HJT Logi

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by inky89, May 26, 2008.

  1. inky89

    inky89 Member

    Joined:
    May 26, 2008
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    11
    Eli Winkkari alkanu mesoamaan monen ohjelman asennuksessa "This installation package could not be opened. Verify that the package exists and that you can access it, blablabla"


    HJT Logi:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:15:55, on 26.5.2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16643)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\System32\CTHELPER.EXE
    C:\Windows\System32\CTXFIHLP.EXE
    C:\Program Files\AVG\AVG8\avgtray.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Windows\System32\CTXFISPI.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Windows\system32\conime.exe
    D:\Softat\mIRC\mirc.exe
    C:\Program Files\uTorrent\uTorrent.exe
    D:\Softat\Mozilla Firefox\firefox.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
    O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O13 - Gopher Prefix:
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
    O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Unknown owner - C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe (file missing)

    --
    End of file - 4708 bytes
     
    inky89, May 26, 2008
    #1
  2. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    ===========

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
     
    Hujo, May 26, 2008
    #2
  3. inky89

    inky89 Member

    Joined:
    May 26, 2008
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    11
    Combofix Log:

    ComboFix 08-05-25.4 - inky` 2008-05-26 14:28:20.1 - NTFSx86
    Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1033.18.1980 [GMT 3:00]
    Running from: C:\Users\inky`\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((( Files Created from 2008-04-26 to 2008-05-26 )))))))))))))))))))))))))))))))
    .

    2008-05-26 14:25 . 2008-05-26 14:25 <DIR> d-------- C:\VundoFix Backups
    2008-05-26 14:15 . 2008-05-26 14:15 <DIR> d-------- C:\Program Files\Trend Micro
    2008-05-25 21:36 . 2008-05-25 21:37 <DIR> d-------- C:\Program Files\Java
    2008-05-25 21:36 . 2008-05-25 21:36 <DIR> d-------- C:\Program Files\Common Files\Java
    2008-05-25 21:20 . 2008-05-25 21:20 <DIR> d-------- C:\Program Files\Logitech
    2008-05-25 21:20 . 2008-05-02 02:39 170,512 --a------ C:\Windows\System32\kemutb.dll
    2008-05-25 21:20 . 2008-05-02 02:39 145,936 --a------ C:\Windows\System32\KemUtil.dll
    2008-05-25 21:20 . 2008-05-02 02:40 117,264 --a------ C:\Windows\System32\KemWnd.dll
    2008-05-25 21:20 . 2008-05-02 02:40 84,496 --a------ C:\Windows\System32\KemXML.dll
    2008-05-25 14:47 . 2008-05-25 14:47 0 --a------ C:\Windows\nsreg.dat
    2008-05-25 10:06 . 2008-05-24 23:14 <DIR> d-------- C:\Windows\Panther
    2008-05-25 10:06 . 2008-05-25 10:06 <DIR> d--hs---- C:\Boot
    2008-05-25 10:06 . 2008-01-09 01:32 443,912 -rahs---- C:\bootmgr
    2008-05-25 10:06 . 2008-05-25 10:06 8,192 -ra-s---- C:\BOOTSECT.BAK
    2008-05-25 10:05 . 2008-05-25 10:05 <DIR> d-------- C:\Windows\System32\OEM
    2008-05-25 10:05 . 2007-03-16 19:40 59 -ra------ C:\Windows\DELL_VERSION
    2008-05-25 02:13 . 2008-05-25 02:13 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
    2008-05-25 02:11 . 2008-05-25 02:11 <DIR> d-------- C:\Windows\PCHEALTH
    2008-05-25 02:05 . 2008-05-25 02:05 <DIR> d-------- C:\ProgramData\WLInstaller
    2008-05-25 02:05 . 2008-05-25 02:11 <DIR> d-------- C:\Program Files\Windows Live
    2008-05-25 02:05 . 2008-05-25 02:11 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-05-25 01:36 . 2008-05-25 01:36 <DIR> d-------- C:\Program Files\Winamp
    2008-05-25 01:33 . 2008-05-25 01:33 <DIR> d-------- C:\Windows\System32\Macromed
    2008-05-25 01:21 . 2008-05-25 02:59 1,080 --a------ C:\Windows\System32\settingsbkup.sfm
    2008-05-25 01:21 . 2008-05-25 02:59 1,080 --a------ C:\Windows\System32\settings.sfm
    2008-05-25 00:20 . 2008-05-25 00:20 <DIR> d-------- C:\Program Files\uTorrent
    2008-05-25 00:17 . 2008-05-26 08:51 <DIR> d-------- C:\Windows\System32\drivers\Avg
    2008-05-25 00:17 . 2008-05-25 00:17 <DIR> d-------- C:\ProgramData\Creative Labs
    2008-05-25 00:17 . 2008-05-25 00:17 <DIR> d-------- C:\ProgramData\avg8
    2008-05-25 00:17 . 2008-05-25 00:17 <DIR> d-------- C:\Program Files\AVG
    2008-05-25 00:17 . 2008-05-25 00:17 96,520 --a------ C:\Windows\System32\drivers\avgldx86.sys
    2008-05-25 00:17 . 2008-05-25 00:17 67,080 --a------ C:\Windows\System32\drivers\avgwfpx.sys
    2008-05-25 00:17 . 2008-05-25 00:17 10,520 --a------ C:\Windows\System32\avgrsstx.dll
    2008-05-25 00:03 . 2008-05-25 00:03 <DIR> d-------- C:\ProgramData\ATI
    2008-05-25 00:00 . 2008-05-25 00:00 0 --a------ C:\Windows\ativpsrm.bin
    2008-05-24 23:59 . 2008-05-25 02:59 55,300 --a------ C:\Windows\System32\BMXStateBkp-{00000001-00000000-00000001-00001102-00000005-00311102}.rfx
    2008-05-24 23:59 . 2008-05-25 02:59 55,300 --a------ C:\Windows\System32\BMXState-{00000001-00000000-00000001-00001102-00000005-00311102}.rfx
    2008-05-24 23:59 . 2008-05-25 02:59 788 --a------ C:\Windows\System32\DVCState-{00000001-00000000-00000001-00001102-00000005-00311102}.rfx
    2008-05-24 23:54 . 2008-05-24 23:54 944,184 --a------ C:\Windows\System32\winload.exe
    2008-05-24 23:54 . 2008-05-24 23:54 620,088 --a------ C:\Windows\System32\ci.dll
    2008-05-24 23:54 . 2008-05-24 23:54 371,712 --a------ C:\Windows\System32\srcore.dll
    2008-05-24 23:54 . 2008-05-24 23:54 313,856 --a------ C:\Windows\System32\rstrui.exe
    2008-05-24 23:54 . 2008-05-24 23:54 40,960 --a------ C:\Windows\System32\srclient.dll
    2008-05-24 23:54 . 2008-05-24 23:54 19,000 --a------ C:\Windows\System32\kd1394.dll
    2008-05-24 23:54 . 2008-05-24 23:54 16,384 --a------ C:\Windows\System32\srdelayed.exe
    2008-05-24 23:54 . 2008-05-24 23:54 7,168 --a------ C:\Windows\System32\f3ahvoas.dll
    2008-05-24 23:54 . 2008-05-24 23:54 6,656 --a------ C:\Windows\System32\kbd106n.dll
    2008-05-24 23:53 . 2008-05-24 23:53 2,027,008 --a------ C:\Windows\System32\win32k.sys
    2008-05-24 23:53 . 2008-05-24 23:53 296,448 --a------ C:\Windows\System32\gdi32.dll
    2008-05-24 23:53 . 2008-05-24 23:53 83,968 --a------ C:\Windows\System32\dnsrslvr.dll
    2008-05-24 23:53 . 2008-05-24 23:53 53,760 --a------ C:\Windows\System32\drivers\hdaudbus.sys
    2008-05-24 23:53 . 2008-05-24 23:53 24,576 --a------ C:\Windows\System32\dnscacheugc.exe
    2008-05-24 23:37 . 2008-05-24 23:37 <DIR> d-------- C:\Program Files\OpenAL
    2008-05-24 23:37 . 2008-05-24 23:37 413,696 --a------ C:\Windows\System32\wrap_oal.dll
    2008-05-24 23:37 . 2008-05-24 23:37 110,592 --a------ C:\Windows\System32\OpenAL32.dll
    2008-05-24 23:37 . 2007-02-26 15:24 94,208 --a------ C:\Windows\System32\cttele32.dll
    2008-05-24 23:35 . 2008-05-24 23:37 <DIR> d-------- C:\Windows\System32\Data
    2008-05-24 23:35 . 2007-08-28 10:22 108,544 --a------ C:\Windows\System32\APOMngr.DLL
    2008-05-24 23:35 . 2007-05-28 11:28 69,120 --a------ C:\Windows\System32\CmdRtr.DLL
    2008-05-24 23:35 . 2008-02-20 20:59 11,776 --a------ C:\Windows\INRES.DLL
    2008-05-24 23:35 . 2008-02-20 20:58 10,240 --a------ C:\Windows\CTDCRES.DLL
    2008-05-24 23:35 . 2008-02-20 20:58 3,072 --a------ C:\Windows\CTXFIRES.DLL
    2008-05-24 23:35 . 2008-05-24 23:35 87 -rah----- C:\Windows\ctfile.rfc
    2008-05-24 23:34 . 2008-05-25 00:18 <DIR> d-------- C:\ProgramData\Creative
    2008-05-24 23:33 . 2008-05-24 23:38 <DIR> d-------- C:\Program Files\Creative
    2008-05-24 23:33 . 2008-05-24 23:33 <DIR> d-------- C:\Program Files\Common Files\Creative Labs Shared
    2008-05-24 23:33 . 2000-05-22 16:58 647,872 --------- C:\Windows\System32\Mscomct2.ocx
    2008-05-24 23:33 . 2006-10-06 14:17 53,248 --------- C:\Windows\Ctregrun.exe
    2008-05-24 23:32 . 2008-05-25 21:31 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
    2008-05-24 23:31 . 2008-05-25 21:38 <DIR> d--hs---- C:\Windows\Installer
    2008-05-24 23:31 . 2008-05-24 23:31 <DIR> d-------- C:\Program Files\Common Files\InstallShield
    2008-05-24 23:31 . 2008-05-24 23:35 <DIR> d-------- C:\Program Files\ATI Technologies
    2008-05-24 23:30 . 2008-05-25 00:15 <DIR> d-------- C:\Program Files\ATI
    2008-05-24 23:30 . 2008-05-24 23:30 <DIR> d-------- C:\ATI
    2008-05-24 23:23 . 2006-11-02 13:23 <DIR> dr------- C:\Users\inky`\Videos
    2008-05-24 23:23 . 2006-11-02 13:23 <DIR> d-------- C:\Users\inky`\Saved Games
    2008-05-24 23:23 . 2006-11-02 13:23 <DIR> dr------- C:\Users\inky`\Pictures
    2008-05-24 23:23 . 2006-11-02 13:23 <DIR> dr------- C:\Users\inky`\Music
    2008-05-24 23:23 . 2006-11-02 13:23 <DIR> dr------- C:\Users\inky`\Links
    2008-05-24 23:23 . 2008-05-25 02:14 <DIR> dr------- C:\Users\inky`\Downloads
    2008-05-24 23:23 . 2008-05-25 02:12 <DIR> dr------- C:\Users\inky`\Documents
    2008-05-24 23:23 . 2008-05-25 20:19 <DIR> dr------- C:\Users\inky`\Contacts
    2008-05-24 23:23 . 2008-05-24 23:26 <DIR> d--h----- C:\Users\inky`\AppData
    2008-05-24 23:23 . 2008-05-25 02:12 <DIR> d-------- C:\Users\inky`
    2008-05-24 23:23 . 2007-03-17 14:41 171,136 -rahs---- C:\grldr
    2008-05-24 23:22 . 2008-05-24 23:22 1,712,984 --a------ C:\Windows\System32\wuaueng.dll
    2008-05-24 23:22 . 2008-05-24 23:22 1,524,224 --a------ C:\Windows\System32\wucltux.dll
    2008-05-24 23:22 . 2008-05-24 23:22 53,080 --a------ C:\Windows\System32\wuauclt.exe
    2008-05-24 23:22 . 2008-05-24 23:22 43,352 --a------ C:\Windows\System32\wups2.dll
    2008-05-24 23:21 . 2008-05-24 23:21 549,720 --a------ C:\Windows\System32\wuapi.dll
    2008-05-24 23:21 . 2008-05-24 23:21 80,896 --a------ C:\Windows\System32\wudriver.dll
    2008-05-24 23:21 . 2008-05-24 23:21 33,624 --a------ C:\Windows\System32\wups.dll
    2008-05-24 23:20 . 2008-05-24 23:20 163,000 --a------ C:\Windows\System32\wuwebv.dll
    2008-05-24 23:20 . 2008-05-24 23:20 31,232 --a------ C:\Windows\System32\wuapp.exe
    2008-05-24 23:19 . 2008-05-24 23:19 <DIR> dr------- C:\Windows\System32\config\systemprofile\Contacts
    2008-05-24 23:09 . 2008-05-24 23:40 <DIR> d-------- C:\Windows\Debug
    2008-05-12 19:30 . 2008-05-12 19:30 3,592,704 --a------ C:\Windows\System32\drivers\atikmdag.sys
    2008-05-12 18:56 . 2008-05-12 18:56 397,312 --a------ C:\Windows\System32\ATIDEMGX.dll
    2008-05-12 18:55 . 2008-05-12 18:55 327,680 --a------ C:\Windows\System32\atipdlxx.dll
    2008-05-12 18:55 . 2008-05-12 18:55 266,240 --a------ C:\Windows\System32\Ati2evxx.dll
    2008-05-12 18:55 . 2008-05-12 18:55 262,144 --a------ C:\Windows\System32\Oemdspif.dll
    2008-05-12 18:55 . 2008-05-12 18:55 159,744 --a------ C:\Windows\System32\atitmmxx.dll
    2008-05-12 18:55 . 2008-05-12 18:55 43,520 --a------ C:\Windows\System32\ati2edxx.dll
    2008-05-12 18:53 . 2008-05-12 18:53 675,840 --a------ C:\Windows\System32\Ati2evxx.exe
    2008-05-12 18:40 . 2008-05-12 18:40 3,101,184 --a------ C:\Windows\System32\atiumdag.dll
    2008-05-12 18:26 . 2008-05-12 18:26 9,994,240 --a------ C:\Windows\System32\atioglxx.dll
    2008-05-12 18:23 . 2008-05-12 18:23 4,291,584 --a------ C:\Windows\System32\atiumdva.dll
    2008-05-12 18:23 . 2008-05-12 18:23 3,107,788 --a------ C:\Windows\System32\atiumdva.dat
    2008-05-12 18:11 . 2008-05-12 18:11 48,640 --a------ C:\Windows\System32\amdpcom32.dll
    2008-05-12 18:11 . 2008-05-12 18:11 19,968 --a------ C:\Windows\System32\atiadlxx.dll
    2008-05-12 17:56 . 2008-05-12 17:56 49,152 --a------ C:\Windows\System32\drivers\ati2erec.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-24 20:59 --------- d-----w C:\Program Files\Windows Mail
    2008-05-24 20:51 826,368 ----a-w C:\Windows\System32\wininet.dll
    2008-05-24 20:51 56,320 ----a-w C:\Windows\System32\iesetup.dll
    2008-05-24 20:51 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
    2008-05-24 20:51 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
    2008-05-24 20:12 174 --sha-w C:\Program Files\desktop.ini
    2008-04-01 22:28 2,102,272 ----a-w C:\Windows\System32\x264vfw.dll
    2008-03-31 21:25 682,496 ----a-w C:\Windows\System32\divx.dll
    2008-03-28 17:41 7,680 ----a-w C:\Windows\System32\ff_vfw.dll
    2008-03-21 20:30 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
    2008-03-21 20:28 81,920 ----a-w C:\Windows\System32\dpl100.dll
    2008-03-06 00:38 90,112 ----a-w C:\Windows\System32\atibrtmon.exe
    .

    ------- Sigcheck -------

    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 15:32 2159104 C:\Windows\System32\oobefldr.dll]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
    "CTHelper"="CTHELPER.EXE" [2008-02-20 20:58 19456 C:\Windows\System32\CTHELPER.EXE]
    "CTxfiHlp"="CTXFIHLP.EXE" [2008-02-20 20:58 19968 C:\Windows\System32\CTXFIHLP.EXE]
    "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-05-25 00:17 1177368]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.l3fhg"= mp3fhg.acm
    "msacm.divxa32"= divxa32.acm
    "VIDC.X264"= x264vfw.dll
    "VIDC.HFYU"= huffyuv.dll
    "vidc.i263"= i263_32.drv
    "VIDC.YV12"= yv12vfw.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{7A836FAB-E509-4E58-A926-CF0E4AF45733}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe
    "{06C41711-FC5B-4AED-837A-59361AFD16B0}"= C:\Program Files\AVG\AVG8\avgemc.exe:avgemc.exe
    "TCP Query User{C5090224-566D-454A-BA49-73373E17C2F8}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
    "UDP Query User{68984D55-C2E7-4104-AD73-CF81F667FF9F}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
    "TCP Query User{6096F784-CA90-4A6E-8A30-6CD846646448}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
    "UDP Query User{06CB24B4-E039-4220-BD1A-60AFA82FCFBD}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
    "TCP Query User{AB9CECE8-DA8F-44D6-A096-3798197ABD20}C:\\users\\inky`\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\ucl3l6rj\\installer-70353-849fi-mirc[1].exe"= UDP:C:\users\inky`\appdata\local\microsoft\windows\temporary internet files\content.ie5\ucl3l6rj\installer-70353-849fi-mirc[1].exe:installer-70353-849fi-mirc[1].exe
    "UDP Query User{D5AD5A00-9C6F-4094-B01B-2C7A9C253EB8}C:\\users\\inky`\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\ucl3l6rj\\installer-70353-849fi-mirc[1].exe"= TCP:C:\users\inky`\appdata\local\microsoft\windows\temporary internet files\content.ie5\ucl3l6rj\installer-70353-849fi-mirc[1].exe:installer-70353-849fi-mirc[1].exe
    "{0141360B-2E24-4DCC-88E2-7FC9475D33CF}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
    "TCP Query User{7E7F271A-CC4C-4C8D-B23D-3CDBC56B11D0}D:\\softat\\mirc\\mirc.exe"= UDP:D:\softat\mirc\mirc.exe:mIRC
    "UDP Query User{A5912C22-560E-48B0-8890-9A214F31891C}D:\\softat\\mirc\\mirc.exe"= TCP:D:\softat\mirc\mirc.exe:mIRC
    "TCP Query User{185FE238-7B11-4DC1-A619-B601E97839CC}D:\\softat\\mozilla firefox\\firefox.exe"= UDP:D:\softat\mozilla firefox\firefox.exe:Firefox
    "UDP Query User{FF410F6F-2B36-4894-82E8-F403178F8CBE}D:\\softat\\mozilla firefox\\firefox.exe"= TCP:D:\softat\mozilla firefox\firefox.exe:Firefox
    "TCP Query User{7E8A7E30-C705-4ADD-B6A4-C0A15CC07440}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
    "UDP Query User{B7F96841-DF10-4B7C-A53D-48DEEECBC7A7}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

    R1 AvgLdx86;AVG AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-05-25 00:17]
    R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-05-25 00:17]
    R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-05-25 00:17]
    R2 CTAudSvcService;Creative Audio Service;C:\Program Files\Creative\Shared Files\CTAudSvc.exe [2008-03-07 19:24]
    R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-05-12 19:30]
    R3 AvgWfpX;AVG8 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfpx.sys [2008-05-25 00:17]
    R3 ha20x2k;Creative 20X HAL Driver;C:\Windows\system32\drivers\ha20x2k.sys [2008-02-25 09:44]
    R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 10:30]
    S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;"C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe" [2008-05-24 23:33]

    *Newly Created Service* - CATCHME
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-26 14:30:02
    Windows 6.0.6000 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    C:\Windows\TEMP\66c3cbc9-3c8e-49f1-a108-9712dfacd617.tmp 0 bytes


    **************************************************************************
    .
    Completion time: 2008-05-26 14:32:03
    ComboFix-quarantined-files.txt 2008-05-26 11:30:58

    Pre-Run: 96,904,327,168 bytes free
    Post-Run: 97,105,690,624 bytes free

    Malwarebytes ajaa läpi tällä hetkellä.. tulee logi hetken kuluttua..

    203 --- E O F --- 2008-05-24 23:59:00
     
    inky89, May 26, 2008
    #3
  4. inky89

    inky89 Member

    Joined:
    May 26, 2008
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    11
    Malwarebytes' Anti-Malware 1.12
    Tietokantaversio: 788

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
    Tarkistetut kohteet: 93194
    Kulunut aika: 14 minute(s), 21 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)
     
    inky89, May 26, 2008
    #4
  5. Hujo

    Hujo Guest

    Lataa Atribunen ATF Cleaner

    Ohjeet;

    Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.Main:n alla valitse: Select All
    Klikkaa Empty Selected valintaa.
    Jos käytät FireFoxia selaimenasi Klikkaa Firefox yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
    Jos käytät Operaa selaimenasiKlikkaa Opera yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa taas.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
    Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
    Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)
     
    Hujo, May 26, 2008
    #5
  6. roope77

    roope77 Guest

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:21:30, on 27.5.2080
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMB32.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FCH32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FAMEH32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsqh.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsaua.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fssm32.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsus.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\WINDOWS\system32\LVCOMSX.EXE
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Elisa\Avustaja\Elisa.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\fsguidll.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    D:\Reader\Reader_sl.exe
    D:\roope\steam.exe
    C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsav32.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [Elisa Avustaja] "C:\Program Files\Elisa\Avustaja\Elisa.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [DVMedia] E:\\Resource\AutoRerun.exe E:\
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Microsoft Update] livemessenger.com
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Steam] "d:\roope\steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-21-2025429265-725345543-1834134010-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Omistaja')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?97d0bd91d64c48ffa2da8ee0fe11d307
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?97d0bd91d64c48ffa2da8ee0fe11d307
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\Office\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - D:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - D:\Titan Poker\casino.exe
    O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - D:\Titan Poker\casino.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Office\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://D:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/flashax.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O21 - SSODL: printers - {6E56B36C-6B29-490A-B545-DE4463D583A4} - libwinets.dll (file missing)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    --
    End of file - 10813 bytes
     
    roope77, May 27, 2008
    #6
  7. Hujo

    Hujo Guest

    Lataa SmitfraudFix (c) S!Ri
    Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

    Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita ponnahtava rapport – muistion sisältö viestiketjuusi.
    Löytyy myös C:\rapport.txt

    Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
    (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
    A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
    silloin ne saattavat varoittaa käyttäjää.

    ================

    Lataa MsnCleaner.zip

    "Pura tiedosto työpöydälle, älä käytä sitä vielä.
    "Käynnistä kone Vikasietotilaan
    "Tuplaklikkaa MsnCleaner.exe
    "Paina Analyze nappia.
    "Jos löytyy tartuntoja, paina Deleted nappia.
    "Käynnistä kone normaalisti ja lähetä C:\MsnCleaner.txt raportti viestiketjuusi.
     
    Last edited by a moderator: May 27, 2008
    Hujo, May 27, 2008
    #7

Share This Page