Konejumittaa. (viruksia)

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by jonkku, Feb 27, 2008.

  1. jonkku

    jonkku Regular member

    Joined:
    Dec 8, 2007
    Messages:
    221
    Likes Received:
    0
    Trophy Points:
    26
    Kone jumittaa koko ajan epäilen että tässä on
    viruksia..

    tässä logi:

    Logfile of HijackThis v1.99.1
    Scan saved at 11:28:20, on 27.2.2008
    Platform: Unknown Windows (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16609)

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
    C:\Program Files\Sonera\InternetAvustaja\bin\sprtcmd.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Windows\ehome\ehtray.exe
    C:\Windows\System32\p2phost.exe
    C:\Program Files\Simple Star\PhotoShow 5\data\Xtras\mssysmgr.exe
    C:\Windows\system32\conime.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\BitComets\BitComet.exe
    C:\Users\perhe\Downloads\hijackthis_self.exe
    C:\HJT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://s6.travian.fi/dorf2.php
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComets\tools\BitCometBHO_1.2.1.2.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [VOBRegCheck] C:\Windows\System32\VOBREGCheck.exe -CheckReg
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [Sonera] "C:\Program Files\Sonera\InternetAvustaja\bin\sprtcmd.exe" /P Sonera
    O4 - HKLM\..\Run: [soneraVista] wscript.exe "C:\Program Files\Sonera\InternetAvustaja\Agentui\snapins\vista\vistaupdate.js" sonera
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s
    O4 - HKCU\..\Run: [Simple Star PhotoShow Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComets\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComets\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComets\BitComet.exe/AddAllLink.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComets\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
    O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (file missing)
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure internet security\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure internet security\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure internet security\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure internet security\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure internet security\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure internet security\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure internet security\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure internet security\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure internet security\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure internet security\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure internet security\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O11 - Options group: [INTERNATIONAL] International*
    O13 - Gopher Prefix:
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)


    Mitä pitää tehä?
     
    jonkku, Feb 27, 2008
    #1
  2. Hujo

    Hujo Guest

    Poista vanha versio HijackThis v1.99.1

    lataa tuosta uusi versio

    Lataa TÄSTÄ HJTInstall.exe

    * Tallenna HJTInstall.exe työpöydällesi.
    * Tuplaklikkaa HJTInstall.exe-kuvaketta työpöydälläsi.
    * Oletuksena se asentaa itsensä hakemistoon C:\Program Files\Trend Micro\HijackThis.
    * Klikkaa Install.
    * Asennusohjelma luo HijackThis-kuvakkeen työpöydälle.
    * Kun asennus on valmis, se käynnistää HijackThisin.
    * Klikkaa Do a system scan and save a logfile-painiketta. Ohjelma aloittaa skannauksen ja lokin pitäisi avautua Muistioon.
    * Klikkaa ensin "Muokkaa > Valitse kaikki" sitten "Muokkaa > Kopioi" kopioidaksesi koko lokin sisällön.
    * Liitä lokin sisältö seuraavaan vastaukseesi.
    * ÄLÄ käytä Analyse This-nappulaa, sen löydöt ovat vaarallisia väärinymmärrettyinä.
    * ÄLÄ fixaa HijackThis-ohjelmalla vielä mitään. Suurin osa sen löydöistä ovat joko harmittomia tai jopa tarpeellisia.

    ==========

    scannaa uusi hjt:n loki
     
    Hujo, Feb 27, 2008
    #2
  3. jonkku

    jonkku Regular member

    Joined:
    Dec 8, 2007
    Messages:
    221
    Likes Received:
    0
    Trophy Points:
    26
    Tässä on uusi loki:



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:42:31, on 27.2.2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16609)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
    C:\Program Files\Sonera\InternetAvustaja\bin\sprtcmd.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Windows\ehome\ehtray.exe
    C:\Windows\System32\p2phost.exe
    C:\Program Files\Simple Star\PhotoShow 5\data\Xtras\mssysmgr.exe
    C:\Windows\system32\conime.exe
    C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
    C:\Program Files\BitComets\BitComet.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComets\tools\BitCometBHO_1.2.1.2.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [VOBRegCheck] C:\Windows\System32\VOBREGCheck.exe -CheckReg
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [Sonera] "C:\Program Files\Sonera\InternetAvustaja\bin\sprtcmd.exe" /P Sonera
    O4 - HKLM\..\Run: [soneraVista] wscript.exe "C:\Program Files\Sonera\InternetAvustaja\Agentui\snapins\vista\vistaupdate.js" sonera
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater\AdobeUpdater.exe
    O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComets\BitComet.exe" /tray
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - HKUS\S-1-5-21-2760749092-808667533-2852642859-1000\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'perhe')
    O4 - HKUS\S-1-5-21-2760749092-808667533-2852642859-1000\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s (User 'perhe')
    O4 - HKUS\S-1-5-21-2760749092-808667533-2852642859-1000\..\Run: [Simple Star PhotoShow Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe (User 'perhe')
    O4 - HKUS\S-1-5-21-2760749092-808667533-2852642859-1000\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 (User 'perhe')
    O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComets\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComets\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComets\BitComet.exe/AddAllLink.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComets\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
    O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (file missing)
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O13 - Gopher Prefix:
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 9059 bytes
     
    jonkku, Feb 27, 2008
    #3
  4. Hujo

    Hujo Guest

    Javan päivitys ja välimuistin tyhjennys:

    1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
    2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
    Niissä pitäisi olla seuraava kuva vieressä: [​IMG]

    3. Valitse kaikki entiset Java versiosi ja valitse Poista.
    4. Asenna uusin Java päivitys seuraavasta linkistä..
    5. Käynnistä kone uudelleen asennuksen jälkeen:

    http://java.sun.com/javase/downloads/index.jsp

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u4

    Paina Download

    Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

    7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

    8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

    *Applications and Applets

    *Trace and Log Files

    Ja paina OK -nappia

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.

    10. Klikkaa OK jättääksesi Java asetusikkunasi.

    ============

    Lataa tuolta http://www.ccleaner.com/download/builds.aspx
    CCleaner v2.05.555- Standard Build, ÄLÄ aseenna Yahoo toolbaria!

    laita asetukset näin:
    Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

    aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
    aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi
     
    Hujo, Feb 27, 2008
    #4
  5. jonkku

    jonkku Regular member

    Joined:
    Dec 8, 2007
    Messages:
    221
    Likes Received:
    0
    Trophy Points:
    26
    Kiitos erittäin paljon avunannosta!

    Mutta en löytäyt ohjauspaneelista sitä java juttua
    vaikka kuinka etsin, muu kyllä onnistui täydellisesti.

    Tässä vielä uusin loki:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:54:41, on 27.2.2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16609)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
    C:\Program Files\Sonera\InternetAvustaja\bin\sprtcmd.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Windows\ehome\ehtray.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Simple Star\PhotoShow 5\data\Xtras\mssysmgr.exe
    C:\Windows\system32\conime.exe
    C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://s6.travian.fi/dorf2.php
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComets\tools\BitCometBHO_1.2.1.2.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [VOBRegCheck] C:\Windows\System32\VOBREGCheck.exe -CheckReg
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [Sonera] "C:\Program Files\Sonera\InternetAvustaja\bin\sprtcmd.exe" /P Sonera
    O4 - HKLM\..\Run: [soneraVista] wscript.exe "C:\Program Files\Sonera\InternetAvustaja\Agentui\snapins\vista\vistaupdate.js" sonera
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s
    O4 - HKCU\..\Run: [Simple Star PhotoShow Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKUS\S-1-5-21-2760749092-808667533-2852642859-1000\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User '?')
    O4 - HKUS\S-1-5-21-2760749092-808667533-2852642859-1000\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User '?')
    O4 - HKUS\S-1-5-21-2760749092-808667533-2852642859-1000\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User '?')
    O4 - HKUS\S-1-5-21-2760749092-808667533-2852642859-1000\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User '?')
    O4 - HKUS\S-1-5-21-2760749092-808667533-2852642859-1000\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s (User '?')
    O4 - HKUS\S-1-5-21-2760749092-808667533-2852642859-1000\..\Run: [Simple Star PhotoShow Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe (User '?')
    O4 - HKUS\S-1-5-21-2760749092-808667533-2852642859-1000\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 (User '?')
    O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User '?')
    O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComets\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComets\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComets\BitComet.exe/AddAllLink.htm
    O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComets\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
    O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (file missing)
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O13 - Gopher Prefix:
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 8604 bytes
     
    jonkku, Feb 27, 2008
    #5
  6. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, Feb 27, 2008
    #6
  7. jonkku

    jonkku Regular member

    Joined:
    Dec 8, 2007
    Messages:
    221
    Likes Received:
    0
    Trophy Points:
    26
    Loki :





    ComboFix 08-02-25.3 - Game box 2008-02-27 16:12:06.1 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1035.18.1166 [GMT 2:00]
    Running from: C:\Users\perhe\Desktop\ComboFix.exe
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Program Files\internet explorer\msimg32.dll

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-27 to 2008-02-27 )))))))))))))))))
    .

    2008-02-27 14:03 . 2008-02-27 14:03 <KANSIO> d-------- C:\Program Files\CCleaner
    2008-02-27 13:37 . 2008-02-27 13:37 <KANSIO> d-------- C:\Program Files\Sun
    2008-02-27 11:27 . 2008-02-27 14:51 <KANSIO> d-------- C:\HJT
    2008-02-26 20:38 . 2008-02-26 20:38 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-02-26 18:56 . 2008-02-26 18:56 <KANSIO> d-------- C:\Program Files\Movie Maker 2.6
    2008-02-23 23:13 . 2008-02-23 23:13 <KANSIO> d-------- C:\Users\Game box\AppData\Roaming\vlc
    2008-02-23 10:49 . 2008-02-23 10:51 <KANSIO> d-------- C:\Users\perhe\AppData\Roaming\uTorrent
    2008-02-23 10:43 . 2008-02-23 10:43 <KANSIO> d-------- C:\Program Files\BitComets
    2008-02-20 19:53 . 2008-02-20 19:53 <KANSIO> d-------- C:\Users\Juhana\AppData\Roaming\Apple Computer
    2008-02-15 14:45 . 2008-02-15 14:49 <KANSIO> d-------- C:\Program Files\Counter-Strike
    2008-02-13 21:35 . 2008-02-13 21:35 194,560 --a------ C:\Windows\System32\WebClnt.dll
    2008-02-13 21:35 . 2008-02-13 21:35 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
    2008-02-13 21:33 . 2008-02-13 21:33 943,800 --a------ C:\Windows\System32\winload.exe
    2008-02-13 21:33 . 2008-02-13 21:33 905,400 --a------ C:\Windows\System32\winresume.exe
    2008-02-13 21:33 . 2008-02-13 21:33 595,456 --a------ C:\Windows\System32\schedsvc.dll
    2008-02-13 21:33 . 2008-02-13 21:33 115,200 --a------ C:\Windows\System32\loadperf.dll
    2008-02-13 21:33 . 2008-02-13 21:34 54,784 --a------ C:\Windows\System32\drivers\i8042prt.sys
    2008-02-13 21:33 . 2008-02-13 21:33 39,424 --a------ C:\Windows\System32\lodctr.exe
    2008-02-13 21:33 . 2008-02-13 21:33 32,256 --a------ C:\Windows\System32\unlodctr.exe
    2008-02-13 21:33 . 2008-02-13 21:33 23,552 --a------ C:\Windows\System32\nshhttp.dll
    2008-02-13 21:33 . 2008-02-13 21:33 17,408 --a------ C:\Windows\System32\prflbmsg.dll
    2008-02-13 21:33 . 2008-02-13 21:33 15,872 --a------ C:\Windows\System32\drivers\kbdhid.sys
    2008-02-13 21:31 . 2008-02-13 21:31 803,328 --a------ C:\Windows\System32\drivers\tcpip.sys
    2008-02-13 21:31 . 2008-02-13 21:31 216,632 --a------ C:\Windows\System32\drivers\netio.sys
    2008-02-13 21:31 . 2008-02-13 21:31 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
    2008-02-13 21:31 . 2008-02-13 21:31 24,064 --a------ C:\Windows\System32\netcfg.exe
    2008-02-13 21:31 . 2008-02-13 21:31 22,016 --a------ C:\Windows\System32\netiougc.exe
    2008-02-07 20:27 . 2008-02-07 20:27 <KANSIO> d-------- C:\Users\All Users\Disk Cleaner
    2008-02-07 20:27 . 2008-02-07 20:27 <KANSIO> d-------- C:\Registry Helper
    2008-02-07 20:27 . 2008-02-07 20:27 <KANSIO> d-------- C:\ProgramData\Disk Cleaner
    2008-02-07 20:27 . 2008-02-07 20:27 <KANSIO> d-------- C:\Program Files\Disk Cleaner
    2008-02-07 20:26 . 2008-02-07 20:26 <KANSIO> d-------- C:\Windows\System32\Registry Helper Screen Saver dir
    2008-02-07 20:26 . 2008-02-07 20:26 <KANSIO> d-------- C:\Program Files\SafeApp Screen Savers
    2008-02-07 20:26 . 2008-02-07 20:26 <KANSIO> d-------- C:\Program Files\Registry Helper
    2008-02-06 05:08 . 2008-02-06 05:08 207,168 --a------ C:\Windows\System32\Registry Helper Screen Saver.scr
    2008-02-05 15:12 . 2008-02-05 15:12 40,448 --a------ C:\Windows\hypremv1.exe
    2008-02-05 15:12 . 2008-02-05 15:12 662 --a------ C:\Windows\hypremv1.inf
    2008-02-05 12:17 . 2008-02-07 19:09 1,071,978 --a------ C:\Users\perhe\WoW-2.0.0-enGB-Installer-downloader.exe
    2008-01-27 15:14 . 2008-02-23 22:12 <KANSIO> d-------- C:\Users\Game box\Shared
    2008-01-27 15:14 . 2008-02-23 22:28 <KANSIO> d-------- C:\Users\Game box\Incomplete
    2008-01-27 15:13 . 2008-02-23 22:28 <KANSIO> d-------- C:\Users\Game box\AppData\Roaming\LimeWire

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-02-27 11:37 --------- d-----w C:\Program Files\Java
    2008-02-27 09:27 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-02-27 09:26 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-02-23 21:13 --------- d-----w C:\Users\Game box\AppData\Roaming\vlc
    2008-02-23 20:29 --------- d-----w C:\Program Files\LimeWire
    2008-02-23 11:01 --------- d-----w C:\Users\Juhana\AppData\Roaming\LimeWire
    2008-02-15 17:51 --------- d-----w C:\Program Files\Counter-Strike 1.6 V31
    2008-02-13 19:28 824,832 ----a-w C:\Windows\System32\wininet.dll
    2008-02-13 19:28 56,320 ----a-w C:\Windows\System32\iesetup.dll
    2008-02-13 19:28 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
    2008-02-13 19:28 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
    2008-02-13 14:23 --------- d-----w C:\Program Files\F-Secure Internet Security
    2008-02-13 14:23 --------- d-----w C:\Program Files\F-Secure
    2008-02-09 19:29 --------- d-----w C:\Users\perhe\AppData\Roaming\LimeWire
    2008-02-02 08:48 --------- d-----w C:\Program Files\VideoLAN
    2008-01-25 17:25 --------- d-----w C:\Users\Game box\AppData\Roaming\PC Suite
    2008-01-25 17:20 716,272 ----a-w C:\Windows\system32\drivers\sptd.sys
    2008-01-25 12:09 --------- d-----w C:\Program Files\GameSpy Arcade
    2008-01-24 19:47 --------- d-----w C:\Users\perhe\AppData\Roaming\mIRC
    2008-01-20 15:10 --------- d-----w C:\Users\perhe\AppData\Roaming\Apple Computer
    2008-01-20 15:09 --------- d-----w C:\Program Files\iTunes
    2008-01-20 15:09 --------- d-----w C:\Program Files\iPod
    2008-01-20 15:08 --------- d-----w C:\ProgramData\Apple Computer
    2008-01-20 15:06 --------- d-----w C:\Program Files\QuickTime
    2008-01-20 15:04 --------- d-----w C:\Program Files\Apple Software Update
    2008-01-20 15:03 --------- d-----w C:\ProgramData\Apple
    2008-01-20 15:03 --------- d-----w C:\Program Files\Common Files\Apple
    2008-01-13 19:41 --------- d-----w C:\Users\perhe\AppData\Roaming\Nokia
    2008-01-12 20:16 --------- d-----w C:\Program Files\Paint.NET
    2008-01-09 14:25 --------- d-----w C:\Program Files\Windows Sidebar
    2008-01-09 14:18 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
    2008-01-09 14:18 449,024 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
    2008-01-09 14:18 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
    2008-01-09 14:18 2,143,744 ----a-w C:\Windows\AppPatch\AcGenral.dll
    2008-01-09 14:18 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
    2008-01-09 14:18 1,686,016 ----a-w C:\Windows\System32\gameux.dll
    2008-01-09 14:17 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
    2008-01-09 14:17 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
    2008-01-09 14:17 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
    2008-01-09 14:17 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
    2008-01-09 14:17 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
    2008-01-09 14:16 11,776 ----a-w C:\Windows\System32\sbunattend.exe
    2008-01-05 20:59 --------- d-----w C:\Users\Juhana\AppData\Roaming\Nokia
    2008-01-05 09:41 --------- d-----w C:\Users\Juhana\AppData\Roaming\PC Suite
    2008-01-05 09:25 --------- d-----w C:\ProgramData\PC Suite
    2008-01-05 09:18 --------- d-----w C:\Users\perhe\AppData\Roaming\PC Suite
    2008-01-05 09:17 --------- d-----w C:\Program Files\Common Files\PCSuite
    2008-01-05 09:17 --------- d-----w C:\Program Files\Common Files\Nokia
    2008-01-05 09:16 --------- d-----w C:\Program Files\Nokia
    2008-01-05 09:16 --------- d-----w C:\Program Files\DIFX
    2008-01-05 09:15 --------- d-----w C:\Program Files\PC Connectivity Solution
    2008-01-05 09:11 --------- d-----w C:\ProgramData\Installations
    2008-01-04 17:51 --------- d-----w C:\ProgramData\Adobe Systems
    2008-01-04 17:45 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-01-04 17:43 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
    2008-01-02 20:09 --------- d-----w C:\Program Files\America's Army
    2008-01-02 00:12 43,520 ----a-w C:\Windows\system32\drivers\fetnd5bv.sys
    2007-12-29 13:24 --------- d-----w C:\Users\Juhana\AppData\Roaming\Video DVD Maker FREE
    2007-12-12 19:22 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
    2007-12-12 19:22 223,232 ----a-w C:\Windows\System32\WMASF.DLL
    2007-12-12 19:22 1,327,104 ----a-w C:\Windows\System32\quartz.dll
    2007-12-12 18:32 3,504,824 ----a-w C:\Windows\System32\ntkrnlpa.exe
    2007-12-12 18:32 3,470,520 ----a-w C:\Windows\System32\ntoskrnl.exe
    2007-09-17 13:52 174 --sha-w C:\Program Files\desktop.ini
    2007-04-26 15:26 32 ----a-r C:\Users\All Users\hash.dat
    2007-04-26 15:26 32 ----a-r C:\ProgramData\hash.dat
    2007-11-24 07:58 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    2007-11-24 07:58 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    2007-11-24 07:58 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 16:16 1232896]
    "WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 14:34 2159104 C:\Windows\System32\oobefldr.dll]
    "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55 5674352]
    "AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater\AdobeUpdater.exe" [2005-03-16 19:16 970752]
    "BitComet"="C:\Program Files\BitComets\BitComet.exe" [2008-02-01 09:20 2194744]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-05-23 20:17 1006264]
    "RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 14:37 4186112 C:\Windows\RtHDVCpl.exe]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 14:40 155648]
    "VOBRegCheck"="C:\Windows\System32\VOBREGCheck.exe" [ ]
    "F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-28 11:19 183208]
    "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-28 11:18 740208]
    "Sonera"="C:\Program Files\Sonera\InternetAvustaja\bin\sprtcmd.exe" [2007-09-03 12:29 197880]
    "soneraVista"="wscript.exe" [2006-11-02 11:46 135168 C:\Windows\System32\wscript.exe]
    "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-12 04:28 86016]
    "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-12 04:28 8497696]
    "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-12 04:28 81920]
    "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "LogonHoursAction"= 2 (0x2)
    "DontDisplayLogonHoursWarnings"= 1 (0x1)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{14C096B5-E194-41DF-906E-16EBE893FC00}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)|Edge=TRUE|
    "{FD7061D5-3D64-4D2B-A8D1-68D38E41AD27}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
    "{AD076441-B68C-4B8F-BB0B-33B298957F9F}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
    "{106F113C-8C03-44EB-A656-0AD8F81398BF}"= UDP:C:\Users\Public\Documents\LimeWire\LimeWire.exe:LimeWire
    "{A96DE403-7E39-4010-B58F-A0C1A2519FE4}"= TCP:C:\Users\Public\Documents\LimeWire\LimeWire.exe:LimeWire
    "{DB552348-E3E0-47F7-A949-27B30BA39202}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)|Edge=TRUE|
    "{A52B7D22-1FB7-4B57-8881-585EE6434872}"= UDP:C:\FirstSteps\LimeWire\LimeWire.exe:LimeWire
    "{0361D7FB-5871-43E2-92A1-45C03EBAB201}"= TCP:C:\FirstSteps\LimeWire\LimeWire.exe:LimeWire
    "{91265830-B8F7-43FE-BDE7-EAB79FD68D1E}"= UDP:C:\Users\Juhana\LimeWire\LimeWire.exe:LimeWire
    "{4A514931-F3D9-4A8F-B0BB-D8D200A89216}"= TCP:C:\Users\Juhana\LimeWire\LimeWire.exe:LimeWire
    "{11F754DB-A1B3-4A08-AC80-F382B750704E}"= UDP:C:\Users\Juhana\AppData\Local\Microsoft\Messenger\top14590@hotmail.com\Sharing Folders\LimeWire\LimeWire.exe:LimeWire
    "{B78935A5-CE08-46F2-88F2-60BAC8913BC2}"= TCP:C:\Users\Juhana\AppData\Local\Microsoft\Messenger\top14590@hotmail.com\Sharing Folders\LimeWire\LimeWire.exe:LimeWire
    "{C17C6DC1-F15A-41C8-AA42-8F032A1F077E}"= UDP:C:\Users\Juhana\Documents\Desktop\LimeWire\LimeWire.exe:LimeWire
    "{9421017E-398E-452E-AD98-267A327DED67}"= TCP:C:\Users\Juhana\Documents\Desktop\LimeWire\LimeWire.exe:LimeWire
    "TCP Query User{EDA9A4E2-6AEE-445E-827D-3FECD321A6F5}C:\program files\counter-strike 1.6 v31\hl.exe"= UDP:C:\program files\counter-strike 1.6 v31\hl.exe:Half-Life Launcher|Desc=Half-Life Launcher
    "UDP Query User{55A1113A-AA32-4FC9-953F-32C8F9162356}C:\program files\counter-strike 1.6 v31\hl.exe"= TCP:C:\program files\counter-strike 1.6 v31\hl.exe:Half-Life Launcher|Desc=Half-Life Launcher
    "TCP Query User{8F911852-4708-405D-8766-7A61B2C50020}C:\program files\bitcomet\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client|Desc=BitComet - a BitTorrent Client
    "UDP Query User{EF63EAE6-C9E5-4750-8C47-C89B461A32CC}C:\program files\bitcomet\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client|Desc=BitComet - a BitTorrent Client
    "TCP Query User{F0DC58AB-3C4F-458C-A7BE-6F7CC095C8CD}C:\program files\dc++\dcplusplus.exe"= Disabled:UDP:C:\program files\dc++\dcplusplus.exe:DCPlusPlus|Desc=DCPlusPlus
    "UDP Query User{3A450C41-AC21-43BC-9CA4-522116C87D1F}C:\program files\dc++\dcplusplus.exe"= Disabled:TCP:C:\program files\dc++\dcplusplus.exe:DCPlusPlus|Desc=DCPlusPlus
    "{444B08EB-3E70-493A-97BF-D3237D168A96}"= Disabled:UDP:C:\Program Files\Morpheus\Morpheus.exe:Morpheus
    "{ED9B9A94-39FD-4F60-BAD5-F49AC0C220FF}"= Disabled:TCP:C:\Program Files\Morpheus\Morpheus.exe:Morpheus
    "TCP Query User{1F6AAB4C-47EC-4091-AAB6-BFE88F9FCBE1}C:\program files\america's army\system\armyops.exe"= UDP:C:\program files\america's army\system\armyops.exe:ArmyOps|Desc=ArmyOps
    "UDP Query User{BF59D5D2-F3DD-4D82-A6E8-51EBE7F7E2B8}C:\program files\america's army\system\armyops.exe"= TCP:C:\program files\america's army\system\armyops.exe:ArmyOps|Desc=ArmyOps
    "{89BD7317-B2BC-4CDD-808B-C38CE3CCEE3B}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
    "{00049BBF-CF5F-42D6-A512-2F64490B36B7}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
    "TCP Query User{FF6C48D3-AD45-4F70-80AA-9BC044D89621}C:\program files\ea games\medal of honor allied assault spearhead demo\moh_spearhead_demo.exe"= Disabled:UDP:C:\program files\ea games\medal of honor allied assault spearhead demo\moh_spearhead_demo.exe:Medal of Honor Allied Assault(tm) Spearhead|Desc=Medal of Honor Allied Assault(tm) Spearhead
    "UDP Query User{61C889B6-A0A9-4425-B4CF-724C0DDD0389}C:\program files\ea games\medal of honor allied assault spearhead demo\moh_spearhead_demo.exe"= Disabled:TCP:C:\program files\ea games\medal of honor allied assault spearhead demo\moh_spearhead_demo.exe:Medal of Honor Allied Assault(tm) Spearhead|Desc=Medal of Honor Allied Assault(tm) Spearhead
    "TCP Query User{F663DB30-FB18-439B-B5ED-B415AE995A1C}C:\program files\wolfenstein - enemy territory\et.exe"= Disabled:UDP:C:\program files\wolfenstein - enemy territory\et.exe:ET|Desc=ET
    "UDP Query User{B6EB225E-DD09-4EDC-9A78-A1BD6B6C7A4B}C:\program files\wolfenstein - enemy territory\et.exe"= Disabled:TCP:C:\program files\wolfenstein - enemy territory\et.exe:ET|Desc=ET
    "TCP Query User{92B953F0-C957-40AA-A51F-58A4C481EC96}C:\program files\bitcomets\bitcomet.exe"= UDP:C:\program files\bitcomets\bitcomet.exe:BitComet - a BitTorrent Client|Desc=BitComet - a BitTorrent Client
    "UDP Query User{88F4C46D-50E9-4C6E-8B32-1188F0EFBB0B}C:\program files\bitcomets\bitcomet.exe"= TCP:C:\program files\bitcomets\bitcomet.exe:BitComet - a BitTorrent Client|Desc=BitComet - a BitTorrent Client
    "TCP Query User{EDED72A1-6D7B-4E96-BC96-C67868F9F4C2}C:\program files\utorrent\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent|Desc=uTorrent
    "UDP Query User{DB540AC6-4D10-4328-A742-F69E57A78A07}C:\program files\utorrent\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent|Desc=uTorrent

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

    R0 videX32;videX32;C:\Windows\system32\DRIVERS\videX32.sys [2006-10-17 21:22]
    R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\Windows\system32\DRIVERS\xfilt.sys [2006-10-18 18:39]
    R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-02-13 16:16]
    R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2007-05-28 11:16]
    R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys [2007-08-22 14:57]
    R1 fsvista;F-Secure Vista Support Driver;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsvista.sys [2007-05-28 11:15]
    R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-28 11:15]
    R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\Windows\system32\DRIVERS\fetnd5bv.sys [2008-01-02 02:12]
    R3 RTSTOR;USB Mass Storage Device;C:\Windows\system32\drivers\RTSTOR.SYS [2007-05-11 19:09]
    S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-28 11:15]
    S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-28 11:15]

    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-27 16:15:36
    Windows 6.0.6000 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "VOBRegCheck"="C:\\Windows\\System32\\VOBREGCheck.exe -CheckReg"
    .
    Completion time: 2008-02-27 16:16:45
    ComboFix-quarantined-files.txt 2008-02-27 14:16:42
    .
    2008-02-27 06:51:41 --- E O F ---
     
    jonkku, Feb 27, 2008
    #7
  8. Hujo

    Hujo Guest

    Poista koneelta lisää poista sovelutuksesta

    LimeWire

    poista vikasiedossa kansio

    C:\Program Files\LimeWire
     
    Last edited by a moderator: Feb 27, 2008
    Hujo, Feb 27, 2008
    #8

Share This Page