Kompuutteri hidastelee.. HJT-logia näytillä.

Eilen illalla alko takkuilee. Voisko joku tarkistaa login?
Kiitokset etukäteen.
____

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:06:18, on 12.6.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\lg_swupdate\GiljabiStart.exe
C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.lge.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [LG Intelligent Update] "C:\Program Files\lg_swupdate\giljabistart.exe" Gilautouc
O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O13 - Gopher Prefix:
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Evil Driver Daemon (NishService) - Unknown owner - C:\Program Files\LG Software\System Control Manager\edd.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Oz128 Driver\o2flash.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

--
End of file - 5192 bytes
____

 

1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

 

Tässä tätä ComboFix lokia..

ComboFix 08-06-20.4 - Trans Logicenter 2008-06-23 14:28:10.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1035.18.1388 [GMT 3:00]
Running from: C:\Users\Trans Logicenter\Desktop\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Users\Trans Logicenter\AppData\Roaming\inst.exe

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-23 to 2008-06-23 )))))))))))))))))
.

2008-06-22 10:42 . 2008-06-22 10:42 3,261 --a------ C:\Windows\E220AutoRunLog.tmp
2008-06-22 10:41 . 2008-06-22 10:41 <KANSIO> d-------- C:\Program Files\Vodafone
2008-06-22 10:41 . 2007-04-16 12:02 101,120 --a------ C:\Windows\System32\drivers\ewusbmdm.sys
2008-06-16 02:41 . 2008-06-16 02:41 <KANSIO> d-------- C:\Program Files\Screamer Radio
2008-06-15 22:31 . 2008-06-15 22:31 <KANSIO> dr------- C:\Windows\System32\config\systemprofile\Music
2008-06-15 20:11 . 2008-06-15 20:11 <KANSIO> d-------- C:\Program Files\VstPlugins
2008-06-15 20:11 . 2008-06-15 20:11 <KANSIO> d-------- C:\Program Files\Outsim
2008-06-15 20:11 . 2002-07-08 01:14 1,294,336 --a------ C:\Windows\System32\vorbis.acm
2008-06-15 20:11 . 2006-06-20 11:56 225,280 --a------ C:\Windows\System32\rewire.dll
2008-06-15 20:09 . 2008-06-18 01:40 <KANSIO> d-------- C:\Program Files\Image-Line
2008-06-13 11:54 . 2008-06-13 11:54 <KANSIO> d-------- C:\Users\Trans Logicenter\AppData\Roaming\teamspeak2
2008-06-13 11:54 . 2008-06-13 11:54 <KANSIO> d-------- C:\Program Files\Teamspeak2_RC2
2008-06-13 11:54 . 2008-06-13 11:54 34,064 --a------ C:\Windows\System32\lhacm.acm
2008-06-12 13:53 . 2008-06-12 13:55 <KANSIO> d-------- C:\Users\Trans Logicenter\AppData\Roaming\Hamachi
2008-06-12 13:53 . 2008-06-12 13:53 25,280 --a------ C:\Windows\System32\drivers\hamachi.sys
2008-06-12 10:22 . 2008-06-12 10:29 <KANSIO> d-------- C:\Users\All Users\Lavasoft
2008-06-12 10:22 . 2008-06-12 10:29 <KANSIO> d-------- C:\ProgramData\Lavasoft
2008-06-12 10:22 . 2008-06-12 10:22 <KANSIO> d-------- C:\Program Files\Lavasoft
2008-06-12 10:21 . 2008-06-22 10:41 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-12 03:05 . 2008-06-12 03:05 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-06-10 13:42 . 2008-06-10 13:43 <KANSIO> d-------- C:\Users\Trans Logicenter\AppData\Roaming\Fireshot
2008-06-10 13:42 . 2008-06-10 13:42 <KANSIO> d--hs---- C:\Users\All Users\System Restore
2008-06-10 13:42 . 2008-06-10 13:42 <KANSIO> d--hs---- C:\ProgramData\System Restore
2008-06-08 20:20 . 2008-06-08 20:30 <KANSIO> d-------- C:\Program Files\SopCast
2008-06-08 12:30 . 2008-06-08 17:31 <KANSIO> d-------- C:\Users\Trans Logicenter\AppData\Roaming\Xfire
2008-06-08 12:30 . 2008-06-08 17:28 <KANSIO> d-------- C:\Users\All Users\Xfire
2008-06-08 12:30 . 2008-06-08 17:28 <KANSIO> d-------- C:\ProgramData\Xfire
2008-06-08 12:29 . 2008-06-08 12:30 <KANSIO> d-------- C:\Program Files\Xfire
2008-06-07 21:38 . 2008-06-07 21:38 <KANSIO> d-------- C:\ATI
2008-06-06 23:26 . 2008-06-07 12:56 <KANSIO> d-------- C:\Program Files\VirtualDJ
2008-05-30 18:53 . 2008-05-30 18:53 <KANSIO> d-------- C:\Users\Trans Logicenter\AppData\Roaming\KompoZer
2008-05-29 23:31 . 2008-05-29 23:31 <KANSIO> d-------- C:\Users\Trans Logicenter\AppData\Roaming\Thunderbird
2008-05-29 23:31 . 2008-05-29 23:31 <KANSIO> d-------- C:\Program Files\Mozilla Thunderbird
2008-05-29 23:31 . 2008-05-29 23:31 0 --a------ C:\Windows\nsreg.dat
2008-05-28 10:53 . 2008-05-28 10:53 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-05-27 20:26 . 2008-03-08 05:08 4,240,384 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-05-27 20:26 . 2008-03-08 07:21 1,695,744 --a------ C:\Windows\System32\gameux.dll
2008-05-26 22:46 . 2008-06-18 16:29 22,328 --a------ C:\Windows\System32\drivers\PnkBstrK.sys
2008-05-26 22:46 . 2008-05-26 22:46 22,328 --a------ C:\Users\Trans Logicenter\AppData\Roaming\PnkBstrK.sys
2008-05-26 22:45 . 2008-05-26 22:45 674,600 --a------ C:\Windows\System32\pbsvc.exe
2008-05-26 22:45 . 2008-06-18 16:29 107,832 --a------ C:\Windows\System32\PnkBstrB.exe
2008-05-26 22:45 . 2008-05-26 22:45 66,872 --a------ C:\Windows\System32\PnkBstrA.exe
2008-05-25 19:34 . 2008-05-25 19:34 <KANSIO> d-------- C:\PerfLogs
2008-05-25 14:02 . 2008-05-25 14:02 <KANSIO> d-------- C:\Program Files\MSXML 4.0
2008-05-25 00:48 . 2008-05-25 00:48 <KANSIO> d-------- C:\Users\Trans Logicenter\AppData\Roaming\DeepBurner
2008-05-25 00:47 . 2008-05-25 00:47 <KANSIO> d-------- C:\Program Files\Astonsoft
2008-05-24 22:15 . 2008-05-24 23:29 <KANSIO> d-------- C:\Program Files\PeerGuardian2
2008-05-24 12:23 . 2008-05-24 12:37 <KANSIO> d-------- C:\Users\Trans Logicenter\AppData\Roaming\CopyToDvd
2008-05-24 12:18 . 2008-05-28 00:24 <KANSIO> d-------- C:\Users\Trans Logicenter\AppData\Roaming\Vso
2008-05-24 12:18 . 2008-05-24 12:18 47,360 --a------ C:\Windows\System32\drivers\pcouffin.sys
2008-05-24 12:18 . 2008-05-28 00:24 47,360 --a------ C:\Users\Trans Logicenter\AppData\Roaming\pcouffin.sys

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-22 07:41 --------- d-----w C:\Program Files\Vodafone
2008-06-18 13:17 --------- d-----w C:\Users\Trans Logicenter\AppData\Roaming\uTorrent
2008-06-15 21:51 --------- d-----w C:\Users\Trans Logicenter\AppData\Roaming\Winamp
2008-06-15 17:11 --------- d-----w C:\Program Files\VstPlugins
2008-06-12 07:26 12,632 ----a-w C:\Windows\System32\lsdelete.exe
2008-06-12 00:02 --------- d-----w C:\Program Files\ApexDC++
2008-06-11 00:46 --------- d-----w C:\Program Files\Windows Mail
2008-06-09 14:46 --------- d-----w C:\Users\Trans Logicenter\AppData\Roaming\OpenOffice.org2
2008-06-08 09:14 --------- d-----w C:\Program Files\ATI
2008-06-07 18:27 --------- d-----w C:\Program Files\lg_swupdate
2008-06-07 09:56 --------- d-----w C:\Program Files\VirtualDJ
2008-05-30 16:48 --------- d-----w C:\Users\Trans Logicenter\AppData\Roaming\FileZilla
2008-05-27 21:24 --------- d-----w C:\Users\Trans Logicenter\AppData\Roaming\Vso
2008-05-25 22:42 --------- d-----w C:\Program Files\America's Army
2008-05-25 16:44 174 --sha-w C:\Program Files\desktop.ini
2008-05-25 16:37 --------- d-----w C:\Program Files\Windows Sidebar
2008-05-25 16:37 --------- d-----w C:\Program Files\Windows Calendar
2008-05-25 16:36 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-05-25 16:36 --------- d-----w C:\Program Files\Windows Journal
2008-05-25 16:36 --------- d-----w C:\Program Files\Windows Defender
2008-05-25 16:36 --------- d-----w C:\Program Files\Windows Collaboration
2008-05-25 15:01 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-05-25 15:01 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-05-21 20:29 --------- d-----w C:\Program Files\America's Army Server Manager
2008-05-21 20:25 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-21 19:16 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2008-05-21 19:12 --------- d-----w C:\Program Files\Microsoft IntelliPoint
2008-05-18 20:25 --------- d-----w C:\Program Files\Paint.NET
2008-05-18 15:34 --------- d-----w C:\Users\Trans Logicenter\AppData\Roaming\Mp3tag
2008-05-18 15:12 --------- d-----w C:\Program Files\Mp3tag
2008-05-18 15:12 --------- d-----w C:\Program Files\mp3DirectCut
2008-05-18 14:24 --------- d-----w C:\Program Files\Java
2008-05-18 14:23 --------- d-----w C:\Program Files\Common Files\Java
2008-05-14 05:05 --------- d-----w C:\Program Files\OpenOffice.org 2.4
2008-05-14 01:28 41,296 ----a-w C:\Windows\System32\xfcodec.dll
2008-05-11 16:01 --------- d-----w C:\Program Files\uTorrent
2008-05-10 01:33 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys
2008-05-07 06:55 767,488 ----a-w C:\Windows\system32\drivers\athr.sys
2008-05-07 03:25 --------- d-----w C:\Program Files\FileZilla FTP Client
2008-05-06 14:39 --------- d-----w C:\Users\Trans Logicenter\AppData\Roaming\Nvu
2008-05-05 18:48 --------- d-----w C:\Program Files\Common Files\Adobe
2008-04-29 06:31 --------- d-----w C:\Program Files\ffdshow
2008-04-29 05:51 --------- d-----w C:\Users\Trans Logicenter\AppData\Roaming\Media Player Classic
2008-04-29 04:53 --------- d-----w C:\ProgramData\Messenger Plus!
2008-04-27 14:49 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-04-27 14:35 --------- d-----w C:\Program Files\Winamp
2008-04-27 12:21 --------- d-----w C:\Users\Trans Logicenter\AppData\Roaming\TVU Networks
2008-04-27 12:19 --------- d-----w C:\ProgramData\TVU Networks
2008-04-27 12:19 --------- d-----w C:\Program Files\TVUPlayer
2008-04-27 11:44 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-04-27 11:44 --------- d-----w C:\Program Files\Windows Live
2008-04-27 11:41 --------- d-----w C:\ProgramData\WLInstaller
2008-04-26 13:34 --------- d-----w C:\Program Files\CCleaner
2008-04-26 13:08 --------- d-----w C:\ProgramData\Avira
2008-04-26 13:08 --------- d-----w C:\Program Files\Avira
2008-04-26 12:45 --------- d-----w C:\Users\Trans Logicenter\AppData\Roaming\ATI
2008-04-26 08:08 1,314,816 ----a-w C:\Windows\System32\quartz.dll
2008-04-25 04:35 826,880 ----a-w C:\Windows\System32\wininet.dll
2008-04-23 04:42 428,544 ----a-w C:\Windows\System32\EncDec.dll
2008-04-23 04:42 293,376 ----a-w C:\Windows\System32\psisdecd.dll
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 10:33 1233920]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 10:33 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LG Intelligent Update"="C:\Program Files\lg_swupdate\giljabistart.exe" [2008-02-26 00:09 247088]
"MGSysCtrl"="C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe" [2007-11-22 00:33 565248]
"RtHDVCpl"="RtHDVCpl.exe" [2007-12-17 22:02 4718592 C:\Windows\RtHDVCpl.exe]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 22:17 61440]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-23 08:20 815104]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-26 16:12 262401]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 12:01 1037736]
"Skytel"="Skytel.exe" [2007-11-21 05:15 1826816 C:\Windows\SkyTel.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1861133033-218184433-3803424193-1000]
"EnableNotificationsRef"=dword:00000002

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{02C8345E-BF91-4B08-8945-BEAA4746D134}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{0BB98C98-975B-4CEC-988B-81F77193817D}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"{7028B286-B0A4-4F21-8E5F-1B2D9917CC34}"= Profile=Public|C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{957433BF-3C8E-4CEE-8297-0079DCBEC905}C:\\program files\\tvuplayer\\tvuplayer.exe"= UDP:C:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"UDP Query User{4DDC5950-1658-4875-9C1E-02526D5BAF5D}C:\\program files\\tvuplayer\\tvuplayer.exe"= TCP:C:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"TCP Query User{861F724A-B095-468B-830A-9ABF99F67782}C:\\program files\\dc++\\dcplusplus.exe"= UDP:C:\program files\dc++\dcplusplus.exeC++
"UDP Query User{AD1CC6C9-58F7-409F-952A-96CD6563E196}C:\\program files\\dc++\\dcplusplus.exe"= TCP:C:\program files\dc++\dcplusplus.exeC++
"TCP Query User{2BE2C15F-2A41-4883-9AEE-90831175A614}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{B14062A1-60AB-4358-B016-79462F17F7DD}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"{489B13F9-6DD9-4952-A455-7B7ABB4661DA}"= UDP:C:\Program Files\ApexDC++\ApexDC.exe:ApexDC++ - Pinnacle of File Sharing
"{3CD75F0D-64B0-4FD5-8A8F-75E55ECA0878}"= TCP:C:\Program Files\ApexDC++\ApexDC.exe:ApexDC++ - Pinnacle of File Sharing
"TCP Query User{97D94996-40B6-4D70-A1EC-01B3D127A197}C:\\program files\\tvuplayer\\tvuplayer.exe"= UDP:C:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"UDP Query User{C5B415B8-CAD5-430F-A26D-2BA7626DF1A7}C:\\program files\\tvuplayer\\tvuplayer.exe"= TCP:C:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"TCP Query User{D1CF7268-1154-458A-A39E-9C61512A75C8}C:\\program files\\apexdc++\\apexdc.exe"= UDP:C:\program files\apexdc++\apexdc.exe:ApexDC++
"UDP Query User{93BA5948-C1F2-4802-AC77-2BC69EBECC20}C:\\program files\\apexdc++\\apexdc.exe"= TCP:C:\program files\apexdc++\apexdc.exe:ApexDC++
"{C3B96FD8-780F-4706-887C-ABD27BADA9DF}"= Disabled:C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{52DAD476-9D7E-4ABA-9A2A-4AF07B289F9D}D:\\program files\\call of duty\\codmp.exe"= UDP:\program files\call of duty\codmp.exe:CoDMP
"UDP Query User{717E7ADF-755A-412D-A97B-1E3A84C5A8D9}D:\\program files\\call of duty\\codmp.exe"= TCP:\program files\call of duty\codmp.exe:CoDMP
"TCP Query User{AA4C4919-69FA-4292-A73D-8428EE8392A3}C:\\program files\\america's army\\system\\armyops.exe"= UDP:C:\program files\america's army\system\armyops.exe:ArmyOps
"UDP Query User{FC5C08EC-43DD-42FA-8650-E7A5A80D95A3}C:\\program files\\america's army\\system\\armyops.exe"= TCP:C:\program files\america's army\system\armyops.exe:ArmyOps
"TCP Query User{A6A5E110-6E76-438C-AB0A-6FBD29A6B0C7}C:\\program files\\america's army\\system\\armyops.exe"= UDP:C:\program files\america's army\system\armyops.exe:ArmyOps
"UDP Query User{FAFDAE27-DFDF-4FD6-888B-BD8BAF3E786F}C:\\program files\\america's army\\system\\armyops.exe"= TCP:C:\program files\america's army\system\armyops.exe:ArmyOps
"{7F705273-E10B-4D94-A971-CDBE5FB1B98F}"= UDP:C:\Windows\System32\PnkBstrA.exenkBstrA
"{1A8DC196-5394-4E14-A4B4-44A636A2AB2F}"= TCP:C:\Windows\System32\PnkBstrA.exenkBstrA
"{062BC96F-FA70-4F07-9A01-7043CB75B151}"= UDP:C:\Windows\System32\PnkBstrB.exenkBstrB
"{2AB26B98-D3FB-4B7C-856D-5C7032C9C844}"= TCP:C:\Windows\System32\PnkBstrB.exenkBstrB
"TCP Query User{317FEA46-4DE1-49A5-BC7C-961B1A5C0972}C:\\program files\\america's army\\system\\server.exe"= UDP:C:\program files\america's army\system\server.exe:Server
"UDP Query User{2267A18D-B100-4AEC-9B1C-1E62C83B33C1}C:\\program files\\america's army\\system\\server.exe"= TCP:C:\program files\america's army\system\server.exe:Server
"TCP Query User{864B91BC-3A52-46B8-A457-DD63CCFE48DE}C:\\program files\\xfire\\xfire.exe"= UDP:C:\program files\xfire\xfire.exe:Xfire
"UDP Query User{9AB9E77C-11A9-41F8-9C05-BA287AC37F34}C:\\program files\\xfire\\xfire.exe"= TCP:C:\program files\xfire\xfire.exe:Xfire
"TCP Query User{947B59B5-3DBD-4B05-9287-AAFBBCE4D011}C:\\program files\\sopcast\\sopcast.exe"= UDP:C:\program files\sopcast\sopcast.exe:SopCast Main Application
"UDP Query User{0F74855D-2C6B-4888-A5F9-DEFB598FC496}C:\\program files\\sopcast\\sopcast.exe"= TCP:C:\program files\sopcast\sopcast.exe:SopCast Main Application
"TCP Query User{D49816FF-F17E-483E-8BEE-A2DCAAD5FF01}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{5851AD18-8077-4CE1-ACD5-6B7F911721A9}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{75E4458C-C04B-4433-BFD9-610568F8DD7E}C:\\program files\\sopcast\\adv\\sopadver.exe"= Disabled:UDP:C:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"UDP Query User{2D771E12-9D92-4C49-A714-436690CF8CF3}C:\\program files\\sopcast\\adv\\sopadver.exe"= Disabled:TCP:C:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"TCP Query User{4F9D8273-ABEF-4988-9492-BCCB343FC833}C:\\program files\\sopcast\\sopcast.exe"= UDP:C:\program files\sopcast\sopcast.exe:SopCast Main Application
"UDP Query User{75D79197-A613-4D86-AC86-473D8B502CBF}C:\\program files\\sopcast\\sopcast.exe"= TCP:C:\program files\sopcast\sopcast.exe:SopCast Main Application
"TCP Query User{DD0CC72A-33D1-4FED-AE35-4DDAF3F7FEDA}C:\\program files\\sopcast\\adv\\sopadver.exe"= UDP:C:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"UDP Query User{336B09AC-8CDA-4EB8-861F-86516CBD96BE}C:\\program files\\sopcast\\adv\\sopadver.exe"= TCP:C:\program files\sopcast\adv\sopadver.exe:SopCast Adver

R0 O2MDRDR;O2MDRDR;C:\Windows\system32\DRIVERS\o2media.sys [2007-04-03 21:04]
R0 O2SDRDR;O2SDRDR;C:\Windows\system32\DRIVERS\o2sd.sys [2007-04-03 03:11]
R2 NishService;Evil Driver Daemon;C:\Program Files\LG Software\System Control Manager\edd.exe [2007-08-24 01:37]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-02-26 11:53]
R3 MGHwCtrl;MGHwCtrl;C:\Windows\system32\drivers\MGHwCtrl.sys [2006-12-22 16:21]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fba76407-402d-11dd-b6a4-001d9254e4a0}]
\shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fba76414-402d-11dd-b6a4-001d9254e4a0}]
\shell\AutoRun\command - F:\VMC_PBStarter.exe

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-23 14:30:51
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-23 14:31:41
ComboFix-quarantined-files.txt 2008-06-23 11:31:37

Pre-Run: 91,597,000,704 tavua vapaana
Post-Run: 91,579,539,456 tavua vapaana

219 --- E O F --- 2008-06-22 07:45:54

 

Lataa Malwarebytes' Anti-Malware työpöydällesi.

1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.

 

Eipä näyttänyt löytävän mitään haitallista. Antivir tosin ilmoitti viruksesta kesken skannauksen - BDS/Hupigon.cmmc, FruityLoops ohjelmasta.

Tässä malwarebyteslokia.

Malwarebytes' Anti-Malware 1.18
Tietokantaversio: 882

17:06:31 23.6.2008
mbam-log-6-23-2008 (17-06-31).txt

Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
Tarkistetut kohteet: 115563
Kulunut aika: 37 minute(s), 50 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)

 

Lataa NoLop työpöydällesi yhdestä seuraavista linkeistä...
Linkki1
Linkki2
Linkki3

1.Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen
2.Tuplaklikkaa NoLop.exe ajaaksesi sen
3.Klikkaa nappulaa "Search and Destroy"
<<Tietokoneesi skannataan saastuneiden tiedostojen osalta>>
4, Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK
5. Klikkaa "REBOOT"-painiketta.
6. NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera.
-- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataa mscomctl.ocx ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan.