HJT loki tarkistettavaksi

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Samiv93, Jul 16, 2007.

  1. Samiv93

    Samiv93 Regular member

    Joined:
    Jun 14, 2006
    Messages:
    252
    Likes Received:
    0
    Trophy Points:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:34:28, on 16.7.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    D:\Ohjelmat\Avast\aswUpdSv.exe
    D:\Ohjelmat\Avast\ashServ.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    D:\Ohjelmat\Winamp\winampa.exe
    D:\Ohjelmat\DAEMON Tools\daemon.exe
    C:\WINDOWS\system32\spoolsv.exe
    D:\Ohjelmat\ZoneAlarm\zlclient.exe
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    D:\Ohjelmat\Lokitech\iTouch.exe
    C:\Program Files\Desktop Messenger\8876480\Program\backWeb-8876480.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    D:\Ohjelmat\Lokitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    D:\Ohjelmat\Avast\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    D:\Imutukset\BitComet\BitComet.exe
    D:\Ohjelmat\Lokitek\SetPoint\SetPoint.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
    D:\Ohjelmat\Avast\ashMaiSv.exe
    D:\Ohjelmat\Avast\ashWebSv.exe
    D:\Ohjelmat\Ad-Aware\aawservice.exe
    D:\Ohjelmat\Ad-Aware\Ad-Aware2007.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    E:\Virus ohjelmia\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Imutukset\BitComet\tools\BitCometBHO_1.1.7.4.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
    O2 - BHO: MSVPS System - {C87D64B5-DF92-4703-90CB-B465B6982941} - C:\WINDOWS\qnxplugin.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [WinampAgent] D:\Ohjelmat\Winamp\winampa.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "D:\Ohjelmat\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Ohjelmat\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [zBrowser Launcher] D:\Ohjelmat\Lokitech\iTouch.exe
    O4 - HKLM\..\Run: [LDM] C:\Program Files\Desktop Messenger\8876480\Program\backWeb-8876480.exe
    O4 - HKLM\..\Run: [EM_EXEC] D:\Ohjelmat\Lokitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [avast!] D:\Ohjelmat\Avast\ashDisp.exe
    O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
    O4 - HKCU\..\Run: [Steam] "D:\Ohjelmat\Steam\Steam.exe" -silent
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    O4 - HKCU\..\Run: [BitComet] "D:\Imutukset\BitComet\BitComet.exe" /tray
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: .protected
    O4 - Global Startup: .protected
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: Logitech SetPoint.lnk = D:\Ohjelmat\Lokitek\SetPoint\SetPoint.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Imutukset\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Imutukset\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Imutukset\BitComet\BitComet.exe/AddAllLink.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\Imutukset\BitComet\tools\BitCometBHO_1.1.7.4.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1179512820090
    O17 - HKLM\System\CCS\Services\Tcpip\..\{21E313AD-8841-4105-8ED8-2ED4A87F0708}: NameServer = 212.50.211.242 212.50.192.226
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O21 - SSODL: msddx - {F8916469-F077-4836-8389-0156C549408D} - C:\WINDOWS\msddx.dll
    O21 - SSODL: msqnx - {44C0A7B4-34F7-4964-8386-5F08D8C9BFDF} - C:\WINDOWS\msqnx.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Ohjelmat\Ad-Aware\aawservice.exe
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Ohjelmat\Avast\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - D:\Ohjelmat\Avast\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Ohjelmat\Avast\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - D:\Ohjelmat\Avast\ashWebSv.exe
    O23 - Service: iPod-palvelu (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
    O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

    --
    End of file - 9309 bytes
     
    Samiv93, Jul 16, 2007
    #1
  2. Auttaja

    Auttaja Guest

    Lataa SmitfraudFix (by S!Ri) työpöydällesi.

    Tuplaklikkaa tiedostoa SmitfraudFix.exe

    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita tämän tekstitiedoston sisältö viestiketjuusi.

    **Jos työkalu ei käynnisty työpöydältä niin siirrä SmitfraudFix.exe suoraan järjestelmäaseman juureen (yleensä C:). Kokeile sitten käynnistää ohjelma uudestaan sieltä.

    Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.
    http://www.beyondlogic.org/consulting/processutil/processutil.htm

    ==========

    Printtaa ohjeet ulos tai tallenna nämä tekstitiedostoon.

    Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.


    Kun vikasietotilassa, tuplaklikkaa tiedostoa SmitfraudFix.exe
    Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.

    Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.

    Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".

    Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
    Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
    Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.

    ==========

    Laita molempien kohtien lokit, myös uusi HJTlogi
     
    Auttaja, Jul 16, 2007
    #2
  3. Samiv93

    Samiv93 Regular member

    Joined:
    Jun 14, 2006
    Messages:
    252
    Likes Received:
    0
    Trophy Points:
    26
    SmitFraudFix v2.204

    Scan done at 11:59:06,09, ti 17.07.2007
    Run from C:\SmitfraudFix
    OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    D:\Ohjelmat\Ad-Aware\aawservice.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\WINDOWS\system32\ctfmon.exe
    D:\Ohjelmat\Winamp\winampa.exe
    D:\Ohjelmat\DAEMON Tools\daemon.exe
    D:\Ohjelmat\ZoneAlarm\zlclient.exe
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    D:\Ohjelmat\Lokitech\iTouch.exe
    C:\Program Files\Desktop Messenger\8876480\Program\backWeb-8876480.exe
    D:\Ohjelmat\Lokitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

    C:\WINDOWS\.protected FOUND !
    C:\WINDOWS\main_uninstaller.exe FOUND !
    C:\WINDOWS\msddx.dll FOUND !
    C:\WINDOWS\msqnx.dll FOUND !
    C:\WINDOWS\privacy_danger FOUND !
    C:\WINDOWS\qnxplugin.dll FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Jari


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Jari\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu

    C:\DOCUME~1\Jari\KYNNIS~1\Ohjelmat\KYNNIS~1\.protected FOUND !
    C:\DOCUME~1\ALLUSE~1\KYNNIS~1\Ohjelmat\KYNNIS~1\.protected FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Jari\Suosikit


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop

    C:\DOCUME~1\Jari\TYPYT~1\Error Cleaner.url FOUND !
    C:\DOCUME~1\Jari\TYPYT~1\Privacy Protector.url FOUND !
    C:\DOCUME~1\Jari\TYPYT~1\Spyware?Malware Protection.url FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="file:///C:\\WINDOWS\\privacy_danger\\index.htm"
    "SubscribedURL"=""
    "FriendlyName"="Privacy Protection"

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="Nykyinen kotisivu"

    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Rustock



    »»»»»»»»»»»»»»»»»»»»»»»» DNS



    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End

     
    Samiv93, Jul 17, 2007
    #3
  4. Auttaja

    Auttaja Guest

    Juu ajappa toi optio 2 vikasiedoss (loki sit siit) ja uusi normaalitilassa otetu hjt logi nii jatkellaan,
     
    Auttaja, Jul 17, 2007
    #4
  5. Samiv93

    Samiv93 Regular member

    Joined:
    Jun 14, 2006
    Messages:
    252
    Likes Received:
    0
    Trophy Points:
    26
    SmitFraudFix v2.204

    Scan done at 12:09:13,66, ti 17.07.2007
    Run from C:\SmitfraudFix
    OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    127.0.0.1 localhost

    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

    C:\WINDOWS\.protected Deleted
    C:\WINDOWS\main_uninstaller.exe Deleted
    C:\WINDOWS\msddx.dll Deleted
    C:\WINDOWS\msqnx.dll Deleted
    C:\WINDOWS\privacy_danger\ Deleted
    C:\WINDOWS\qnxplugin.dll Deleted
    C:\DOCUME~1\Jari\KYNNIS~1\Ohjelmat\KYNNIS~1\.protected Deleted
    C:\DOCUME~1\ALLUSE~1\KYNNIS~1\Ohjelmat\KYNNIS~1\.protected Deleted
    C:\DOCUME~1\Jari\TYPYT~1\Error Cleaner.url Deleted
    C:\DOCUME~1\Jari\TYPYT~1\Privacy Protector.url Deleted
    C:\DOCUME~1\Jari\TYPYT~1\Spyware?Malware Protection.url Deleted

    »»»»»»»»»»»»»»»»»»»»»»»» DNS



    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End

     
    Samiv93, Jul 17, 2007
    #5
  6. Auttaja

    Auttaja Guest

    uusi normaalitilassa otetu hjt logi nii jatkellaan,
     
    Auttaja, Jul 17, 2007
    #6
  7. Samiv93

    Samiv93 Regular member

    Joined:
    Jun 14, 2006
    Messages:
    252
    Likes Received:
    0
    Trophy Points:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:30:18, on 17.7.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    D:\Ohjelmat\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\ctfmon.exe
    D:\Ohjelmat\Winamp\winampa.exe
    D:\Ohjelmat\DAEMON Tools\daemon.exe
    D:\Ohjelmat\ZoneAlarm\zlclient.exe
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    D:\Ohjelmat\Lokitech\iTouch.exe
    C:\Program Files\Desktop Messenger\8876480\Program\backWeb-8876480.exe
    D:\Ohjelmat\Lokitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
    D:\Imutukset\BitComet\BitComet.exe
    D:\Ohjelmat\Lokitek\SetPoint\SetPoint.exe
    C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    D:\Imutukset\DC++\DCPlusPlus.exe
    D:\Pelit\Mudi\zMUD\Zmud.exe
    D:\Pelit\Mudi\zMUD\Zmud.exe
    E:\Virus ohjelmia\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Imutukset\BitComet\tools\BitCometBHO_1.1.7.4.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
    O2 - BHO: MSVPS System - {C87D64B5-DF92-4703-90CB-B465B6982941} - C:\WINDOWS\qnxplugin.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [WinampAgent] D:\Ohjelmat\Winamp\winampa.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "D:\Ohjelmat\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Ohjelmat\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [zBrowser Launcher] D:\Ohjelmat\Lokitech\iTouch.exe
    O4 - HKLM\..\Run: [LDM] C:\Program Files\Desktop Messenger\8876480\Program\backWeb-8876480.exe
    O4 - HKLM\..\Run: [EM_EXEC] D:\Ohjelmat\Lokitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
    O4 - HKCU\..\Run: [Steam] "D:\Ohjelmat\Steam\Steam.exe" -silent
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    O4 - HKCU\..\Run: [BitComet] "D:\Imutukset\BitComet\BitComet.exe" /tray
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: Logitech SetPoint.lnk = D:\Ohjelmat\Lokitek\SetPoint\SetPoint.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Imutukset\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Imutukset\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Imutukset\BitComet\BitComet.exe/AddAllLink.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\Imutukset\BitComet\tools\BitCometBHO_1.1.7.4.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1179512820090
    O17 - HKLM\System\CCS\Services\Tcpip\..\{21E313AD-8841-4105-8ED8-2ED4A87F0708}: NameServer = 212.50.211.242 212.50.192.226
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O21 - SSODL: msddx - {F8916469-F077-4836-8389-0156C549408D} - C:\WINDOWS\msddx.dll
    O21 - SSODL: msqnx - {44C0A7B4-34F7-4964-8386-5F08D8C9BFDF} - C:\WINDOWS\msqnx.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Ohjelmat\Ad-Aware\aawservice.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: iPod-palvelu (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
    O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

    --
    End of file - 8198 bytes
     
    Samiv93, Jul 17, 2007
    #7
  8. Auttaja

    Auttaja Guest

    Missä virustorjunta koneelta? avira Antivir hyvä ilmanen siihen!

    1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
    http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
    http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. (C:\ComboFix.txt) Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Last edited by a moderator: Jul 17, 2007
    Auttaja, Jul 17, 2007
    #8
  9. Samiv93

    Samiv93 Regular member

    Joined:
    Jun 14, 2006
    Messages:
    252
    Likes Received:
    0
    Trophy Points:
    26
    virus torjunta ohjelma oli tilapäisesti poissa käytöstä.

    "Jari" - 2007-07-17 12:43:26 - ComboFix 07-07-13.8 - Service Pack 2 NTFS


    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\DOCUME~1\Jari\Suosikit.\Error Cleaner.url
    C:\DOCUME~1\Jari\Suosikit.\Privacy Protector.url
    C:\DOCUME~1\Jari\Suosikit.\Spyware&Malware Protection.url
    C:\DOCUME~1\Jari\TYPYT~1.\Error Cleaner.url
    C:\DOCUME~1\Jari\TYPYT~1.\Privacy Protector.url
    C:\DOCUME~1\Jari\TYPYT~1.\Spyware&Malware Protection.url
    C:\WINDOWS\dat.txt
    C:\WINDOWS\main_uninstaller.exe
    C:\WINDOWS\msddx.dll
    C:\WINDOWS\msqnx.dll
    C:\WINDOWS\NDNuninstall6_38.exe
    C:\WINDOWS\NDNuninstall7_48.exe
    C:\WINDOWS\privacy_danger
    C:\WINDOWS\privacy_danger\images\capt.gif
    C:\WINDOWS\privacy_danger\images\danger.jpg
    C:\WINDOWS\privacy_danger\images\down.gif
    C:\WINDOWS\privacy_danger\images\spacer.gif
    C:\WINDOWS\privacy_danger\index.htm
    C:\WINDOWS\qnxplugin.dll
    C:\WINDOWS\rs.txt
    C:\WINDOWS\system32\drivers\etc\.protected


    ((((((((((((((((((((((((( Files Created from 2007-06-17 to 2007-07-17 )))))))))))))))))))))))))))))))


    2007-07-17 12:42 51,200 --a------ C:\WINDOWS\nircmd.exe
    2007-07-16 18:12 5,537,792 --a------ C:\DOCUME~1\Jari\ntuser.dat
    2007-07-16 18:12 237,568 --a------ C:\DOCUME~1\LOCALS~1\ntuser.dat
    2007-07-16 18:12 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\AntiVir PersonalEdition Classic
    2007-07-16 13:07 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
    2007-07-14 19:40 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
    2007-07-13 12:44 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\My The Lord of the Rings, The Rise of the Witch-king Files
    2007-07-11 19:15 5,504 --------- C:\WINDOWS\system32\drivers\imagedrv.sys
    2007-07-11 19:15 125,184 --------- C:\WINDOWS\system32\drivers\imagesrv.sys
    2007-07-11 19:15 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
    2007-07-11 19:14 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
    2007-07-11 19:14 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
    2007-07-11 19:14 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
    2007-07-11 19:14 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
    2007-07-11 19:14 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
    2007-07-04 17:29 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\Media Player Classic
    2007-06-29 15:18 87,552 --a------ C:\WINDOWS\system32\CNMLM4b.DLL
    2007-06-29 15:18 73,728 --a------ C:\WINDOWS\system32\CNMCP4b.exe
    2007-06-29 15:18 5,632 --a------ C:\WINDOWS\system32\CNMVS4b.DLL
    2007-06-29 15:18 <KANSIO> d--h----- C:\BJPrinter
    2007-06-27 21:33 <KANSIO> d-------- C:\Program Files\ATI Technologies
    2007-06-27 20:48 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\Real
    2007-06-27 20:48 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
    2007-06-24 01:34 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\Apple Computer
    2007-06-24 01:26 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
    2007-06-23 15:53 <KANSIO> d-------- C:\Program Files\Logitech
    2007-06-21 15:35 <KANSIO> d-------- C:\WINDOWS\system32\SoftwareDistribution
    2007-06-20 22:55 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\My Battle for Middle-earth(tm) II Files
    2007-06-20 22:41 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\Logitech
    2007-06-20 22:39 69,632 --a------ C:\WINDOWS\system32\KemXML.dll
    2007-06-20 22:39 163,840 --a------ C:\WINDOWS\system32\kemutb.dll
    2007-06-20 22:39 135,168 --a------ C:\WINDOWS\system32\KemUtil.dll
    2007-06-20 22:39 110,592 --a------ C:\WINDOWS\system32\KemWnd.dll
    2007-06-20 22:39 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
    2007-06-20 22:34 <KANSIO> d-------- C:\Program Files\Desktop Messenger
    2007-06-20 22:32 94,208 --a------ C:\WINDOWS\system32\FEELIT.DLL
    2007-06-20 22:32 67,694 --a------ C:\WINDOWS\system32\drivers\LMouFlt2.sys
    2007-06-20 22:32 50,990 --------- C:\WINDOWS\system32\drivers\L8042PR2.SYS
    2007-06-20 22:32 5,838 --a------ C:\WINDOWS\system32\drivers\LKbdFlt2.sys
    2007-06-20 22:32 3,792 --a------ C:\WINDOWS\system32\LMOUSE16.DLL
    2007-06-20 22:32 29,184 --a------ C:\WINDOWS\system32\LOGILANG.DLL
    2007-06-20 22:32 22,206 --a------ C:\WINDOWS\system32\drivers\LHidFlt2.sys
    2007-06-20 22:32 19,180 --a------ C:\WINDOWS\system32\LCoInst.dll
    2007-06-20 22:32 17,408 --a------ C:\WINDOWS\system32\LMOUSE32.DLL
    2007-06-20 22:32 164,352 --a------ C:\WINDOWS\system32\COMNCTR.DLL
    2007-06-20 22:32 155,648 --a------ C:\WINDOWS\system32\ifc21.dll
    2007-06-20 22:32 140,800 --------- C:\WINDOWS\system32\lmoufrc.dll
    2007-06-20 22:32 109,056 --a------ C:\WINDOWS\system32\LGUICOM.DLL
    2007-06-20 15:04 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\LogiShrd
    2007-06-20 15:01 56,080 --a------ C:\WINDOWS\KHALMNPR.Exe
    2007-06-20 15:01 36,112 --a------ C:\WINDOWS\system32\drivers\LMouFilt.Sys
    2007-06-20 15:01 34,832 --a------ C:\WINDOWS\system32\drivers\LHidFilt.Sys
    2007-06-20 15:01 28,688 --a------ C:\WINDOWS\system32\drivers\LUsbFilt.sys
    2007-06-20 15:01 20,496 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.sys
    2007-06-20 15:01 1,419,024 --a------ C:\WINDOWS\system32\WdfCoInstaller01005.dll
    2007-06-19 21:53 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\Ahead
    2007-06-19 21:49 <KANSIO> d-------- C:\Program Files\Nero
    2007-06-19 21:49 <KANSIO> d-------- C:\Program Files\Common Files\Ahead
    2007-06-19 20:43 740,442 --a------ C:\WINDOWS\system32\divx.dll
    2007-06-19 20:43 73,728 --a------ C:\WINDOWS\system32\dpl100.dll
    2007-06-19 20:43 593,920 --a------ C:\WINDOWS\system32\xvidcore.dll
    2007-06-19 20:43 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
    2007-06-19 20:43 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll
    2007-06-19 20:43 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
    2007-06-19 20:43 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll
    2007-06-19 12:58 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\VersionTracker Pro


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-07-16 10:05:58 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2007-07-15 20:25:28 -------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-07-15 17:48:31 -------- d-----w C:\Program Files\themexp
    2007-07-10 19:36:35 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll
    2007-07-07 17:42:39 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\Skype
    2007-07-06 07:44:03 -------- d-----w C:\Program Files\Sitecom
    2007-06-20 19:40:04 -------- d-----w C:\Program Files\Common Files\Logitech
    2007-06-20 19:34:39 90,112 ------r C:\WINDOWS\bwUnin-6.1.0.155-8876480L.exe
    2007-06-20 12:03:02 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
    2007-06-20 12:02:46 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
    2007-06-20 12:02:41 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
    2007-06-19 18:44:56 -------- d-----w C:\Program Files\Yahoo!
    2007-06-17 11:23:31 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
    2007-06-16 18:08:15 -------- d-----w C:\Program Files\AGEIA Technologies
    2007-06-16 10:30:17 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
    2007-06-16 10:23:46 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
    2007-06-14 09:49:16 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\InstallShield
    2007-06-14 08:52:40 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\InstallShield Installation Information
    2007-06-13 22:14:53 1,402 ----a-w C:\WINDOWS\mozver.dat
    2007-06-13 19:50:17 43,152 ----a-w C:\WINDOWS\system32\drivers\ativvpxx.vp
    2007-06-13 19:25:36 339,968 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
    2007-06-13 19:24:32 268,288 ----a-w C:\WINDOWS\system32\ati2dvag.dll
    2007-06-13 19:24:13 2,155,520 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
    2007-06-13 19:23:23 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
    2007-06-13 19:17:37 139,264 ----a-w C:\WINDOWS\system32\atipdlxx.dll
    2007-06-13 19:17:26 118,784 ----a-w C:\WINDOWS\system32\Oemdspif.dll
    2007-06-13 19:17:18 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
    2007-06-13 19:17:12 42,496 ----a-w C:\WINDOWS\system32\ati2edxx.dll
    2007-06-13 19:16:59 118,784 ----a-w C:\WINDOWS\system32\ati2evxx.dll
    2007-06-13 19:15:39 483,328 ----a-w C:\WINDOWS\system32\ati2evxx.exe
    2007-06-13 19:14:51 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
    2007-06-13 19:10:33 8,097,792 ----a-w C:\WINDOWS\system32\atioglx2.dll
    2007-06-13 19:07:26 2,922,208 ----a-w C:\WINDOWS\system32\ati3duag.dll
    2007-06-13 18:57:21 1,512,960 ----a-w C:\WINDOWS\system32\ativvaxx.dll
    2007-06-13 18:46:28 5,431,296 ----a-w C:\WINDOWS\system32\atioglxx.dll
    2007-06-13 18:43:53 262,144 ----a-w C:\WINDOWS\system32\atikvmag.dll
    2007-06-13 18:42:29 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
    2007-06-13 18:41:46 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
    2007-06-13 18:41:06 50,176 ----a-w C:\WINDOWS\system32\atiok3x2.dll
    2007-06-13 18:36:45 368,640 ----a-w C:\WINDOWS\system32\ati2cqag.dll
    2007-06-13 11:29:00 520,192 ------w C:\WINDOWS\system32\ati2sgag.exe
    2007-06-11 17:33:11 12,464 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
    2007-06-10 17:18:21 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\acccore
    2007-06-10 16:41:16 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\My Battle for Middle-earth Files
    2007-06-10 16:03:01 4,212 ---h--w C:\WINDOWS\system32\zllictbl.dat
    2007-06-10 14:23:42 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\AdobeUM
    2007-06-05 05:15:17 1,785,344 --sh--w C:\WINDOWS\lzhall.exe
    2007-06-04 18:19:18 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\Help
    2007-06-04 12:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
    2007-06-04 12:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
    2007-06-04 12:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
    2007-06-03 15:28:49 271,360 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys
    2007-06-03 15:28:47 18,048 ----a-w C:\WINDOWS\system32\drivers\lirsgt.sys
    2007-06-02 12:21:05 -------- d-----w C:\Program Files\America's Army Server Manager
    2007-05-27 11:12:21 1,683 ----a-w C:\WINDOWS\eReg.dat
    2007-05-27 10:23:25 -------- d-----w C:\Program Files\Electronic Arts
    2007-05-26 20:15:04 -------- d-----w C:\Program Files\Creative
    2007-05-25 12:23:21 223,128 ----a-w C:\WINDOWS\system32\drivers\dtscsi.sys
    2007-05-24 17:27:29 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd5069.sys
    2007-05-24 17:27:29 664,064 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
    2007-05-23 14:39:44 0 ----a-w C:\WINDOWS\nsreg.dat
    2007-05-20 17:37:40 -------- d-----w C:\Program Files\Winamp
    2007-05-20 16:00:37 -------- d-----w C:\Program Files\TGTSoft
    2007-05-19 21:01:46 48,660 ----a-w C:\WINDOWS\system32\perfc00B.dat
    2007-05-19 21:01:46 283,356 ----a-w C:\WINDOWS\system32\perfh00B.dat
    2007-05-19 20:07:51 -------- d-----w C:\Program Files\Messenger
    2007-05-19 19:22:45 -------- d-----w C:\Program Files\Common Files\InstallShield
    2007-05-19 19:16:06 -------- d-----w C:\Program Files\Common Files\DirectX
    2007-05-19 12:01:23 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\.BitTornado
    2007-05-19 08:04:37 -------- d-----w C:\Program Files\MSN Messenger
    2007-05-19 08:04:10 -------- d-----w C:\Program Files\Skype
    2007-05-19 08:04:05 -------- d-----w C:\Program Files\Common Files\Skype
    2007-05-19 07:21:29 -------- d-----w C:\Program Files\Movie Maker
    2007-05-19 07:18:01 -------- d-----w C:\Program Files\Windows NT
    2007-05-18 19:09:32 -------- d-----w C:\Program Files\Common Files\ODBC
    2007-05-18 19:09:29 -------- d-----w C:\Program Files\Common Files\SpeechEngines
    2007-05-18 18:29:13 -------- d--h--w C:\Program Files\WindowsUpdate
    2007-05-18 18:24:59 20,747 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
    2007-05-18 18:19:40 -------- d-----w C:\Program Files\microsoft frontpage
    2007-05-18 18:19:25 0 --sha-r C:\MSDOS.SYS
    2007-05-18 18:19:25 0 --sha-r C:\IO.SYS
    2007-05-18 18:19:25 0 ----a-w C:\CONFIG.SYS
    2007-05-18 18:19:25 0 ----a-w C:\AUTOEXEC.BAT
    2007-05-18 18:17:51 -------- d-----w C:\Program Files\Online Services
    2007-05-18 18:16:37 -------- d-----w C:\Program Files\Common Files\MSSoap
    2007-05-18 18:16:25 21,672 ----a-w C:\WINDOWS\system32\emptyregdb.dat
    2007-05-18 18:15:07 -------- d-----w C:\Program Files\MSN Gaming Zone
    2007-05-18 01:30:41 972,072 ----a-w C:\WINDOWS\system32\ativva6x.dat
    2007-05-18 01:30:41 3,107,788 ----a-w C:\WINDOWS\system32\ativva5x.dat
    2007-05-18 01:30:40 3,107,788 ----a-w C:\WINDOWS\system32\ativvaxx.dat
    2007-05-16 15:14:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-04-25 14:22:38 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
    2007-04-18 16:14:18 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
    2005-12-07 15:06 399424 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    2006-12-18 04:16 59032 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
    2007-05-10 16:09 722472 --a------ C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
    2007-07-04 19:28 513336 --a------ D:\Imutukset\BitComet\tools\BitCometBHO_1.1.7.4.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C333CF63-767F-4831-94AC-E683D962C63C}]
    2006-05-10 02:13 65536 --a------ C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C87D64B5-DF92-4703-90CB-B465B6982941}]
    C:\WINDOWS\qnxplugin.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WinampAgent"="D:\Ohjelmat\Winamp\winampa.exe" [2007-05-15 01:22]
    "DAEMON Tools"="D:\Ohjelmat\DAEMON Tools\daemon.exe" [2005-11-09 01:00]
    "ZoneAlarm Client"="D:\Ohjelmat\ZoneAlarm\zlclient.exe" [2007-03-09 01:02]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 C:\WINDOWS\KHALMNPR.Exe]
    "zBrowser Launcher"="D:\Ohjelmat\Lokitech\iTouch.exe" [2001-12-20 01:59]
    "LDM"="C:\Program Files\Desktop Messenger\8876480\Program\backWeb-8876480.exe" [2007-06-20 22:34]
    "EM_EXEC"="D:\Ohjelmat\Lokitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2001-12-20 09:42]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35]
    "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-04-02 10:35]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 21:31]
    "Steam"="D:\Ohjelmat\Steam\Steam.exe" [2007-07-14 16:14]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" []
    "LDM"="C:\Program Files\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-06-20 22:34]
    "BitComet"="D:\Imutukset\BitComet\BitComet.exe" [2007-07-09 20:26]

    [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
    Source= file:///C:\WINDOWS\privacy_danger\index.htm
    FriendlyName= Privacy Protection

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup]

    *Newly Created Service* - ANTIVIRSCHEDULER
    *Newly Created Service* - ANTIVIRSERVICE
    *Newly Created Service* - AVGIO
    *Newly Created Service* - AVGNTFLT
    *Newly Created Service* - AVIPBB

    **************************************************************************

    catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-07-17 12:52:02
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-07-17 12:53:36
    C:\ComboFix-quarantined-files.txt ... 2007-07-17 12:53

    --- E O F ---
     
    Samiv93, Jul 17, 2007
    #9
  10. Auttaja

    Auttaja Guest

    Avaa Notepad ja kopioi/liitä allaolevassa lainausboxissa oleva teksti sinne:

    Tallenna se nimellä CFScript. (Tarkista että on juuri noin kirjoitettu)

    Sitten raahaa CFScript ComboFix.exeen kuten alla.

    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

    myös uusi hjtlogi
     
    Auttaja, Jul 17, 2007
    #10
  11. Samiv93

    Samiv93 Regular member

    Joined:
    Jun 14, 2006
    Messages:
    252
    Likes Received:
    0
    Trophy Points:
    26
    en oo nyt iha varma että pitääkö mun uuestaa kattoo tuolla combo fixilla kaikki samallai mite aiemminki sitte siitä kopsata logi samalla hjtlogi

     
    Samiv93, Jul 17, 2007
    #11
  12. Samiv93

    Samiv93 Regular member

    Joined:
    Jun 14, 2006
    Messages:
    252
    Likes Received:
    0
    Trophy Points:
    26
    "Jari" - 2007-07-17 13:13:52 - ComboFix 07-07-13.8 - Service Pack 2 NTFS
    Command switches used :: C:\Documents and Settings\Jari\CFScript..txt


    ((((((((((((((((((((((((( Files Created from 2007-06-17 to 2007-07-17 )))))))))))))))))))))))))))))))


    2007-07-17 12:42 51,200 --a------ C:\WINDOWS\nircmd.exe
    2007-07-16 18:12 5,537,792 --a------ C:\DOCUME~1\Jari\ntuser.dat
    2007-07-16 18:12 237,568 --a------ C:\DOCUME~1\LOCALS~1\ntuser.dat
    2007-07-16 18:12 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\AntiVir PersonalEdition Classic
    2007-07-16 13:07 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
    2007-07-14 19:40 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
    2007-07-13 12:44 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\My The Lord of the Rings, The Rise of the Witch-king Files
    2007-07-11 19:15 5,504 --------- C:\WINDOWS\system32\drivers\imagedrv.sys
    2007-07-11 19:15 125,184 --------- C:\WINDOWS\system32\drivers\imagesrv.sys
    2007-07-11 19:15 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
    2007-07-11 19:14 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
    2007-07-11 19:14 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
    2007-07-11 19:14 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
    2007-07-11 19:14 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
    2007-07-11 19:14 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
    2007-07-04 17:29 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\Media Player Classic
    2007-06-29 15:18 87,552 --a------ C:\WINDOWS\system32\CNMLM4b.DLL
    2007-06-29 15:18 73,728 --a------ C:\WINDOWS\system32\CNMCP4b.exe
    2007-06-29 15:18 5,632 --a------ C:\WINDOWS\system32\CNMVS4b.DLL
    2007-06-29 15:18 <KANSIO> d--h----- C:\BJPrinter
    2007-06-27 21:33 <KANSIO> d-------- C:\Program Files\ATI Technologies
    2007-06-27 20:48 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\Real
    2007-06-27 20:48 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
    2007-06-24 01:34 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\Apple Computer
    2007-06-24 01:26 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
    2007-06-23 15:53 <KANSIO> d-------- C:\Program Files\Logitech
    2007-06-21 15:35 <KANSIO> d-------- C:\WINDOWS\system32\SoftwareDistribution
    2007-06-20 22:55 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\My Battle for Middle-earth(tm) II Files
    2007-06-20 22:41 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\Logitech
    2007-06-20 22:39 69,632 --a------ C:\WINDOWS\system32\KemXML.dll
    2007-06-20 22:39 163,840 --a------ C:\WINDOWS\system32\kemutb.dll
    2007-06-20 22:39 135,168 --a------ C:\WINDOWS\system32\KemUtil.dll
    2007-06-20 22:39 110,592 --a------ C:\WINDOWS\system32\KemWnd.dll
    2007-06-20 22:39 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
    2007-06-20 22:34 <KANSIO> d-------- C:\Program Files\Desktop Messenger
    2007-06-20 22:32 94,208 --a------ C:\WINDOWS\system32\FEELIT.DLL
    2007-06-20 22:32 67,694 --a------ C:\WINDOWS\system32\drivers\LMouFlt2.sys
    2007-06-20 22:32 50,990 --------- C:\WINDOWS\system32\drivers\L8042PR2.SYS
    2007-06-20 22:32 5,838 --a------ C:\WINDOWS\system32\drivers\LKbdFlt2.sys
    2007-06-20 22:32 3,792 --a------ C:\WINDOWS\system32\LMOUSE16.DLL
    2007-06-20 22:32 29,184 --a------ C:\WINDOWS\system32\LOGILANG.DLL
    2007-06-20 22:32 22,206 --a------ C:\WINDOWS\system32\drivers\LHidFlt2.sys
    2007-06-20 22:32 19,180 --a------ C:\WINDOWS\system32\LCoInst.dll
    2007-06-20 22:32 17,408 --a------ C:\WINDOWS\system32\LMOUSE32.DLL
    2007-06-20 22:32 164,352 --a------ C:\WINDOWS\system32\COMNCTR.DLL
    2007-06-20 22:32 155,648 --a------ C:\WINDOWS\system32\ifc21.dll
    2007-06-20 22:32 140,800 --------- C:\WINDOWS\system32\lmoufrc.dll
    2007-06-20 22:32 109,056 --a------ C:\WINDOWS\system32\LGUICOM.DLL
    2007-06-20 15:04 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\LogiShrd
    2007-06-20 15:01 56,080 --a------ C:\WINDOWS\KHALMNPR.Exe
    2007-06-20 15:01 36,112 --a------ C:\WINDOWS\system32\drivers\LMouFilt.Sys
    2007-06-20 15:01 34,832 --a------ C:\WINDOWS\system32\drivers\LHidFilt.Sys
    2007-06-20 15:01 28,688 --a------ C:\WINDOWS\system32\drivers\LUsbFilt.sys
    2007-06-20 15:01 20,496 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.sys
    2007-06-20 15:01 1,419,024 --a------ C:\WINDOWS\system32\WdfCoInstaller01005.dll
    2007-06-19 21:53 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\Ahead
    2007-06-19 21:49 <KANSIO> d-------- C:\Program Files\Nero
    2007-06-19 21:49 <KANSIO> d-------- C:\Program Files\Common Files\Ahead
    2007-06-19 20:43 740,442 --a------ C:\WINDOWS\system32\divx.dll
    2007-06-19 20:43 73,728 --a------ C:\WINDOWS\system32\dpl100.dll
    2007-06-19 20:43 593,920 --a------ C:\WINDOWS\system32\xvidcore.dll
    2007-06-19 20:43 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
    2007-06-19 20:43 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll
    2007-06-19 20:43 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
    2007-06-19 20:43 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll
    2007-06-19 12:58 <KANSIO> d-------- C:\DOCUME~1\Jari\APPLIC~1\VersionTracker Pro


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-07-16 10:05:58 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2007-07-15 20:25:28 -------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-07-15 17:48:31 -------- d-----w C:\Program Files\themexp
    2007-07-10 19:36:35 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll
    2007-07-07 17:42:39 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\Skype
    2007-07-06 07:44:03 -------- d-----w C:\Program Files\Sitecom
    2007-06-20 19:40:04 -------- d-----w C:\Program Files\Common Files\Logitech
    2007-06-20 19:34:39 90,112 ------r C:\WINDOWS\bwUnin-6.1.0.155-8876480L.exe
    2007-06-20 12:03:02 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
    2007-06-20 12:02:46 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
    2007-06-20 12:02:41 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
    2007-06-19 18:44:56 -------- d-----w C:\Program Files\Yahoo!
    2007-06-17 11:23:31 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
    2007-06-16 18:08:15 -------- d-----w C:\Program Files\AGEIA Technologies
    2007-06-16 10:30:17 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
    2007-06-16 10:23:46 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
    2007-06-14 09:49:16 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\InstallShield
    2007-06-14 08:52:40 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\InstallShield Installation Information
    2007-06-13 22:14:53 1,402 ----a-w C:\WINDOWS\mozver.dat
    2007-06-13 19:50:17 43,152 ----a-w C:\WINDOWS\system32\drivers\ativvpxx.vp
    2007-06-13 19:25:36 339,968 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
    2007-06-13 19:24:32 268,288 ----a-w C:\WINDOWS\system32\ati2dvag.dll
    2007-06-13 19:24:13 2,155,520 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
    2007-06-13 19:23:23 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
    2007-06-13 19:17:37 139,264 ----a-w C:\WINDOWS\system32\atipdlxx.dll
    2007-06-13 19:17:26 118,784 ----a-w C:\WINDOWS\system32\Oemdspif.dll
    2007-06-13 19:17:18 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
    2007-06-13 19:17:12 42,496 ----a-w C:\WINDOWS\system32\ati2edxx.dll
    2007-06-13 19:16:59 118,784 ----a-w C:\WINDOWS\system32\ati2evxx.dll
    2007-06-13 19:15:39 483,328 ----a-w C:\WINDOWS\system32\ati2evxx.exe
    2007-06-13 19:14:51 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
    2007-06-13 19:10:33 8,097,792 ----a-w C:\WINDOWS\system32\atioglx2.dll
    2007-06-13 19:07:26 2,922,208 ----a-w C:\WINDOWS\system32\ati3duag.dll
    2007-06-13 18:57:21 1,512,960 ----a-w C:\WINDOWS\system32\ativvaxx.dll
    2007-06-13 18:46:28 5,431,296 ----a-w C:\WINDOWS\system32\atioglxx.dll
    2007-06-13 18:43:53 262,144 ----a-w C:\WINDOWS\system32\atikvmag.dll
    2007-06-13 18:42:29 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
    2007-06-13 18:41:46 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
    2007-06-13 18:41:06 50,176 ----a-w C:\WINDOWS\system32\atiok3x2.dll
    2007-06-13 18:36:45 368,640 ----a-w C:\WINDOWS\system32\ati2cqag.dll
    2007-06-13 11:29:00 520,192 ------w C:\WINDOWS\system32\ati2sgag.exe
    2007-06-11 17:33:11 12,464 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
    2007-06-10 17:18:21 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\acccore
    2007-06-10 16:41:16 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\My Battle for Middle-earth Files
    2007-06-10 16:03:01 4,212 ---h--w C:\WINDOWS\system32\zllictbl.dat
    2007-06-10 14:23:42 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\AdobeUM
    2007-06-05 05:15:17 1,785,344 --sh--w C:\WINDOWS\lzhall.exe
    2007-06-04 18:19:18 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\Help
    2007-06-04 12:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
    2007-06-04 12:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
    2007-06-04 12:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
    2007-06-03 15:28:49 271,360 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys
    2007-06-03 15:28:47 18,048 ----a-w C:\WINDOWS\system32\drivers\lirsgt.sys
    2007-06-02 12:21:05 -------- d-----w C:\Program Files\America's Army Server Manager
    2007-05-27 11:12:21 1,683 ----a-w C:\WINDOWS\eReg.dat
    2007-05-27 10:23:25 -------- d-----w C:\Program Files\Electronic Arts
    2007-05-26 20:15:04 -------- d-----w C:\Program Files\Creative
    2007-05-25 12:23:21 223,128 ----a-w C:\WINDOWS\system32\drivers\dtscsi.sys
    2007-05-24 17:27:29 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd5069.sys
    2007-05-24 17:27:29 664,064 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
    2007-05-23 14:39:44 0 ----a-w C:\WINDOWS\nsreg.dat
    2007-05-20 17:37:40 -------- d-----w C:\Program Files\Winamp
    2007-05-20 16:00:37 -------- d-----w C:\Program Files\TGTSoft
    2007-05-19 21:01:46 48,660 ----a-w C:\WINDOWS\system32\perfc00B.dat
    2007-05-19 21:01:46 283,356 ----a-w C:\WINDOWS\system32\perfh00B.dat
    2007-05-19 20:07:51 -------- d-----w C:\Program Files\Messenger
    2007-05-19 19:22:45 -------- d-----w C:\Program Files\Common Files\InstallShield
    2007-05-19 19:16:06 -------- d-----w C:\Program Files\Common Files\DirectX
    2007-05-19 12:01:23 -------- d-----w C:\DOCUME~1\Jari\APPLIC~1\.BitTornado
    2007-05-19 08:04:37 -------- d-----w C:\Program Files\MSN Messenger
    2007-05-19 08:04:10 -------- d-----w C:\Program Files\Skype
    2007-05-19 08:04:05 -------- d-----w C:\Program Files\Common Files\Skype
    2007-05-19 07:21:29 -------- d-----w C:\Program Files\Movie Maker
    2007-05-19 07:18:01 -------- d-----w C:\Program Files\Windows NT
    2007-05-18 19:09:32 -------- d-----w C:\Program Files\Common Files\ODBC
    2007-05-18 19:09:29 -------- d-----w C:\Program Files\Common Files\SpeechEngines
    2007-05-18 18:29:13 -------- d--h--w C:\Program Files\WindowsUpdate
    2007-05-18 18:24:59 20,747 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
    2007-05-18 18:19:40 -------- d-----w C:\Program Files\microsoft frontpage
    2007-05-18 18:19:25 0 --sha-r C:\MSDOS.SYS
    2007-05-18 18:19:25 0 --sha-r C:\IO.SYS
    2007-05-18 18:19:25 0 ----a-w C:\CONFIG.SYS
    2007-05-18 18:19:25 0 ----a-w C:\AUTOEXEC.BAT
    2007-05-18 18:17:51 -------- d-----w C:\Program Files\Online Services
    2007-05-18 18:16:37 -------- d-----w C:\Program Files\Common Files\MSSoap
    2007-05-18 18:16:25 21,672 ----a-w C:\WINDOWS\system32\emptyregdb.dat
    2007-05-18 18:15:07 -------- d-----w C:\Program Files\MSN Gaming Zone
    2007-05-18 01:30:41 972,072 ----a-w C:\WINDOWS\system32\ativva6x.dat
    2007-05-18 01:30:41 3,107,788 ----a-w C:\WINDOWS\system32\ativva5x.dat
    2007-05-18 01:30:40 3,107,788 ----a-w C:\WINDOWS\system32\ativvaxx.dat
    2007-05-16 15:14:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-04-25 14:22:38 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
    2007-04-18 16:14:18 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
    2005-12-07 15:06 399424 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    2006-12-18 04:16 59032 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
    2007-05-10 16:09 722472 --a------ C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
    2007-07-04 19:28 513336 --a------ D:\Imutukset\BitComet\tools\BitCometBHO_1.1.7.4.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C333CF63-767F-4831-94AC-E683D962C63C}]
    2006-05-10 02:13 65536 --a------ C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WinampAgent"="D:\Ohjelmat\Winamp\winampa.exe" [2007-05-15 01:22]
    "DAEMON Tools"="D:\Ohjelmat\DAEMON Tools\daemon.exe" [2005-11-09 01:00]
    "ZoneAlarm Client"="D:\Ohjelmat\ZoneAlarm\zlclient.exe" [2007-03-09 01:02]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 C:\WINDOWS\KHALMNPR.Exe]
    "zBrowser Launcher"="D:\Ohjelmat\Lokitech\iTouch.exe" [2001-12-20 01:59]
    "LDM"="C:\Program Files\Desktop Messenger\8876480\Program\backWeb-8876480.exe" [2007-06-20 22:34]
    "EM_EXEC"="D:\Ohjelmat\Lokitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2001-12-20 09:42]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35]
    "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-04-02 10:35]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 21:31]
    "Steam"="D:\Ohjelmat\Steam\Steam.exe" [2007-07-14 16:14]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" []
    "LDM"="C:\Program Files\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-06-20 22:34]
    "BitComet"="D:\Imutukset\BitComet\BitComet.exe" [2007-07-09 20:26]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup]

    *Newly Created Service* - ANTIVIRSCHEDULER
    *Newly Created Service* - ANTIVIRSERVICE
    *Newly Created Service* - AVGIO
    *Newly Created Service* - AVGNTFLT
    *Newly Created Service* - AVIPBB
    *Newly Created Service* - CATCHME

    **************************************************************************

    catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-07-17 13:19:57
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-07-17 13:23:34
    C:\ComboFix-quarantined-files.txt ... 2007-07-17 13:23
    C:\ComboFix2.txt ... 2007-07-17 12:53

    --- E O F ---
     
    Samiv93, Jul 17, 2007
    #12
  13. Samiv93

    Samiv93 Regular member

    Joined:
    Jun 14, 2006
    Messages:
    252
    Likes Received:
    0
    Trophy Points:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:46:27, on 17.7.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\spoolsv.exe
    D:\Ohjelmat\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\ctfmon.exe
    D:\Ohjelmat\Winamp\winampa.exe
    D:\Ohjelmat\DAEMON Tools\daemon.exe
    D:\Ohjelmat\ZoneAlarm\zlclient.exe
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    D:\Ohjelmat\Lokitech\iTouch.exe
    C:\Program Files\Desktop Messenger\8876480\Program\backWeb-8876480.exe
    D:\Ohjelmat\Lokitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
    D:\Imutukset\BitComet\BitComet.exe
    D:\Ohjelmat\Lokitek\SetPoint\SetPoint.exe
    C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    D:\Imutukset\DC++\DCPlusPlus.exe
    D:\Pelit\Mudi\zMUD\Zmud.exe
    D:\Pelit\Mudi\zMUD\Zmud.exe
    D:\Ohjelmat\Winamp\winamp.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\WINDOWS\explorer.exe
    E:\Virus ohjelmia\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Imutukset\BitComet\tools\BitCometBHO_1.1.7.4.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [WinampAgent] D:\Ohjelmat\Winamp\winampa.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "D:\Ohjelmat\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Ohjelmat\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [zBrowser Launcher] D:\Ohjelmat\Lokitech\iTouch.exe
    O4 - HKLM\..\Run: [LDM] C:\Program Files\Desktop Messenger\8876480\Program\backWeb-8876480.exe
    O4 - HKLM\..\Run: [EM_EXEC] D:\Ohjelmat\Lokitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
    O4 - HKCU\..\Run: [Steam] "D:\Ohjelmat\Steam\Steam.exe" -silent
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    O4 - HKCU\..\Run: [BitComet] "D:\Imutukset\BitComet\BitComet.exe" /tray
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: Logitech SetPoint.lnk = D:\Ohjelmat\Lokitek\SetPoint\SetPoint.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Imutukset\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Imutukset\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Imutukset\BitComet\BitComet.exe/AddAllLink.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\Imutukset\BitComet\tools\BitCometBHO_1.1.7.4.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1179512820090
    O17 - HKLM\System\CCS\Services\Tcpip\..\{21E313AD-8841-4105-8ED8-2ED4A87F0708}: NameServer = 212.50.211.242 212.50.192.226
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Ohjelmat\Ad-Aware\aawservice.exe
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: iPod-palvelu (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
    O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 8098 bytes
     
    Samiv93, Jul 17, 2007
    #13
  14. Auttaja

    Auttaja Guest

    Avaa hijackthis merkkaa seuraavat rivi(t) ja paina fix checked, sulje muut ohjelmat siksi aikaa.

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =


    Tässä ohje miten merkataan:
    [​IMG]


    ==========

    Tarkista koneesi F-Securen online skannerilla

    Huom, skanneri toimii vain Internet Explorer selaimella

    * Lue sivun ohjeet huolella läpi
    * Klikkaa Start scanning
    * Mikäli saat Internet Explorer -suojausvaroituksen, klikkaa Asenna
    * Klikkaa Accept
    * Klikkaa Custom Scan
    * Säädä asetukset seuraavasti

    o "Virus Scan Option" kohdasta valitse Scan whole system
    o "Other Scan Option" kohdasta valitse Scan All Files
    o Valitse Scan whole system for rootkits
    o Valitse Scan whole system for spyware
    o Laita ruksi kohtaan Scan inside archives
    o Varmista että Use advanced heuristics on valittuna

    * Klikkaa Start
    * Skannaus käynnistyy kun tarvittavat tiedostot/päivitykset on ladattu
    * Odota kärsivällisesti
    * Kun sakannaus on suoritettu, klikkaa Automatic cleaning
    * Klikkaa Show Report
    * Raportti aukeaa selaimessa, kopioi teksti kokonaan
    * Liitä kopioitu teksti esim. muistioon tai Wordiin ja tallenna työpöydälle
    * Voit sulkea skannerin
    * Lähetä raportti viestiketjuusi

    ==========

    Tämä jos tunnet tietokoneesi olevan hitaan puoleinen, etkä ole eheyttänyt pitkään aikaan:

    Avaa Oma tietokone
    -> Tee seuraava toimenpide kaikille Paikallisille levyille
    [​IMG]

    ==========

    Lataa CCleaner ja asenna se:
    Avaa "Options", sieltä "Language" ja valitse "Suomi (Finnish)"

    Avaa "Virheet" kohta, paina "Etsi rekisterin virheitä", paina "Korjaa valitut rekisterin virheet..". Paina "Kyllä", kun ohjelma kysyy "Haluatko varmuuskopioida muutokset rekisteriin", tallenna tiedosto esim. työpöydälle.

    Avaa "Puhdistaja", paina "Tutki" ja tämän jälkeen "Aja Ccleaner". Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti.

    ==========

    Jos sinulla ei ole tätä java versiota (6.2): Vanha java saastuttaa helposti koneesi!

    Javan päivitys ja välimuistin tyhjennys:

    1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
    2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
    Niissä pitäisi olla seuraava kuva vieressä: [​IMG]
    3. Valitse kaikki entiset Java versiosi ja valitse Poista.
    4. Asenna uusin Java päivitys seuraavasta linkistä..
    5. Käynnistä kone uudelleen asennuksen jälkeen:

    http://java.sun.com/javase/downloads/index.jsp
    tai http://www.filehippo.com/download_java_runtime/

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u2

    Paina Download

    Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

    7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle    ).

    8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

    *Applications and Applets

    *Trace and Log Files


    Ja paina OK -nappia

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.

    10. Klikkaa OK jättääksesi Java asetusikkunasi.

    ==========

    Lataa Deckard's System Scanner Työpöydällesi.

    Huomioi: Sinulla tulee olla Järjestelmänvalvojan oikeudet ajaaksesi ohjelman.

    [*]Sulje kaikki avoimet ikkunat ja ohjelmat.
    [*]Tupla Klikkaa Dss.exe tiedostoa ajaaksesi ohjelman, seuraa ohjeita.
    [*]Kun Scannaus on valmis 2 textitiedostoa pitäisi avautua, Main.txt ja extra.txt
    [*]Näppäile Kopioi ( CTRL+A -> CTRL + C ) ja liitä ( CTRL + V )
    [*]kopioi ja liitä Extra.txt & Main.txt sisältö seuraavaan vastaukseesi.

    myös F-securen raportti
     
    Auttaja, Jul 17, 2007
    #14

Share This Page