-03-20 21:45 . 2008-03-20 22:41 <KANSIO> d-------- C:\eJay_se
    2008-03-20 21:45 . 2008-03-20 22:41 118 --a------ C:\WINDOWS\eJay_se.inf
    2008-03-20 21:35 . 2008-03-26 19:50 3,594,272 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2008-03-20 21:35 . 2008-03-26 16:46 41,852 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
    2008-03-20 21:31 . 2007-09-06 16:14 75,248 --a------ C:\WINDOWS\zllsputility.exe
    2008-03-20 21:30 . 2007-09-06 16:14 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll
    2008-03-20 21:30 . 2008-03-26 18:33 353,247 --a------ C:\WINDOWS\system32\vsconfig.xml
    2008-03-20 19:52 . 2008-03-20 19:52 <KANSIO> d-------- C:\Program Files\Bluetack
    2008-03-19 17:06 . 2008-03-19 17:06 25,736 --ah----- C:\WINDOWS\system32\mlfcache.dat
    2008-03-19 16:55 . 2008-03-19 16:56 <KANSIO> d-------- C:\Program Files\Safari
    2008-03-19 16:55 . 2008-03-19 16:55 <KANSIO> d-------- C:\Program Files\Bonjour
    2008-03-17 12:21 . 2007-12-04 15:04 837,496 --a--c--- C:\WINDOWS\system32\aswBoot.exe
    2008-03-17 12:21 . 2004-01-09 11:13 380,928 --a--c--- C:\WINDOWS\system32\actskin4.ocx
    2008-03-17 12:21 . 2007-12-04 14:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
    2008-03-17 12:21 . 2007-12-04 16:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
    2008-03-17 12:21 . 2007-12-04 16:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
    2008-03-17 12:21 . 2007-12-04 16:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
    2008-03-17 12:21 . 2007-12-04 16:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
    2008-03-17 12:21 . 2007-12-04 16:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
    2008-03-15 14:50 . 2008-03-17 12:16 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-03-15 10:34 . 2008-03-15 10:34 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Grisoft
    2008-03-15 10:34 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-03-11 18:08 . 2008-03-11 18:08 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
    2008-03-11 18:08 . 2008-03-11 18:08 <KANSIO> d-------- C:\Program Files\Common Files\Nokia
    2008-03-11 18:07 . 2008-03-11 18:07 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
    2008-03-08 23:54 . 2008-03-08 23:54 <KANSIO> d-------- C:\Program Files\Microsoft XNA
    2008-03-08 23:51 . 2008-03-08 23:51 <KANSIO> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2008-03-08 23:21 . 2008-03-08 23:31 <KANSIO> d-------- C:\Program Files\Microsoft Visual Studio 8
    2008-03-08 19:25 . 2008-03-09 20:07 <KANSIO> d-------- C:\Program Files\Netcraft Toolbar
    2008-03-07 09:34 . 2008-03-15 14:40 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Comodo
    2008-03-07 09:34 . 2008-03-15 14:26 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\comodo
    2008-03-07 08:43 . 2008-03-07 08:43 <KANSIO> d-------- C:\Program Files\ToniArts
    2008-03-06 21:19 . 2008-03-07 17:33 <KANSIO> d-------- C:\Program Files\Freeciv-2.1.1-gtk2
    2008-03-06 21:17 . 2008-03-06 21:17 <KANSIO> d-------- C:\Program Files\SiSoftware
    2008-03-06 17:36 . 2008-03-06 17:36 <KANSIO> d-------- C:\Program Files\Tall Emu
    2008-03-06 17:36 . 2008-03-06 17:36 <KANSIO> d-------- C:\OnlineArmor
    2008-03-05 17:03 . 2008-03-05 17:03 4,212 ---h----- C:\WINDOWS\system32\imlictbl.dat
    2008-03-04 20:55 . 2008-03-04 20:55 <KANSIO> d-------- C:\Documents and Settings\NetworkService\Käynnistä-valikko
    2008-03-03 16:48 . 2008-03-03 16:48 <KANSIO> d-------- C:\Program Files\Team MediaPortal
    2008-03-03 14:53 . 2008-03-03 14:53 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Talkback
    2008-03-02 20:21 . 2008-03-02 20:21 <KANSIO> d-------- C:\Documents and Settings\Atte\Incomplete
    2008-03-02 20:21 . 2008-03-02 20:31 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\FrostWire
    2008-03-02 20:20 . 2008-03-05 18:35 <KANSIO> d-------- C:\Program Files\FrostWire
    2008-03-02 13:38 . 2008-03-02 13:38 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\PC Tools
    2008-03-01 19:18 . 2007-06-26 16:17 87,504 --a------ C:\WINDOWS\system32\drivers\csfpc.sys
    2008-03-01 19:17 . 2008-03-01 19:22 <KANSIO> d-------- C:\Program Files\CE-Infosys
    2008-03-01 19:17 . 2008-03-01 19:17 <KANSIO> d-------- C:\log data
    2008-03-01 19:17 . 2008-03-01 19:17 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\CE-Infosys
    2008-03-01 10:45 . 2008-03-01 10:45 <KANSIO> d-------- C:\Program Files\Innovative Solutions
    2008-03-01 10:23 . 2008-03-01 10:24 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\TrueCrypt
    2008-02-29 23:13 . 2008-02-29 23:13 <KANSIO> d-------- C:\Program Files\TrueCrypt
    2008-02-29 23:13 . 2008-03-20 18:24 223,424 --a------ C:\WINDOWS\system32\drivers\truecrypt.sys
    2008-02-29 22:02 . 2008-03-21 22:29 <KANSIO> d-------- C:\Program Files\SUPERAntiSpyware
    2008-02-29 22:02 . 2008-02-29 22:02 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
    2008-02-29 20:25 . 2008-03-23 19:50 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
    2008-02-29 20:19 . 2008-02-29 20:19 <KANSIO> d-------- C:\Program Files\ImgBurn
    2008-02-29 20:19 . 2008-02-29 20:19 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\DAEMON Tools
    2008-02-29 19:33 . 2008-02-29 19:37 <KANSIO> d-------- C:\Program Files\MediaCoder
    2008-02-29 13:11 . 2008-02-29 13:11 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\F-Secure
    2008-02-29 13:01 . 2008-03-06 15:15 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
    2008-02-29 13:00 . 2008-02-29 13:00 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\fssg

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-26 17:43 --------- d-----w C:\Documents and Settings\Atte\Application Data\BitTorrent
    2008-03-26 16:35 --------- d-----w C:\Program Files\lg_fwupdate
    2008-03-26 09:26 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-03-25 17:36 --------- d-----w C:\Program Files\DC++
    2008-03-24 20:48 --------- d-----w C:\Program Files\EvilLyrics
    2008-03-24 16:02 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-03-24 13:17 --------- d-----w C:\Documents and Settings\Atte\Application Data\uTorrent
    2008-03-23 13:38 --------- d-----w C:\Documents and Settings\Atte\Application Data\Ahead
    2008-03-23 13:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-03-23 13:23 --------- d-----w C:\Program Files\Google
    2008-03-22 13:59 --------- d-----w C:\Documents and Settings\Atte\Application Data\OpenOffice.org2
    2008-03-21 20:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-03-21 18:35 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-03-20 14:13 --------- d-----w C:\Program Files\Java
    2008-03-19 15:18 --------- d-----w C:\Program Files\Winamp
    2008-03-19 14:56 --------- d-----w C:\Documents and Settings\Atte\Application Data\Apple Computer
    2008-03-15 19:57 --------- d-----w C:\Documents and Settings\Atte\Application Data\JDiskReport
    2008-03-15 14:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-03-15 12:35 --------- d-----w C:\Program Files\Windows Live
    2008-03-15 12:33 --------- d-----w C:\Program Files\Windows Live Toolbar
    2008-03-15 12:29 --------- d-----w C:\Program Files\Wolfenstein 3D
    2008-03-15 08:50 --------- d-----w C:\Documents and Settings\Atte\Application Data\Skype
    2008-03-15 08:44 --------- d-----w C:\Documents and Settings\Atte\Application Data\skypePM
    2008-03-11 16:07 --------- d-----w C:\Program Files\Nokia
    2008-03-09 18:09 --------- d-----w C:\Program Files\Opera 9.5 beta
    2008-03-08 21:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-03-06 14:52 --------- d-----w C:\Program Files\Counter-Strike 1.6
    2008-03-02 18:31 --------- d-----w C:\Documents and Settings\Atte\Application Data\Winamp
    2008-02-29 18:20 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
    2008-02-25 16:00 --------- d-----w C:\Program Files\Wolfenstein - Enemy Territory
    2008-02-24 19:03 --------- d-----w C:\Documents and Settings\Atte\Application Data\LaCie
    2008-02-24 18:16 --------- d-----w C:\Program Files\LaCie
    2008-02-24 12:38 --------- d-----w C:\Program Files\Winamp Remote
    2008-02-24 12:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\OrbNetworks
    2008-02-24 10:39 --------- d-----w C:\Program Files\Activision
    2008-02-23 13:02 --------- d-----w C:\Program Files\Futuremark
    2008-02-23 10:04 --------- d-----w C:\Program Files\TitanTV
    2008-02-23 10:02 --------- d-----w C:\Program Files\Windows Media Components
    2008-02-23 09:15 --------- d-----w C:\Program Files\VIA
    2008-02-22 15:22 --------- d-----w C:\Program Files\Infogrames
    2008-02-21 21:56 --------- d-----w C:\Documents and Settings\Atte\Application Data\SiteAdvisor
    2008-02-21 11:27 --------- d-----w C:\Program Files\FDRLab
    2008-02-21 11:22 --------- d-----w C:\Program Files\JGoodies
    2008-02-20 22:15 --------- d-----w C:\Program Files\Burn4Free
    2008-02-20 22:14 --------- d-----w C:\Program Files\Notepad X
    2008-02-20 22:14 --------- d-----w C:\Documents and Settings\Atte\Application Data\Notepad X
    2008-02-20 22:13 --------- d-----w C:\Documents and Settings\Atte\Application Data\FDRLab
    2008-02-19 22:30 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-02-17 13:38 --------- d-----w C:\Program Files\YourWare Solutions
    2008-02-15 09:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-02-14 12:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
    2008-02-14 12:18 --------- d-----w C:\Program Files\Zone Labs
    2008-02-09 22:01 --------- d-----w C:\Program Files\SlySoft
    2008-02-09 22:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\SlySoft
    2008-02-09 18:37 --------- d-----w C:\Documents and Settings\Atte\Application Data\vlc
    2008-02-09 18:34 --------- d-----w C:\Program Files\VideoLAN
    2008-02-06 13:41 --------- d-----w C:\Documents and Settings\Atte\Application Data\Uniblue
    2008-02-06 13:40 --------- d-----w C:\Program Files\Uniblue
    2008-02-05 16:45 --------- d-----w C:\Program Files\Windows Media Connect 2
    2008-02-03 16:14 --------- d-----w C:\Documents and Settings\Atte\Application Data\dvdcss
    2008-02-01 18:25 --------- d-----w C:\Program Files\QuickTime
    2008-02-01 18:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-02-01 18:23 --------- d-----w C:\Program Files\Apple Software Update
    2008-02-01 18:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
    2008-02-01 12:35 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-01-27 18:18 --------- d-----w C:\Program Files\Common Files\DirectX
    2008-01-27 18:17 --------- d-----w C:\Program Files\directx
    2008-01-27 18:10 --------- d-----w C:\Program Files\Warthog
    2008-01-27 14:06 --------- d-----w C:\Program Files\uTorrent
    2008-01-26 19:51 23,600 -c--a-w C:\WINDOWS\system32\drivers\TVICHW32.SYS
    2008-01-26 19:48 --------- d-----w C:\Program Files\Lavalys
    2008-01-26 19:08 --------- d-----w C:\Program Files\Blender Foundation
    2008-01-26 18:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
    2008-01-26 17:53 --------- d-----w C:\Documents and Settings\Atte\Application Data\DAEMON Tools Pro
    2008-01-26 16:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-01-26 11:51 --------- d-----w C:\Program Files\PhishGuard
    2008-01-26 11:50 624 -csha-r C:\WINDOWS\system32\drivers\OP_CACHE.ATR
    2008-01-26 11:50 312 -csha-r C:\WINDOWS\system32\drivers\OP_CACHE.IDX
    2008-01-26 11:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\PhishGuard
    2008-01-26 11:37 --------- d-----w C:\Program Files\Oca History Tool
    2008-01-26 11:32 --------- d-----w C:\Program Files\Common Files\Skype
    2008-01-26 11:11 --------- d-----w C:\Documents and Settings\Atte\Application Data\WinPatrol
    2008-01-26 11:05 --------- d-----w C:\Documents and Settings\Atte\Application Data\AdobeUM
    2008-01-26 11:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
    2008-01-26 11:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
    2008-01-26 11:02 --------- d-----w C:\Program Files\Alwil Software
    2008-01-26 10:54 1,944 -csha-r C:\WINDOWS\Fonts\OP_CACHE.IDX
    2008-01-26 10:50 --------- d-----w C:\Program Files\SystemRequirementsLab
    2008-01-26 10:50 --------- d-----w C:\Program Files\Paint.NET
    2008-01-26 10:49 --------- d-----w C:\Program Files\GameSpy Arcade
    2008-01-26 10:49 --------- d-----w C:\Program Files\EMCO Malware Destroyer
    2008-01-26 10:49 --------- d-----w C:\Program Files\DNA
    2008-01-26 10:49 --------- d-----w C:\Program Files\Darkeden
    2008-01-26 10:49 --------- d-----w C:\Program Files\BitTorrent
    2008-01-26 10:49 --------- d-----w C:\Program Files\BitComet
    2008-01-26 10:49 --------- d-----w C:\Program Files\AvRack
    2008-01-26 10:42 --------- d-----w C:\Program Files\McAfee.com
    2008-01-26 10:36 --------- d-----w C:\Documents and Settings\Atte\Application Data\McAfee
    2008-01-26 10:35 --------- d-----w C:\Documents and Settings\Atte\Application Data\Lavasoft
    2008-01-25 16:05 32 -c--a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a33fa729-d155-4b23-842b-2c665ecabdb6}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 05:00 15360]
    "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
    "BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2008-03-20 16:14 587568]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 14:42 212992]
    "SoundMan"="SOUNDMAN.EXE" [2005-08-17 12:39 90112 C:\WINDOWS\SOUNDMAN.EXE]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
    "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 15:10 56928]
    "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55 54832]
    "LGODDFU"="C:\Program Files\lg_fwupdate\fwupdate.exe" [2008-01-11 00:47 249856]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
    "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14 919016]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 05:00 15360]
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]
    "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38 39264]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoResolveSearch"= 1 (0x1)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "C:\\Program Files\\BitTorrent\\bittorrent.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
    "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
    "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
    "C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\Win32\\RpcDataSrv.exe"=
    "C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\RpcSandraSrv.exe"=
    "C:\\Program Files\\Freeciv-2.1.1-gtk2\\civserver.exe"=
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "8117:TCP"= 8117:TCP:BitComet 8117 TCP
    "8117:UDP"= 8117:UDP:BitComet 8117 UDP

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)

    R0 ViBus;ViBus;C:\WINDOWS\system32\DRIVERS\ViBus.sys [2007-12-07 11:13]
    R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2007-09-21 17:49]
    R0 ViPrt;VIA SATA IDE Device Driver;C:\WINDOWS\system32\DRIVERS\ViPrt.sys [2007-12-07 11:10]
    S3 0e46;0e46;C:\WINDOWS\system32\0e46.sys [2008-01-19 20:14]
    S3 EverestDriver;Lavalys EVEREST Kernel Driver;C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [2005-08-18 00:00]
    S3 FXDRV;FXDRV;D:\Fxdrv.sys []
    S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-03-22 22:56]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-03-26 10:50:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-03-26 16:36:33 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
    - C:\Program Files\Windows Defender\MpCmdRun.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-26 19:49:58
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EverestDriver]
    "ImagePath"="\??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\explorer.exe
    -> C:\Program Files\SiteAdvisor\6253\saHook.dll
    .
    Completion time: 2008-03-26 19:54:16
    ComboFix-quarantined-files.txt 2008-03-26 17:54:07
    .
    2008-03-26 09:15:46 --- E O F ---
     
    ocelot007, Mar 26, 2008
    #7
  8. Hujo

    Hujo Guest

    Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

    Tallenna se nimellä CFScript.txt

    Sitten raahaa CFScript ComboFix.exeen kuten alla.
    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
     
    Last edited by a moderator: Mar 26, 2008
    Hujo, Mar 26, 2008
    #8
  9. ocelot007

    ocelot007 Member

    Joined:
    Jun 30, 2007
    Messages:
    64
    Likes Received:
    0
    Trophy Points:
    16
    ComboFix 08-03-25.4 - Atte 2008-03-27 12:16:05.3 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.128 [GMT 2:00]
    Running from: C:\Documents and Settings\Atte\Työpöytä\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Atte\Työpöytä\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .
    TimedOut: progfile.dat
    -- Script messages for sUBs --
    Findstr -MIF:/ "\\TTC\.pdb InsertAdvertisement"
    GREP -Eisf temp00
    VFind -tf -s282624 "C:\Program Files\????????*[0-9].dll"

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-02-27 to 2008-03-27 )))))))))))))))))
    .

    2008-03-26 19:06 . 2008-03-26 21:55 <KANSIO> d-------- C:\Program Files\TVUPlayer
    2008-03-26 19:06 . 2008-03-26 21:54 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\TVU Networks
    2008-03-26 13:24 . 2008-03-26 13:25 <KANSIO> d-ahs---- C:\WINDOWS\Repair
    2008-03-26 13:07 . 2008-03-26 13:07 <KANSIO> d-------- C:\Program Files\XeroBank
    2008-03-26 13:07 . 2008-03-26 13:07 <KANSIO> d-------- C:\Program Files\Runtime Software
    2008-03-25 13:03 . 2002-11-02 09:53 57,344 --a------ C:\WINDOWS\system32\WNASPINT.DLL
    2008-03-25 10:23 . 2008-03-25 11:39 <KANSIO> d-------- C:\Program Files\HalfLife2
    2008-03-24 18:03 . 2008-03-24 18:03 <KANSIO> d-------- C:\Program Files\Lavasoft
    2008-03-24 17:51 . 2008-03-24 17:51 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\ImgBurn
    2008-03-24 00:07 . 2008-03-24 00:07 <KANSIO> d-------- C:\Program Files\MagicDisc
    2008-03-24 00:07 . 2008-02-18 17:29 96,256 --a------ C:\WINDOWS\system32\drivers\mcdbus.sys
    2008-03-23 19:28 . 2008-03-23 19:28 <KANSIO> d-------- C:\Program Files\DVD Decrypter
    2008-03-23 15:29 . 2008-03-23 15:29 <KANSIO> d-------- C:\eJay
    2008-03-23 13:25 . 2008-03-23 13:25 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-03-23 13:25 . 2008-03-23 13:25 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-03-22 19:36 . 2008-03-22 19:36 <KANSIO> d-------- C:\Documents and Settings\LocalService\Käynnistä-valikko
    2008-03-22 17:22 . 2008-03-22 17:26 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\VersionTracker Pro
    2008-03-22 15:54 . 2008-03-22 22:14 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Crystal Player
    2008-03-22 15:47 . 2008-03-22 15:47 <KANSIO> d-------- C:\Program Files\TechTracker
    2008-03-21 20:28 . 2008-03-21 20:28 <KANSIO> d-------- C:\Program Files\Eraser
    2008-03-21 20:28 . 2008-03-21 20:28 <KANSIO> d--h----- C:\Documents and Settings\All Users\Application Data\{A25FEDC1-F6D7-440C-BCE2-B71F595F6646}
    2008-03-21 20:12 . 2008-03-21 20:12 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\SUPERAntiSpyware.com
    2008-03-21 20:08 . 2008-03-21 20:08 <KANSIO> d-------- C:\Program Files\Axon Data
    2008-03-21 19:48 . 2008-03-21 19:48 <KANSIO> d-------- C:\Disney
    2008-03-21 19:48 . 2008-03-23 09:30 626 --a------ C:\WINDOWS\7ThLevel.ini
    2008-03-20 21:45 . 2008-03-20 22:41 <KANSIO> d-------- C:\eJay_se
    2008-03-20 21:45 . 2008-03-20 22:41 118 --a------ C:\WINDOWS\eJay_se.inf
    2008-03-20 21:35 . 2008-03-27 12:21 3,969,056 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2008-03-20 21:35 . 2008-03-26 23:37 46,196 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
    2008-03-20 21:31 . 2007-09-06 16:14 75,248 --a------ C:\WINDOWS\zllsputility.exe
    2008-03-20 21:30 . 2007-09-06 16:14 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll
    2008-03-20 21:30 . 2008-03-27 09:48 353,247 --a------ C:\WINDOWS\system32\vsconfig.xml
    2008-03-20 19:52 . 2008-03-20 19:52 <KANSIO> d-------- C:\Program Files\Bluetack
    2008-03-19 17:06 . 2008-03-19 17:06 25,736 --ah----- C:\WINDOWS\system32\mlfcache.dat
    2008-03-19 16:55 . 2008-03-19 16:56 <KANSIO> d-------- C:\Program Files\Safari
    2008-03-19 16:55 . 2008-03-19 16:55 <KANSIO> d-------- C:\Program Files\Bonjour
    2008-03-17 12:21 . 2007-12-04 15:04 837,496 --a--c--- C:\WINDOWS\system32\aswBoot.exe
    2008-03-17 12:21 . 2004-01-09 11:13 380,928 --a--c--- C:\WINDOWS\system32\actskin4.ocx
    2008-03-17 12:21 . 2007-12-04 14:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
    2008-03-17 12:21 . 2007-12-04 16:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
    2008-03-17 12:21 . 2007-12-04 16:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
    2008-03-17 12:21 . 2007-12-04 16:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
    2008-03-17 12:21 . 2007-12-04 16:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
    2008-03-17 12:21 . 2007-12-04 16:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
    2008-03-15 14:50 . 2008-03-17 12:16 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-03-15 10:34 . 2008-03-15 10:34 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Grisoft
    2008-03-15 10:34 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-03-11 18:08 . 2008-03-11 18:08 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
    2008-03-11 18:08 . 2008-03-11 18:08 <KANSIO> d-------- C:\Program Files\Common Files\Nokia
    2008-03-11 18:07 . 2008-03-11 18:07 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
    2008-03-08 23:54 . 2008-03-08 23:54 <KANSIO> d-------- C:\Program Files\Microsoft XNA
    2008-03-08 23:51 . 2008-03-08 23:51 <KANSIO> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2008-03-08 23:21 . 2008-03-08 23:31 <KANSIO> d-------- C:\Program Files\Microsoft Visual Studio 8
    2008-03-08 19:25 . 2008-03-09 20:07 <KANSIO> d-------- C:\Program Files\Netcraft Toolbar
    2008-03-07 09:34 . 2008-03-15 14:40 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Comodo
    2008-03-07 09:34 . 2008-03-15 14:26 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\comodo
    2008-03-07 08:43 . 2008-03-07 08:43 <KANSIO> d-------- C:\Program Files\ToniArts
    2008-03-06 21:19 . 2008-03-07 17:33 <KANSIO> d-------- C:\Program Files\Freeciv-2.1.1-gtk2
    2008-03-06 21:17 . 2008-03-06 21:17 <KANSIO> d-------- C:\Program Files\SiSoftware
    2008-03-06 17:36 . 2008-03-06 17:36 <KANSIO> d-------- C:\Program Files\Tall Emu
    2008-03-06 17:36 . 2008-03-06 17:36 <KANSIO> d-------- C:\OnlineArmor
    2008-03-05 17:03 . 2008-03-05 17:03 4,212 ---h----- C:\WINDOWS\system32\imlictbl.dat
    2008-03-04 20:55 . 2008-03-04 20:55 <KANSIO> d-------- C:\Documents and Settings\NetworkService\Käynnistä-valikko
    2008-03-03 16:48 . 2008-03-03 16:48 <KANSIO> d-------- C:\Program Files\Team MediaPortal
    2008-03-03 14:53 . 2008-03-03 14:53 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Talkback
    2008-03-02 20:21 . 2008-03-02 20:21 <KANSIO> d-------- C:\Documents and Settings\Atte\Incomplete
    2008-03-02 20:21 . 2008-03-02 20:31 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\FrostWire
    2008-03-02 20:20 . 2008-03-05 18:35 <KANSIO> d-------- C:\Program Files\FrostWire
    2008-03-02 13:38 . 2008-03-02 13:38 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\PC Tools
    2008-03-01 19:18 . 2007-06-26 16:17 87,504 --a------ C:\WINDOWS\system32\drivers\csfpc.sys
    2008-03-01 19:17 . 2008-03-01 19:22 <KANSIO> d-------- C:\Program Files\CE-Infosys
    2008-03-01 19:17 . 2008-03-01 19:17 <KANSIO> d-------- C:\log data
    2008-03-01 19:17 . 2008-03-01 19:17 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\CE-Infosys
    2008-03-01 10:45 . 2008-03-01 10:45 <KANSIO> d-------- C:\Program Files\Innovative Solutions
    2008-03-01 10:23 . 2008-03-01 10:24 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\TrueCrypt
    2008-02-29 23:13 . 2008-02-29 23:13 <KANSIO> d-------- C:\Program Files\TrueCrypt
    2008-02-29 23:13 . 2008-03-20 18:24 223,424 --a------ C:\WINDOWS\system32\drivers\truecrypt.sys
    2008-02-29 22:02 . 2008-03-21 22:29 <KANSIO> d-------- C:\Program Files\SUPERAntiSpyware
    2008-02-29 22:02 . 2008-02-29 22:02 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
    2008-02-29 20:25 . 2008-03-23 19:50 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
    2008-02-29 20:19 . 2008-02-29 20:19 <KANSIO> d-------- C:\Program Files\ImgBurn
    2008-02-29 20:19 . 2008-02-29 20:19 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\DAEMON Tools
    2008-02-29 19:33 . 2008-02-29 19:37 <KANSIO> d-------- C:\Program Files\MediaCoder
    2008-02-29 13:11 . 2008-02-29 13:11 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\F-Secure
    2008-02-29 13:01 . 2008-03-06 15:15 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
    2008-02-29 13:00 . 2008-02-29 13:00 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\fssg

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-27 10:20 --------- d-----w C:\Documents and Settings\Atte\Application Data\BitTorrent
    2008-03-27 08:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-03-27 07:50 --------- d-----w C:\Program Files\lg_fwupdate
    2008-03-26 21:14 --------- d-----w C:\Program Files\DC++
    2008-03-26 09:27 453,120 ----a-w C:\WINDOWS\Internet Logs\xDB9.tmp
    2008-03-26 09:27 1,380,352 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp
    2008-03-26 09:26 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-03-25 10:15 98,304 -c--a-w C:\WINDOWS\system32\CmdLineExt.dll
    2008-03-24 20:48 --------- d-----w C:\Program Files\EvilLyrics
    2008-03-24 16:02 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-03-24 13:17 --------- d-----w C:\Documents and Settings\Atte\Application Data\uTorrent
    2008-03-23 13:38 --------- d-----w C:\Documents and Settings\Atte\Application Data\Ahead
    2008-03-23 13:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-03-23 13:23 --------- d-----w C:\Program Files\Google
    2008-03-23 12:33 267,776 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
    2008-03-23 12:33 1,361,920 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp
    2008-03-22 13:59 --------- d-----w C:\Documents and Settings\Atte\Application Data\OpenOffice.org2
    2008-03-21 22:11 173,568 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
    2008-03-21 22:11 1,347,072 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
    2008-03-21 18:35 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-03-21 10:07 1,918,464 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
    2008-03-21 10:07 1,325,056 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
    2008-03-20 21:11 1,396,224 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
    2008-03-20 21:11 1,323,008 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
    2008-03-20 14:13 --------- d-----w C:\Program Files\Java
    2008-03-19 15:18 --------- d-----w C:\Program Files\Winamp
    2008-03-19 14:56 --------- d-----w C:\Documents and Settings\Atte\Application Data\Apple Computer
    2008-03-15 19:57 --------- d-----w C:\Documents and Settings\Atte\Application Data\JDiskReport
    2008-03-15 14:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-03-15 12:35 --------- d-----w C:\Program Files\Windows Live
    2008-03-15 12:33 --------- d-----w C:\Program Files\Windows Live Toolbar
    2008-03-15 12:29 --------- d-----w C:\Program Files\Wolfenstein 3D
    2008-03-15 08:50 --------- d-----w C:\Documents and Settings\Atte\Application Data\Skype
    2008-03-15 08:44 --------- d-----w C:\Documents and Settings\Atte\Application Data\skypePM
    2008-03-11 16:07 --------- d-----w C:\Program Files\Nokia
    2008-03-09 18:09 --------- d-----w C:\Program Files\Opera 9.5 beta
    2008-03-08 21:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-03-06 14:52 --------- d-----w C:\Program Files\Counter-Strike 1.6
    2008-03-02 18:31 --------- d-----w C:\Documents and Settings\Atte\Application Data\Winamp
    2008-02-29 18:20 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
    2008-02-25 16:00 --------- d-----w C:\Program Files\Wolfenstein - Enemy Territory
    2008-02-24 19:03 --------- d-----w C:\Documents and Settings\Atte\Application Data\LaCie
    2008-02-24 18:16 --------- d-----w C:\Program Files\LaCie
    2008-02-24 12:38 --------- d-----w C:\Program Files\Winamp Remote
    2008-02-24 12:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\OrbNetworks
    2008-02-24 10:39 --------- d-----w C:\Program Files\Activision
    2008-02-23 13:02 --------- d-----w C:\Program Files\Futuremark
    2008-02-23 10:04 --------- d-----w C:\Program Files\TitanTV
    2008-02-23 10:02 --------- d-----w C:\Program Files\Windows Media Components
    2008-02-23 09:15 --------- d-----w C:\Program Files\VIA
    2008-02-22 15:22 --------- d-----w C:\Program Files\Infogrames
    2008-02-21 21:56 --------- d-----w C:\Documents and Settings\Atte\Application Data\SiteAdvisor
    2008-02-21 11:27 --------- d-----w C:\Program Files\FDRLab
    2008-02-21 11:22 --------- d-----w C:\Program Files\JGoodies
    2008-02-20 22:15 --------- d-----w C:\Program Files\Burn4Free
    2008-02-20 22:14 --------- d-----w C:\Program Files\Notepad X
    2008-02-20 22:14 --------- d-----w C:\Documents and Settings\Atte\Application Data\Notepad X
    2008-02-20 22:13 --------- d-----w C:\Documents and Settings\Atte\Application Data\FDRLab
    2008-02-20 20:21 29,395 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_02_20_22_18_12_small.dmp.zip
    2008-02-19 22:30 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-02-17 13:38 --------- d-----w C:\Program Files\YourWare Solutions
    2008-02-15 09:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-02-14 12:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
    2008-02-14 12:18 --------- d-----w C:\Program Files\Zone Labs
    2008-02-09 22:01 --------- d-----w C:\Program Files\SlySoft
    2008-02-09 22:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\SlySoft
    2008-02-09 18:37 --------- d-----w C:\Documents and Settings\Atte\Application Data\vlc
    2008-02-09 18:34 --------- d-----w C:\Program Files\VideoLAN
    2008-02-06 13:41 --------- d-----w C:\Documents and Settings\Atte\Application Data\Uniblue
    2008-02-06 13:40 --------- d-----w C:\Program Files\Uniblue
    2008-02-05 16:45 --------- d-----w C:\Program Files\Windows Media Connect 2
    2008-02-03 16:14 --------- d-----w C:\Documents and Settings\Atte\Application Data\dvdcss
    2008-02-01 18:25 --------- d-----w C:\Program Files\QuickTime
    2008-02-01 18:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-02-01 18:23 --------- d-----w C:\Program Files\Apple Software Update
    2008-02-01 18:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
    2008-02-01 12:35 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-01-27 18:18 --------- d-----w C:\Program Files\Common Files\DirectX
    2008-01-27 18:17 21,840 -c--a-w C:\WINDOWS\system32\SIntfNT.dll
    2008-01-27 18:17 17,212 -c--a-w C:\WINDOWS\system32\SIntf32.dll
    2008-01-27 18:17 12,067 -c--a-w C:\WINDOWS\system32\SIntf16.dll
    2008-01-27 18:17 --------- d-----w C:\Program Files\directx
    2008-01-27 18:10 --------- d-----w C:\Program Files\Warthog
    2008-01-27 14:06 --------- d-----w C:\Program Files\uTorrent
    2008-01-26 10:54 1,944 -csha-r C:\WINDOWS\Fonts\OP_CACHE.IDX
    2008-01-25 16:05 32 -c--a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
    2008-01-19 18:14 185,824 -c--a-w C:\WINDOWS\system32\0e46.sys
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 05:00 15360]
    "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
    "BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2008-03-20 16:14 587568]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 14:42 212992]
    "SoundMan"="SOUNDMAN.EXE" [2005-08-17 12:39 90112 C:\WINDOWS\SOUNDMAN.EXE]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
    "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 15:10 56928]
    "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55 54832]
    "LGODDFU"="C:\Program Files\lg_fwupdate\fwupdate.exe" [2008-01-11 00:47 249856]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
    "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14 919016]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 05:00 15360]
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]
    "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38 39264]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoResolveSearch"= 1 (0x1)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "C:\\Program Files\\BitTorrent\\bittorrent.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
    "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
    "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
    "C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\Win32\\RpcDataSrv.exe"=
    "C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\RpcSandraSrv.exe"=
    "C:\\Program Files\\Freeciv-2.1.1-gtk2\\civserver.exe"=
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "8117:TCP"= 8117:TCP:BitComet 8117 TCP
    "8117:UDP"= 8117:UDP:BitComet 8117 UDP

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)

    R0 ViBus;ViBus;C:\WINDOWS\system32\DRIVERS\ViBus.sys [2007-12-07 11:13]
    R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2007-09-21 17:49]
    R0 ViPrt;VIA SATA IDE Device Driver;C:\WINDOWS\system32\DRIVERS\ViPrt.sys [2007-12-07 11:10]
    S3 0e46;0e46;C:\WINDOWS\system32\0e46.sys [2008-01-19 20:14]
    S3 EverestDriver;Lavalys EVEREST Kernel Driver;C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [2005-08-18 00:00]
    S3 FXDRV;FXDRV;D:\Fxdrv.sys []
    S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-03-22 22:56]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-03-26 10:50:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-03-27 07:51:54 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
    - C:\Program Files\Windows Defender\MpCmdRun.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-27 12:21:51
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EverestDriver]
    "ImagePath"="\??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\explorer.exe
    -> C:\Program Files\SiteAdvisor\6253\saHook.dll
    .
    Completion time: 2008-03-27 12:26:08
    ComboFix-quarantined-files.txt 2008-03-27 10:26:01
    ComboFix2.txt 2008-03-26 17:54:17
    .
    2008-03-26 09:15:46 --- E O F ---
     
    ocelot007, Mar 27, 2008
    #9
  10. Hujo

    Hujo Guest

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.

    ============

    scannaa uusi hjt:n loki
     
    Hujo, Mar 27, 2008
    #10
  11. ocelot007

    ocelot007 Member

    Joined:
    Jun 30, 2007
    Messages:
    64
    Likes Received:
    0
    Trophy Points:
    16
    Malwarebytes' Anti-Malware 1.09
    Tietokantaversio: 552

    Tarkistustyyppi: Täysi tarkistus (C:\|G:\|)
    Tarkistetut kohteet: 169673
    Kulunut aika: 1 hour(s), 26 minute(s), 33 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 1
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 1

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    HKEY_CLASSES_ROOT\CLSID\{c4ee31f3-4768-11d2-be5c-00a0c9a83da1} (Rogue.WinFixer) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    C:\Documents and Settings\Atte\Työpöytä\ohjelmia\Uusi kansio\Uusi kansio (3)\English_Free_CompuSec\English_Free_CompuSec\compusec installation\installation container\sqlite3.dll (Rogue.Multiple) -> Quarantined and deleted successfully.



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:31:41, on 27.3.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\Program Files\SiteAdvisor\6253\SAService.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\lg_fwupdate\fwupdate.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\BitTorrent\bittorrent.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - .DEFAULT User Startup: OP_CACHE.ATR (User 'Default user')
    O4 - .DEFAULT User Startup: OP_CACHE.IDX (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
    O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SiteAdvisor-palvelu (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 9788 bytes
     
    ocelot007, Mar 27, 2008
    #11
  12. Hujo

    Hujo Guest

    Päivitä AVG Anti-Spyware 7.5 ja aja vikasiedossa
     
    Hujo, Mar 27, 2008
    #12

Share This Page