Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:05:59, on 18.3.2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16609) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\ASUS\ASUS Live Update\ALU.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\ASUS\ATK Media\DMedia.exe C:\Windows\ASScrPro.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Apoint2K\ApMsgFwd.exe C:\Windows\System32\rundll32.exe C:\Program Files\Apoint2K\HidFind.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\Apoint2K\Apvfb.exe C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\uTorrent\uTorrent.exe C:\Windows\explorer.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu') O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\Windows\System32\StkCSrv.exe O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- End of file - 8135 bytes Onkohan mitään huolestuttavaa?
1.Lataa combofix.exe työpöydällesi yhdestä linkistä: combofix1 combofix2 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
combofix:n logi: ComboFix 08-03-18.1 - Jape 2008-03-19 14:05:00.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1035.18.1258 [GMT 2:00] Running from: C:\Users\Jape\Downloads\ComboFix.exe * Created a new restore point . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-02-19 to 2008-03-19 ))))))))))))))))) . Tiedostoja ei ole luotu tällä aikavälillä . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-19 12:05 --------- d-----w C:\Users\Jape\AppData\Roaming\uTorrent 2008-03-19 11:57 12,978 ----a-w C:\Users\Jape\AppData\Roaming\nvModes.dat 2008-03-18 20:05 --------- d-----w C:\Program Files\Trend Micro 2008-03-18 17:10 --------- d-----w C:\Users\Jape\AppData\Roaming\foobar2000 2008-03-12 13:05 45,056 ----a-w C:\Windows\System32\acovcnt.exe 2008-03-12 13:02 --------- d-----w C:\Program Files\Windows Mail 2008-03-12 07:52 --------- d-----w C:\ProgramData\Microsoft Help 2008-03-10 11:55 --------- d-----w C:\Program Files\iTunes 2008-03-10 11:55 --------- d-----w C:\Program Files\iPod 2008-03-10 11:52 --------- d-----w C:\Program Files\QuickTime 2008-03-08 17:47 --------- d-----w C:\Program Files\Google 2008-03-08 07:54 --------- d-----w C:\Program Files\Java 2008-03-06 07:56 --------- d-----w C:\Program Files\MediaInfo 2008-03-04 19:12 --------- d-----w C:\Users\Jape\AppData\Roaming\ImgBurn 2008-03-04 18:59 --------- d-----w C:\Program Files\ImgBurn 2008-03-04 16:12 --------- d-----w C:\Users\Jape\AppData\Roaming\dvdcss 2008-03-01 14:46 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-03-01 14:31 --------- d-----w C:\Program Files\FlashFXP 2008-03-01 14:27 --------- d-----w C:\ProgramData\FlashFXP 2008-03-01 07:48 413,696 ----a-w C:\Windows\System32\wrap_oal.dll 2008-03-01 07:48 110,592 ----a-w C:\Windows\System32\OpenAL32.dll 2008-02-29 21:55 --------- d-----w C:\ProgramData\Media Center Programs 2008-02-29 19:17 --------- d-----w C:\Program Files\Nokia 2008-02-29 19:05 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-27 11:58 --------- d-----w C:\ProgramData\Apple Computer 2008-02-27 01:01 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-02-26 09:25 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-02-26 09:25 --------- d-----w C:\Program Files\Windows Live 2008-02-26 09:23 --------- d-----w C:\ProgramData\WLInstaller 2008-02-20 05:47 765,440 ----a-w C:\Windows\system32\drivers\athr.sys 2008-02-14 05:52 194,560 ----a-w C:\Windows\System32\WebClnt.dll 2008-02-14 05:52 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys 2008-02-14 05:50 943,800 ----a-w C:\Windows\System32\winload.exe 2008-02-14 05:50 905,400 ----a-w C:\Windows\System32\winresume.exe 2008-02-14 05:50 595,456 ----a-w C:\Windows\System32\schedsvc.dll 2008-02-14 05:50 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys 2008-02-14 05:50 39,424 ----a-w C:\Windows\System32\lodctr.exe 2008-02-14 05:50 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys 2008-02-14 05:50 32,256 ----a-w C:\Windows\System32\unlodctr.exe 2008-02-14 05:50 23,552 ----a-w C:\Windows\System32\nshhttp.dll 2008-02-14 05:50 17,408 ----a-w C:\Windows\System32\prflbmsg.dll 2008-02-14 05:50 115,200 ----a-w C:\Windows\System32\loadperf.dll 2008-02-14 05:48 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys 2008-02-14 05:48 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys 2008-02-14 05:48 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe 2008-02-14 05:48 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe 2008-02-14 05:48 24,064 ----a-w C:\Windows\System32\netcfg.exe 2008-02-14 05:48 22,016 ----a-w C:\Windows\System32\netiougc.exe 2008-02-14 05:48 216,632 ----a-w C:\Windows\system32\drivers\netio.sys 2008-02-14 05:48 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys 2008-02-14 05:48 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll 2008-02-14 05:48 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys 2008-02-14 05:48 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys 2008-02-14 05:48 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys 2008-02-14 05:47 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll 2008-02-14 05:47 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll 2008-02-14 05:47 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll 2008-02-14 05:47 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll 2008-02-14 05:47 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll 2008-02-14 05:47 1,686,528 ----a-w C:\Windows\System32\gameux.dll 2008-02-14 05:44 824,832 ----a-w C:\Windows\System32\wininet.dll 2008-02-14 05:44 56,320 ----a-w C:\Windows\System32\iesetup.dll 2008-02-14 05:44 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2008-02-14 05:44 26,624 ----a-w C:\Windows\System32\ieUnatt.exe 2008-02-11 18:05 --------- d-----w C:\Program Files\ffdshow 2008-02-04 18:18 --------- d-----w C:\Users\Jape\AppData\Roaming\Autodesk 2008-02-04 18:18 --------- d-----w C:\ProgramData\Autodesk 2008-02-01 16:53 --------- d-----w C:\Program Files\AutoCAD 2008 2008-02-01 16:52 --------- d-----w C:\Program Files\Common Files\Autodesk Shared 2008-02-01 16:46 --------- d-----w C:\Program Files\Autodesk 2008-01-31 20:27 --------- d-----w C:\ProgramData\Installations 2008-01-31 18:03 715,248 ----a-w C:\Windows\system32\drivers\sptd.sys 2008-01-26 10:45 229,888 ----a-w C:\Windows\System32\msshsq.dll 2008-01-26 10:25 --------- d-----w C:\Users\Jape\AppData\Roaming\Logitech 2008-01-26 10:25 --------- d-----w C:\ProgramData\LogiShrd 2008-01-26 10:24 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf 2008-01-26 10:24 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2008-01-26 10:22 --------- d-----w C:\Program Files\Common Files\Logitech 2008-01-26 10:21 --------- d-----w C:\ProgramData\Logitech 2008-01-26 10:21 --------- d-----w C:\Program Files\Logitech 2008-01-20 11:00 --------- d-----w C:\Program Files\CCleaner 2008-01-10 05:50 1,244,672 ----a-w C:\Windows\System32\mcmde.dll 2008-01-08 19:09 11,776 ----a-w C:\Windows\System32\sbunattend.exe 2007-09-03 19:28 174 --sha-w C:\Program Files\desktop.ini . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-08 21:09 1232896] "NB Probe"="" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-09-03 20:23 1006264] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-01-19 08:19 90191] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-01-19 08:19 7770112] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-01-19 08:19 81920] "RtHDVCpl"="RtHDVCpl.exe" [2007-02-15 11:07 4390912 C:\Windows\RtHDVCpl.exe] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 11:31 630784] "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2006-09-12 03:22 155648] "ATKMEDIA"="C:\Program Files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 17:27 61440] "ASUS Screen Saver Protector"="C:\Windows\ASScrPro.exe" [2007-09-04 05:51 33136] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 56080 C:\Windows\KHALMNPR.Exe] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [ ] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696] Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-01-18 23:48:42 2752512] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-01-26 12:21:39 692224] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List] "C:\\Program Files\\FlashFXP\\FlashFXP.exe"= C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{26E2FF19-AAC6-43CB-8CD0-B6C9063A51DB}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{9442B277-9936-490C-A4E0-BE524DB33A02}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent "TCP Query User{90F8B5B9-AF4F-4180-BF2E-469E3B7D9F88}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{EECD0B43-9C06-4210-AA46-2CDAD1A34867}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent "{022B64ED-1C0D-4D33-BCA3-508A7658162C}"= UDP:\Games\BF2\BF2.exe:Battlefield 2 "{50CFA6CA-2017-4B86-93DB-9158C434E20A}"= TCP:\Games\BF2\BF2.exe:Battlefield 2 "TCP Query User{5549EC58-FB06-499A-8794-444E8305D150}D:\\games\\css\\hl2.exe"= UDP:\games\css\hl2.exe:hl2 "UDP Query User{A36F1148-704F-438B-A010-95F15F433078}D:\\games\\css\\hl2.exe"= TCP:\games\css\hl2.exe:hl2 "{8CF92D72-00B8-4131-B4E7-58000F0CB414}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{47FE3C0A-0F3C-4921-AC2E-CF103D28DF9C}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{4AE6D93C-8BC5-49AD-909B-65E83D52B8E3}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{2BF8B31E-96F7-4F5B-B496-7E74092A3CFB}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{A847D3C8-154C-4EED-B201-54D6F6D5768F}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{186A9C91-FF37-4DA5-9115-9B8E0C042B93}D:\\games\\counter strike source\\counter-strike source\\hl2.exe"= UDP:\games\counter strike source\counter-strike source\hl2.exe:hl2 "UDP Query User{0D82FB0A-1162-4397-8FD1-A39296443CE4}D:\\games\\counter strike source\\counter-strike source\\hl2.exe"= TCP:\games\counter strike source\counter-strike source\hl2.exe:hl2 "TCP Query User{2D748A03-53FB-4655-9580-BF7A281DE80C}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= UDP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater "UDP Query User{4368A9FC-E61C-45F8-B4EB-9181A62C42AF}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= TCP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater "TCP Query User{2DBA2FD2-7BEE-4BE3-A2DA-0B65C9F52221}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= UDP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process "UDP Query User{E3D25E7B-70AB-463F-B928-B0A76DDB588A}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= TCP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process "TCP Query User{B0435664-FAE9-497C-AA1A-E0ED86593263}C:\\users\\jape\\downloads\\wowclient-downloader.exe"= UDP:C:\users\jape\downloads\wowclient-downloader.exe:wowclient-downloader.exe "UDP Query User{7A33FB66-426F-4083-90D7-855F27CF3F71}C:\\users\\jape\\downloads\\wowclient-downloader.exe"= TCP:C:\users\jape\downloads\wowclient-downloader.exe:wowclient-downloader.exe "{D1629AE5-16E2-42F0-B8E0-A4B0E5AF4387}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "TCP Query User{834CD6EE-1FAF-44ED-A982-220683592620}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{1EF7528A-26AE-42DB-BD51-606908521169}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "{9D38333E-8194-4D52-AB10-8BE5271839AE}"= UDP:\Games\Kane & Lynch - Dead Men\kaneandlynch.exe:Kane & Lynch: Dead Men "{88E27718-B1AD-4BE9-8522-B7FCD132056C}"= TCP:\Games\Kane & Lynch - Dead Men\kaneandlynch.exe:Kane & Lynch: Dead Men "{6739A55C-ADE5-4EA3-BA30-8EF21E4449F0}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{0FDBECBE-48E1-4745-8D45-41A9A9755BAF}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "C:\\Program Files\\FlashFXP\\FlashFXP.exe"= C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 16:52] R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;C:\Windows\System32\StkCSrv.exe [2006-12-10 18:31] R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service;C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2006-11-01 07:40] R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2008-02-20 07:47] R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;C:\Windows\system32\Drivers\StkCMini.sys [2007-01-19 17:19] R3 WCPU;WCPU;C:\Program Files\P4G\WCPU.sys [2007-01-03 00:37] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e22f3c1c-921d-11dc-9603-001a92c82b24}] \shell\AutoRun\command - G:\LaunchU3.exe -a . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-19 14:08:01 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-19 14:09:12 . 2008-03-12 07:52:36 --- E O F ---
scannaa hjt:llä merkkaa paina Fix checked O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) === Kopioi / liitä seuraava teksti alapuolella tyhjään muistioFiluun Varmista että tiedoston tyyppi on ”all Files” ja tallenna se Poisto.bat. nimisenä työpöydällesi. @echo off sc stop CLTNetCnService sc delete CLTNetCnService Tupla-klikkaa Poisto.bat. filua työpöydälläsi , ikkuna avautuu ja Sulkeutuu tämä on normaalia. Poista kansio vikasiedossa :\Program Files\Common Files\Symantec Shared
