Vainoharhaisuus iski, voisko joku kattella login läpi? Työpöydälle tullu muutaman kerran itsestään "new folder" ilman mitää syytä... Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:43:27, on 9.4.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\COMODO\Firewall\cmdagent.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\RunDll32.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\COMODO\Firewall\cfp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\NOTEPAD.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O4 - HKLM\..\Run: [C6501Sound] RunDll32 c6501.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
Escan Ohjeet tuolla sivulla. http://koti.mbnet.fi/pattaya1/escanmwav.htm lataa tuosta http://www.spywareinfo.dk/download/mwav.exe päivitä tuosta http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat laita täpit merkkauksien mukaan http://koti.mbnet.fi/pattaya1/eScan6.jpg scannaa jos ala luukkuun tulee jotain niin kopioi se näin: Käytä komentoa Ctrl+A. Kopioi rivit komennolla Ctrl+C. Liitä rivit komennolla Ctrl+V. Laita virus log tänne.
Muuten puhdasta näyttää mutta seuraava errori tulee: Wed Apr 09 17:17:03 2008 => ***** Scanning Service Files ***** Wed Apr 09 17:17:03 2008 => Scanning HKLM\SYSTEM\CurrentControlSet\Services Wed Apr 09 17:17:03 2008 => ERROR!!! Invalid Entry \??\C:\DOCUME~1\*käyttäjä*\LOCALS~1\Temp\catchme.sys in SYSTEM\CurrentControlSet\Services\catchme... Wed Apr 09 17:17:07 2008 => ERROR!!! ScanFile Fails... mikälie toi?
1.Lataa combofix.exe työpöydällesi yhdestä linkistä: combofix1 combofix2 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
ComboFix 08-04-08.10 - Kimmo 2008-04-09 17:54:49.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1311 [GMT 3:00] Running from: C:\Documents and Settings\Kimmo\Desktop\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((( Files Created from 2008-03-09 to 2008-04-09 ))))))))))))))))))))))))))))))) . 2008-04-09 17:40 . 2008-04-09 17:40 <DIR> d-------- C:\Documents and Settings\Kimmo\DoctorWeb 2008-04-09 17:05 . 2008-04-09 17:05 0 --a------ C:\23990098.$$$ 2008-04-09 14:52 . 2008-04-09 14:52 <DIR> d-------- C:\WINDOWS\Sun 2008-04-09 14:41 . 2008-04-09 14:47 <DIR> d-------- C:\Downloads 2008-04-09 14:39 . 2008-04-09 14:47 <DIR> d-------- C:\Kaspersky 2008-04-09 14:37 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-04-09 14:34 . 2008-04-09 14:37 <DIR> d-------- C:\Program Files\Java 2008-04-09 14:33 . 2008-04-09 14:33 <DIR> d-------- C:\Program Files\Common Files\Java 2008-04-09 13:56 . 2008-04-09 13:56 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-04-09 13:56 . 2008-04-09 14:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-04-09 13:32 . 2008-04-09 13:32 <DIR> d-------- C:\Program Files\Trend Micro 2008-04-09 13:29 . 2008-04-09 13:29 <DIR> d-------- C:\VundoFix Backups 2008-04-09 13:13 . 2008-04-09 13:13 <DIR> d-------- C:\WINDOWS\ERUNT 2008-04-09 13:03 . 2008-04-09 13:10 1,905 --a------ C:\WINDOWS\diagwrn.xml 2008-04-09 13:03 . 2008-04-09 13:10 1,905 --a------ C:\WINDOWS\diagerr.xml 2008-04-09 08:35 . 2008-04-09 08:36 1,355 --a------ C:\WINDOWS\imsins.BAK 2008-04-07 12:43 . 1996-07-25 16:13 295,424 --a------ C:\WINDOWS\unin0411.exe 2008-04-07 12:42 . 2008-04-07 12:42 <DIR> d-------- C:\Documents and Settings\Kimmo\WINDOWS 2008-04-06 11:17 . 2008-04-09 16:56 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-04-06 11:17 . 2008-04-06 11:17 1,409 --a------ C:\WINDOWS\QTFont.for 2008-04-05 22:51 . 2008-03-29 20:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys 2008-04-05 22:51 . 2008-03-29 20:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys 2008-04-03 14:58 . 2004-08-04 00:56 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-04-03 14:58 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-04-03 14:58 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys 2008-04-03 14:58 . 2001-08-17 22:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-04-03 12:15 . 2008-04-03 12:15 461 --a------ C:\WINDOWS\EAGRAPH.INI 2008-04-03 02:26 . 2008-04-03 02:26 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll 2008-04-02 17:29 . 2008-04-02 17:29 <DIR> d-------- C:\Programme 2008-04-01 13:44 . 2001-11-23 12:08 712,704 --a------ C:\WINDOWS\system32\c6501a3d.dll 2008-04-01 13:44 . 2001-11-23 12:08 712,704 --a------ C:\WINDOWS\system32\a3d.dll 2008-04-01 13:44 . 2006-06-27 14:54 32,768 --a------ C:\WINDOWS\system32\c6501p.dll 2008-04-01 13:44 . 2008-04-01 13:53 479 --a------ C:\WINDOWS\system\C6501.ini 2008-03-30 21:32 . 2008-03-30 21:32 <DIR> d-------- C:\Documents and Settings\Kimmo\Application Data\IrfanView 2008-03-25 11:55 . 2008-03-25 11:55 764,416 --a------ C:\WINDOWS\GPInstall.exe 2008-03-24 21:19 . 2008-03-24 21:19 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Xfire 2008-03-24 12:35 . 2008-03-24 12:35 12,666 --a------ C:\WINDOWS\Ascd_tmp.ini 2008-03-24 11:52 . 2008-03-24 11:54 <DIR> d-------- C:\Program Files\Natural Mod 2008-03-20 21:09 . 2008-03-20 21:09 <DIR> d-------- C:\Program Files\Activision 2008-03-20 20:33 . 2008-03-20 21:21 319 --a------ C:\WINDOWS\game.ini 2008-03-20 20:20 . 2008-03-20 20:20 <DIR> d--hs---- C:\WINDOWS\ftpcache 2008-03-20 20:19 . 2008-03-20 20:33 <DIR> d-------- C:\Program Files\DAEMON Tools Lite 2008-03-20 01:41 . 2008-03-20 01:41 <DIR> d--h----- C:\WINDOWS\PIF 2008-03-19 16:52 . 2001-08-17 14:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-03-19 16:52 . 2001-08-17 14:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys 2008-03-19 16:52 . 2001-08-17 15:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-03-19 16:52 . 2001-08-17 15:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys 2008-03-19 13:15 . 2008-03-19 13:15 <DIR> d--hs---- C:\Documents and Settings\Kimmo\Phone Browser 2008-03-18 15:07 . 2008-03-18 16:34 <DIR> d-------- C:\Documents and Settings\Kimmo\Application Data\uTorrent 2008-03-17 22:23 . 2008-03-17 22:23 <DIR> d-------- C:\Program Files\DIFX 2008-03-17 22:23 . 2008-03-17 22:23 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-03-17 22:23 . 2008-03-17 22:25 <DIR> d-------- C:\Documents and Settings\Kimmo\Application Data\Nokia 2008-03-17 22:23 . 2008-03-17 22:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite 2008-03-17 22:22 . 2008-03-17 22:22 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-03-17 22:22 . 2008-03-17 22:23 <DIR> d-------- C:\Documents and Settings\Kimmo\Application Data\PC Suite 2008-03-17 22:22 . 2008-03-17 22:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Downloaded Installations 2008-03-17 22:14 . 2008-03-17 22:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nokia 2008-03-17 22:14 . 2007-02-22 11:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2008-03-17 22:14 . 2007-02-22 11:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-03-17 22:14 . 2007-02-22 11:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-03-17 22:14 . 2007-02-22 11:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2008-03-17 22:14 . 2007-02-22 11:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2008-03-17 22:14 . 2007-02-22 11:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2008-03-17 22:13 . 2008-03-20 01:38 <DIR> d-------- C:\Program Files\Nokia 2008-03-17 22:13 . 2008-03-20 01:38 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-03-17 22:13 . 2008-03-17 22:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations 2008-03-10 22:45 . 2008-03-10 22:45 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Xfire 2008-03-10 22:26 . 2008-03-10 22:26 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb 2008-03-10 22:26 . 2008-03-10 22:26 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb 2008-03-10 16:15 . 2008-03-10 22:26 <DIR> d-------- C:\Program Files\Windows Media Connect 2 2008-03-10 16:13 . 2008-03-17 22:26 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF 2008-03-10 15:49 . 2008-03-20 01:43 <DIR> d-------- C:\Program Files\FMOD SoundSystem 2008-03-10 13:50 . 2008-03-20 01:35 <DIR> d-------- C:\Program Files\DivX 2008-03-10 12:16 . 2008-03-10 12:16 <DIR> d-------- C:\Program Files\NVIDIA Corporation 2008-03-10 12:16 . 2007-11-01 18:23 499,712 --a------ C:\WINDOWS\system32\msvcc102.rra 2008-03-10 12:16 . 2007-11-01 18:23 348,160 --a------ C:\WINDOWS\system32\msvcc6ce.rra 2008-03-10 12:16 . 2008-03-10 12:15 151,552 --a------ C:\WINDOWS\system32\nvRegDev.dll 2008-03-10 11:56 . 2008-03-10 11:56 <DIR> d-------- C:\Program Files\IrfanView . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-09 09:49 --------- d-----w C:\Program Files\Xfire 2008-04-08 19:19 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\Xfire 2008-04-07 15:44 --------- d-----w C:\Program Files\Euroword2004 2008-04-01 10:44 --------- d-----w C:\Program Files\C-Media 6501 Sound 2008-03-29 17:45 1,146,232 ----a-w C:\WINDOWS\system32\aswBoot.exe 2008-03-29 17:35 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2008-03-29 17:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2008-03-29 17:27 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2008-03-29 17:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2008-03-29 17:23 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr 2008-03-28 07:23 85,752 ----a-w C:\WINDOWS\system32\drivers\cmdGuard.sys 2008-03-27 15:44 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-20 20:55 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-03-20 20:55 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-03-20 20:38 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2008-03-20 18:25 22,328 ----a-w C:\Documents and Settings\Kimmo\Application Data\PnkBstrK.sys 2008-03-19 22:38 --------- d-----w C:\Program Files\Hewlett-Packard 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-18 16:44 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-03-18 14:22 --------- d-----w C:\Program Files\Electronic Arts 2008-03-14 22:06 23,800 ----a-w C:\WINDOWS\system32\drivers\cmdhlp.sys 2008-03-14 22:06 139,008 ----a-w C:\WINDOWS\system32\guard32.dll 2008-03-09 08:16 --------- d-----w C:\Program Files\Bonjour 2008-03-08 11:35 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-03-08 10:17 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\Winamp 2008-03-07 09:41 --------- d-----w C:\Program Files\AMD 2008-03-07 08:50 --------- d-----w C:\Program Files\HP 2008-03-05 13:31 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\Apple Computer 2008-03-05 13:29 --------- d-----w C:\Program Files\QuickTime 2008-03-05 13:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-03-04 19:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet 2008-03-04 19:07 --------- d-----w C:\Program Files\GIMP-2.0 2008-03-04 18:55 --------- d-----w C:\Program Files\Common Files\Adobe 2008-03-04 18:53 --------- d-----w C:\Program Files\Common Files\Control Panels 2008-03-04 18:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\ALM 2008-03-04 18:26 --------- d-----w C:\Program Files\Common Files\Macrovision Shared 2008-03-04 17:42 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe 2008-03-04 17:15 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\gtk-2.0 2008-03-04 08:50 --------- d-----w C:\Program Files\GoldWave 2008-03-01 09:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles 2008-02-29 19:40 --------- d-----w C:\Program Files\Codec Pack - All In 1 2008-02-29 19:37 737,280 ----a-w C:\WINDOWS\iun6002.exe 2008-02-29 19:34 --------- d-----w C:\Program Files\Webteh 2008-02-29 19:14 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-02-29 15:50 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\fretsonfire 2008-02-28 19:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\MsvThumbs 2008-02-28 19:14 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2008-02-28 19:14 389,120 ------w C:\WINDOWS\Setup1.exe 2008-02-28 17:29 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2008-02-28 17:29 262,144 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2008-02-28 17:28 --------- d-----w C:\Program Files\Futuremark 2008-02-26 21:56 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\InstallShield 2008-02-26 21:43 --------- d-----w C:\Program Files\AGEIA Technologies 2008-02-26 21:42 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-02-26 19:27 --------- d-----w C:\Program Files\CCleaner 2008-02-22 17:24 --------- d-----w C:\Program Files\MSXML 6.0 2008-02-22 12:51 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\Ahead 2008-02-22 11:03 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\Audacity 2008-02-22 07:21 --------- d-----w C:\Program Files\MSBuild 2008-02-22 07:18 --------- d-----w C:\Program Files\Reference Assemblies 2008-02-21 19:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\comodo 2008-02-21 19:43 --------- d-----w C:\Program Files\COMODO 2008-02-21 19:42 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\Comodo 2008-02-21 19:38 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\Grisoft 2008-02-21 19:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-02-21 18:07 --------- d-----w C:\Program Files\Windows Live 2008-02-21 18:05 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-02-21 18:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-02-21 17:51 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\AdobeUM 2008-02-21 17:46 --------- d-----w C:\Program Files\Microsoft.NET 2008-02-21 17:12 --------- d-----w C:\Program Files\MSXML 4.0 2008-02-21 15:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\LightScribe 2008-02-21 15:19 --------- d-----w C:\Program Files\Alwil Software 2008-02-21 15:15 --------- d-----w C:\Program Files\Common Files\LightScribe 2008-02-21 15:15 --------- d-----w C:\Program Files\Common Files\Ahead 2008-02-21 15:13 --------- d-----w C:\Program Files\Nero 2008-02-21 15:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero 2008-02-21 15:01 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\DAEMON Tools 2008-02-21 14:48 --------- d-----w C:\Program Files\Winamp 2008-02-21 14:15 --------- d-----w C:\Program Files\microsoft frontpage 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-16 08:59 659,456 ----a-w C:\WINDOWS\system32\wininet.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:56 15360] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-01-17 19:51 486856] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "C6501Sound"="c6501.cpl" [] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776] "nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 20:37 79224] "COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-03-15 01:05 1503488] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920] "amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 12:06 77824] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 10:56 15360] "PcSync"="D:\Ohjelmat\PC Suite\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 18:15 1634304] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "D:\\Pelit\\Crysis\\Bin32\\Crysis.exe"= "D:\\Pelit\\Crysis\\Bin32\\CrysisDedicatedServer.exe"= "D:\\Pelit\\World in Conflict\\wic.exe"= "D:\\Pelit\\World in Conflict\\wic_ds.exe"= "D:\\Pelit\\World in Conflict\\wic_online.exe"= "D:\\Pelit\\HL2\\SteamApps\\kimpley\\counter-strike source\\hl2.exe"= "C:\\Program Files\\Xfire\\xfire.exe"= "D:\\Pelit\\Battlefield 2\\BF2.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 20:31] R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-03-28 10:23] R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-03-15 01:06] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 20:35] R3 c65013264;C-Media CM6501 Like Sound UDAX Interface;C:\WINDOWS\system32\drivers\c6501.sys [2007-01-25 15:18] S3 zlportio;zlportio;G:\Games\UltraStar Deluxe\zlportio.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca6787c3-e08f-11dc-ae54-806d6172696f}] \Shell\AutoRun\command - F:\Bin\Assetup.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . ************************************************************************** catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-09 17:57:40 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\guard32.dll PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\WINDOWS\system32\guard32.dll . Completion time: 2008-04-09 17:57:57 ComboFix-quarantined-files.txt 2008-04-09 14:57:40 Pre-Run: 82,278,780,928 bytes free Post-Run: 82,277,830,656 bytes free . 2008-04-09 05:36:47 --- E O F ---
aja tuosta Lataa: RegSeeker.zip työpöydälle: Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman. Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen. Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken). Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin. Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK". Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK". Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen.
Joo kyllä toi tuntu piristävän konetta ku sai vedettyä koko prosessin läpi. Vedin vielä AVG antispywaret ja Avastin eikä nekään mitään löytäneet... pakko kai se on uskoa et kone on kohtuu puhdas Kiitosta paljon nopeista vastauksista!
