Isass...

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Ticsi, Feb 17, 2009.

  1. Ticsi

    Ticsi Member

    Joined:
    Nov 13, 2006
    Messages:
    32
    Likes Received:
    0
    Trophy Points:
    16
    [​IMG]

    Tällänen löyty ja tein topicin ja neuvottiin postaamaan tälle alueelle muutamies lokien kera. Täs "alkuperäinen" topic: http://keskustelu.afterdawn.com/thread_view.cfm/749621


    Lokit:


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:06:01, on 17.2.2009
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16809)
    Boot mode: Normal

    Running processes:
    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
    C:\Program Files\Norman\Npm\Bin\Zanda.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\System32\LEXBCES.EXE
    C:\Windows\system32\taskeng.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\LEXPPS.EXE
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\Launch Manager\HotkeyApp.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    C:\Program Files\Norman\Npm\Bin\Zlh.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Windows\PixArt\Pac207\Monitor.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Users\Käyttäjä\Program Files\DNA\btdna.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Norman\nse\bin\NSESVC.EXE
    C:\Program Files\Launch Manager\WisLMSvc.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
    C:\Program Files\Norman\Nvc\bin\nvcoas.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Norman\Nvc\BIN\NIP.EXE
    C:\Program Files\Norman\Nvc\bin\cclaw.exe
    C:\Program Files\Ventrilo\Ventrilo.exe
    C:\Program Files\mIRC\mirc.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\SwiftKit\SwiftKit.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\servicing\TrustedInstaller.exe
    C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
    C:\Program Files\Java\jre6\bin\java.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [HotkeyApp] "C:\Program Files\Launch Manager\HotkeyApp.exe"
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [services] C:\WINDOWS\Microsoft\services.exe
    O4 - HKLM\..\Run: [lsass] C:\Program Files\lsass.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
    O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Käyttäjä\Program Files\DNA\btdna.exe"
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\Windows\System32\LEXBCES.EXE
    O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
    O23 - Service: WisLMSvc - Wistron Corp. - C:\Program Files\Launch Manager\WisLMSvc.exe

    --
    End of file - 9887 bytes




    Malwarebytes' Anti-Malware 1.34
    Tietokantaversio: 1768
    Windows 6.0.6000

    17.2.2009 10:36:01
    mbam-log-2009-02-17 (10-36-01).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
    Tarkistetut kohteet: 136684
    Kulunut aika: 1 hour(s), 30 minute(s), 31 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 1
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services (Trojan.Agent) -> Quarantined and deleted successfully.

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)
     
    Ticsi, Feb 17, 2009
    #1
  2. Hujo

    Hujo Guest

    1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
    Combofix1
    Combofix2

    älä asenna palutus consolia
    2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    ================

    näyttää olevan avira ja norman koneella
    yksi virustorjunta pisaaa.
     
    Last edited by a moderator: Feb 17, 2009
    Hujo, Feb 17, 2009
    #2
  3. Ticsi

    Ticsi Member

    Joined:
    Nov 13, 2006
    Messages:
    32
    Likes Received:
    0
    Trophy Points:
    16
    ComboFix 09-02-15.01 - Käyttäjä 2009-02-17 14:30:51.1 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1035.18.2038.881 [GMT 2:00]
    Sijainti: c:\users\Käyttäjä\Downloads\ComboFix.exe
    AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
    AV: Norman Virus Control ver. 5.99 *On-access scanning enabled* (Updated)
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\x64

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-17 to 2009-02-17 )))))))))))))))))
    .

    2009-02-17 09:05 . 2009-02-17 09:05 <KANSIO> d-------- c:\program files\Trend Micro
    2009-02-17 09:02 . 2009-02-17 09:02 <KANSIO> d-------- c:\users\Käyttäjä\AppData\Roaming\Malwarebytes
    2009-02-17 09:02 . 2009-02-17 09:02 <KANSIO> d-------- c:\users\All Users\Malwarebytes
    2009-02-17 09:02 . 2009-02-17 09:02 <KANSIO> d-------- c:\programdata\Malwarebytes
    2009-02-17 09:02 . 2009-02-17 09:02 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
    2009-02-17 09:02 . 2009-02-11 10:19 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
    2009-02-17 09:02 . 2009-02-11 10:19 15,504 --a------ c:\windows\System32\drivers\mbam.sys
    2009-02-15 02:00 . 2008-12-05 06:29 1,244,672 --a------ c:\windows\System32\mcmde.dll
    2009-02-15 02:00 . 2008-12-05 06:29 428,032 --a------ c:\windows\System32\EncDec.dll
    2009-02-15 02:00 . 2008-12-05 06:29 292,352 --a------ c:\windows\System32\psisdecd.dll
    2009-02-15 02:00 . 2008-12-05 06:29 217,088 --a------ c:\windows\System32\psisrndr.ax
    2009-02-15 02:00 . 2008-12-05 06:29 177,152 --a------ c:\windows\System32\mpg2splt.ax
    2009-02-15 02:00 . 2008-12-05 06:29 80,896 --a------ c:\windows\System32\MSNP.ax
    2009-02-15 02:00 . 2008-12-05 06:29 68,608 --a------ c:\windows\System32\Mpeg2Data.ax
    2009-02-15 02:00 . 2008-12-05 06:29 57,856 --a------ c:\windows\System32\MSDvbNP.ax
    2009-02-13 09:38 . 2009-02-13 09:38 <KANSIO> d-------- c:\users\Käyttäjä\AppData\Roaming\NCH Software
    2009-02-13 09:37 . 2009-02-13 09:37 <KANSIO> d-------- c:\users\All Users\NCH Software
    2009-02-13 09:37 . 2009-02-13 09:37 <KANSIO> d-------- c:\programdata\NCH Software
    2009-02-13 09:37 . 2009-02-13 09:37 <KANSIO> d-------- c:\program files\NCH Software
    2009-02-08 17:16 . 2009-02-08 17:16 <KANSIO> d-------- c:\program files\Axife Mouse Recorder DEMO

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-02-17 12:35 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\mIRC
    2009-02-17 12:34 4,456,448 --sha-w c:\users\Käyttäjä\NTUSER.DAT
    2009-02-17 12:34 4,456,448 --sha-w c:\users\Käyttäjä\NTUSER.DAT
    2009-02-17 12:30 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\BitTorrent
    2009-02-17 12:28 34 ----a-w c:\users\Käyttäjä\jagex_runescape_preferences.dat
    2009-02-17 12:28 34 ----a-w c:\users\Käyttäjä\jagex_runescape_preferences.dat
    2009-02-17 12:27 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\DNA
    2009-02-17 12:26 --------- d-----w c:\program files\SwiftKit
    2009-02-17 07:02 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\Malwarebytes
    2009-02-17 06:56 --------- d-----w c:\program files\Norman
    2009-02-14 22:30 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\Ventrilo
    2009-02-14 12:16 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\LimeWire
    2009-02-13 07:38 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\NCH Software
    2009-02-13 04:37 --------- d-----w c:\programdata\Microsoft Help
    2009-02-13 04:36 --------- d-----w c:\program files\Windows Mail
    2009-01-15 04:16 826,368 ----a-w c:\windows\System32\wininet.dll
    2009-01-15 04:16 56,320 ----a-w c:\windows\System32\iesetup.dll
    2009-01-15 04:16 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
    2009-01-15 04:15 26,624 ----a-w c:\windows\System32\ieUnatt.exe
    2009-01-14 11:12 --------- d-----w c:\program files\Steam
    2009-01-08 15:21 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\DivX
    2009-01-08 09:36 --------- d-----w c:\program files\DivX
    2009-01-08 09:36 --------- d-----w c:\program files\Common Files\PX Storage Engine
    2009-01-07 18:41 --------- d-----w c:\program files\BitTorrent
    2009-01-02 17:52 --------- d-----w c:\program files\Bonjour
    2009-01-02 15:08 410,984 ----a-w c:\windows\System32\deploytk.dll
    2009-01-02 15:08 --------- d-----w c:\program files\Java
    2008-12-27 10:44 --------- d-----w c:\program files\Warcraft III
    2008-12-26 19:16 --------- d-----w c:\program files\Counter-Strike 1.6
    2008-12-26 18:57 --------- d-----w c:\program files\Intel
    2008-12-17 13:00 --------- d-----w c:\program files\ATI
    2008-12-17 12:56 --------- d-----w c:\program files\ATI Technologies
    2008-12-12 09:18 87,336 ----a-w c:\windows\System32\dns-sd.exe
    2008-12-12 09:11 61,440 ----a-w c:\windows\System32\dnssd.dll
    2008-12-11 13:31 174 --sha-w c:\program files\desktop.ini
    2008-12-11 00:33 86,016 ----a-w c:\windows\System32\dpl100.dll
    2008-12-11 00:33 200,704 ----a-w c:\windows\System32\dtu100.dll
    2008-12-09 14:04 8,198,680 ----a-w c:\windows\System32\TVWSetup.exe
    2008-12-09 14:04 150,552 ----a-w c:\windows\System32\igfxpers.exe
    2008-12-09 14:04 141,848 ----a-w c:\windows\System32\igfxtray.exe
    2008-12-09 14:03 993,816 ----a-w c:\windows\System32\igxpun.exe
    2008-12-09 14:03 668,696 ----a-w c:\windows\System32\igfxcfg.exe
    2008-12-09 14:03 173,592 ----a-w c:\windows\System32\hkcmd.exe
    2008-12-09 14:03 172,568 ----a-w c:\windows\System32\igfxext.exe
    2008-12-09 02:28 593,920 ----a-w c:\windows\System32\dpuGUI11.dll
    2008-12-09 02:28 57,344 ----a-w c:\windows\System32\dpv11.dll
    2008-12-09 02:28 344,064 ----a-w c:\windows\System32\dpus11.dll
    2008-12-09 02:28 294,912 ----a-w c:\windows\System32\dpu11.dll
    2008-12-02 10:49 252,952 ----a-w c:\windows\System32\igfxsrvc.exe
    2008-12-02 10:40 155,648 ----a-w c:\windows\System32\igfxCoIn_v1608.dll
    2008-12-02 10:33 3,821,568 ----a-w c:\windows\System32\igdumd32.dll
    2008-12-02 10:31 1,498,564 ----a-w c:\windows\System32\igkrng400.bin
    2008-12-02 10:27 536,576 ----a-w c:\windows\System32\igdumdx32.dll
    2008-12-02 10:22 2,580,480 ----a-w c:\windows\System32\igd10umd32.dll
    2008-12-02 10:13 4,112,384 ----a-w c:\windows\System32\ig4icd32.dll
    2008-12-02 10:13 2,674,688 ----a-w c:\windows\System32\ig4dev32.dll
    2008-12-02 10:04 398,336 ----a-w c:\windows\System32\TVWizudlg.exe
    2008-12-02 10:03 59,392 ----a-w c:\windows\System32\oemdspif.dll
    2008-12-02 10:03 257,536 ----a-w c:\windows\System32\igfxTMM.dll
    2008-12-02 10:03 23,552 ----a-w c:\windows\System32\igfxexps.dll
    2008-12-02 10:03 200,192 ----a-w c:\windows\System32\igfxpph.dll
    2008-12-02 10:03 140,288 ----a-w c:\windows\System32\igfxtvcx.dll
    2008-12-02 10:02 94,208 ----a-w c:\windows\System32\hccutils.dll
    2008-12-02 10:02 51,712 ----a-w c:\windows\System32\igfxsrvc.dll
    2008-12-02 10:02 5,702,656 ----a-w c:\windows\System32\igfxress.dll
    2008-12-02 10:02 210,432 ----a-w c:\windows\System32\igfxdev.dll
    2008-12-02 10:02 130,048 ----a-w c:\windows\System32\igfxdo.dll
    2008-12-02 10:00 319,456 ----a-w c:\windows\System32\difxapi.dll
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-06-23 1232896]
    "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
    "BitTorrent DNA"="c:\users\Käyttäjä\Program Files\DNA\btdna.exe" [2008-12-16 342848]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2007-07-26 192512]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]
    "SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-08-17 102400]
    "Norman ZANDA"="c:\program files\Norman\Npm\bin\ZLH.EXE" [2008-06-02 273520]
    "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
    "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-07-09 36352]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-12-09 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-12-09 173592]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-12-09 150552]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-02 136600]
    "Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 c:\windows\RtHDVCpl.exe]
    "Skytel"="Skytel.exe" [2007-06-15 c:\windows\SkyTel.exe]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{65C14AE8-94D2-4788-812C-CA7BA2526EA9}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
    "TCP Query User{600E0CEB-1CF1-422A-9434-EF09862092DF}c:\\program files\\b2bpoker\\pokerihuone\\jre\\bin\\javaw.exe"= UDP:c:\program files\b2bpoker\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
    "UDP Query User{352AE621-DEC2-4333-9BC8-3BF4A0D7D911}c:\\program files\\b2bpoker\\pokerihuone\\jre\\bin\\javaw.exe"= TCP:c:\program files\b2bpoker\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
    "{829E3431-F9AE-4A36-B45E-467457E94154}"= UDP:c:\limewire\LimeWire.exe:LimeWire
    "{2A2EB5E3-0BA4-421F-9072-E1C747537D21}"= TCP:c:\limewire\LimeWire.exe:LimeWire
    "TCP Query User{67B52A71-777E-4C68-BEA9-3F80EA0D1742}c:\\program files\\mirc\\mirc.exe"= UDP:c:\program files\mirc\mirc.exe:mIRC
    "UDP Query User{A8EBC4C1-B5B6-4912-BBD0-8D3C18593CE5}c:\\program files\\mirc\\mirc.exe"= TCP:c:\program files\mirc\mirc.exe:mIRC
    "TCP Query User{115D2CDE-8EC8-403E-85B7-8BA2066AEB48}c:\\program files\\mirc\\mirc.exe"= UDP:c:\program files\mirc\mirc.exe:mIRC
    "UDP Query User{316606A1-0180-43CD-AC33-D86B78A39065}c:\\program files\\mirc\\mirc.exe"= TCP:c:\program files\mirc\mirc.exe:mIRC
    "TCP Query User{3FD6E4AE-1F56-4E70-8330-2D3E953F70C8}c:\\program files\\steam\\steamapps\\tic_o\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\tic_o\counter-strike source\hl2.exe:hl2
    "UDP Query User{069C6CCD-001B-479F-B068-B49F973F8C6E}c:\\program files\\steam\\steamapps\\tic_o\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\tic_o\counter-strike source\hl2.exe:hl2
    "{11B10A16-0029-47DB-9C72-667FE43BF6A9}"= UDP:c:\program files\Warcraft III\Frozen Throne.exe:Warcraft III - The Frozen Throne
    "{763CAC73-13BF-46A3-B810-D658D44E01FE}"= TCP:c:\program files\Warcraft III\Frozen Throne.exe:Warcraft III - The Frozen Throne
    "TCP Query User{C4309C57-6847-492C-9220-6EAE809493CC}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III
    "UDP Query User{AB1C09FC-357B-4C74-9E86-2894208EE9D2}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III
    "{D8A5DFCF-92B6-4E0C-89C5-242D4E240B1F}"= UDP:c:\program files\WC3Banlist\WC3Banlist.exe:WC3Banlist
    "{D6AE6F46-3D43-46BC-981E-6D411C825DA4}"= TCP:c:\program files\WC3Banlist\WC3Banlist.exe:WC3Banlist
    "{0CBE05B6-F90B-486C-ACF7-C106C6767229}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "{C1FCCD91-759A-45EB-975B-007CBF7E865F}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
    "{FA6B7E74-C112-404C-AFBC-1C2FA03C5746}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
    "{1FFAF5F3-CF4B-41C6-B339-B0A0CF62D77B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
    "{CA88F19D-90F9-4C0E-ACF0-A0E1CE6552B7}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
    "TCP Query User{386DAB8F-C755-4A23-9D0D-7D14AEAA9F2B}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III
    "UDP Query User{4B2AAFC5-8F05-40EA-8F7F-764F4EE21509}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III
    "TCP Query User{FC615E60-9448-4607-830C-A152DA05F736}c:\\program files\\steam\\steamapps\\tic_o\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\tic_o\counter-strike source\hl2.exe:hl2
    "UDP Query User{6C7BAC35-6419-4369-9921-F7010CBDA965}c:\\program files\\steam\\steamapps\\tic_o\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\tic_o\counter-strike source\hl2.exe:hl2
    "TCP Query User{5CFCB65E-08DA-40FC-BC6C-61883A0173EB}c:\\program files\\electronic arts\\eadm\\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
    "UDP Query User{BF30914F-AD99-4008-93CE-573805B03ECB}c:\\program files\\electronic arts\\eadm\\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
    "TCP Query User{521395ED-3891-4460-9EC6-0FF7FB5C16C4}c:\\program files\\electronic arts\\eadm\\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
    "UDP Query User{9F3CB65D-1A1C-4D28-A8DB-FA9EC28A3D69}c:\\program files\\electronic arts\\eadm\\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
    "TCP Query User{02FE0278-3B44-4329-A6DE-72DA698BAF9D}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
    "UDP Query User{0EB75EEF-4DE6-41C8-9804-CF01797719B9}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
    "{8EC18954-105E-4418-8116-957E2B88FF25}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)
    "{1CE39CCA-ED87-437E-985D-C65C2D1E3A7A}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)
    "TCP Query User{5A1E1327-A2D5-4A0C-B654-98AA37629841}c:\\users\\käyttäjä\\program files\\dna\\btdna.exe"= UDP:c:\users\käyttäjä\program files\dna\btdna.exe:btdna.exe
    "UDP Query User{6165EE58-FB7D-4BA2-9CB6-CD9E8AFB1B50}c:\\users\\käyttäjä\\program files\\dna\\btdna.exe"= TCP:c:\users\käyttäjä\program files\dna\btdna.exe:btdna.exe
    "TCP Query User{6A6E4FD6-7713-44A4-9580-70FBEEF3FBF1}c:\\program files\\counter-strike 1.6\\hl.exe"= UDP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
    "UDP Query User{B98D11D3-02A5-4395-AB27-F3CDCEF9BD3D}c:\\program files\\counter-strike 1.6\\hl.exe"= TCP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
    "{72EB78AB-B188-42F4-8599-427653F7DBF5}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
    "{CA956F39-7D4B-4A82-9B6F-EC421E7D2670}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
    "TCP Query User{D27BE586-EE22-456F-9861-72B524D85D3C}c:\\users\\käyttäjä\\desktop\\fiaryhookv1.0.exe"= UDP:c:\users\käyttäjä\desktop\fiaryhookv1.0.exe:fiaryhookv1.0.exe
    "UDP Query User{E653C2F8-0787-4BF5-A3DC-BBC1B2B059DD}c:\\users\\käyttäjä\\desktop\\fiaryhookv1.0.exe"= TCP:c:\users\käyttäjä\desktop\fiaryhookv1.0.exe:fiaryhookv1.0.exe
    "TCP Query User{1A874D3B-429C-4F91-A118-9EB87122340E}c:\\program files\\valve\\counter-strike source\\hl2.exe"= UDP:c:\program files\valve\counter-strike source\hl2.exe:hl2
    "UDP Query User{A9C7CE42-8E50-4A33-B902-5F498A7D8CCD}c:\\program files\\valve\\counter-strike source\\hl2.exe"= TCP:c:\program files\valve\counter-strike source\hl2.exe:hl2
    "TCP Query User{5DBDF36A-1E95-4FA7-ABF6-1F86E7E1B805}c:\\program files\\steam\\steamapps\\fly_guy\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\fly_guy\counter-strike source\hl2.exe:hl2
    "UDP Query User{2711B1FD-40CF-4636-A04E-9AE451578882}c:\\program files\\steam\\steamapps\\fly_guy\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\fly_guy\counter-strike source\hl2.exe:hl2
    "TCP Query User{0834001E-CEE4-4BBF-A632-DA7BA6011847}c:\\program files\\counter-strike 1.6\\hl.exe"= UDP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
    "UDP Query User{0B6CE34A-1FFE-4563-A888-E8376441D953}c:\\program files\\counter-strike 1.6\\hl.exe"= TCP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
    "{CC615E33-9D73-416D-9AA0-EFFF3EA91409}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
    "{DBE9AEA1-323A-4E38-BD05-2D87EC152490}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
    "TCP Query User{BD9D567C-828D-49C5-8308-5A168F6F5740}c:\\program files\\bittorrent\\bittorrent.exe"= UDP:c:\program files\bittorrent\bittorrent.exe:BitTorrent
    "UDP Query User{4BAADB90-AD46-436F-A9EF-9092C097FAA2}c:\\program files\\bittorrent\\bittorrent.exe"= TCP:c:\program files\bittorrent\bittorrent.exe:BitTorrent

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
    "c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

    R1 Hotkey;Hotkey;c:\windows\System32\drivers\HOTKEY.sys [2008-06-23 9867]
    R2 Ndiskio;Ndiskio;c:\program files\Norman\nse\bin\Ndiskio.sys [2008-09-16 20448]
    R3 nsesvc;Norman Scanner Engine Service;c:\program files\Norman\nse\bin\Nsesvc.exe [2009-02-02 183352]
    R3 NvcMFlt;NvcMFlt;c:\windows\System32\drivers\nvcv32mf.sys [2008-09-16 19512]
    R3 nvcoas;Norman Virus Control on-access component;c:\program files\Norman\NVC\bin\Nvcoas.exe [2008-09-16 183352]
    R3 NVCScheduler;Norman Virus Control Scheduler;c:\program files\Norman\NVC\bin\Nvcsched.exe [2008-09-16 146488]
    R3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2008-06-23 118784]
    S3 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [2005-08-02 32512]
    S3 PAC207;SoC PC-Camera;c:\windows\System32\drivers\PFC027.SYS [2006-12-05 507136]

    --- Muut muistissa olevat ajurit/palvelut ---

    *Deregistered* - mchInjDrv
    .
    .
    ------- Täydentävä tarkistus -------
    .
    uInternet Settings,ProxyOverride = *.local
    IE: V&ie Microsoft Exceliin - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    FF - ProfilePath - c:\users\Käyttäjä\AppData\Roaming\Mozilla\Firefox\Profiles\v5kfzyxc.default\
    FF - prefs.js: browser.search.selectedEngine - GoogleCOM
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.fi/
    FF - prefs.js: keyword.URL - hxxp://www.google-searchbar.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
    1 tiedosto(a) on siirretty.
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

    ---- FIREFOXIN KÄYTÄNNÖT ----

    FF - user.js: browser.search.selectedEngine - GoogleCOM
    FF - user.js: keyword.URL - hxxp://www.google-searchbar.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-17 14:34:49
    Windows 6.0.6000 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...


    **************************************************************************
    .
    --------------------- Prosesseihin ladatut DLLt ---------------------

    - - - - - - - > 'Explorer.exe'(684)
    c:\program files\Norman\nvc\bin\Niphk.dll
    .
    Valmistumisajankohta: 2009-02-17 14:38:59
    ComboFix-quarantined-files.txt 2009-02-17 12:37:38

    Ennen ajoa: 100 380 381 184 tavua vapaana
    Ajon jälkeen: 100,541,747,200 tavua vapaana

    231 --- E O F --- 2009-02-17 07:01:43
     
    Ticsi, Feb 17, 2009
    #3
  4. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, Feb 17, 2009
    #4
  5. Ticsi

    Ticsi Member

    Joined:
    Nov 13, 2006
    Messages:
    32
    Likes Received:
    0
    Trophy Points:
    16
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:33:42, on 18.2.2009
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16809)
    Boot mode: Normal

    Running processes:
    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
    C:\Program Files\Norman\Npm\Bin\Zanda.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\LEXBCES.EXE
    C:\Windows\System32\LEXPPS.EXE
    C:\Windows\System32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\Launch Manager\HotkeyApp.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    C:\Program Files\Norman\Npm\Bin\Zlh.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Windows\PixArt\Pac207\Monitor.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Users\Käyttäjä\Program Files\DNA\btdna.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Norman\nse\bin\NSESVC.EXE
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Launch Manager\WisLMSvc.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Norman\Nvc\bin\nvcoas.exe
    C:\Program Files\Norman\Nvc\BIN\NIP.EXE
    C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
    C:\Program Files\Norman\Nvc\bin\cclaw.exe
    C:\Program Files\Ventrilo\Ventrilo.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\SwiftKit\SwiftKit.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
    C:\Program Files\Java\jre6\bin\java.exe
    C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
    C:\Program Files\Java\jre6\bin\java.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [HotkeyApp] "C:\Program Files\Launch Manager\HotkeyApp.exe"
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Käyttäjä\Program Files\DNA\btdna.exe"
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\Windows\System32\LEXBCES.EXE
    O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
    O23 - Service: WisLMSvc - Wistron Corp. - C:\Program Files\Launch Manager\WisLMSvc.exe

    --
    End of file - 8759 bytes
     
    Ticsi, Feb 18, 2009
    #5
  6. Hujo

    Hujo Guest

    eli järjestelmän valvojan oikeudet käyttöön ja poista avira koneelta
     
    Hujo, Feb 18, 2009
    #6

Share This Page