Eli koneeni tilttailee kesken pelaamisen ja jopa elokuvien katsomisen joten näkyykö tässä jotakin outoa ja mitä pitäisi tehdä? Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:43:01, on 8.2.2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Windows\System32\rundll32.exe C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe C:\Windows\V0350Mon.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Windows\System32\mobsync.exe C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Steam\Steam.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\OpenOffice.org 3\program\soffice.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\OpenOffice.org 3\program\soffice.bin C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\DllHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: Norton-työkalurivi - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [IS CfgWiz] "C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" /MODULE CfgWiz /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [AVFX Engine] "C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" O4 - HKLM\..\Run: [V0350Mon.exe] C:\Windows\V0350Mon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [PSPVideo9] C:\Program Files\pspvideo9\pspVideo9.exe -t O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu') O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 O13 - Gopher Prefix: O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JS...1/&filename=jinstall-6u11-windows-i586-jc.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Packard Bell BV - C:\Program Files\Packard bell\SAXO27\HIDSERVICE.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\Program Files\Norton Internet Security\isPwdSvc.exe (file missing) O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: SrvCDEject - Unknown owner - C:\Program Files\Packard Bell\SrvCDEject.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
Koneella kaksi virustorjuntaa avira ja norton poista toinen ============== scannaa hjt:llä merkkaa paina Fix checked R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" ============= Lataa Malwarebytes' Anti-Malware työpöydällesi. 1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. 2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish. 3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. 4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan. 5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset. 6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected. 7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt 8. Lähetä lokin sisältö seuraavassa viestissäsi
Malwarebytes' Anti-Malware 1.33 Tietokantaversio: 1738 Windows 6.0.6001 Service Pack 1 8.2.2009 17:21:30 mbam-log-2009-02-08 (17-21-30).txt Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|F:\|G:\|H:\|) Tarkistetut kohteet: 129725 Kulunut aika: 55 minute(s), 41 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 0 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 0 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: (Haitallisia kohteita ei löydetty) Tälläistä tuli? mikä voi olla vikana? ja en saa poistettua nortonia se ei vain suostu poistumaan en tiedä miksi
Koneella pitää olla järjestelmän valvojan oikeuksilla Linkki =============== Lataa ja suorita Norton-poistotyökalu
Joo nyt on poistettu mutta kone tilttailee vieläkin koska ram muisti täyttyy yht äkkiä joten onko jotain muuta outoa tuolla?
1.Lataa Combofix.exe työpöydällesi yhdestä linkistä: Combofix1 Combofix2 Älä asenna palautus consolia 2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. =============== Luo poistolista: • Avaa HiJackThis • Klikkaa "Configure" valintaa oikealla alhaalla • Klikkaa "Misc Tools" • Klikkaa boxia joka sanoo "Uninstall Manager" • Klikkaa valintaa "Save list" • Kopioi ja liitä kyseinen lista muistiosta ketjuusi =============== scannaa uusi hjt:n loki
ComboFix 09-02-08.01 - gigantti 2009-02-08 22:34:31.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1035.18.2046.1014 [GMT 2:00] Sijainti: c:\users\gigantti\Desktop\ComboFix.exe * Uusi palautuspiste luotu . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-08 to 2009-02-08 ))))))))))))))))) . 2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\Malwarebytes 2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\users\All Users\Malwarebytes 2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\programdata\Malwarebytes 2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-02-08 16:18 . 2009-01-14 16:11 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2009-02-08 16:18 . 2009-01-14 16:11 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2009-02-08 13:40 . 2009-02-08 13:40 <KANSIO> d-------- c:\program files\Trend Micro 2009-02-05 18:50 . 2009-02-05 18:50 <KANSIO> d-------- c:\windows\System32\IOSUBSYS 2009-01-27 12:02 . 2009-01-27 12:02 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\Samsung 2009-01-27 11:48 . 2007-07-03 16:58 106,792 --a------ c:\windows\System32\drivers\sscdmdm.sys 2009-01-27 11:48 . 2007-07-03 16:54 80,552 --a------ c:\windows\System32\drivers\sscdbus.sys 2009-01-27 11:48 . 2007-07-03 16:57 11,944 --a------ c:\windows\System32\drivers\sscdmdfl.sys 2009-01-27 11:48 . 2007-07-03 17:00 9,256 --a------ c:\windows\System32\drivers\sscdwhnt.sys 2009-01-27 11:48 . 2007-07-03 17:00 9,256 --a------ c:\windows\System32\drivers\sscdwh.sys 2009-01-27 11:48 . 2007-07-03 16:56 9,256 --a------ c:\windows\System32\drivers\sscdcmnt.sys 2009-01-27 11:48 . 2007-07-03 16:56 9,256 --a------ c:\windows\System32\drivers\sscdcm.sys 2009-01-27 11:45 . 2009-01-27 11:49 <KANSIO> d-------- c:\windows\System32\Samsung_USB_Drivers 2009-01-27 11:44 . 2009-01-27 11:44 <KANSIO> d-------- c:\program files\Samsung 2009-01-27 11:44 . 2009-01-27 12:00 5,632 --a------ c:\windows\System32\drivers\StarOpen.sys 2009-01-27 11:44 . 2005-08-28 20:51 766 --a------ c:\windows\System32\Uninstall.ico 2009-01-23 09:33 . 2009-01-23 09:33 <KANSIO> d-------- c:\program files\AviSynth 2.5 2009-01-22 08:52 . 2009-01-22 08:52 <KANSIO> d-------- c:\program files\Smart Projects 2009-01-18 21:26 . 2009-01-18 21:26 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\AdobeUM 2009-01-15 15:52 . 2009-02-04 22:11 <KANSIO> d-------- c:\program files\Common Files\Steam 2009-01-15 15:41 . 2009-02-08 21:33 <KANSIO> d-------- c:\program files\Steam 2009-01-15 15:40 . 2009-01-15 15:41 <KANSIO> d-------- c:\windows\048298C9A4D3490B9FF9AB023A9238F3.TMP 2009-01-14 23:27 . 2009-01-14 23:27 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\OpenOffice.org 2009-01-14 23:22 . 2009-01-14 23:22 <KANSIO> d-------- c:\program files\OpenOffice.org 3 2009-01-14 15:45 . 2009-01-14 15:45 <KANSIO> d-------- c:\users\All Users\Avira 2009-01-14 15:45 . 2009-01-14 15:45 <KANSIO> d-------- c:\programdata\Avira 2009-01-14 15:45 . 2009-01-14 15:45 <KANSIO> d-------- c:\program files\Avira 2009-01-14 08:27 . 2008-12-16 04:42 288,768 --a------ c:\windows\System32\drivers\srv.sys 2009-01-12 16:50 . 2009-01-12 16:50 <KANSIO> d-------- c:\program files\URUSoft . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-08 20:34 524,288 --sha-w c:\users\Järjestelmänvalvoja1\NTUSER.DAT 2009-02-08 19:30 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-02-07 19:34 --------- d-----w c:\users\gigantti\AppData\Roaming\uTorrent 2009-02-07 19:27 --------- d-----w c:\users\gigantti\AppData\Roaming\LimeWire 2009-02-05 16:50 --------- d-----w c:\program files\Google 2009-01-27 09:44 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-22 16:28 --------- d-----w c:\program files\World of Warcraft 2009-01-18 21:38 --------- d-----w c:\program files\Common Files\Adobe 2009-01-14 14:01 --------- d-----w c:\users\gigantti\AppData\Roaming\Packard Bell 2009-01-14 13:59 --------- d-----w c:\program files\Windows Mail 2009-01-10 20:01 --------- d-----w c:\programdata\Roxio 2009-01-09 17:24 --------- d-----w c:\users\gigantti\AppData\Roaming\Roxio 2009-01-06 08:21 --------- d-----w c:\users\gigantti\AppData\Roaming\PeerNetworking 2009-01-05 18:47 --------- d-----w c:\users\gigantti\AppData\Roaming\vlc 2009-01-02 12:11 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2009-01-02 11:03 410,984 ----a-w c:\windows\System32\deploytk.dll 2009-01-02 11:02 --------- d-----w c:\program files\Java 2009-01-02 10:58 --------- d-----w c:\program files\LimeWire 2009-01-02 09:05 174 --sha-w c:\program files\desktop.ini 2009-01-01 19:57 --------- d-----w c:\program files\Windows Sidebar 2009-01-01 19:57 --------- d-----w c:\program files\Windows Photo Gallery 2009-01-01 19:57 --------- d-----w c:\program files\Windows Journal 2009-01-01 19:57 --------- d-----w c:\program files\Windows Defender 2009-01-01 19:57 --------- d-----w c:\program files\Windows Collaboration 2009-01-01 19:57 --------- d-----w c:\program files\Windows Calendar 2009-01-01 19:12 82,432 ----a-w c:\windows\System32\axaltocm.dll 2009-01-01 19:12 101,888 ----a-w c:\windows\System32\ifxcardm.dll 2008-12-30 23:31 --------- d-----w c:\program files\uTorrent 2008-12-30 23:20 --------- d-----w c:\program files\VideoLAN 2008-12-30 11:34 --------- d-----w c:\programdata\Blizzard 2008-12-30 09:45 --------- d-----w c:\program files\Common Files\Blizzard Entertainment 2008-12-27 21:54 --------- d-----w c:\users\gigantti\AppData\Roaming\Creative 2008-12-27 21:54 --------- d-----w c:\programdata\Creative 2008-12-27 21:49 --------- d-----w c:\program files\Creative 2008-12-27 21:43 --------- d-----w c:\programdata\muvee Technologies 2008-12-27 20:32 --------- d-----w c:\programdata\NVIDIA 2008-12-27 19:37 269,312 ----a-w c:\windows\System32\es.dll 2008-12-27 18:51 --------- d-----w c:\program files\PhotoFiltre 2008-12-27 18:46 --------- d-----w c:\program files\B2BPOKER 2008-12-27 11:31 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2 2008-12-27 11:29 --------- d-----w c:\program files\Windows Live 2008-12-27 11:27 --------- d-----w c:\users\gigantti\AppData\Roaming\Apple Computer 2008-12-27 11:27 --------- d-----w c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-12-27 11:27 --------- d-----w c:\program files\iTunes 2008-12-27 11:26 --------- d-----w c:\programdata\Apple Computer 2008-12-27 11:26 --------- d-----w c:\program files\iPod 2008-12-27 11:26 --------- d-----w c:\program files\Common Files\Apple 2008-12-27 11:25 --------- d-----w c:\program files\QuickTime 2008-12-27 11:25 --------- d-----w c:\program files\Bonjour 2008-12-27 11:23 --------- d-----w c:\program files\Apple Software Update 2008-12-27 11:21 --------- d-----w c:\programdata\Apple 2008-12-27 11:14 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller 2008-12-27 11:10 --------- d-----w c:\programdata\WLInstaller 2008-12-27 09:10 61,440 ----a-w c:\windows\System32\winipsec.dll 2008-12-27 09:10 361,984 ----a-w c:\windows\System32\IPSECSVC.DLL 2008-12-27 09:10 28,672 ----a-w c:\windows\System32\FwRemoteSvr.dll 2008-12-27 09:10 272,896 ----a-w c:\windows\System32\polstore.dll 2008-12-27 09:08 94,720 ----a-w c:\windows\System32\PortableDeviceClassExtension.dll 2008-12-27 09:08 241,152 ----a-w c:\windows\System32\PortableDeviceApi.dll 2008-12-27 09:08 160,768 ----a-w c:\windows\System32\PortableDeviceTypes.dll 2008-12-27 09:03 428,544 ----a-w c:\windows\System32\EncDec.dll 2008-12-27 09:03 293,376 ----a-w c:\windows\System32\psisdecd.dll 2008-12-27 09:01 296,960 ----a-w c:\windows\System32\gdi32.dll 2008-12-27 08:58 212,480 ----a-w c:\windows\system32\drivers\mrxsmb10.sys 2008-12-27 08:56 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll 2008-12-27 08:56 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll 2008-12-27 08:56 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll 2008-12-27 08:56 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll 2008-12-27 08:56 28,672 ----a-w c:\windows\System32\Apphlpdm.dll 2008-12-27 08:56 2,560 ----a-w c:\windows\AppPatch\AcRes.dll 2008-12-27 08:56 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll 2008-12-27 08:56 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll 2008-12-27 08:56 1,695,744 ----a-w c:\windows\System32\gameux.dll 2008-12-27 08:55 303,616 ----a-w c:\windows\System32\wmpeffects.dll 2008-12-27 08:54 2,048 ----a-w c:\windows\System32\msxml3r.dll 2008-12-27 08:54 2,032,640 ----a-w c:\windows\System32\win32k.sys 2008-12-27 08:54 1,191,936 ----a-w c:\windows\System32\msxml3.dll 2008-12-27 08:50 2,048 ----a-w c:\windows\System32\tzres.dll 2008-12-27 08:45 2,927,104 ----a-w c:\windows\explorer.exe 2008-12-27 08:41 827,392 ----a-w c:\windows\System32\wininet.dll 2008-12-27 08:37 801,280 ----a-w c:\windows\System32\NaturalLanguage6.dll 2008-12-27 08:37 6,917,120 ----a-w c:\windows\System32\NlsLexicons0c1a.dll 2008-12-27 08:37 4,495,360 ----a-w c:\windows\System32\NlsData0816.dll 2008-12-27 08:37 4,495,360 ----a-w c:\windows\System32\NlsData0416.dll 2008-12-27 08:37 4,495,360 ----a-w c:\windows\System32\NlsData0414.dll 2008-12-27 08:37 2,342,912 ----a-w c:\windows\System32\NlsData000d.dll 2008-12-27 08:37 1,965,056 ----a-w c:\windows\System32\NlsData0c1a.dll 2008-12-27 08:37 1,965,056 ----a-w c:\windows\System32\NlsData081a.dll 2008-12-27 08:37 1,965,056 ----a-w c:\windows\System32\NlsData000f.dll 2008-12-27 08:35 988,216 ----a-w c:\windows\System32\winload.exe 2008-12-27 08:35 927,288 ----a-w c:\windows\System32\winresume.exe 2008-12-27 08:35 615,992 ----a-w c:\windows\System32\ci.dll 2008-12-27 08:35 6,656 ----a-w c:\windows\System32\kbd106n.dll 2008-12-27 08:35 46,592 ----a-w c:\windows\System32\setbcdlocale.dll 2008-12-27 08:35 40,960 ----a-w c:\windows\System32\srclient.dll 2008-12-27 08:35 378,368 ----a-w c:\windows\System32\srcore.dll 2008-12-27 08:35 318,464 ----a-w c:\windows\System32\rstrui.exe 2008-12-27 08:35 19,000 ----a-w c:\windows\System32\kd1394.dll 2008-12-27 08:35 14,848 ----a-w c:\windows\System32\srdelayed.exe 2008-12-27 08:32 712,704 ----a-w c:\windows\System32\WindowsCodecs.dll 2007-07-13 07:06 141,824 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "SmpcSys"="c:\program files\Packard Bell\SetUpMyPC\SmpSys.exe" [2007-05-03 1116728] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "Creative Live! Cam Manager"="c:\program files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-05-02 151552] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "Steam"="c:\program files\steam\steam.exe" [2009-01-15 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 232184] "toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13580832] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 92704] "AVFX Engine"="c:\program files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2007-04-09 20480] "V0350Mon.exe"="c:\windows\V0350Mon.exe" [2007-03-28 32768] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-02 136600] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "RtHDVCpl"="RtHDVCpl.exe" [2007-03-01 c:\windows\RtHDVCpl.exe] c:\users\gigantti\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-10-04 393216] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{961656CC-7C8C-4F93-8147-C31E85AB6C8F}"= UDP:c:\program files\Skype\Phone\Skype.exe:Skype "{FBF9AC3D-ADF0-4668-80F2-6A6460EF475A}"= TCP:c:\program files\Skype\Phone\Skype.exe:Skype "{518374B7-6003-4526-94F3-BDC374C3486E}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{A84817C4-0FB6-4215-A31E-95D00BBEFBB9}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{8EDB7684-189E-474B-B2E0-BF9AC019BBB5}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{8F9D51FC-28C6-45EC-8D0B-476D96BC30D0}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{5E03385F-A84F-46B6-8D0F-8498B325DE53}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "TCP Query User{C0A99A90-7B29-4CBB-90F2-813F9B328C19}c:\\program files\\b2bpoker\\pokerihuone\\jre\\bin\\javaw.exe"= UDP:c:\program files\b2bpoker\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary "UDP Query User{98E14683-453E-42C2-8D48-17177512DE4E}c:\\program files\\b2bpoker\\pokerihuone\\jre\\bin\\javaw.exe"= TCP:c:\program files\b2bpoker\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary "{90717786-729F-4940-BA94-3783CE1070A7}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{7DE88E92-FE46-4ADB-B7C9-41CB10961B36}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "TCP Query User{954E3F98-C99C-4477-BB30-6FA810052257}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire "UDP Query User{1A4D98BB-8FE2-461F-A241-54A4C7FF702D}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire "TCP Query User{331B987E-79DC-4882-92B2-DE1D591F18A2}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2 "UDP Query User{0F820793-94FF-4A11-AA0C-4AACA2541582}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2 "TCP Query User{659D8150-8385-403B-A02A-FF0489EC40A2}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent "UDP Query User{7935285F-63E6-4AB4-99F7-FA4CDE2651FC}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent "TCP Query User{84DEB74E-4D9D-4738-8030-D062E81665E2}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2 "UDP Query User{3DAD7939-CEC4-4AA5-968E-041429D7F844}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2 "TCP Query User{9363542A-D88A-41D6-A0B2-9614D0124141}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire "UDP Query User{9542653B-8E23-467C-96D2-531B18262489}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire "TCP Query User{6210DB8E-AFD0-43AF-9B44-2A2314A6B574}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary "UDP Query User{4C664FB6-CAA3-4B47-9B8F-78CD4466B6CA}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary "{2657FA41-61DC-4DCD-B3D6-3BEBE0993CF3}"= UDP:c:\program files\Steam\Steam.exe:Steam "{7A7153E6-6965-469E-BF13-0BFFCBCAAE2D}"= TCP:c:\program files\Steam\Steam.exe:Steam "{8DFFA929-5219-4BF8-AA37-CA652CF5F21D}"= UDP:c:\users\gigantti\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool "{CB4F9F34-FEFE-4FDF-9118-BECDC1E23A29}"= TCP:c:\users\gigantti\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool R2 SrvCDEject;SrvCDEject;c:\program files\Packard Bell\SrvCDEject.exe [2007-07-13 613376] R3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\System32\drivers\3xHybrid.sys [2007-07-13 816512] R3 FETND6V;VIA Rhine Family Fast Ethernet Adapter Driver;c:\windows\System32\drivers\fetnd6v.sys [2008-09-22 43520] R3 X10Hid;X10 Hid Device;c:\windows\System32\drivers\x10hid.sys [2007-07-13 13976] S2 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" --> c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [?] S3 VF0350Afx;VF0350 Audio FX;c:\windows\System32\drivers\V0350Afx.sys [2008-12-27 143136] S3 VF0350Vfx;VF0350 Video FX;c:\windows\System32\drivers\V0350Vfx.sys [2008-12-27 7424] S3 VF0350Vid;Live! Cam Video IM (VF0350);c:\windows\System32\drivers\V0350Vid.sys [2008-12-27 170016] . 'Ajoitetut tehtävät'-kansion sisältö 2009-02-08 c:\windows\Tasks\Laajennettu takuu.job - c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2006-11-21 18:38] 2009-02-08 c:\windows\Tasks\User_Feed_Synchronization-{04AF7E74-8C43-412E-9533-DFB08147C7E3}.job - c:\windows\system32\msfeedssync.exe [2008-01-19 09:33] . - - - - POISTETUT JÄMÄRIVIT - - - - HKLM-Run-PSPVideo9 - c:\program files\pspvideo9\pspVideo9.exe . ------- Täydentävä tarkistus ------- . uStart Page = hxxp://www.google.fi/ IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-08 22:37:25 Windows 6.0.6001 Service Pack 1 NTFS tarkistaa piilotettuja prosesseja ... ? [31676] ? [33448] ? [36368] ? [39996] ? [64156] ? [64172] tarkistaa piilotettuja käynnistysarvoja ... tarkistaa piilotettuja tiedostoja ... tarkistus on valmis piilotetut tiedostot: 0 ************************************************************************** . Valmistumisajankohta: 2009-02-08 22:39:48 ComboFix-quarantined-files.txt 2009-02-08 20:39:43 Ennen ajoa: 217 202 823 168 tavua vapaana Ajon jälkeen: 217,300,402,176 tavua vapaana 252 --- E O F --- 2009-02-05 16:28:09 Tälläistä tuli. Nyt on hjt logi tulossa uudestaan laitanko senkin tänne? Tässä tää lista Adobe Flash Player 10 ActiveX Adobe Flash Player 9 ActiveX Adobe Reader 8 Adobe Reader 8.1.3 - Suomi Adobe Shockwave Player Advanced Audio FX Engine Advanced Video FX Engine Apple Mobile Device Support Apple Software Update Avira AntiVir Personal - Free Antivirus AviSynth 2.5 Bonjour Counter-Strike: Source Counter-Strike: Source Creative Live! Cam Center Creative Live! Cam FX Creator Creative Live! Cam Manager Creative Live! Cam User's Guide Creative Live! Cam Video Chat or Video IM Driver (1.01.05.0000) Creative Photo Calendar Creative Photo Manager Creative Software AutoUpdate Creative System Information Creator 9 Day of Defeat: Source Firefox Flash Player 9 Internet Explorer Google Earth Google Earth Half-Life 2: Deathmatch Half-Life 2: Lost Coast HDRegFI HijackThis 2.0.2 Infocentre Rev. 2.0 IsoBuster 2.5 iTunes Java(TM) 6 Update 11 LimeWire 4.18.8 Malwarebytes' Anti-Malware MCE Software Encoder 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB929729) Microsoft Visual C++ 2005 Redistributable MSXML 4.0 SP2 (KB954430) NIS2007 NVIDIA Drivers OpenOffice.org 3.0 Packard Bell ImageWriter Packard Bell LCD Test Packard Bell Updator PhotoFiltre Picasa 3 Picasa2 PSP Video 9 1.74 QuickTime Realtek HD Audio V6.0.1.5377 Realtek High Definition Audio Driver Roxio Creator 9 LE SAMSUNG Mobile Modem Driver Set Samsung Mobile phone USB driver Software SAMSUNG Mobile USB Modem 1.0 Software SAMSUNG Mobile USB Modem Software Samsung PC Studio 3 Security Update for CAPICOM (KB931906) Security Update for CAPICOM (KB931906) SetUp My PC Shockwave player 10 Steam(TM) Subtitle Workshop 2.51 TVTUNER TIGER V1.3.3.4a VIA Rhine Family Fast Ethernet Adapter Video NVIDIA v158.18 Windows Live Messenger WinRAR archiver VLC media player 0.9.8a World of Warcraft X10 Hardware(TM)
Nyt tuon alla olevan lainauksen sisällön Kopioit / liität Tyhjään muistioon käynnistä nappi >apuohjelmat > muistio Tallenna se nimellä CFScript.txt työpöydälle Sitten raahaa CFScript ComboFix.exeen kuten alla. Laita tuleva loki tänne. Sammutat ja käynnistät koneen
ComboFix 09-02-08.02 - gigantti 2009-02-09 15:52:52.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1035.18.2046.1301 [GMT 2:00] Sijainti: c:\users\gigantti\Desktop\ComboFix.exe Käytetyt komentorivivalitsimet :: c:\users\gigantti\Desktop\CFScript.txt * Uusi palautuspiste luotu . (((((((((((((((((((((((((((((((((((((( Muut poistot )))))))))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Common Files\Symantec Shared c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-09 to 2009-02-09 ))))))))))))))))) . 2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\Malwarebytes 2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\users\All Users\Malwarebytes 2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\programdata\Malwarebytes 2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-02-08 16:18 . 2009-01-14 16:11 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2009-02-08 16:18 . 2009-01-14 16:11 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2009-02-08 13:40 . 2009-02-08 13:40 <KANSIO> d-------- c:\program files\Trend Micro 2009-02-05 18:50 . 2009-02-05 18:50 <KANSIO> d-------- c:\windows\System32\IOSUBSYS 2009-01-27 12:02 . 2009-01-27 12:02 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\Samsung 2009-01-27 11:48 . 2007-07-03 16:58 106,792 --a------ c:\windows\System32\drivers\sscdmdm.sys 2009-01-27 11:48 . 2007-07-03 16:54 80,552 --a------ c:\windows\System32\drivers\sscdbus.sys 2009-01-27 11:48 . 2007-07-03 16:57 11,944 --a------ c:\windows\System32\drivers\sscdmdfl.sys 2009-01-27 11:48 . 2007-07-03 17:00 9,256 --a------ c:\windows\System32\drivers\sscdwhnt.sys 2009-01-27 11:48 . 2007-07-03 17:00 9,256 --a------ c:\windows\System32\drivers\sscdwh.sys 2009-01-27 11:48 . 2007-07-03 16:56 9,256 --a------ c:\windows\System32\drivers\sscdcmnt.sys 2009-01-27 11:48 . 2007-07-03 16:56 9,256 --a------ c:\windows\System32\drivers\sscdcm.sys 2009-01-27 11:45 . 2009-01-27 11:49 <KANSIO> d-------- c:\windows\System32\Samsung_USB_Drivers 2009-01-27 11:44 . 2009-01-27 11:44 <KANSIO> d-------- c:\program files\Samsung 2009-01-27 11:44 . 2009-01-27 12:00 5,632 --a------ c:\windows\System32\drivers\StarOpen.sys 2009-01-27 11:44 . 2005-08-28 20:51 766 --a------ c:\windows\System32\Uninstall.ico 2009-01-23 09:33 . 2009-01-23 09:33 <KANSIO> d-------- c:\program files\AviSynth 2.5 2009-01-22 08:52 . 2009-01-22 08:52 <KANSIO> d-------- c:\program files\Smart Projects 2009-01-18 21:26 . 2009-01-18 21:26 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\AdobeUM 2009-01-15 15:52 . 2009-02-04 22:11 <KANSIO> d-------- c:\program files\Common Files\Steam 2009-01-15 15:41 . 2009-02-09 15:47 <KANSIO> d-------- c:\program files\Steam 2009-01-15 15:40 . 2009-01-15 15:41 <KANSIO> d-------- c:\windows\048298C9A4D3490B9FF9AB023A9238F3.TMP 2009-01-14 23:27 . 2009-01-14 23:27 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\OpenOffice.org 2009-01-14 23:22 . 2009-01-14 23:22 <KANSIO> d-------- c:\program files\OpenOffice.org 3 2009-01-14 15:45 . 2009-01-14 15:45 <KANSIO> d-------- c:\users\All Users\Avira 2009-01-14 15:45 . 2009-01-14 15:45 <KANSIO> d-------- c:\programdata\Avira 2009-01-14 15:45 . 2009-01-14 15:45 <KANSIO> d-------- c:\program files\Avira 2009-01-14 08:27 . 2008-12-16 04:42 288,768 --a------ c:\windows\System32\drivers\srv.sys 2009-01-12 16:50 . 2009-01-12 16:50 <KANSIO> d-------- c:\program files\URUSoft . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-09 13:52 524,288 --sha-w c:\users\Järjestelmänvalvoja1\NTUSER.DAT 2009-02-07 19:34 --------- d-----w c:\users\gigantti\AppData\Roaming\uTorrent 2009-02-07 19:27 --------- d-----w c:\users\gigantti\AppData\Roaming\LimeWire 2009-02-05 16:50 --------- d-----w c:\program files\Google 2009-01-27 09:44 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-22 16:28 --------- d-----w c:\program files\World of Warcraft 2009-01-18 21:38 --------- d-----w c:\program files\Common Files\Adobe 2009-01-14 14:01 --------- d-----w c:\users\gigantti\AppData\Roaming\Packard Bell 2009-01-14 13:59 --------- d-----w c:\program files\Windows Mail 2009-01-10 20:01 --------- d-----w c:\programdata\Roxio 2009-01-09 17:24 --------- d-----w c:\users\gigantti\AppData\Roaming\Roxio 2009-01-06 08:21 --------- d-----w c:\users\gigantti\AppData\Roaming\PeerNetworking 2009-01-05 18:47 --------- d-----w c:\users\gigantti\AppData\Roaming\vlc 2009-01-02 12:11 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2009-01-02 11:03 410,984 ----a-w c:\windows\System32\deploytk.dll 2009-01-02 11:02 --------- d-----w c:\program files\Java 2009-01-02 10:58 --------- d-----w c:\program files\LimeWire 2009-01-02 09:05 174 --sha-w c:\program files\desktop.ini 2009-01-01 19:57 --------- d-----w c:\program files\Windows Sidebar 2009-01-01 19:57 --------- d-----w c:\program files\Windows Photo Gallery 2009-01-01 19:57 --------- d-----w c:\program files\Windows Journal 2009-01-01 19:57 --------- d-----w c:\program files\Windows Defender 2009-01-01 19:57 --------- d-----w c:\program files\Windows Collaboration 2009-01-01 19:57 --------- d-----w c:\program files\Windows Calendar 2009-01-01 19:12 82,432 ----a-w c:\windows\System32\axaltocm.dll 2009-01-01 19:12 101,888 ----a-w c:\windows\System32\ifxcardm.dll 2008-12-30 23:31 --------- d-----w c:\program files\uTorrent 2008-12-30 23:20 --------- d-----w c:\program files\VideoLAN 2008-12-30 11:34 --------- d-----w c:\programdata\Blizzard 2008-12-30 09:45 --------- d-----w c:\program files\Common Files\Blizzard Entertainment 2008-12-27 21:54 --------- d-----w c:\users\gigantti\AppData\Roaming\Creative 2008-12-27 21:54 --------- d-----w c:\programdata\Creative 2008-12-27 21:49 --------- d-----w c:\program files\Creative 2008-12-27 21:43 --------- d-----w c:\programdata\muvee Technologies 2008-12-27 20:32 --------- d-----w c:\programdata\NVIDIA 2008-12-27 19:37 269,312 ----a-w c:\windows\System32\es.dll 2008-12-27 18:51 --------- d-----w c:\program files\PhotoFiltre 2008-12-27 18:46 --------- d-----w c:\program files\B2BPOKER 2008-12-27 11:31 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2 2008-12-27 11:29 --------- d-----w c:\program files\Windows Live 2008-12-27 11:27 --------- d-----w c:\users\gigantti\AppData\Roaming\Apple Computer 2008-12-27 11:27 --------- d-----w c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-12-27 11:27 --------- d-----w c:\program files\iTunes 2008-12-27 11:26 --------- d-----w c:\programdata\Apple Computer 2008-12-27 11:26 --------- d-----w c:\program files\iPod 2008-12-27 11:26 --------- d-----w c:\program files\Common Files\Apple 2008-12-27 11:25 --------- d-----w c:\program files\QuickTime 2008-12-27 11:25 --------- d-----w c:\program files\Bonjour 2008-12-27 11:23 --------- d-----w c:\program files\Apple Software Update 2008-12-27 11:21 --------- d-----w c:\programdata\Apple 2008-12-27 11:14 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller 2008-12-27 11:10 --------- d-----w c:\programdata\WLInstaller 2008-12-27 09:10 61,440 ----a-w c:\windows\System32\winipsec.dll 2008-12-27 09:10 361,984 ----a-w c:\windows\System32\IPSECSVC.DLL 2008-12-27 09:10 28,672 ----a-w c:\windows\System32\FwRemoteSvr.dll 2008-12-27 09:10 272,896 ----a-w c:\windows\System32\polstore.dll 2008-12-27 09:08 94,720 ----a-w c:\windows\System32\PortableDeviceClassExtension.dll 2008-12-27 09:08 241,152 ----a-w c:\windows\System32\PortableDeviceApi.dll 2008-12-27 09:08 160,768 ----a-w c:\windows\System32\PortableDeviceTypes.dll 2008-12-27 09:03 428,544 ----a-w c:\windows\System32\EncDec.dll 2008-12-27 09:03 293,376 ----a-w c:\windows\System32\psisdecd.dll 2008-12-27 09:01 296,960 ----a-w c:\windows\System32\gdi32.dll 2008-12-27 08:58 212,480 ----a-w c:\windows\system32\drivers\mrxsmb10.sys 2008-12-27 08:56 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll 2008-12-27 08:56 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll 2008-12-27 08:56 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll 2008-12-27 08:56 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll 2008-12-27 08:56 28,672 ----a-w c:\windows\System32\Apphlpdm.dll 2008-12-27 08:56 2,560 ----a-w c:\windows\AppPatch\AcRes.dll 2008-12-27 08:56 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll 2008-12-27 08:56 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll 2008-12-27 08:56 1,695,744 ----a-w c:\windows\System32\gameux.dll 2008-12-27 08:55 303,616 ----a-w c:\windows\System32\wmpeffects.dll 2008-12-27 08:54 2,048 ----a-w c:\windows\System32\msxml3r.dll 2008-12-27 08:54 2,032,640 ----a-w c:\windows\System32\win32k.sys 2008-12-27 08:54 1,191,936 ----a-w c:\windows\System32\msxml3.dll 2008-12-27 08:50 2,048 ----a-w c:\windows\System32\tzres.dll 2008-12-27 08:45 2,927,104 ----a-w c:\windows\explorer.exe 2008-12-27 08:41 827,392 ----a-w c:\windows\System32\wininet.dll 2008-12-27 08:37 801,280 ----a-w c:\windows\System32\NaturalLanguage6.dll 2008-12-27 08:37 6,917,120 ----a-w c:\windows\System32\NlsLexicons0c1a.dll 2008-12-27 08:37 4,495,360 ----a-w c:\windows\System32\NlsData0816.dll 2008-12-27 08:37 4,495,360 ----a-w c:\windows\System32\NlsData0416.dll 2008-12-27 08:37 4,495,360 ----a-w c:\windows\System32\NlsData0414.dll 2008-12-27 08:37 2,342,912 ----a-w c:\windows\System32\NlsData000d.dll 2008-12-27 08:37 1,965,056 ----a-w c:\windows\System32\NlsData0c1a.dll 2008-12-27 08:37 1,965,056 ----a-w c:\windows\System32\NlsData081a.dll 2008-12-27 08:37 1,965,056 ----a-w c:\windows\System32\NlsData000f.dll 2008-12-27 08:35 988,216 ----a-w c:\windows\System32\winload.exe 2008-12-27 08:35 927,288 ----a-w c:\windows\System32\winresume.exe 2008-12-27 08:35 615,992 ----a-w c:\windows\System32\ci.dll 2008-12-27 08:35 6,656 ----a-w c:\windows\System32\kbd106n.dll 2008-12-27 08:35 46,592 ----a-w c:\windows\System32\setbcdlocale.dll 2008-12-27 08:35 40,960 ----a-w c:\windows\System32\srclient.dll 2008-12-27 08:35 378,368 ----a-w c:\windows\System32\srcore.dll 2008-12-27 08:35 318,464 ----a-w c:\windows\System32\rstrui.exe 2008-12-27 08:35 19,000 ----a-w c:\windows\System32\kd1394.dll 2008-12-27 08:35 14,848 ----a-w c:\windows\System32\srdelayed.exe 2008-12-27 08:32 712,704 ----a-w c:\windows\System32\WindowsCodecs.dll 2008-12-27 08:32 425,472 ----a-w c:\windows\System32\PhotoMetadataHandler.dll 2007-07-13 07:06 141,824 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll . ((((((((((((((((((((((((((((( SnapShot@2009-02-08_22.38.10,52 ))))))))))))))))))))))))))))))))))))))))) . - 2009-02-08 19:30:56 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-02-09 13:46:27 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-02-08 19:30:56 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2009-02-09 13:46:27 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2009-02-08 20:37:31 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat + 2009-02-09 13:48:01 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat + 2009-02-09 13:48:01 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2009-02-08 20:37:22 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat + 2009-02-09 13:48:06 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat + 2009-02-09 13:48:06 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 - 2009-02-08 19:30:57 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-02-09 13:48:37 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-02-08 19:30:57 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-02-09 13:48:37 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-02-08 19:30:57 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-02-09 13:48:37 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-02-08 20:34:12 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat + 2009-02-09 13:52:20 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat + 2009-02-09 13:52:20 262,144 ---ha-w c:\windows\System32\config\systemprofile\ntuser.dat.LOG1 - 2009-02-08 19:38:26 104,742 ----a-w c:\windows\System32\perfc009.dat + 2009-02-09 13:54:03 104,742 ----a-w c:\windows\System32\perfc009.dat - 2009-02-08 19:38:26 85,240 ----a-w c:\windows\System32\perfc00B.dat + 2009-02-09 13:54:03 85,240 ----a-w c:\windows\System32\perfc00B.dat - 2009-02-08 19:38:26 595,308 ----a-w c:\windows\System32\perfh009.dat + 2009-02-09 13:54:03 595,308 ----a-w c:\windows\System32\perfh009.dat - 2009-02-08 19:38:26 443,892 ----a-w c:\windows\System32\perfh00B.dat + 2009-02-09 13:54:03 443,892 ----a-w c:\windows\System32\perfh00B.dat - 2009-02-08 19:34:22 6,316 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4036286748-1219283907-3130473445-1002_UserData.bin + 2009-02-09 13:48:26 6,332 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4036286748-1219283907-3130473445-1002_UserData.bin - 2009-02-08 19:34:20 65,710 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2009-02-09 13:48:26 66,054 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2009-02-08 19:34:17 35,830 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-02-09 13:48:24 36,140 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin . -- Snapshot nollattu tähän hetkeen -- . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "SmpcSys"="c:\program files\Packard Bell\SetUpMyPC\SmpSys.exe" [2007-05-03 1116728] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "Creative Live! Cam Manager"="c:\program files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-05-02 151552] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "Steam"="c:\program files\steam\steam.exe" [2009-01-15 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 232184] "toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13580832] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 92704] "AVFX Engine"="c:\program files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2007-04-09 20480] "V0350Mon.exe"="c:\windows\V0350Mon.exe" [2007-03-28 32768] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-02 136600] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "RtHDVCpl"="RtHDVCpl.exe" [2007-03-01 c:\windows\RtHDVCpl.exe] c:\users\gigantti\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-10-04 393216] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{961656CC-7C8C-4F93-8147-C31E85AB6C8F}"= UDP:c:\program files\Skype\Phone\Skype.exe:Skype "{FBF9AC3D-ADF0-4668-80F2-6A6460EF475A}"= TCP:c:\program files\Skype\Phone\Skype.exe:Skype "{518374B7-6003-4526-94F3-BDC374C3486E}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{A84817C4-0FB6-4215-A31E-95D00BBEFBB9}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{8EDB7684-189E-474B-B2E0-BF9AC019BBB5}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{8F9D51FC-28C6-45EC-8D0B-476D96BC30D0}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{5E03385F-A84F-46B6-8D0F-8498B325DE53}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "TCP Query User{C0A99A90-7B29-4CBB-90F2-813F9B328C19}c:\\program files\\b2bpoker\\pokerihuone\\jre\\bin\\javaw.exe"= UDP:c:\program files\b2bpoker\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary "UDP Query User{98E14683-453E-42C2-8D48-17177512DE4E}c:\\program files\\b2bpoker\\pokerihuone\\jre\\bin\\javaw.exe"= TCP:c:\program files\b2bpoker\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary "{90717786-729F-4940-BA94-3783CE1070A7}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{7DE88E92-FE46-4ADB-B7C9-41CB10961B36}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "TCP Query User{954E3F98-C99C-4477-BB30-6FA810052257}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire "UDP Query User{1A4D98BB-8FE2-461F-A241-54A4C7FF702D}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire "TCP Query User{331B987E-79DC-4882-92B2-DE1D591F18A2}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2 "UDP Query User{0F820793-94FF-4A11-AA0C-4AACA2541582}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2 "TCP Query User{659D8150-8385-403B-A02A-FF0489EC40A2}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent "UDP Query User{7935285F-63E6-4AB4-99F7-FA4CDE2651FC}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent "TCP Query User{84DEB74E-4D9D-4738-8030-D062E81665E2}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2 "UDP Query User{3DAD7939-CEC4-4AA5-968E-041429D7F844}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2 "TCP Query User{9363542A-D88A-41D6-A0B2-9614D0124141}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire "UDP Query User{9542653B-8E23-467C-96D2-531B18262489}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire "TCP Query User{6210DB8E-AFD0-43AF-9B44-2A2314A6B574}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary "UDP Query User{4C664FB6-CAA3-4B47-9B8F-78CD4466B6CA}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary "{2657FA41-61DC-4DCD-B3D6-3BEBE0993CF3}"= UDP:c:\program files\Steam\Steam.exe:Steam "{7A7153E6-6965-469E-BF13-0BFFCBCAAE2D}"= TCP:c:\program files\Steam\Steam.exe:Steam "{8DFFA929-5219-4BF8-AA37-CA652CF5F21D}"= UDP:c:\users\gigantti\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool "{CB4F9F34-FEFE-4FDF-9118-BECDC1E23A29}"= TCP:c:\users\gigantti\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool R2 SrvCDEject;SrvCDEject;c:\program files\Packard Bell\SrvCDEject.exe [2007-07-13 613376] R3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\System32\drivers\3xHybrid.sys [2007-07-13 816512] R3 FETND6V;VIA Rhine Family Fast Ethernet Adapter Driver;c:\windows\System32\drivers\fetnd6v.sys [2008-09-22 43520] R3 X10Hid;X10 Hid Device;c:\windows\System32\drivers\x10hid.sys [2007-07-13 13976] S2 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" --> c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [?] S3 VF0350Afx;VF0350 Audio FX;c:\windows\System32\drivers\V0350Afx.sys [2008-12-27 143136] S3 VF0350Vfx;VF0350 Video FX;c:\windows\System32\drivers\V0350Vfx.sys [2008-12-27 7424] S3 VF0350Vid;Live! Cam Video IM (VF0350);c:\windows\System32\drivers\V0350Vid.sys [2008-12-27 170016] . 'Ajoitetut tehtävät'-kansion sisältö 2009-02-08 c:\windows\Tasks\Laajennettu takuu.job - c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2006-11-21 18:38] 2009-02-09 c:\windows\Tasks\User_Feed_Synchronization-{04AF7E74-8C43-412E-9533-DFB08147C7E3}.job - c:\windows\system32\msfeedssync.exe [2008-01-19 09:33] . . ------- Täydentävä tarkistus ------- . uStart Page = hxxp://www.google.fi/ IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-09 15:54:58 Windows 6.0.6001 Service Pack 1 NTFS tarkistaa piilotettuja prosesseja ... ? [6632] ? [58756] ? [62388] ? [432] ? [26872] ? [26888] tarkistaa piilotettuja käynnistysarvoja ... tarkistaa piilotettuja tiedostoja ... tarkistus on valmis piilotetut tiedostot: 0 ************************************************************************** . Valmistumisajankohta: 2009-02-09 15:57:09 ComboFix-quarantined-files.txt 2009-02-09 13:57:06 ComboFix2.txt 2009-02-08 20:39:50 Ennen ajoa: 214 405 091 328 tavua vapaana Ajon jälkeen: 214,374,141,952 tavua vapaana 289 --- E O F --- 2009-02-05 16:28:09 Tollanen tuli
Nyt toimii KIITOS PALJO HUJO! parempaa ja NOPEAMPAA apua en olisi voinut edes toivoa! Todella nopeata toimintaa KIITOS!
Kirjoita suorita luukkuun ComboFix /u Klikkaa ok ========== Lataa OTMoveIt OTMoveIt ja tallenna se työpöydällesi. Tuplaklikkaa OTMoveIt.exe. Klikkaa CleanUp!. Valitse Yes kun kysytään "Begin cleanup Process?". Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse. HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne. ============= Lataa Tästä Ccleaner CCleaner v 2.14.750.- Standard Build, ÄLÄ aseenna Yahoo toolbaria! Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki". Asennuksen jälkeen aukaise CCleaneri. Valitse vasemmalta pystyrivistä Options. Valitse viereisestä pystyrivistä Settings. Language kohtaan valitse Suomi. Puhdistaja Valitse vasemmalta pystyrivistä Puhdistaja. Paina alhaalta Tutki. Nyt CCleaneri tutkii, mitä voidaan poistaa (tempit, cookiessit jne.). Kun tutkiminen on valmis, paina Aja CCleaner. Nyt CCleaneri poistaa löydetyt tempit, cookiessit jne. Rekisterin virheiden korjaus Valitse vasemmalta pystyrivistä Rekisteri. Paina alhaalta Etsi rekisterin virheitä. Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet. Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon. Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet. Saat vielä varmistus kysymyksen, paina Ok. Kun virheet on korjattu, paina Sulje. Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
Scannaa koneesi Kaspersky Online Scannerin Ohjelman käynnistyessä kysytään sallitaanko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä. " Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen. " Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next. " Klikkaa nyt asetuksia, Scan Settings " Tarkista asetuksista, että seuraavat ovat valittuina: o Scan using the following Anti-Virus database: + Extended (Jos valittavissa, muuten valitse Standard) o Scan Options: + Scan Archives + Scan Mail Bases " Klikkaa OK " Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer " Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut. " Klikkaa nyt Save as Text-painiketta. " Tallenna tiedosto työpöydällesi. " Mikäli haluat jatkaa asian käsittelyä foorumissa niin kopioi tiedoston sisältö viestiisi.
