Levytila vähenee

Koneella on ollut vähän aikaa sitten virusongelmia, jotka eivät näköjään
ole siivouksen jälkeen kokonaan poistuneet. Nyt C-aseman levytila vähenee pikkuhiljaa, vaikka käytänkin CCleaneria ja ATF-Cleaneria useasti päivässä. Aina virusskannauksen yhteydessä tila tuntuu vähenevän
nopeampaan tahtiin. Tilaa on tällä hetkellä 81,4 Mt, alunperin sitä oli
ainakin 1,0 Gt.

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 19:06:26, on 19.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
E:\Program Files\Avast 4\aswUpdSv.exe
E:\Program Files\Avast 4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
E:\Program Files\Avast 4\ashMaiSv.exe
E:\Program Files\Avast 4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDLL32.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\PROGRA~1\AVAST4~1\ashDisp.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\Program Files\PeerGuardian2\pg2.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Spybot - Search & Destroy2\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.regionline.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\BitComet2\tools\BitCometBHO_1.1.6.14.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~2\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {B26DCB3D-F95F-4F27-AC17-7FCF96744AB7} - (no file)
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ZoneAlarm Client] "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\AVAST4~1\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [PeerGuardian] E:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy2\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://E:\BitComet2\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://E:\BitComet2\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://E:\BitComet2\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~2\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~2\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2931566C-B8A6-46C5-BF4D-E6AB9251E953} (Nexon Package Manager Control) - http://file.nx.com/activex/public_new/nxpm.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/178cea2c22f28de0a215/netzip/RdxIE601.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FCF289D4-0AC8-4ED8-BE31-E8AF09606AB5} (download_35mb_com.applet) - http://www.35mb.com/downloadapplet.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Avast 4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Avast 4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Avast 4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Avast 4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - E:\Program Files\sandra\SiSoftware Sandra Lite 2005.SR1\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - E:\Program Files\sandra\SiSoftware Sandra Lite 2005.SR1\RpcSandraSrv.exe
O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

--
End of file - 9781 bytes

 

scannaa hjt:llä merkkaa paina Fix checked

O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {B26DCB3D-F95F-4F27-AC17-7FCF96744AB7} - (no file)
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/178cea2c22f2...ip/RdxIE601.cab

==========

Poista lisää poista sovelutuksesta

ZoneAlarmSB

poista vikasiedossa kansio

C:\Program Files\ZoneAlarmSB


============

Lataa: RegSeeker.zip työpöydälle:

Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman.
Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen.
Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri
Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken).
Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta
klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin.
Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet
Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK".
Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK".
Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen.

===========

Escan
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg

scannaa

jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl+A.
Kopioi rivit komennolla Ctrl+C.
Liitä rivit komennolla Ctrl+V.

Laita virus log tänne.

==========

Lataa koneelle
SpywareBlaster
päivittele sitä joskus

 

Kiitos avusta.
Escan loki:

File C:\Documents and Settings\Järjestelmänvalvoja\Application Data\SecuROM\UserData\???????????p???????? infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Järjestelmänvalvoja\Application Data\SecuROM\UserData\???????????p??????????? infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\QooBox\Quarantine\C\WINDOWS\system32\qommjih.dll.vir infected by "Trojan.Win32.BHO.auf" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{433B85A3-D243-4F1E-9BA4-C59433662817}\RP864\A0136991.dll infected by "Trojan.Win32.BHO.axg" Virus. Action Taken: File Deleted.
File C:\VundoFix Backups\pmkhe.dll.bad tagged as not-a-virus:AdWare.Win32.Virtumonde.gkz. No Action Taken.
File C:\VundoFix Backups\qommjih.dll.bad infected by "Trojan.Win32.BHO.auf" Virus. Action Taken: File Deleted.
File C:\VundoFix Backups\rqrqqpp.dll.bad infected by "Trojan.Win32.BHO.axg" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Installer\{8b746ef4-e419-4712-bbe4-9c10b4172f7d}\zip.dll infected by "Trojan-Downloader.Win32.BHO.cm" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Installer\{a8cff82c-b1f6-435e-825a-bdcf962d1cd0}\zip.dll infected by "Trojan-Downloader.Win32.BHO.cm" Virus. Action Taken: File Deleted.
File E:\System Volume Information\_restore{433B85A3-D243-4F1E-9BA4-C59433662817}\RP864\A0141314.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.63. No Action Taken.

 

1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK

 

4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä

Tämän jälkeen tulee viesti:

Järjestelmän palauttaminen kohtasi ongelmia yhden tai useamman aseman käyttöönotossa tai käytöstä poistamisessa. Käynnistä tietokone uudelleen.

Uudelleenkäynnistämisen jälkeen sama viesti ilmestyy yhä.

 

1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

=======

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

 

ComboFix 08-02-21 - Järjestelmänvalvoja 2008-02-21 16:01:54.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.261 [GMT 2:00]
Running from: E:\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-21 to 2008-02-21 )))))))))))))))))
.

2008-02-21 15:58 . 2008-02-21 15:58 1,310,977 --a------ C:\SDFix.exe
2008-02-20 22:18 . 2008-02-20 22:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-20 22:18 . 2008-02-20 22:18 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-20 15:21 . 2007-12-18 22:36 262,144 --a------ C:\Program Files\Uninstall Spy Blocker.dll
2008-02-17 23:52 . 2008-02-17 23:52 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2008-02-17 23:52 . 2008-02-17 23:52 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb
2008-02-11 18:48 . 2008-02-17 22:22 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\DoctorWeb
2008-02-11 18:48 . 2008-02-17 22:22 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\DoctorWeb
2008-02-10 15:43 . 2008-02-10 15:51 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-02-10 02:03 . 2008-02-20 16:58 <KANSIO> d-------- C:\VundoFix Backups
2008-02-09 18:38 . 2008-02-09 18:38 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Grisoft
2008-02-09 18:38 . 2008-02-09 18:38 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-09 18:38 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-09 00:45 . 2008-02-09 00:51 <KANSIO> d-------- C:\fixwareout
2008-02-08 23:20 . 2008-02-08 23:20 <KANSIO> d-------- C:\WINDOWS\ERUNT
2008-02-08 17:43 . 2008-02-08 17:41 691,545 --a------ C:\WINDOWS\unins000.exe
2008-02-08 17:43 . 2008-02-08 17:43 3,438 --a------ C:\WINDOWS\unins000.dat
2008-02-06 14:31 . 2008-02-06 14:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-06 14:30 . 2008-02-06 14:30 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-04 18:09 . 2007-12-04 16:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-02-04 18:09 . 2007-12-04 16:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-02-02 16:19 . 2007-12-17 13:53 159,458 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-02-01 16:57 . 2008-02-21 15:59 <KANSIO> d-------- C:\SDFix
2008-02-01 16:45 . 2008-02-01 16:45 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\PrevxCSI
2008-02-01 16:45 . 2008-02-01 16:45 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2008-01-31 23:53 . 2008-01-31 23:53 11 --a------ C:\WINDOWS\tekkyuuman.INI
2008-01-31 23:29 . 2008-02-19 20:12 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\JDiskReport
2008-01-31 18:42 . 2008-01-31 18:42 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Uniblue
2008-01-26 15:37 . 2008-01-26 15:37 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\ScummVM

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-21 14:05 14,573,600 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-20 20:27 173,492 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-20 18:49 --------- d-----w C:\Program Files\Canon
2008-02-20 18:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-20 18:46 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-20 18:31 --------- d-----w C:\Program Files\Astonsoft
2008-02-20 18:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-20 12:55 --------- d-----w C:\Documents and Settings\Järjestelmänvalvoja\Application Data\foobar2000
2008-02-18 20:36 --------- d-----w C:\Documents and Settings\Järjestelmänvalvoja\Application Data\uTorrent
2008-02-17 21:51 --------- d-----w C:\Program Files\Google
2008-02-17 21:46 --------- d-----w C:\Program Files\Winamp
2008-02-17 21:37 --------- d-----w C:\Program Files\Lexmark
2008-02-17 21:35 --------- d-----w C:\Program Files\Indy
2008-02-13 21:18 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-02-11 16:19 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd6685.sys
2008-02-01 20:40 3,196,416 ----a-w C:\WINDOWS\Internet Logs\xDB14.tmp
2008-01-30 15:14 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-01-30 15:14 249,856 ------w C:\WINDOWS\Setup1.exe
2008-01-29 15:10 30,296 ----a-w C:\Documents and Settings\Järjestelmänvalvoja\Application Data\GDIPFONTCACHEV1.DAT
2008-01-09 10:10 --------- d-----w C:\Documents and Settings\Järjestelmänvalvoja\Application Data\dvdcss
2008-01-01 16:38 --------- d-----w C:\Program Files\uTorrent
2007-12-29 12:10 --------- d-----w C:\Documents and Settings\Järjestelmänvalvoja\Application Data\DivX
2007-12-28 19:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pinnacle
2007-12-28 19:41 --------- d-----w C:\Program Files\DivX
2007-12-23 09:13 11,156,278 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2007-12-14 09:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-07 00:34 321,024 ----a-w C:\WINDOWS\Internet Logs\xDB13.tmp
2007-12-05 00:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-04 18:41 550,912 ------w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-08 22:49 4,381,696 ----a-w C:\WINDOWS\Internet Logs\xDB12.tmp
2007-08-24 17:26 6,099 ----a-w C:\WINDOWS\Fonts\rammstein.zip
2007-08-24 17:26 41,553 ----a-w C:\WINDOWS\Fonts\sepultura.zip
2007-08-24 17:26 33,959 ----a-w C:\WINDOWS\Fonts\slayer.zip
2007-08-24 17:26 21,540 ----a-w C:\WINDOWS\Fonts\motorhead.zip
2007-08-24 17:25 57,938 ----a-w C:\WINDOWS\Fonts\manowar.zip
2007-08-24 17:25 30,745 ----a-w C:\WINDOWS\Fonts\megadeth.zip
2007-08-19 19:59 2,993,152 ----a-w C:\WINDOWS\Internet Logs\xDB11.tmp
2007-08-08 20:16 5,797,376 ----a-w C:\WINDOWS\Internet Logs\xDB10.tmp
2007-06-30 20:45 3,547,648 ----a-w C:\WINDOWS\Internet Logs\xDBF.tmp
2007-06-23 09:11 2,944,512 ----a-w C:\WINDOWS\Internet Logs\xDBE.tmp
2007-06-17 20:56 3,414,528 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp
2007-05-22 08:13 96,256 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp
2007-05-22 08:13 2,411,008 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp
2007-05-20 20:46 3,249,664 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp
2007-05-03 15:18 4,386,304 ----a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2007-05-03 15:15 16,957,158 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_05_03_17_07_02_full.dmp.zip
2007-05-03 15:14 16,650,157 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_05_03_17_06_41_full.dmp.zip
2007-05-03 15:12 90,043 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_05_03_17_06_47_small.dmp.zip
2007-05-03 15:12 78,085 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_05_03_17_01_31_small.dmp.zip
2007-05-03 15:12 16,650,992 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_05_03_17_01_24_full.dmp.zip
2007-05-03 15:12 116,395 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_05_03_17_00_56_small.dmp.zip
2007-03-31 22:20 2,913,280 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2007-03-30 21:42 3,153,408 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2007-03-19 19:34 1,488,896 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2007-02-24 06:35 105,050 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_02_23_21_58_52_small.dmp.zip
2006-11-23 17:19 1,811,456 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2006-11-17 19:59 127,488 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2006-11-03 15:20 2,711,040 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2006-10-08 12:43 1,652,736 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2006-09-18 14:59 1,560,576 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2006-08-29 03:59 93,666 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2006_08_28_20_33_27_small.dmp.zip
2005-09-03 13:26 12,089,061 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2005_09_03_16_10_40.dmp.zip
2005-02-17 11:55 11,347,274 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2005_02_17_05_37_30.dmp.zip
2004-03-11 10:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PeerGuardian"="E:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824]
"SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy2\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2007-12-05 01:41 81920 C:\WINDOWS\system32\nvmctray.dll]
"ZoneAlarm Client"="E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"avast!"="E:\PROGRA~1\AVAST4~1\ashDisp.exe" [2007-12-04 15:00 79224]
"!AVG Anti-Spyware"="E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 01:12 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-04-08 18:12]
R1 SSHDRV65;SSHDRV65;C:\WINDOWS\System32\drivers\SSHDRV65.sys [2004-10-02 05:45]
R2 DLPortIO;DriverLINX Port I/O Driver;C:\WINDOWS\system32\drivers\DLPortIO.sys [1996-09-27 08:10]
R3 Ltn_stk7070P;PCTV based TV tuner device;C:\WINDOWS\system32\DRIVERS\Ltn_stk7070P.sys [2007-06-14 14:41]
R3 Ltn_stkrc;PCTV Infrared Receiver;C:\WINDOWS\system32\DRIVERS\Ltn_stkrc.sys [2007-06-13 19:30]
R3 moufiltr;Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\moufiltr.sys [2005-11-30 17:13]
S1 MindmachinePro;Mind Machine Pro Driver;C:\WINDOWS\system32\DRIVERS\mfbmmusb.sys [2004-11-23 22:14]
S3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys []
S3 DISK_DRIVE32;DISK_DRIVE32;E:\maple hack\Disk Drove\disk_1024.sys []
S3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 12:29]

*Newly Created Service* - PGFILTER
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-21 16:06:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-21 16:07:53
ComboFix-quarantined-files.txt 2008-02-21 14:07:43
ComboFix2.txt 2008-02-11 16:47:21
.
2008-02-13 20:59:53 --- E O F ---






SDFix: Version 1.144

Run by Järjestelmänvalvoja on to 21.02.2008 at 16:15

Microsoft Windows XP [versio 5.1.2600]
Running From: C:\SDFix

Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Checking Files:

No Trojan Files Found






Removing Temp Files...

ADS Check:



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-21 16:23:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:5dd0f7b2
"s1"=dword:8452ba22
"s2"=dword:8119c70f
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:16,5c,7d,86,65,13,4a,50,a9,d1,92,6a,a2,62,65,cd,2d,ce,b6,84,39,..
"p0"="E:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,63,52,1d,b1,78,83,f4,7c,8f,7b,43,54,95,ff,2a,4b,c5,..
"khjeh"=hex:63,99,3f,7c,7e,14,39,bd,c0,25,68,33,9c,1c,01,76,58,ba,55,39,58,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:e6,c4,03,39,10,60,52,c6,7b,da,f8,b1,3d,68,be,db,eb,34,cf,ca,86,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:16,5c,7d,86,65,13,4a,50,a9,d1,92,6a,a2,62,65,cd,2d,ce,b6,84,39,..
"p0"="E:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,63,52,1d,b1,78,83,f4,7c,8f,7b,43,54,95,ff,2a,4b,c5,..
"khjeh"=hex:63,99,3f,7c,7e,14,39,bd,c0,25,68,33,9c,1c,01,76,58,ba,55,39,58,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:e6,c4,03,39,10,60,52,c6,7b,da,f8,b1,3d,68,be,db,eb,34,cf,ca,86,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:16,5c,7d,86,65,13,4a,50,a9,d1,92,6a,a2,62,65,cd,2d,ce,b6,84,39,..
"p0"="E:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,63,52,1d,b1,78,83,f4,7c,8f,7b,43,54,95,ff,2a,4b,c5,..
"khjeh"=hex:63,99,3f,7c,7e,14,39,bd,c0,25,68,33,9c,1c,01,76,58,ba,55,39,58,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:1a,5e,da,bd,92,e5,57,12,82,03,b4,ad,af,bf,b8,dc,7f,78,27,4a,4f,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x00ffc\xd3w\2]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG10.00.00.01WORKSTATION"="7E8961BF40CF8525FB28D0CB5406AEEC6A519F8D6545C22778090C6CC17E6695D5E2EE18BEA106305EFCDB99677FC1E3DBBDD6BF4D72E729D0EC1257D6DF7C5ADC94C332AC7D5A6DA2B98902277654F14EDBD7FBDD507ADB1E4F80D8B9ABD92E88DD3E949BCEDF62DFB85F1094843F2D194574F1A9456C8E192911632D35A8341233211722741BA36F8E4AA1B8B37CC158C85FA3C9A7D1A13E24E03F7AC235FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A2D97226D213B555FEBC9E127BECC74C5D575E7D6A3B9808885A8D60A7C8B227977921CFF894087A25A6BB97C9661B3DBD42B74E58EC12CCD2499B6174F3DC7D0B6CE6157AF16FDDE12C3E139B33D2989B84DC95F48BFBD98030D794F6A5FE4B70F1B48720D184A04279CD38856C9C2E764B84A9AA5B5414B5414984298DAAFE229EED9DA913C5E974A5C8862DC503FC724BACB1A57F5276AC75AAA2DB5DE4A98CC9A832AB9AA482B908C4E00B7306A646FE0639E09D231B2F076A42304F267E338FB2800ED1865AE9BF890DEB2F98753CA677AF316166C11F742B1C1D1D5BD7294F0A2C0C2647816E2C9334F0B7A15134C0196939F92F4F7002444D6E07E63219AE6239B486B3AE467393E68DCCFC4AA217BA1C731807C92BB5BE5642D19C2F3F952410EC680DBB837F6F960CB5F7928DB15BE3AF73685FEBDB591A0B434691ED2FE9806C448AA54B7BBE9988BBD681115EB1BF0D4745DE628207E18FA81FC30A6C033A3F97568FD95ACC29742C4F13DAB0A61584D17F3DD2FD6EDA6ACF5AD30C01F25344620EBE7BCF1CE593D70E64B0FED8A8DCD4F09016E4E9148B0F9CEF81E5F2452FA8441D93565F51FE16B1B8E7611928359864959812080335BB7D6E8C566CEC8973FCB997A98151A3404C786C386CA0FD661A2CDA240CFEFDB18BC86254010CACCFB544934C9B324333E5ADBD240E877F8DC6D86F80EAC5CFD1481CCBA081C8C9CED893A382819FEF5179856D8CE8B3516112C2004B5077EB7F26A6A5C5F82BE4834B237BD5B62D9580F455251AA1DF623797B548F2999762A190D061109FA05488E08E6114F251EF293C93203C8A2B746968A299235B0F1B246421050FE6FAC4F9E4992F4D23E60E3927D9AB25309A9CD8081DD7525A2950F670C52A967171B77795285357E7ABD6230067ABC9CD94C5656D5BF9B59298128D7C8EFCBE961AFDA523464F4A16C2025C05A019E5D664AB7886BB0EC7317042DEBF713EE463F4402EB6A03A05B5311DDDE90BFCF5EE3AE1F932BC33CA192A97E7E886C5A816E2FB3EE6893EA6836387A6D5D2F83DF029CD5B44031E3E60209D28160BF96D22A77E84C4F61A966F2678B664453E41E8A7290D85D517EB5393B2A25FDFD95C2F6EEDB750029F"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:



Files with Hidden Attributes:

Tue 15 Jun 2004 0 A..H. --- "C:\WINDOWS\wlwl.exe.tmp"
Sun 19 Jun 2005 192,512 A..H. --- "C:\Program Files\MP3 Recorder\Recordmix.exe"
Sat 9 Sep 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 14 Oct 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed 21 Sep 2005 32,256 A..H. --- "C:\Documents and Settings\J„rjestelm„nvalvoja\Ty”p”yt„\K„ytt„m„tt”m„t ty”p”yd„n pikakuvakkeet\~WRL0003.tmp"
Thu 24 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT3.tmp"
Thu 15 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b7e6c7771d289926881287eb0ecc2a85\BIT4.tmp"
Fri 28 Oct 2005 444 ...HR --- "C:\Documents and Settings\J„rjestelm„nvalvoja\Application Data\SecuROM\UserData\securom_v7_01.bak"

Finished!




Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 18:20:59, on 21.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
E:\Program Files\Avast 4\aswUpdSv.exe
E:\Program Files\Avast 4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
E:\Program Files\Avast 4\ashMaiSv.exe
E:\Program Files\Avast 4\ashWebSv.exe
C:\WINDOWS\system32\RunDLL32.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\PROGRA~1\AVAST4~1\ashDisp.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.regionline.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~2\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ZoneAlarm Client] "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\AVAST4~1\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [PeerGuardian] E:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy2\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~2\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~2\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2931566C-B8A6-46C5-BF4D-E6AB9251E953} (Nexon Package Manager Control) - http://file.nx.com/activex/public_new/nxpm.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FCF289D4-0AC8-4ED8-BE31-E8AF09606AB5} (download_35mb_com.applet) - http://www.35mb.com/downloadapplet.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Avast 4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Avast 4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Avast 4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Avast 4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - E:\Program Files\sandra\SiSoftware Sandra Lite 2005.SR1\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - E:\Program Files\sandra\SiSoftware Sandra Lite 2005.SR1\RpcSandraSrv.exe
O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

--
End of file - 8032 bytes

 

Poista toi Trend Micro HijackThis v2.0.0 (BETA)

ota uudempi versio

Lataa TÄSTÄ HJTInstall.exe

* Tallenna HJTInstall.exe työpöydällesi.
* Tuplaklikkaa HJTInstall.exe-kuvaketta työpöydälläsi.
* Oletuksena se asentaa itsensä hakemistoon C:\Program Files\Trend Micro\HijackThis.
* Klikkaa Install.
* Asennusohjelma luo HijackThis-kuvakkeen työpöydälle.
* Kun asennus on valmis, se käynnistää HijackThisin.
* Klikkaa Do a system scan and save a logfile-painiketta. Ohjelma aloittaa skannauksen ja lokin pitäisi avautua Muistioon.
* Klikkaa ensin "Muokkaa > Valitse kaikki" sitten "Muokkaa > Kopioi" kopioidaksesi koko lokin sisällön.
* Liitä lokin sisältö seuraavaan vastaukseesi.
* ÄLÄ käytä Analyse This-nappulaa, sen löydöt ovat vaarallisia väärinymmärrettyinä.
* ÄLÄ fixaa HijackThis-ohjelmalla vielä mitään. Suurin osa sen löydöistä ovat joko harmittomia tai jopa tarpeellisia.

=======

Päivitä \AVG Anti-Spyware 7.5 ja aja se vikasiedossa.

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:58:49, on 21.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
E:\Program Files\Avast 4\aswUpdSv.exe
E:\Program Files\Avast 4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
E:\Program Files\Avast 4\ashMaiSv.exe
E:\Program Files\Avast 4\ashWebSv.exe
C:\WINDOWS\system32\RunDLL32.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\PROGRA~1\AVAST4~1\ashDisp.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.regionline.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~2\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ZoneAlarm Client] "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\AVAST4~1\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [PeerGuardian] E:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy2\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~2\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~2\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2931566C-B8A6-46C5-BF4D-E6AB9251E953} (Nexon Package Manager Control) - http://file.nx.com/activex/public_new/nxpm.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FCF289D4-0AC8-4ED8-BE31-E8AF09606AB5} (download_35mb_com.applet) - http://www.35mb.com/downloadapplet.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Avast 4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Avast 4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Avast 4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Avast 4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - E:\Program Files\sandra\SiSoftware Sandra Lite 2005.SR1\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - E:\Program Files\sandra\SiSoftware Sandra Lite 2005.SR1\RpcSandraSrv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6792 bytes

 

1. Käynnistä Spybot-S&D Edistyneessä tilassa
2. Jos se ei ole Edistyneessä tilassa, mene Tila-valikkoon ja valitse Edistynyt tila
3. Klikkaa vasemmalla Työkalut
4. Klikkaa listassa Pysyvä suojaus
5. Ota rasti pois kohdasta "Pysyvä TeaTimer" ja paina OK.
6. Käynnistä kone uudelleen.

========

scannaa hjt:llä merkkaa paina Fix checked

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - (no file)
O2 - BHO: (no name) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)

 

Uusi hjt-loki:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:44:04, on 22.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
E:\Program Files\Avast 4\aswUpdSv.exe
E:\Program Files\Avast 4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
E:\Program Files\Avast 4\ashMaiSv.exe
E:\Program Files\Avast 4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDLL32.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\PROGRA~1\AVAST4~1\ashDisp.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.regionline.fi/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~2\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ZoneAlarm Client] "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\AVAST4~1\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [PeerGuardian] E:\Program Files\PeerGuardian2\pg2.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~2\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~2\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2931566C-B8A6-46C5-BF4D-E6AB9251E953} (Nexon Package Manager Control) - http://file.nx.com/activex/public_new/nxpm.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FCF289D4-0AC8-4ED8-BE31-E8AF09606AB5} (download_35mb_com.applet) - http://www.35mb.com/downloadapplet.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Avast 4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Avast 4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Avast 4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Avast 4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - E:\Program Files\sandra\SiSoftware Sandra Lite 2005.SR1\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - E:\Program Files\sandra\SiSoftware Sandra Lite 2005.SR1\RpcSandraSrv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6448 bytes


Vieläkin levytila mystisesti hupenee, olisikohan muuta kuin viruksesta johtuvaa?

 

Otas uusi combofix loki

 

ComboFix 08-02-21 - Järjestelmänvalvoja 2008-02-22 20:03:36.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.189 [GMT 2:00]
Running from: E:\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-22 to 2008-02-22 )))))))))))))))))
.

2008-02-21 22:33 . 2008-02-22 18:23 2,608 --a------ C:\WINDOWS\system32\settings.aaw
2008-02-21 22:33 . 2008-02-22 18:23 960 --a------ C:\WINDOWS\system32\history.aaw
2008-02-21 15:58 . 2008-02-21 15:58 1,310,977 --a------ C:\SDFix.exe
2008-02-20 22:18 . 2008-02-20 22:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-20 22:18 . 2008-02-20 22:18 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-20 15:21 . 2007-12-18 22:36 262,144 --a------ C:\Program Files\Uninstall Spy Blocker.dll
2008-02-17 23:52 . 2008-02-17 23:52 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2008-02-17 23:52 . 2008-02-17 23:52 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb
2008-02-10 15:43 . 2008-02-10 15:51 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-02-10 02:03 . 2008-02-20 16:58 <KANSIO> d-------- C:\VundoFix Backups
2008-02-09 18:38 . 2008-02-09 18:38 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Grisoft
2008-02-09 18:38 . 2008-02-09 18:38 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-09 18:38 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-09 00:45 . 2008-02-09 00:51 <KANSIO> d-------- C:\fixwareout
2008-02-08 23:20 . 2008-02-08 23:20 <KANSIO> d-------- C:\WINDOWS\ERUNT
2008-02-08 17:43 . 2008-02-08 17:41 691,545 --a------ C:\WINDOWS\unins000.exe
2008-02-08 17:43 . 2008-02-08 17:43 3,438 --a------ C:\WINDOWS\unins000.dat
2008-02-04 18:09 . 2007-12-04 16:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-02-04 18:09 . 2007-12-04 16:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-02-02 16:19 . 2007-12-17 13:53 159,458 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-02-01 16:57 . 2008-02-21 16:26 <KANSIO> d-------- C:\SDFix
2008-02-01 16:45 . 2008-02-01 16:45 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\PrevxCSI
2008-02-01 16:45 . 2008-02-01 16:45 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2008-01-31 23:53 . 2008-01-31 23:53 11 --a------ C:\WINDOWS\tekkyuuman.INI
2008-01-31 23:29 . 2008-02-19 20:12 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\JDiskReport
2008-01-31 18:42 . 2008-01-31 18:42 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Uniblue
2008-01-26 15:37 . 2008-01-26 15:37 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\ScummVM

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-22 18:07 14,770,208 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-22 16:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-22 14:12 175,628 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-22 12:01 --------- d-----w C:\Documents and Settings\Järjestelmänvalvoja\Application Data\foobar2000
2008-02-21 16:40 --------- d-----w C:\Documents and Settings\Järjestelmänvalvoja\Application Data\TrojanHunter
2008-02-21 16:35 --------- d-----w C:\Documents and Settings\Järjestelmänvalvoja\Application Data\IrfanView
2008-02-21 14:19 12,936,817 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-02-20 18:49 --------- d-----w C:\Program Files\Canon
2008-02-20 18:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-20 18:46 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-20 18:31 --------- d-----w C:\Program Files\Astonsoft
2008-02-18 20:36 --------- d-----w C:\Documents and Settings\Järjestelmänvalvoja\Application Data\uTorrent
2008-02-17 21:46 --------- d-----w C:\Program Files\Winamp
2008-02-17 21:37 --------- d-----w C:\Program Files\Lexmark
2008-02-17 21:35 --------- d-----w C:\Program Files\Indy
2008-02-13 21:18 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-02-11 16:19 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd6685.sys
2008-02-01 20:40 3,196,416 ----a-w C:\WINDOWS\Internet Logs\xDB14.tmp
2008-01-30 15:14 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-01-30 15:14 249,856 ------w C:\WINDOWS\Setup1.exe
2008-01-29 15:10 30,296 ----a-w C:\Documents and Settings\Järjestelmänvalvoja\Application Data\GDIPFONTCACHEV1.DAT
2008-01-09 10:10 --------- d-----w C:\Documents and Settings\Järjestelmänvalvoja\Application Data\dvdcss
2008-01-01 16:38 --------- d-----w C:\Program Files\uTorrent
2007-12-29 12:10 --------- d-----w C:\Documents and Settings\Järjestelmänvalvoja\Application Data\DivX
2007-12-28 19:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pinnacle
2007-12-28 19:41 --------- d-----w C:\Program Files\DivX
2007-12-14 09:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-07 00:34 321,024 ----a-w C:\WINDOWS\Internet Logs\xDB13.tmp
2007-12-05 00:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-04 18:41 550,912 ------w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-08 22:49 4,381,696 ----a-w C:\WINDOWS\Internet Logs\xDB12.tmp
2007-08-24 17:26 6,099 ----a-w C:\WINDOWS\Fonts\rammstein.zip
2007-08-24 17:26 41,553 ----a-w C:\WINDOWS\Fonts\sepultura.zip
2007-08-24 17:26 33,959 ----a-w C:\WINDOWS\Fonts\slayer.zip
2007-08-24 17:26 21,540 ----a-w C:\WINDOWS\Fonts\motorhead.zip
2007-08-24 17:25 57,938 ----a-w C:\WINDOWS\Fonts\manowar.zip
2007-08-24 17:25 30,745 ----a-w C:\WINDOWS\Fonts\megadeth.zip
2007-08-19 19:59 2,993,152 ----a-w C:\WINDOWS\Internet Logs\xDB11.tmp
2007-08-08 20:16 5,797,376 ----a-w C:\WINDOWS\Internet Logs\xDB10.tmp
2007-06-30 20:45 3,547,648 ----a-w C:\WINDOWS\Internet Logs\xDBF.tmp
2007-06-23 09:11 2,944,512 ----a-w C:\WINDOWS\Internet Logs\xDBE.tmp
2007-06-17 20:56 3,414,528 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp
2007-05-22 08:13 96,256 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp
2007-05-22 08:13 2,411,008 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp
2007-05-20 20:46 3,249,664 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp
2007-05-03 15:18 4,386,304 ----a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2007-05-03 15:15 16,957,158 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_05_03_17_07_02_full.dmp.zip
2007-05-03 15:14 16,650,157 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_05_03_17_06_41_full.dmp.zip
2007-05-03 15:12 90,043 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_05_03_17_06_47_small.dmp.zip
2007-05-03 15:12 78,085 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_05_03_17_01_31_small.dmp.zip
2007-05-03 15:12 16,650,992 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_05_03_17_01_24_full.dmp.zip
2007-05-03 15:12 116,395 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_05_03_17_00_56_small.dmp.zip
2007-03-31 22:20 2,913,280 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2007-03-30 21:42 3,153,408 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2007-03-19 19:34 1,488,896 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2007-02-24 06:35 105,050 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_02_23_21_58_52_small.dmp.zip
2006-11-23 17:19 1,811,456 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2006-11-17 19:59 127,488 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2006-11-03 15:20 2,711,040 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2006-10-08 12:43 1,652,736 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2006-09-18 14:59 1,560,576 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2006-08-29 03:59 93,666 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2006_08_28_20_33_27_small.dmp.zip
2005-09-03 13:26 12,089,061 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2005_09_03_16_10_40.dmp.zip
2005-02-17 11:55 11,347,274 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2005_02_17_05_37_30.dmp.zip
2004-03-11 10:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PeerGuardian"="E:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2007-12-05 01:41 81920 C:\WINDOWS\system32\nvmctray.dll]
"ZoneAlarm Client"="E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"avast!"="E:\PROGRA~1\AVAST4~1\ashDisp.exe" [2007-12-04 15:00 79224]
"!AVG Anti-Spyware"="E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 01:12 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-04-08 18:12]
R1 SSHDRV65;SSHDRV65;C:\WINDOWS\System32\drivers\SSHDRV65.sys [2004-10-02 05:45]
R2 DLPortIO;DriverLINX Port I/O Driver;C:\WINDOWS\system32\drivers\DLPortIO.sys [1996-09-27 08:10]
R3 Ltn_stk7070P;PCTV based TV tuner device;C:\WINDOWS\system32\DRIVERS\Ltn_stk7070P.sys [2007-06-14 14:41]
R3 Ltn_stkrc;PCTV Infrared Receiver;C:\WINDOWS\system32\DRIVERS\Ltn_stkrc.sys [2007-06-13 19:30]
R3 moufiltr;Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\moufiltr.sys [2005-11-30 17:13]
S1 MindmachinePro;Mind Machine Pro Driver;C:\WINDOWS\system32\DRIVERS\mfbmmusb.sys [2004-11-23 22:14]
S3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys []
S3 DISK_DRIVE32;DISK_DRIVE32;E:\maple hack\Disk Drove\disk_1024.sys []
S3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 12:29]

*Newly Created Service* - PGFILTER
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-22 20:06:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-22 20:08:23
ComboFix-quarantined-files.txt 2008-02-22 18:08:15
ComboFix2.txt 2008-02-21 14:07:55
ComboFix3.txt 2008-02-11 16:47:21
.
2008-02-13 20:59:53 --- E O F ---

 

Katos mitä tää on
C:\WINDOWS\Internet Logs\xDB6.tmp

 

Eikös se ole jokin ZoneAlarmin väliaikaistiedosto?
Käytin tuolla: http://virusscan.jotti.org/ eikä se löytänyt siitä mitään vikaa.

 

Lataa Atribunen ATF Cleaner

Ohjeet;

Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.Main:n alla valitse: Select All
Klikkaa Empty Selected valintaa.
Jos käytät FireFoxia selaimenasi Klikkaa Firefox yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Jos käytät Operaa selaimenasiKlikkaa Opera yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa taas.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)

=========

Lataa OTMoveIt
OTMoveIt ja tallenna se työpöydällesi.

Tuplaklikkaa OTMoveIt.exe.
Klikkaa CleanUp!.
Valitse Yes kun kysytään "Begin cleanup Process?".
Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.

HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.

============
Tuosta
SUPERAntiSpyware