Jos joku viittis mulkasta tätäki..

Discussion in 'Virukset ja haittaohjelmat' started by BOOM04, Jun 10, 2006.

Page 1 of 2
  1. BOOM04

    BOOM04 Member

    Joined:
    Jun 9, 2006
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    11
    SmitFraudFix v2.56

    Scan done at 21:11:13,73, pe 09.06.2006
    Run from C:\Documents and Settings\My Name\Ty”p”yt„\SmitfraudFix
    OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
    Fix ran in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\My Name\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\MyName~1\Suosikit


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End

    Jotai oon saanu ilmeisisti jo poistettua ja
    jotain vikaa koneessa kyllä vielä on. Lisää/poista sovelluksiin ei normaali tilassa pääse koska ei muka ole tarvittavia käyttöoikeuksia.
     
    BOOM04, Jun 10, 2006
    #1
  2. BOOM04

    BOOM04 Member

    Joined:
    Jun 9, 2006
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    11
    Ja vielä että kerio ilmottaa vähän väliä tällästä
    c:\WINDOWS\system32\cidaemon.exe
    ei lähde kerio pois ennen kun antaa luvan tolle. oisko joku daemon tools juttu..
     
    BOOM04, Jun 10, 2006
    #2
  3. Werewolf_

    Werewolf_ Regular member

    Joined:
    Dec 24, 2005
    Messages:
    279
    Likes Received:
    0
    Trophy Points:
    26
    Laitappas HiJackThis lokia niin katsotaan josko sieltä löytyisi jotain epämääräistä.
     
    Werewolf_, Jun 10, 2006
    #3
  4. BOOM04

    BOOM04 Member

    Joined:
    Jun 9, 2006
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of HijackThis v1.99.1
    Scan saved at 16:50:10, on 10.6.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    C:\WINDOWS\ATKKBService.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\WINDOWS\System32\cisvc.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\Program Files\Opera\Opera.exe
    C:\PROGRA~1\MSNMES~1\msnmsgr.exe
    C:\WINDOWS\system32\cidaemon.exe
    E:\Valmiit Imutukset\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [AnyDVD] "C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [ErrorGuard] C:\Program Files\ErrorGuard\ErrorGuard.Exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe

     
    BOOM04, Jun 10, 2006
    #4
  5. Werewolf_

    Werewolf_ Regular member

    Joined:
    Dec 24, 2005
    Messages:
    279
    Likes Received:
    0
    Trophy Points:
    26
    HJT, Do a system scan only, merkkaa jos katsot tarpeettomaksi
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

    Onko tietokoneessa kuinka monta käyttäjätiliä? Jos on useita, kannattaa tarkistaa tilien oikeudet näin:
    1. Käynnistä valikko --> Suorita --> kirjoita msconfig
    2. BOOT.INI välilehti,laita rasti kohtaan safeboot
    3. Paina ok, valitse joko käynnistä uudelleen tai myöhemmin.
    4. Käynnistyessä tiliä valittaessa valitse Järjestelmän valvoja
    5. Sitten ohjauspaneeliin, sieltä Käyttäjätilit.
    Alla näkyy tilien nimet ja arvot. Jos tilissä jota käytät normaalisti lukee rajattu tili tai muuta, muttei Järjestelmänvalvoja, voit muokata sen seuraavasti.
    1. Valitse muutettava tili
    2. Muuta Tilintyyppiä, vaihda tyypiksi Järjestelmänvalvoja.
    ja paina vaihda tilin tyyppiä.

    Noonin, nyt pitäisi oikeudet olla kunnossa. sitten tehdään taas
    1. Käynnistä valikko --> Suorita --> kirjoita msconfig
    2. Yleiset välilehti,laita rasti kohtaan Normaali käynnistys - lataa kaikki laiteohjaimet ja palvelut
    3. Paina ok, valitse joko käynnistä uudelleen.

    Sitten pitäisi olla oikeudet laitettu kuntoon :)
     
    Werewolf_, Jun 10, 2006
    #5
  6. BOOM04

    BOOM04 Member

    Joined:
    Jun 9, 2006
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    11
    poistin ton winamp jutun..
    ja tein ton tili homman..käyttämälläni tilillä oli järjestelmävalvoja oikeudet jo valmiiks,mut homma ei pelitä.
    herjaa samaa juttua edelleen..
     
    BOOM04, Jun 10, 2006
    #6
  7. Chi

    Chi Regular member

    Joined:
    Sep 15, 2005
    Messages:
    162
    Likes Received:
    0
    Trophy Points:
    26
    Cidaemon.exe on "indexing service", eli järkkäilee kai filuja koneellasi jotta ne mm. löytyisivät nopeammin. Microsoftin juttu muistaakseni..?
     
    Chi, Jun 10, 2006
    #7
  8. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Käynnistä -> suorita -> services.msc -> ok
    Etsi Indeksointipalvelu, tuplaklikkaa, paina seis ja valitse käynnistymistavaksi ei käytössä.

    Tuo pitäisi auttaa
    c:\WINDOWS\system32\cidaemon.exe-juttuun :)
     
    -kemisti-, Jun 10, 2006
    #8
  9. Werewolf_

    Werewolf_ Regular member

    Joined:
    Dec 24, 2005
    Messages:
    279
    Likes Received:
    0
    Trophy Points:
    26
    Tuokin on tiettävästi virussofta, ainakin mitä googlen löydöt antoivat ymmärtää:

    HJT, do a system scan only ja merkkaa
    O4 - HKLM\..\Run: [ErrorGuard] C:\Program Files\ErrorGuard\ErrorGuard.Exe

    Mitä löysin googlella, tuo kyseessä oleva ohjelma on adware.

    jaa jaa :)
     
    Last edited: Jun 10, 2006
    Werewolf_, Jun 10, 2006
    #9
  10. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    ErrorGuard lähtee pois ohjauspaneelista ja sen jälkeen poistamalla:
    C:\Program Files\ErrorGuard, ei muuta tarvita :)
     
    -kemisti-, Jun 10, 2006
    #10
  11. BOOM04

    BOOM04 Member

    Joined:
    Jun 9, 2006
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    11
    Kiitoksia neuvoista,mutta käyttöoikeudet jumittaa vieläkin.Eli esim ohjauspaneelissa en voi tehdä mitään.

    Tuossa ekassa viestissäni luki nämä jutut.onko syytä huoleen?lähinnä toi wininet huolettaa.


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End








    Tässä uusin..


    Logfile of HijackThis v1.99.1
    Scan saved at 14:35:25, on 11.6.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    C:\WINDOWS\ATKKBService.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\PROGRA~1\MSNMES~1\msnmsgr.exe
    C:\Program Files\Opera\Opera.exe
    E:\Valmiit Imutukset\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [AnyDVD] "C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\\SmartDoctor.exe /start
    O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
     
    BOOM04, Jun 11, 2006
    #11
  12. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Tämä -> Scanning wininet.dll infection
    tarkoittaa, että ohjelma tutkii onko wininet.dll saastunut.

    Oletko kirjautunut järjestelmänvalvojana sisään?

     
    -kemisti-, Jun 11, 2006
    #12
  13. BOOM04

    BOOM04 Member

    Joined:
    Jun 9, 2006
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    11
    molemmat tilit on järjestelmänvalvojia..niin lukee ainaki ohjauspaneelin tilit jutussa
     
    BOOM04, Jun 11, 2006
    #13
  14. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Katotaan sitten tämä:

    Lataa http://www.bleepingcomputer.com/files/oldtimer/WinPFind.zip WinPFind työpöydällesi.

    Pura tiedoston WinPFind.zip sisältö (kansio WinPFind) C aseman juureen.

    Mene sitten kansioon C:\WinPFind ja tuplaklikkaa tiedostoa WinPFind.exe, ohjelma käynnistyy.

    Paina Start Scan painiketta ja odota kunnes skannaus on valmis. Ohjelma skannaa todella suuren määrään tiedostoja etsien vastaavuutta haittaohjelmille tyypillisiin tiedostoihin, joten ole kärsivällinen ja anna ohjelman skannata. Skannaus saattaa kestää jopa yli 30 minuuttia.

    Kun skannaus on valmis, ohjelma näyttää skannaustuloksen. Paina Copy to Clipboard painiketta, tulos kopioituu leikepöydälle. Avaa sitten Muistio ja liitä tulos siihen, tallenna dokumentti työpöydälle nimellä WinPFind loki. Liitä sitten tämän dokumentin sisältö viestiketjuusi.
     
    -kemisti-, Jun 11, 2006
    #14
  15. BOOM04

    BOOM04 Member

    Joined:
    Jun 9, 2006
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    11
    WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

    If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

    »»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600
    Internet Explorer Version: 6.0.2900.2180

    »»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

    Checking %SystemDrive% folder...

    Checking %ProgramFilesDir% folder...

    Checking %WinDir% folder...
    UPX! 22.8.2004 18:04:56 69120 C:\WINDOWS\daemon.dll
    UPX! 20.5.2006 21:23:54 191062016 C:\WINDOWS\MEMORY.DMP
    FSG! 20.5.2006 21:23:54 191062016 C:\WINDOWS\MEMORY.DMP
    PEC2 20.5.2006 21:23:54 191062016 C:\WINDOWS\MEMORY.DMP
    qoologic 20.5.2006 21:23:54 191062016 C:\WINDOWS\MEMORY.DMP
    aspack 20.5.2006 21:23:54 191062016 C:\WINDOWS\MEMORY.DMP
    UPX! 17.2.2006 18:23:28 451072 C:\WINDOWS\Radeon Omega Drivers v3.8.205 Uninstall.exe

    Checking %System% folder...
    UPX! 26.1.2004 7:28:12 325120 C:\WINDOWS\SYSTEM32\avisynth.dll
    aspack 26.5.2005 16:34:52 2297552 C:\WINDOWS\SYSTEM32\d3dx9_26.dll
    UPX! 11.4.2003 3:57:30 269312 C:\WINDOWS\SYSTEM32\devil.dll
    PEC2 9.10.2001 15:00:00 41113 C:\WINDOWS\SYSTEM32\dfrg.msc
    PECompact2 4.5.2006 7:26:22 5818784 C:\WINDOWS\SYSTEM32\MRT.exe
    aspack 4.5.2006 7:26:22 5818784 C:\WINDOWS\SYSTEM32\MRT.exe
    aspack 14.9.2004 17:11:38 701952 C:\WINDOWS\SYSTEM32\ntdll.dll
    Umonitor 14.9.2004 17:11:56 661504 C:\WINDOWS\SYSTEM32\rasdlg.dll
    UPX! 27.4.2006 17:49:30 288417 C:\WINDOWS\SYSTEM32\SrchSTS.exe
    UPX! 9.1.2006 10:36:04 42496 C:\WINDOWS\SYSTEM32\swreg.exe
    UPX! 9.1.2006 10:36:06 40960 C:\WINDOWS\SYSTEM32\swsc.exe
    winsync 9.10.2001 15:00:00 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu

    Checking %System%\Drivers folder and sub-folders...
    UPX! 24.5.2006 18:34:14 776096 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys
    FSG! 24.5.2006 18:34:14 776096 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys
    PEC2 24.5.2006 18:34:14 776096 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys
    aspack 24.5.2006 18:34:14 776096 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys
    PTech 3.8.2004 23:41:38 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys

    Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts


    Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
    10.6.2006 19:10:52 S 2048 C:\WINDOWS\bootstat.dat
    5.6.2006 16:37:18 H 54156 C:\WINDOWS\QTFont.qfn
    11.6.2006 14:47:56 H 0 C:\WINDOWS\LastGood\INF\oem26.inf
    11.6.2006 14:47:56 H 0 C:\WINDOWS\LastGood\INF\oem26.PNF
    11.6.2006 8:16:08 H 1024 C:\WINDOWS\system32\config\default.LOG
    10.6.2006 19:10:54 H 1024 C:\WINDOWS\system32\config\SAM.LOG
    11.6.2006 0:10:16 H 1024 C:\WINDOWS\system32\config\SECURITY.LOG
    11.6.2006 15:01:00 H 1024 C:\WINDOWS\system32\config\software.LOG
    11.6.2006 15:00:52 H 1024 C:\WINDOWS\system32\config\system.LOG
    13.4.2006 16:19:08 H 1024 C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
    14.5.2006 22:49:58 HS 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\b7df00f5-c96d-4138-b76f-0bb251d6b0cf
    14.5.2006 22:49:58 HS 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\Preferred
    10.6.2006 19:10:56 H 6 C:\WINDOWS\Tasks\SA.DAT
    6.6.2006 17:27:06 HS 113 C:\WINDOWS\Temp\Sivuhistoria\History.IE5\desktop.ini
    6.6.2006 17:27:06 HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\desktop.ini
    6.6.2006 17:27:06 HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\24323QUM\desktop.ini
    6.6.2006 17:27:06 HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ANIR753D\desktop.ini
    6.6.2006 17:27:06 HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\DG43HT2J\desktop.ini
    6.6.2006 17:27:06 HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\UAJQ4FVS\desktop.ini

    Checking for CPL files...
    Microsoft Corporation 14.9.2004 17:12:08 70144 C:\WINDOWS\SYSTEM32\access.cpl
    Realtek Semiconductor Corp. 22.6.2005 9:27:04 R 18751488 C:\WINDOWS\SYSTEM32\ALSNDMGR.CPL
    Microsoft Corporation 14.9.2004 17:12:08 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl
    Microsoft Corporation 14.9.2004 17:12:10 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl
    Microsoft Corporation 14.9.2004 17:12:10 135168 C:\WINDOWS\SYSTEM32\desk.cpl
    Microsoft Corporation 14.9.2004 17:12:10 80384 C:\WINDOWS\SYSTEM32\firewall.cpl
    Microsoft Corporation 14.9.2004 17:12:10 154624 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
    Ahead Software AG 15.9.2003 15:56:02 57344 C:\WINDOWS\SYSTEM32\ImageDrive.cpl
    Microsoft Corporation 14.9.2004 17:12:10 359424 C:\WINDOWS\SYSTEM32\inetcpl.cpl
    Microsoft Corporation 14.9.2004 17:12:10 129536 C:\WINDOWS\SYSTEM32\intl.cpl
    Microsoft Corporation 14.9.2004 17:12:10 380416 C:\WINDOWS\SYSTEM32\irprops.cpl
    Microsoft Corporation 14.9.2004 17:12:10 68608 C:\WINDOWS\SYSTEM32\joy.cpl
    Sun Microsystems, Inc. 10.11.2005 14:03:50 49265 C:\WINDOWS\SYSTEM32\jpicpl32.cpl
    Microsoft Corporation 9.10.2001 15:00:00 188416 C:\WINDOWS\SYSTEM32\main.cpl
    Microsoft Corporation 14.9.2004 17:12:10 620032 C:\WINDOWS\SYSTEM32\mmsys.cpl
    Microsoft Corporation 9.10.2001 15:00:00 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl
    Microsoft Corporation 14.9.2004 17:12:10 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl
    Microsoft Corporation 14.9.2004 17:12:10 256000 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
    Microsoft Corporation 9.10.2001 15:00:00 37376 C:\WINDOWS\SYSTEM32\nwc.cpl
    Microsoft Corporation 14.9.2004 17:12:10 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl
    Microsoft Corporation 14.9.2004 17:12:10 115200 C:\WINDOWS\SYSTEM32\powercfg.cpl
    Apple Computer, Inc. 14.12.2003 10:20:50 323072 C:\WINDOWS\SYSTEM32\QuickTime.cpl
    Microsoft Corporation 14.9.2004 17:12:10 299008 C:\WINDOWS\SYSTEM32\sysdm.cpl
    Microsoft Corporation 9.10.2001 15:00:00 28160 C:\WINDOWS\SYSTEM32\telephon.cpl
    Microsoft Corporation 14.9.2004 17:12:10 93696 C:\WINDOWS\SYSTEM32\timedate.cpl
    Microsoft Corporation 14.9.2004 17:12:10 148480 C:\WINDOWS\SYSTEM32\wscui.cpl
    Microsoft Corporation 26.5.2005 5:16:30 174872 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
    Microsoft Corporation 9.10.2001 15:00:00 188416 C:\WINDOWS\SYSTEM32\dllcache\main.cpl
    Microsoft Corporation 9.10.2001 15:00:00 35840 C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl
    Microsoft Corporation 9.10.2001 15:00:00 37376 C:\WINDOWS\SYSTEM32\dllcache\nwc.cpl
    Microsoft Corporation 9.10.2001 15:00:00 28160 C:\WINDOWS\SYSTEM32\dllcache\telephon.cpl
    Microsoft Corporation 26.5.2005 5:16:30 174872 C:\WINDOWS\SYSTEM32\dllcache\wuaucpl.cpl
    Realtek Semiconductor Corp. 22.6.2005 9:27:04 R 18751488 C:\WINDOWS\SYSTEM32\ReinstallBackups\0003\DriverFiles\ALSNDMGR.CPL

    »»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

    Checking files in %ALLUSERSPROFILE%\Startup folder...
    28.12.2005 22:30:12 1757 C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\Adobe Reader Speed Launch.lnk
    27.12.2005 2:41:02 HS 84 C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\desktop.ini
    28.12.2005 20:21:58 1730 C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\Microsoft Office.lnk
    10.1.2006 22:05:12 1648 C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\NkbMonitor.exe.lnk

    Checking files in %ALLUSERSPROFILE%\Application Data folder...
    27.12.2005 2:31:22 HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini

    Checking files in %USERPROFILE%\Startup folder...
    27.12.2005 2:41:02 HS 84 C:\Documents and Settings\Jani Myllynen\Käynnistä-valikko\Ohjelmat\Käynnistys\desktop.ini

    Checking files in %USERPROFILE%\Application Data folder...
    27.12.2005 2:31:22 HS 62 C:\Documents and Settings\Jani Myllynen\Application Data\desktop.ini
    26.5.2006 20:16:16 17144 C:\Documents and Settings\Jani Myllynen\Application Data\GDIPFONTCACHEV1.DAT

    »»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    SV1 =

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

    [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\AVG7 Shell Extension
    {9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG Free\avgse.dll
    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
    {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
    {09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
    {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR
    {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll
    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
    Käynnistä-valikon nasta = %SystemRoot%\system32\SHELL32.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\AVG7 Shell Extension
    {9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG Free\avgse.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR
    {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
    {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
    {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
    {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR
    {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
    = %SystemRoot%\system32\SHELL32.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
    = %SystemRoot%\system32\SHELL32.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
    = %SystemRoot%\system32\SHELL32.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
    = %SystemRoot%\system32\SHELL32.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{F9DB5320-233E-11D1-9F84-707F02C10627}
    = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll

    [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
    AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
    SSVHelper Class = C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}
    ST = C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
    MSNToolBandBHO = C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
    &Päivän vihje = %SystemRoot%\System32\shdocvw.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
    MenuText = Sun Java Console : C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
    ButtonText = Messenger : C:\Program Files\Messenger\msmsgs.exe

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}
    =

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
    {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Lähiosoite : %SystemRoot%\System32\browseui.dll
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
    {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Lähiosoite : %SystemRoot%\System32\browseui.dll
    {0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Linkit : %SystemRoot%\system32\SHELL32.dll
    {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} = MSN : C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    SunJavaUpdateSched C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    SoundMan SOUNDMAN.EXE
    QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
    NeroCheck C:\WINDOWS\system32\NeroCheck.exe
    Anti-Blaxx Manager C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
    AVG7_CC C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    ATIPTA C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    NVMixerTray "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    AnyDVD "C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
    MessengerPlus3 "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    KernelFaultCheck %systemroot%\system32\dumprep 0 -k

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
    IMAIL Installed = 1
    MAPI Installed = 1
    MSFS Installed = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    CTFMON.EXE C:\WINDOWS\system32\ctfmon.exe
    MSMSGS "C:\Program Files\Messenger\msmsgs.exe" /background
    Skype "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    MessengerPlus3 "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
    ASUS SmartDoctor C:\Program Files\ASUS\SmartDoctor\\SmartDoctor.exe /start
    msnmsgr "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state
    system.ini 0
    win.ini 0
    bootini 0
    services 0
    startup 0


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
    {BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
    {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
    {0DF44EAA-FF21-4412-828E-260A8728E7F1} =


    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
    dontdisplaylastusername 0
    legalnoticecaption
    legalnoticetext
    shutdownwithoutlogon 1
    undockwithoutlogon 1


    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
    NoDriveTypeAutoRun 145

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
    CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
    WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
    SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    UserInit = C:\WINDOWS\system32\userinit.exe,
    Shell = Explorer.exe
    System =

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent
    = Ati2evxx.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
    = crypt32.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
    = cryptnet.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
    = cscdll.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
    = wlnotify.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
    = wlnotify.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
    = sclgntfy.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
    = WlNotify.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
    = wlnotify.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
    = wlnotify.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
    Debugger = ntsd -d

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    AppInit_DLLs


    »»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder.
    Scan completed on 11.6.2006 15:09:27
     
    BOOM04, Jun 11, 2006
    #15
  16. BOOM04

    BOOM04 Member

    Joined:
    Jun 9, 2006
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    11
    laitoin piruuttani ton kasperskyn scannaileen..5% tehny ja 1 virus ja 2 saastunutta filua jo löytäny =)
     
    BOOM04, Jun 11, 2006
    #16
  17. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Tuo loki on ok. Lähetä ne kasperskyn tulokset tänne kun valmis :)
     
    -kemisti-, Jun 11, 2006
    #17
  18. BOOM04

    BOOM04 Member

    Joined:
    Jun 9, 2006
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    11
    C:\Documents and Settings\Jani Myllynen\Local Settings\Temp\~nsu.tmp\Au_.exe/data0003 Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped
    C:\Documents and Settings\Jani Myllynen\Local Settings\Temp\~nsu.tmp\Au_.exe NSIS: infected - 1 skipped
    C:\System Volume Information\_restore{DD841BC7-1FA9-4CF1-AC3D-5B253D1AEA0B}\RP178\A0053638.exe/data0003 Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped
    C:\System Volume Information\_restore{DD841BC7-1FA9-4CF1-AC3D-5B253D1AEA0B}\RP178\A0053638.exe NSIS: infected - 1 skipped
    C:\System Volume Information\_restore{DD841BC7-1FA9-4CF1-AC3D-5B253D1AEA0B}\RP178\A0053661.exe Infected: Trojan-Downloader.Win32.Zlob.rf skipped
    D:\Civilization4.fix.exe/EXE-file Infected: Trojan-Proxy.Win32.Delf.aj skipped
    D:\Civilization4.fix.exe Embedded EXE: infected - 1 skipped
    D:\Jako\SmileyCentralPFSetup2.0.3.8-2.exe Infected: not-a-virus:AdWare.Win32.MyWebSearch skipped
    E:\Valmiit Imutukset\[PC GAME NO CD] Civilization 4 crack.zip/install.exe/irsetup.dat Infected: P2P-Worm.Win32.Insta.a skipped
    E:\Valmiit Imutukset\[PC GAME NO CD] Civilization 4 crack.zip/install.exe/upd.exe Infected: not-a-virus:RiskTool.Win32.PsKill.1101 skipped
    E:\Valmiit Imutukset\[PC GAME NO CD] Civilization 4 crack.zip/install.exe/cmdo.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
    E:\Valmiit Imutukset\[PC GAME NO CD] Civilization 4 crack.zip/install.exe/username.exe Infected: not-a-virus:AdWare.Win32.EliteBar.ba skipped
    E:\Valmiit Imutukset\[PC GAME NO CD] Civilization 4 crack.zip/install.exe/smmss.exe Infected: not-a-virus:AdWare.Win32.EZula.bg skipped
    E:\Valmiit Imutukset\[PC GAME NO CD] Civilization 4 crack.zip/install.exe/cheat_plugin.exe/data0001 Infected: Trojan-Downloader.Win32.IstBar.ja skipped
    E:\Valmiit Imutukset\[PC GAME NO CD] Civilization 4 crack.zip/install.exe/cheat_plugin.exe/data0003 Infected: Trojan-Downloader.Win32.IstBar.ny skipped
    E:\Valmiit Imutukset\[PC GAME NO CD] Civilization 4 crack.zip/install.exe/cheat_plugin.exe Infected: Trojan-Downloader.Win32.IstBar.ny skipped
    E:\Valmiit Imutukset\[PC GAME NO CD] Civilization 4 crack.zip/install.exe/expIorer.exe Infected: Trojan-Dropper.Win32.Pakes skipped
    E:\Valmiit Imutukset\[PC GAME NO CD] Civilization 4 crack.zip/install.exe Infected: Trojan-Dropper.Win32.Pakes skipped
    E:\Valmiit Imutukset\[PC GAME NO CD] Civilization 4 crack.zip ZIP: infected - 10 skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack\install.exe/irsetup.dat Infected: P2P-Worm.Win32.Insta.a skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack\install.exe/upd.exe Infected: not-a-virus:RiskTool.Win32.PsKill.1101 skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack\install.exe/cmdo.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack\install.exe/username.exe Infected: not-a-virus:AdWare.Win32.EliteBar.ba skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack\install.exe/smmss.exe Infected: not-a-virus:AdWare.Win32.EZula.bg skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack\install.exe/cheat_plugin.exe/data0001 Infected: Trojan-Downloader.Win32.IstBar.ja skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack\install.exe/cheat_plugin.exe/data0003 Infected: Trojan-Downloader.Win32.IstBar.ny skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack\install.exe/cheat_plugin.exe Infected: Trojan-Downloader.Win32.IstBar.ny skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack\install.exe/expIorer.exe Infected: Trojan-Dropper.Win32.Pakes skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack\install.exe SetupFactory: infected - 9 skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack.zip/install.exe/irsetup.dat Infected: P2P-Worm.Win32.Insta.a skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack.zip/install.exe/upd.exe Infected: not-a-virus:RiskTool.Win32.PsKill.1101 skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack.zip/install.exe/cmdo.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack.zip/install.exe/username.exe Infected: not-a-virus:AdWare.Win32.EliteBar.ba skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack.zip/install.exe/smmss.exe Infected: not-a-virus:AdWare.Win32.EZula.bg skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack.zip/install.exe/cheat_plugin.exe/data0001 Infected: Trojan-Downloader.Win32.IstBar.ja skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack.zip/install.exe/cheat_plugin.exe/data0003 Infected: Trojan-Downloader.Win32.IstBar.ny skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack.zip/install.exe/cheat_plugin.exe Infected: Trojan-Downloader.Win32.IstBar.ny skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack.zip/install.exe/expIorer.exe Infected: Trojan-Dropper.Win32.Pakes skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack.zip/install.exe Infected: Trojan-Dropper.Win32.Pakes skipped
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack.zip ZIP: infected - 10 skipped
     
    BOOM04, Jun 11, 2006
    #18
  19. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Poista nuo:

    D:\Civilization4.fix.exe
    D:\Jako\SmileyCentralPFSetup2.0.3.8-2.exe
    E:\Valmiit Imutukset\[PC GAME NO CD] Civilization 4 crack.zip
    E:\Valmiit Imutukset\[PC GAME] Civilization 4 no cd crack

    Ja putsaa järjestelmän palautus:

    1. Valitse Oma tietokone (klikkaa oikealla).
    2. Valitse Ominaisuudet.
    3. Valitse Järjestelmän palauttaminen- välilehti.
    4. Valitse "Poista järjestelmän palauttaminen käytöstä".
    5. Paina Käytä.
    6. Paina OK.
    7. Käynnistä kone uudelleen
    8. Tee kohdat 1.-3.
    9. Ota rasti pois kohdasta "Poista järjestelmän palauttaminen käytöstä"
    10. Tee kohdat 5. ja 6.
     
    -kemisti-, Jun 11, 2006
    #19
  20. BOOM04

    BOOM04 Member

    Joined:
    Jun 9, 2006
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    11
    sain sen putsattua, mutta en saa ruksia enään pois koska se pitää tehdä normaali tilassa ja normaali tilassa ei ole oikeuksia tehhdä sitä.hämärää..
     
    BOOM04, Jun 11, 2006
    #20
Page 1 of 2

Share This Page