HJT-loki tarkastettavaksi

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by aaffyli, May 4, 2008.

  1. aaffyli

    aaffyli Member

    Joined:
    May 13, 2007
    Messages:
    44
    Likes Received:
    0
    Trophy Points:
    16
    Palomuuri kaatuilee aina tietyin väliajoin. Löytyykö tästä mitään syytä sille?

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:22:30, on 4.5.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\RunDll32.exe
    C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
    C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\RivaTuner v2.07\RivaTuner.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\STINGE~1\wh_exec.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    E:\pelit\steam\steam.exe
    C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
    C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
    C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
    C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system\Cm106eye.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Ventrilo\Ventrilo.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [CM106Sound] RunDll32 CM106.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
    O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.07\RivaTuner.exe" /S
    O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.07\RivaTuner.exe" /T
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [WheelMouse] C:\STINGE~1\wh_exec.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Steam] "e:\pelit\steam\steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

    --
    End of file - 5862 bytes
     
    aaffyli, May 4, 2008
    #1
  2. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    ===========

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Hujo, May 5, 2008
    #2
  3. aaffyli

    aaffyli Member

    Joined:
    May 13, 2007
    Messages:
    44
    Likes Received:
    0
    Trophy Points:
    16
    ComboFix 08-05-01.3 - Omistaja 2008-05-05 14:10:57.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.2522 [GMT 3:00]
    Running from: D:\Lataukset\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-05 to 2008-05-05 )))))))))))))))))
    .

    2008-04-26 23:14 . 2008-04-26 23:14 <KANSIO> d-------- C:\Program Files\Astonsoft
    2008-04-26 23:14 . 2008-04-27 01:23 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\DeepBurner
    2008-04-26 23:08 . 2008-04-26 23:08 <KANSIO> d-------- C:\Program Files\Ahead
    2008-04-23 13:39 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
    2008-04-23 13:38 . 2008-04-23 13:38 <KANSIO> d-------- C:\WINDOWS\system32\ageia
    2008-04-23 13:38 . 2008-04-23 13:38 <KANSIO> d-------- C:\Program Files\AGEIA Technologies
    2008-04-21 12:41 . 2008-04-21 12:41 <KANSIO> d-------- C:\Program Files\Panda Security
    2008-04-21 12:41 . 2008-04-21 12:41 1,859 --a------ C:\WINDOWS\mozver.dat
    2008-04-20 21:00 . 2008-04-26 17:04 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\skypePM
    2008-04-20 21:00 . 2008-04-20 21:00 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
    2008-04-20 20:57 . 2008-04-26 17:18 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Skype
    2008-04-20 20:56 . 2008-04-20 20:56 <KANSIO> d-------- C:\Program Files\Skype
    2008-04-20 20:56 . 2008-04-20 20:56 <KANSIO> d-------- C:\Program Files\Common Files\Skype
    2008-04-20 20:56 . 2008-04-20 20:56 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Skype
    2008-04-20 11:34 . 2008-04-20 11:34 <KANSIO> d-------- C:\Program Files\Innovative Solutions
    2008-04-19 15:37 . 2008-04-19 15:37 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\DAEMON Tools
    2008-04-19 15:37 . 2008-04-19 15:37 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
    2008-04-17 14:45 . 2008-04-17 14:45 <KANSIO> d---s---- C:\Documents and Settings\Omistaja\UserData
    2008-04-13 18:28 . 2008-04-13 18:28 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Grisoft
    2008-04-13 18:28 . 2008-04-13 18:28 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-04-13 18:28 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-04-12 19:27 . 2008-04-12 19:27 <KANSIO> d-------- C:\Program Files\Cyber Snipa Stinger Mouse
    2008-04-11 16:48 . 2008-04-11 20:06 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Microsoft Games
    2008-04-11 13:49 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
    2008-04-11 13:49 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
    2008-04-11 13:49 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
    2008-04-11 13:49 . 2007-03-12 16:42 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll
    2008-04-11 13:49 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
    2008-04-11 13:49 . 2007-03-15 16:57 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll
    2008-04-11 13:49 . 2006-09-28 16:05 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
    2008-04-11 13:49 . 2007-04-04 18:53 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll
    2008-04-11 13:49 . 2006-09-28 16:03 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
    2008-04-11 12:57 . 2008-04-12 19:30 <KANSIO> d-------- C:\Stinger Mouse Driver
    2008-04-07 18:18 . 2008-05-05 14:07 <KANSIO> d-------- C:\Program Files\Mozilla Thunderbird
    2008-04-07 18:18 . 2008-04-07 18:18 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Thunderbird
    2008-04-05 16:10 . 2008-04-05 16:14 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Winamp

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-05 10:44 --------- d-----w C:\Program Files\SpeedFan
    2008-05-05 10:09 69,960 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
    2008-05-02 19:03 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-05-02 19:03 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    2008-05-01 08:57 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\dvdcss
    2008-04-23 20:22 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-04-23 13:25 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\OpenOffice.org2
    2008-04-23 10:25 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-04-19 14:26 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-04-05 13:10 --------- d-----w C:\Program Files\Winamp
    2008-04-03 17:15 --------- d-----w C:\Program Files\Trend Micro
    2008-04-01 12:14 --------- d--h--w C:\Program Files\CanonBJ
    2008-04-01 12:14 --------- d--h--w C:\Documents and Settings\All Users\Application Data\CanonBJ
    2008-03-30 20:47 --------- d-----w C:\Program Files\eRightSoft
    2008-03-30 20:47 --------- d-----w C:\Program Files\AviSynth 2.5
    2008-03-26 20:32 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
    2008-03-26 10:03 --------- d-----w C:\Program Files\Audacity
    2008-03-26 07:04 --------- d-----w C:\Program Files\Java
    2008-03-26 07:03 --------- d-----w C:\Program Files\Common Files\Java
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-17 16:52 --------- d-----w C:\Program Files\Fraps
    2008-03-17 10:35 --------- d-----w C:\Program Files\ATITool
    2008-03-17 10:06 --------- d-----w C:\Program Files\EvilLyrics
    2008-03-13 13:22 --------- d-----w C:\Program Files\CD-DA X-Tractor
    2008-03-12 22:13 --------- d-----w C:\Program Files\Foxit Software
    2008-03-09 22:06 --------- d-----w C:\Program Files\OpenOffice.org 2.3
    2008-03-08 23:32 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-03-08 23:26 2,278,400 ----a-w C:\WINDOWS\system32\TUKernel.exe
    2008-03-08 23:24 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\TuneUp Software
    2008-03-08 23:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
    2008-03-08 23:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-03-08 23:12 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-03-08 23:08 --------- d-----w C:\Program Files\Samurize
    2008-03-08 21:42 --------- d-----w C:\Program Files\A4Tech
    2008-03-08 20:22 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
    2008-03-08 19:45 98,304 ----a-w C:\WINDOWS\system32CmdLineExt.dll
    2008-03-08 19:06 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\vlc
    2008-03-08 16:02 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Talkback
    2008-03-08 16:01 --------- d-----w C:\Program Files\Mozilla Firefox 3 Beta 3
    2008-03-08 13:31 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
    2008-03-08 13:31 262,144 ----a-w C:\WINDOWS\system32\wrap_oal.dll
    2008-03-08 10:36 22,328 ----a-w C:\Documents and Settings\Omistaja\Application Data\PnkBstrK.sys
    2008-03-08 09:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
    2008-03-08 08:42 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Ventrilo
    2008-03-08 03:10 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
    2008-03-08 03:10 --------- d-----w C:\Program Files\Windows Live
    2008-03-08 02:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-03-08 02:35 --------- d-----w C:\Program Files\Logitech
    2008-03-08 02:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
    2008-03-08 02:33 --------- d-----w C:\Program Files\IrfanView
    2008-03-08 02:12 --------- d-----w C:\Program Files\Sharkoon Majestic 5.1 USB
    2008-03-08 02:05 --------- d-----w C:\Program Files\IZArc
    2008-03-08 02:00 --------- d-----w C:\Program Files\RivaTuner v2.07
    2008-03-08 01:49 --------- d-----w C:\Program Files\VideoLAN
    2008-03-08 01:45 --------- d-----w C:\Program Files\Ventrilo
    2008-03-08 01:23 --------- d-----w C:\Program Files\Alwil Software
    2008-03-08 00:15 --------- d-----w C:\Program Files\U-ABIT
    2008-03-08 00:14 --------- d-----w C:\Program Files\DIFX
    2008-03-08 00:14 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\InstallShield
    2008-03-08 00:12 463,524 ----a-w C:\m630a15.zip
    2008-03-08 00:06 --------- d-----w C:\Program Files\Sunbelt Software
    2008-03-07 23:44 --------- d-----w C:\Program Files\Intel
    2008-03-07 23:42 315,392 ----a-w C:\WINDOWS\HideWin.exe
    2008-03-07 23:42 --------- d-----w C:\Program Files\Realtek
    2008-03-07 23:41 --------- d-----w C:\Program Files\Marvell
    2008-03-07 23:26 --------- d-----w C:\Program Files\microsoft frontpage
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
    2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
    2008-02-16 09:02 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-02-07 13:15 408,576 ----a-w C:\WINDOWS\system32\Smab.dll
    2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
    2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
    2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
    "Steam"="e:\pelit\steam\steam.exe" [2008-03-28 09:04 1271032]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SkyTel"="SkyTel.EXE" [2006-05-16 13:04 2879488 C:\WINDOWS\SkyTel.exe]
    "RTHDCPL"="RTHDCPL.EXE" [2007-01-30 13:54 16116224 C:\WINDOWS\RTHDCPL.exe]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 20:37 79224]
    "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2007-12-05 02:41 8523776]
    "nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]
    "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2007-12-05 02:41 81920]
    "CM106Sound"="CM106.cpl" []
    "Launch LCDMon"="C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-12-13 18:43 2051096]
    "Launch LGDCore"="C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-12-13 18:57 2095640]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 21:49 36352]
    "RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.07\RivaTuner.exe" [2008-03-02 20:20 2686976]
    "RivaTuner"="C:\Program Files\RivaTuner v2.07\RivaTuner.exe" [2008-03-02 20:20 2686976]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
    "WheelMouse"="C:\STINGE~1\wh_exec.exe" [2007-11-10 22:08 98304]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 02:12 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.I420"= i420vfw.dll
    "vidc.yv12"= yv12vfw.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "E:\\Pelit\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe"=
    "E:\\Pelit\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe"=
    "E:\\Pelit\\Flagship Studios\\Hellgate London\\Launcher.exe"=
    "E:\\Pelit\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
    "E:\\Pelit\\Steam\\steamapps\\aaffyli@sunpoint.net\\counter-strike\\hl.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 20:31]
    R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 11:21]
    R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 11:21]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 20:35]
    R2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 11:21]
    R3 CM1063264;C-Media CM106 Like Sound UDAX Interface;C:\WINDOWS\system32\drivers\CM106.sys [2007-02-02 15:29]
    R3 whfltr2k;WheelMouse USB Lower Filter Driver;C:\WINDOWS\system32\DRIVERS\whfltr2k.sys [2007-01-26 02:45]
    S0 uGuru;uGuru;C:\WINDOWS\system32\Drivers\uGuru.sys []
    S3 Memctl;Memctl;C:\Program Files\U-ABIT\FlashMenu\Memctl.sys [2006-04-18 15:53]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbb9a53c-0e13-11dd-a555-00508db506ab}]
    \Shell\AutoRun\command - H:\Setup.exe

    *Newly Created Service* - CATCHME
    .
    **************************************************************************

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-05 14:14:01
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    C:\Documents and Settings\Omistaja\Local Settings\Application Data\Microsoft\Messenger\aaffyli@gmail.com\SharingMetadata\Working\database_7C84_31C5_8431_82A6\$db_clean$ 0 bytes

    scan completed successfully
    hidden files: 34

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\explorer.exe
    -> C:\STINGE~1\wh_hook.dll
    .
    Completion time: 2008-05-05 14:15:14
    ComboFix-quarantined-files.txt 2008-05-05 11:15:10

    Pre-Run: 65,155,366,912 tavua vapaana
    Post-Run: 65,213,104,128 tavua vapaana

    196 --- E O F --- 2008-04-09 12:54:47
     
    aaffyli, May 5, 2008
    #3
  4. aaffyli

    aaffyli Member

    Joined:
    May 13, 2007
    Messages:
    44
    Likes Received:
    0
    Trophy Points:
    16
    SDFix: Version 1.179
    Run by Omistaja on ma 05.05.2008 at 14:31

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\DOCUME~1\Omistaja\TYPYT~1\SDFix

    Checking Services :


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-05 14:58:07
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    IPC error: 2 Määritettyä tiedostoa ei löydy.
    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s1"=dword:2df9c43f
    "s2"=dword:110480d0
    "h0"=dword:00000001

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "h0"=dword:00000000
    "khjeh"=hex:d1,de,19,77,96,f0,7e,ee,78,61,51,cb,aa,53,ad,2a,a6,81,25,d0,84,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "h0"=dword:00000000
    "khjeh"=hex:d1,de,19,77,96,f0,7e,ee,78,61,51,cb,aa,53,ad,2a,a6,81,25,d0,84,..

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
    "TracesProcessed"=dword:00000070
    "TracesSuccessful"=dword:00000004

    scanning hidden files ...


    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 33


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:pnkBstrA"
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:pnkBstrB"
    "E:\\Pelit\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe"="E:\\Pelit\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe:*:Enabled:etqwded.exe"
    "E:\\Pelit\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe"="E:\\Pelit\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe:*:Enabled:Enemy Territory - QUAKE Wars(TM) "
    "E:\\Pelit\\Flagship Studios\\Hellgate London\\Launcher.exe"="E:\\Pelit\\Flagship Studios\\Hellgate London\\Launcher.exe:*:Enabled:Hellgate: London"
    "E:\\Pelit\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"="E:\\Pelit\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe:*:Enabled:Gears of War"
    "E:\\Pelit\\Steam\\steamapps\\aaffyli@sunpoint.net\\counter-strike\\hl.exe"="E:\\Pelit\\Steam\\steamapps\\aaffyli@sunpoint.net\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    Remaining Files :


    File Backups: - C:\DOCUME~1\Omistaja\TYPYT~1\SDFix\backups\backups.zip

    Files with Hidden Attributes :

    Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
    Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
    Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
    Wed 3 May 2006 163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
    Wed 21 Feb 2007 31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
    Mon 17 Dec 2007 27,648 ..SH. --- "C:\WINDOWS\system32\Smab0.dll"
    Sun 26 Jun 2005 616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
    Wed 22 Jun 2005 45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
    Fri 14 Mar 2008 13,824 A.SHR --- "C:\Program Files\eRightSoft\SUPER\DXdump.exe"
    Sun 23 Mar 2008 72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
    Tue 2 Oct 2007 16,384 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
    Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
    Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
    Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
    Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
    Sun 9 Jun 2002 36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
    Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
    Tue 10 Dec 2002 102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
    Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
    Tue 10 Dec 2002 208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
    Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
    Sun 9 Jun 2002 40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
    Sun 4 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
    Tue 10 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
    Fri 20 Feb 2004 232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll"
    Sun 9 Jun 2002 525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll"
    Tue 10 Dec 2002 245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll"
    Tue 10 Dec 2002 45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll"
    Tue 10 Dec 2002 98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll"
    Tue 10 Dec 2002 94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll"
    Tue 10 Dec 2002 90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll"
    Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
    Sun 9 Jun 2002 49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll"
    Thu 20 Mar 2008 5,632 ..SHR --- "C:\Program Files\eRightSoft\SUPER\spk\1stRun.exe"
    Sat 8 Mar 2008 2,599,664 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\870c95332c9b60b05a7d2b36b49b0d75\BITD.tmp"

    Finished!
     
    aaffyli, May 5, 2008
    #4
  5. aaffyli

    aaffyli Member

    Joined:
    May 13, 2007
    Messages:
    44
    Likes Received:
    0
    Trophy Points:
    16
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:04:14, on 5.5.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\RunDll32.exe
    C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
    C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
    C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
    C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
    C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
    C:\Program Files\RivaTuner v2.07\RivaTuner.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\STINGE~1\wh_exec.exe
    C:\WINDOWS\system\Cm106eye.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    E:\pelit\steam\steam.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [CM106Sound] RunDll32 CM106.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
    O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.07\RivaTuner.exe" /S
    O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.07\RivaTuner.exe" /T
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [WheelMouse] C:\STINGE~1\wh_exec.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Steam] "e:\pelit\steam\steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

    --
    End of file - 6054 bytes
     
    aaffyli, May 5, 2008
    #5
  6. Hujo

    Hujo Guest

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
     
    Hujo, May 5, 2008
    #6
  7. aaffyli

    aaffyli Member

    Joined:
    May 13, 2007
    Messages:
    44
    Likes Received:
    0
    Trophy Points:
    16
    Malwarebytes' Anti-Malware 1.11
    Tietokantaversio: 720

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|)
    Tarkistetut kohteet: 113917
    Kulunut aika: 58 minute(s), 31 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)
     
    aaffyli, May 5, 2008
    #7
  8. Hujo

    Hujo Guest

    Hujo, May 5, 2008
    #8
  9. aaffyli

    aaffyli Member

    Joined:
    May 13, 2007
    Messages:
    44
    Likes Received:
    0
    Trophy Points:
    16
    ei löytynyt tuollakaan ohjelmalla mitään
     
    aaffyli, May 8, 2008
    #9
  10. Hujo

    Hujo Guest

    vieläkö menee nurin
     
    Last edited by a moderator: May 8, 2008
    Hujo, May 8, 2008
    #10
  11. aaffyli

    aaffyli Member

    Joined:
    May 13, 2007
    Messages:
    44
    Likes Received:
    0
    Trophy Points:
    16
    Juu, vielhän se kaatuilee.
    Pitäis varmaankii vaihtaa muuria.
     
    aaffyli, May 8, 2008
    #11
  12. Hujo

    Hujo Guest

    juu vaiha muuri
     
    Hujo, May 8, 2008
    #12

Share This Page