Kone on ollut parin kuukauden ajan melko hidas, esim. käynnistyksessä kestää 5min, hiiri liikkuu hitaasti ynnämuuta. Käytän AVG Antivirus Freetä. Scannauksessa kestää n. 4h 30min, onko se normaalia? HJT logi: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:21:43, on 27/11/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18241) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\runservice.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\Explorer.EXE C:\windows\system\hpsysdrv.exe C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DNA\btdna.exe C:\Program Files\WhatPulse\WhatPulse.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\NETGEAR\WG111v2\WG111v2.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Program Files\Opera\opera.exe C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.habbo.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: (no name) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file) O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe" O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [WhatPulse] C:\Program Files\WhatPulse\WhatPulse.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM') O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user') O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user') O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: NETGEAR WG111v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v2\WG111v2.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab O16 - DPF: {0F2F3121-75E2-4C60-9977-C1ADC3D5F3DC} (IFIUploader Control) - http://web03.ifi.fi/PhotoProducts/app_support/ActiveX/IfiUploader.cab O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab O16 - DPF: {46058878-5352-4550-8CD0-839BE09FAD8E} (PowerFootball1.PowerFootballLoader1) - http://www.powerchallenge.com/applet/PowerFootballLoader.CAB O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://www.ea.com/downloads/rtpatch/EARTPX.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151665954734 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151668686750 O16 - DPF: {8EF3CEAF-7227-46FC-A58E-9686C74EF4A7} (ChatRepublicPlayer ActiveX) - http://formula-data1.chat-republic.com/~crg/activex/ChatRepublicPlayer.ocx O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - http://www.miniclip.com/igloader/igloader.CAB O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{2ECF460D-A6C0-4A62-8F66-6E0C325AD44E}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: iPod-palvelu (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing) O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 9364 bytes
Jos koneella on Malwarebytes' Anti-Malware ennestään suorita ensin päivitys aja sen jälkeen. Lataa Malwarebytes' Anti-Malware työpöydällesi. 1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. 2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish. 3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. 4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan. 5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset. 6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected. 7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt 8. Lähetä lokin sisältö seuraavassa viestissäsi
Malwarebytes' Anti-Malware 1.30 Tietokantaversio: 1430 Windows 5.1.2600 Service Pack 3 28/11/2008 18:34:23 mbam-log-2008-11-28 (18-34-23).txt Tarkistustyyppi: Täysi tarkistus (A:\|C:\|D:\|E:\|F:\|) Tarkistetut kohteet: 170202 Kulunut aika: 3 hour(s), 20 minute(s), 38 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 8 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 1 Saastuneita hakemistoja: 3 Saastuneita tiedostoja: 26 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{343ce214-9998-4b21-a151-ffe970167297} (Rogue.Installer) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Baidu (Adware.Cinmus) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully. Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully. Saastuneita hakemistoja: C:\Program Files\WinAntiVirus Pro 2007 (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\plugins (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\res (Rogue.WinAntivirus) -> Quarantined and deleted successfully. Saastuneita tiedostoja: C:\Program Files\WinAntiVirus Pro 2007\Activate.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\ASupdater.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\BkSites.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\bnlink.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\bpupdater.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\CompWiz.xml (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\forum.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\integrity.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\kb.url (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\License.rtf (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\Online.url (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\PGE.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\PGupdater.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\pv.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\rbho.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\ResErrors.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\sr.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\Support.url (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\UBUpdater.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\unins000.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\up.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\updater.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\WinAV.xml (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\plugins\vbpv.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\Program Files\WinAntiVirus Pro 2007\res\wa7p.gif (Rogue.WinAntivirus) -> Quarantined and deleted successfully. C:\RECYCLER\ADAPT_Installer.exe (Heuristics.Malware) -> Quarantined and deleted successfully.
1.Lataa Combofix.exe työpöydällesi yhdestä linkistä: Combofix1 Combofix2 2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Kävi jotenki hassusti, ja tuo palkki missä on Käynnistä, käynnissä olevat ohjelmat, kello yms. on hävinnyt.. onkohan se normaalia? Käynnistän koneen uudelleen tämän viestin jälkeen. ComboFix 08-11-27.07 - Omistaja 2008-11-28 19:05:47.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.358.1035.18.32 [GMT 2:00] Sijainti: c:\documents and settings\Omistaja\Omat tiedostot\ComboFix.exe * Uusi palautuspiste luotu . (((((((((((((((((((((((((((((((((((((( Muut poistot )))))))))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Omistaja\err.log c:\documents and settings\Omistaja\ResErrors.log c:\program files\Common Files\companion wizard c:\program files\Common Files\companion wizard\CompWiz.xml c:\windows\system32\iAlmcoin.dll c:\windows\system32\stera.log c:\windows\system32\winio.vxd D:\Autorun.inf . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-10-28 to 2008-11-28 ))))))))))))))))) . 2008-11-28 14:43 . 2008-11-28 14:43 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\Malwarebytes 2008-11-28 14:43 . 2008-11-28 14:43 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-11-28 14:43 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-28 14:43 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-11-27 19:16 . 2008-11-27 19:19 <KANSIO> d-------- C:\HJT 2008-11-27 18:47 . 2008-11-27 18:47 <KANSIO> d-------- c:\program files\CCleaner 2008-11-27 18:03 . 2008-11-27 18:38 <KANSIO> d-------- C:\BMW M3 Challenge 2008-11-25 15:27 . 2008-11-25 21:17 <KANSIO> d-------- c:\program files\BobsTrackBuilder 2008-11-24 15:33 . 2008-11-24 15:32 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-13 19:18 . 2008-11-25 18:59 66 --a------ c:\windows\SpeederXP.INI 2008-11-13 19:12 . 2008-11-26 22:13 <KANSIO> d--h----- C:\$AVG8.VAULT$ 2008-11-13 19:07 . 2008-11-13 19:07 10,520 --a------ c:\windows\system32\avgrsstx.dll 2008-11-13 19:06 . 2008-11-28 14:20 <KANSIO> d-------- c:\windows\system32\drivers\Avg 2008-11-13 19:06 . 2008-11-13 19:06 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys 2008-11-13 19:05 . 2008-11-13 19:05 <KANSIO> d-------- c:\program files\AVG 2008-11-13 19:05 . 2008-11-13 19:05 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\avg8 2008-11-12 19:08 . 2008-09-04 19:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2008-11-12 19:08 . 2008-10-24 13:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-28 17:10 --------- d-----w c:\documents and settings\Omistaja\Application Data\DNA 2008-11-28 16:40 --------- d-----w c:\program files\DNA 2008-11-27 14:41 --------- d-----w c:\program files\DC++ 2008-11-25 19:16 --------- d-----w c:\program files\rFactor 2008-11-25 19:13 --------- d-----w c:\program files\Common Files\Adobe 2008-11-25 18:02 --------- d-----w c:\documents and settings\Omistaja\Application Data\Hamachi 2008-11-25 13:37 --------- d-----w c:\documents and settings\All Users\Application Data\IsolatedStorage 2008-11-24 13:31 --------- d-----w c:\program files\Java 2008-11-23 15:00 --------- d-----w c:\program files\GP3edit 2008-11-04 15:59 --------- d-----w c:\program files\Opera 2008-10-31 17:01 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2008-10-25 23:12 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-25 18:09 --------- d-----w c:\program files\ATI Technologies 2008-10-25 17:41 --------- d-----w c:\program files\Common Files\Download Manager 2008-10-24 21:05 --------- d-----w c:\program files\NVIDIA Corporation 2008-10-24 20:53 --------- d-----w c:\program files\Common Files\Adobe Systems Shared 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-20 13:50 --------- d-----w c:\program files\EA GAMES 2008-10-19 08:58 --------- d-----w c:\program files\QuickTime 2008-10-19 08:58 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer 2008-10-19 08:55 --------- d-----w c:\program files\Windows Live 2008-10-18 16:15 --------- d-----w c:\program files\Yahoo! 2008-10-18 16:14 --------- d-----w c:\program files\Spybot - Search & Destroy 2008-10-18 16:14 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2008-10-18 16:13 --------- d-----w c:\program files\Macromedia 2008-10-18 16:11 --------- d-----w c:\program files\Common Files\Macromedia 2008-10-18 16:03 --------- d-----w c:\program files\Cheat Engine 2008-10-18 16:02 --------- d-----w c:\program files\BitZipper 2008-10-18 16:02 --------- d-----w c:\documents and settings\Omistaja\Application Data\BitZipper 2008-10-18 16:01 --------- d-----w c:\program files\Apple Software Update 2008-10-17 21:00 --------- d-----w c:\documents and settings\Omistaja\Application Data\PC Suite 2008-10-17 16:35 --------- d-----w c:\program files\COMODO 2008-10-17 16:35 --------- d-----w c:\documents and settings\Omistaja\Application Data\Comodo 2008-10-17 16:35 --------- d-----w c:\documents and settings\All Users\Application Data\comodo 2008-10-13 18:46 --------- d-----w c:\program files\Pivot Stickfigure Animator 2008-10-10 21:09 --------- d-----w c:\documents and settings\Omistaja\Application Data\uTorrent 2008-10-08 12:56 --------- d-----w c:\program files\WhatPulse 2008-10-07 15:06 --------- d-----w c:\documents and settings\All Users\Application Data\Chat Republic Games 2008-10-05 14:33 --------- d-----w c:\program files\Image-Line 2008-10-05 14:31 --------- d-----w c:\program files\VstPlugins 2008-10-01 18:08 --------- d-----w c:\program files\Outsim 2008-09-13 12:23 96,704 ----a-w c:\windows\~GLC0001.TMP 2008-08-16 07:46 10,834 ---ha-w c:\program files\HyCam2.GID 2008-07-28 18:30 23 ----a-w c:\documents and settings\Omistaja\jagex_runescape_preferences.dat 2008-05-01 14:23 530 ----a-w c:\program files\HyCam2.hc2lic 2006-07-09 14:07 397,312 ----a-w c:\documents and settings\Omistaja\jogl.dll 2006-07-09 13:58 417,792 ----a-w c:\documents and settings\Omistaja\GL4JavbJauGljJNI14.dll 2004-08-11 07:18 802,816 ----a-w c:\program files\HyCam2.exe 2004-08-10 09:53 183,196 ----a-w c:\program files\HyCam2.hlp 2004-06-08 13:16 61,440 ----a-w c:\program files\CamRes2.dll 2004-06-08 13:16 5,168 ----a-w c:\program files\HyCam2.tlb 2004-06-08 11:01 53,248 ----a-w c:\program files\MClick2.dll 2004-04-22 10:34 53,248 ----a-w c:\program files\UnHyCam2.exe 2004-04-22 10:00 626 ----a-w c:\program files\HyCam2.exe.manifest 2004-04-22 08:38 3,274 ----a-w c:\program files\agreement.txt 2004-04-16 11:07 675 ----a-w c:\program files\HyCam2.cnt 1999-06-24 08:49 587 ----a-w c:\program files\8-44100d.wav 1999-06-24 08:49 421 ----a-w c:\program files\8-44100u.wav 1999-06-24 08:47 317 ----a-w c:\program files\8-22050d.wav 1999-06-24 08:47 225 ----a-w c:\program files\8-22050u.wav 1999-06-24 08:46 183 ----a-w c:\program files\8-11025d.wav 1999-06-24 08:46 135 ----a-w c:\program files\8-11025u.wav 1999-06-24 08:44 127 ----a-w c:\program files\8-8000u.wav 1999-06-24 08:43 151 ----a-w c:\program files\8-8000d.wav 1999-06-24 08:41 220 ----a-w c:\program files\16-8000u.wav 1999-06-24 08:40 260 ----a-w c:\program files\16-8000d.wav 1999-06-24 08:38 956 ----a-w c:\program files\16-44100u.wav 1999-06-24 08:37 1,186 ----a-w c:\program files\16-44100d.wav 1999-06-24 08:34 652 ----a-w c:\program files\16-22050d.wav 1999-06-24 08:34 442 ----a-w c:\program files\16-22050u.wav 1999-06-24 07:54 340 ----a-w c:\program files\16-11025d.wav 1999-06-24 07:50 326 ----a-w c:\program files\16-11025u.wav 2007-06-16 10:03 56 --sh--r c:\windows\system32\4173866096.sys 2007-06-16 10:03 952 --sha-w c:\windows\system32\KGyGaAvL.sys 2008-03-15 11:57 825 --sha-w c:\windows\system32\mmf(2)(2).sys 2008-03-17 05:05 825 --sha-w c:\windows\system32\mmf(2)(3).sys 2008-08-21 06:30 49 --sha-w c:\windows\system32\mmf(2).sys . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-11-12 342336] "WhatPulse"="c:\program files\WhatPulse\WhatPulse.exe" [2006-08-21 665600] "NVIEW"="nview.dll" [2003-05-02 c:\windows\system32\nview.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736] "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688] "Home Theater SchSvr"="c:\program files\Common Files\InterVideo\SchSvr\SchSvr.exe" [2003-08-08 155648] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-13 212992] "NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-02 4640768] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-24 136600] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336] "nwiz"="nwiz.exe" [2003-05-02 c:\windows\system32\nwiz.exe] "AlcxMonitor"="ALCXMNTR.EXE" [2003-04-03 c:\windows\ALCXMNTR.EXE] "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 c:\windows\system32\Ati2mdxx.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264] c:\documents and settings\Default User\K„ynnist„-valikko\Ohjelmat\K„ynnistys\ mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-07 27136] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\DC++\\DCPlusPlus.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\java.exe"= "c:\\Documents and Settings\\Omistaja\\Omat tiedostot\\Peten kansio\\Grand Prix 2 sup\\GrandPrix4\\Grand Prix 4\\GP4.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Program Files\\Opera\\opera.exe"= "c:\\Program Files\\Microprose\\Grand Prix 3\\GP3.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\rFactor\\rFactor.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "43594:TCP"= 43594:TCP:everworld R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-13 97928] S1 ShldDrv;Panda File Shield Driver; [] S2 PavProc;Panda Process Protection Driver;\??\c:\windows\system32\DRIVERS\PavProc.sys [] S3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys [] S3 PCASp50;PCASp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCASp50.sys [] S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\DRIVERS\wg111v2.sys [2006-03-27 167808] S3 VM30xx86;Vimicro USB PC Camera (ZC0301);c:\windows\system32\Drivers\vm30xx86.sys [2008-10-24 1294464] S3 XDva136;XDva136;\??\c:\windows\system32\XDva136.sys [] *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . 'Ajoitetut tehtävät'-kansion sisältö 2008-11-28 c:\windows\Tasks\User_Feed_Synchronization-{4D299A90-20C8-42DB-9774-31B4B4A21089}.job - c:\windows\system32\msfeedssync.exe [2008-08-22 02:05] . - - - - POISTETUT JÄMÄRIVIT - - - - WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file) . ------- Täydentävä tarkistus ------- . FireFox -: Profile - c:\documents and settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\famuj5pp.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT784584&SearchSource=3&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://fi.msn.com/ FF -: plugin - c:\program files\DNA\plugins\npbtdna.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\NpFv41629.dll FF -: plugin - c:\program files\Yahoo!\Common\npyaxmpb.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-28 19:17:07 Windows 5.1.2600 Service Pack 3 NTFS tarkistaa piilotettuja prosesseja ... tarkistaa piilotettuja käynnistysarvoja ... tarkistaa piilotettuja tiedostoja ... tarkistus on valmis piilotetut tiedostot: 0 ************************************************************************** . --------------------- Prosesseihin ladatut DLLt --------------------- - - - - - - - > 'winlogon.exe'(736) c:\windows\SYSTEM32\avgrsstx.dll c:\windows\SYSTEM32\RtlGina2.dll - - - - - - - > 'lsass.exe'(800) c:\windows\system32\avgrsstx.dll . Valmistumisajankohta: 2008-11-28 19:24:13 ComboFix-quarantined-files.txt 2008-11-28 17:24:08 Ennen ajoa: 18,191,319,040 tavua vapaana Ajon jälkeen: 18,628,653,056 tavua vapaana 218 --- E O F --- 2008-11-12 19:21:31
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:45:24, on 28/11/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18241) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\runservice.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\windows\system\hpsysdrv.exe C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DNA\btdna.exe C:\Program Files\WhatPulse\WhatPulse.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\NETGEAR\WG111v2\WG111v2.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Program Files\Opera\opera.exe C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~4.EXE C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.habbo.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: (no name) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file) O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe" O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [WhatPulse] C:\Program Files\WhatPulse\WhatPulse.exe O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM') O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user') O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user') O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: NETGEAR WG111v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v2\WG111v2.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab O16 - DPF: {0F2F3121-75E2-4C60-9977-C1ADC3D5F3DC} (IFIUploader Control) - http://web03.ifi.fi/PhotoProducts/app_support/ActiveX/IfiUploader.cab O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab O16 - DPF: {46058878-5352-4550-8CD0-839BE09FAD8E} (PowerFootball1.PowerFootballLoader1) - http://www.powerchallenge.com/applet/PowerFootballLoader.CAB O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://www.ea.com/downloads/rtpatch/EARTPX.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151665954734 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151668686750 O16 - DPF: {8EF3CEAF-7227-46FC-A58E-9686C74EF4A7} (ChatRepublicPlayer ActiveX) - http://formula-data1.chat-republic.com/~crg/activex/ChatRepublicPlayer.ocx O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - http://www.miniclip.com/igloader/igloader.CAB O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{2ECF460D-A6C0-4A62-8F66-6E0C325AD44E}: NameServer = 208.67.220.220,208.67.222.222 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: iPod-palvelu (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing) O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 8959 bytes
Poista vikasiedossa kansio C:\Program Files\WinAntiVirus Pro 2007 scannaa hjt:llä merkkaa paina Fix checked R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O3 - Toolbar: (no name) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file) O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start =========== Lataa OTMoveIt OTMoveIt ja tallenna se työpöydällesi. Tuplaklikkaa OTMoveIt.exe. Klikkaa CleanUp!. Valitse Yes kun kysytään "Begin cleanup Process?". Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse. HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne. ============ Lataa Tästä Ccleaner CCleaner v 2.14.750.- Standard Build, ÄLÄ aseenna Yahoo toolbaria! Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki". Asennuksen jälkeen aukaise CCleaneri. Valitse vasemmalta pystyrivistä Options. Valitse viereisestä pystyrivistä Settings. Language kohtaan valitse Suomi. Puhdistaja Valitse vasemmalta pystyrivistä Puhdistaja. Paina alhaalta Tutki. Nyt CCleaneri tutkii, mitä voidaan poistaa (tempit, cookiessit jne.). Kun tutkiminen on valmis, paina Aja CCleaner. Nyt CCleaneri poistaa löydetyt tempit, cookiessit jne. Rekisterin virheiden korjaus Valitse vasemmalta pystyrivistä Rekisteri. Paina alhaalta Etsi rekisterin virheitä. Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet. Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon. Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet. Saat vielä varmistus kysymyksen, paina Ok. Kun virheet on korjattu, paina Sulje. Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
Tehty, paitsi en löytänyt " C:\Program Files\WinAntiVirus Pro 2007 " polkua, joten sitä ei voi poistaa. Haullakaan ei löytynyt mitään. Seuraavaa ei löytynyt HJTn listasta: R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = Sitäkään en siis voinut fixata. Muuten kaikki tehty, onko vielä muuta?
Kone on hieman nopeutunut, aina välillä hiiri liikkuu sillein viiveellä, mutta muuten mukavasti. Kiitos.
Katos hiiren liike tuolta ohjauspanelista. =========== ajas vielä Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi. Käynnistä koneesi vikasietotilaan: sammuta ja käynnistä käynnistyksen yhteydessä hakkaa F8 nappia valitse nuolinäppäimellä vikasietotila paina enter ja enter valitse käyttäjätilisi paina kyllä Jossakin koneissa hakataan F8:sin sijasta F5:tä " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix. " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman. " Paina Y käynnistääksesi skriptin. " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot". " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen. " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta. " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished". " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle. " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
SDFix: SDFix: Version 1.240 Run by Omistaja on 29/11/2008 at 13:54 Microsoft Windows XP [versio 5.1.2600] Running From: C:\Documents and Settings\Omistaja\Ty”p”yt„\SDFix\SDFix Checking Services : Restoring Default Security Values Restoring Default Hosts File Rebooting Checking Files : No Trojan Files Found Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-29 14:49:00 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts] "ø\xbbÜ\xb4\x2026ºpÈ ?(?T?r?u?e?T?y?p?e?)?"="Mmj.ttf" scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019" "C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:EnabledC++" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*isabled:Windows Messenger" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000" "C:\\WINDOWS\\system32\\java.exe"="C:\\WINDOWS\\system32\\java.exe:*:Enabled:Java(TM) Platform SE binary" "C:\\Documents and Settings\\Omistaja\\Omat tiedostot\\Peten kansio\\Grand Prix 2 sup\\GrandPrix4\\Grand Prix 4\\GP4.exe"="C:\\Documents and Settings\\Omistaja\\Omat tiedostot\\Peten kansio\\Grand Prix 2 sup\\GrandPrix4\\Grand Prix 4\\GP4.exe:*:Enabled:GP4" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox" "C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:EnabledNA" "C:\\Program Files\\Opera\\opera.exe"="C:\\Program Files\\Opera\\opera.exe:*isabled:Opera Internet Browser" "C:\\Program Files\\Microprose\\Grand Prix 3\\GP3.exe"="C:\\Program Files\\Microprose\\Grand Prix 3\\GP3.exe:*:Enabled:GP3" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" "C:\\Program Files\\rFactor\\rFactor.exe"="C:\\Program Files\\rFactor\\rFactor.exe:*:Enabled:rFactor" "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe" "C:\\Documents and Settings\\Omistaja\\Omat tiedostot\\Kenan's Retro Pack\\Kenan's Retro Pack\\Recommended servers\\Mark's Server\\server.exe"="C:\\Documents and Settings\\Omistaja\\Omat tiedostot\\Kenan's Retro Pack\\Kenan's Retro Pack\\Recommended servers\\Mark's Server\\server.exe:*:Enabled:server" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" Remaining Files : Files with Hidden Attributes : Fri 30 Jun 2006 196 A.SHR --- "C:\BOOT.BAK" Tue 11 Oct 2005 0 A.SH. --- "C:\WINDOWS\SMINST\HPCD.SYS" Sat 16 Jun 2007 56 ..SHR --- "C:\WINDOWS\system32\4173866096.sys" Sat 16 Jun 2007 952 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" Thu 21 Aug 2008 49 A.SH. --- "C:\WINDOWS\system32\mmf(2).sys" Sat 15 Mar 2008 825 A.SH. --- "C:\WINDOWS\system32\mmf(2)(2).sys" Mon 17 Mar 2008 825 A.SH. --- "C:\WINDOWS\system32\mmf(2)(3).sys" Sat 29 Nov 2008 49 A.SH. --- "C:\WINDOWS\system32\mmf.sys" Wed 27 Dec 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Mon 13 Aug 2007 26,624 ...H. --- "C:\Documents and Settings\Omistaja\Omat tiedostot\~WRL0001.tmp" Tue 14 Aug 2007 26,624 ...H. --- "C:\Documents and Settings\Omistaja\Omat tiedostot\~WRL0003.tmp" Tue 14 Aug 2007 26,624 ...H. --- "C:\Documents and Settings\Omistaja\Omat tiedostot\~WRL0005.tmp" Fri 9 Mar 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp" Mon 13 Aug 2007 26,624 A..H. --- "C:\Documents and Settings\Liuska Tomi\Omat tiedostot\Omat tiedostot\~WRL0001.tmp" Tue 14 Aug 2007 26,624 A..H. --- "C:\Documents and Settings\Liuska Tomi\Omat tiedostot\Omat tiedostot\~WRL0003.tmp" Tue 14 Aug 2007 26,624 A..H. --- "C:\Documents and Settings\Liuska Tomi\Omat tiedostot\Omat tiedostot\~WRL0005.tmp" Wed 27 Dec 2006 4,348 A..H. --- "C:\Documents and Settings\Omistaja\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1key.bak" Thu 28 Dec 2006 20 A..H. --- "C:\Documents and Settings\Omistaja\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1lic.bak" Wed 27 Dec 2006 9,656 A.SH. --- "C:\Documents and Settings\Omistaja\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv2key.bak" Finished! HJT: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:06:07, on 29/11/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18241) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\runservice.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\Explorer.EXE C:\windows\system\hpsysdrv.exe C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DNA\btdna.exe C:\Program Files\WhatPulse\WhatPulse.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\NETGEAR\WG111v2\WG111v2.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Program Files\Opera\opera.exe C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.habbo.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe" O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [WhatPulse] C:\Program Files\WhatPulse\WhatPulse.exe O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM') O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user') O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user') O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: NETGEAR WG111v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v2\WG111v2.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab O16 - DPF: {0F2F3121-75E2-4C60-9977-C1ADC3D5F3DC} (IFIUploader Control) - http://web03.ifi.fi/PhotoProducts/app_support/ActiveX/IfiUploader.cab O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab O16 - DPF: {46058878-5352-4550-8CD0-839BE09FAD8E} (PowerFootball1.PowerFootballLoader1) - http://www.powerchallenge.com/applet/PowerFootballLoader.CAB O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://www.ea.com/downloads/rtpatch/EARTPX.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151665954734 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151668686750 O16 - DPF: {8EF3CEAF-7227-46FC-A58E-9686C74EF4A7} (ChatRepublicPlayer ActiveX) - http://formula-data1.chat-republic.com/~crg/activex/ChatRepublicPlayer.ocx O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - http://www.miniclip.com/igloader/igloader.CAB O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{2ECF460D-A6C0-4A62-8F66-6E0C325AD44E}: NameServer = 208.67.220.220,208.67.222.222 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: iPod-palvelu (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing) O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 8122 bytes
