Mahdollinen viirus?

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by olssku, Feb 25, 2008.

  1. olssku

    olssku Member

    Joined:
    Feb 25, 2008
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    11
    Hei!

    Aina kun avaan koneeni niin tulee ilmoitus: Virhe ladattaessa c:\windows\system32\sprt_ads.dll .
    Sitten koneeni valittaa joskus jostain Rundll32.exe:stä ja olen lukenut että se olisi jokin haitallinen. olisin erittäin kiitollinen jos joku osaisi auttaa minua asiassa. Tuossa on ne jotkin HijackThis - logit kun olen lukenut että niitä pitäisi tänne laitella. Kiitos jo etukäteen hänelle joka osaa auttaa.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:20:53, on 25.2.2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16609)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_SL.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Creative\Shared Files\CamTray.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\HJT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.blingo.com/search?q=blingo
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blingo.com/search?q=blingo
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.blingo.com/friends?ref=k0mqBd7jWXVZ_ysP80cjUOrMT2A
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: BrowserCmp - {1D8282E6-BC4F-469B-AAED-7E4FF077AD93} - C:\Windows\system32\iebrowserc.dll
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
    O2 - BHO: superiorads - {4AD44D3E-7316-4251-B754-9B10EC96AF92} - C:\Windows\system32\sprt_ads.dll (file missing)
    O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
    O2 - BHO: dcads - {6FC3C36D-7635-4D43-BA62-0D9D2F2CD06E} - C:\Windows\system32\nsm28DE.dll (file missing)
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
    O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=111307 serial=DR12WCK-8695338-SNC lang=EN
    O4 - HKLM\..\Run: [spa_start] C:\Windows\System32\Rundll32.exe "C:\Windows\system32\sprt_ads.dll" DllStart
    O4 - HKLM\..\Run: [reghostm] C:\Windows\system32\reghostm.exe
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [Winlogon] C:\Windows\system32\drivers\winlogon.exe
    O4 - HKLM\..\Run: [Services] C:\Windows\system32\drivers\services.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [{9B71D88C-C598-4935-C5D1-43AA4DB90836}] C:\Users\Tarja ja Matti\AppData\Roaming\upx.exe
    O4 - HKCU\..\Run: [taskmngr.exe] C:\Users\Tarja ja Matti\Desktop\mods\projektit\taskmngr.exe
    O4 - HKCU\..\Run: [mstwain32] C:\Users\Tarja ja Matti\Desktop\mods\projektit\Taskmngr.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
    O4 - Startup: Magic Holdem.lnk = C:\Program Files\Magic Holdem\MagicHoldem.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O15 - Trusted Zone: http://speed.travian.fi
    O16 - DPF: {0F2F3121-75E2-4C60-9977-C1ADC3D5F3DC} (IFIUploader Control) - http://web03.ifi.fi/PhotoProducts/app_support/ActiveX/IfiUploader.cab
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: ccEvtMgr - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: ccSetMgr - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
    O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\Windows\SYSTEM32\VundoFixSVC.exe

    --
    End of file - 10416 bytes
     
    olssku, Feb 25, 2008
    #1
  2. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

     
    Hujo, Feb 25, 2008
    #2
  3. olssku

    olssku Member

    Joined:
    Feb 25, 2008
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    11
    Tuossa nyt on se raportti.


    ComboFix 08-02-25.3 - Tarja ja Matti 2008-02-25 19:30:39.1 - NTFSx86
    Running from: C:\Users\Tarja ja Matti\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-25 to 2008-02-25 )))))))))))))))))
    .

    Tiedostoja ei ole luotu tällä aikavälillä

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-02-25 14:02 --------- d-----w C:\Program Files\RegCure
    2008-02-25 13:45 46,300 ----a-w C:\Windows\System32\DcadsSocial-uninstall.exe
    2008-02-25 13:12 24,576 ----a-w C:\Windows\System32\VundoFixSVC.exe
    2008-02-24 10:51 --------- d-----w C:\ProgramData\Symantec
    2008-02-24 08:57 --------- d-----w C:\Users\Tarja ja Matti\AppData\Roaming\firfox.exe
    2008-02-24 08:56 --------- d-----w C:\Users\Tarja ja Matti\AppData\Roaming\mstwain32.exe
    2008-02-24 08:43 --------- d-----w C:\Program Files\Website Downloader
    2008-02-23 13:40 --------- d-----w C:\Program Files\MSN Messenger
    2008-02-23 13:38 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
    2008-02-23 13:36 --------- d-----w C:\Program Files\Windows Live
    2008-02-23 13:35 --------- d-----w C:\ProgramData\WLInstaller
    2008-02-22 14:16 32 ----a-w C:\Users\Tarja ja Matti\AppData\Roaming\VMPipe32.dll
    2008-02-22 13:50 --------- d-----w C:\Users\Tarja ja Matti\AppData\Roaming\eagames
    2008-02-22 13:48 --------- d-----w C:\Users\Tarja ja Matti\AppData\Roaming\aimbot
    2008-02-22 13:45 --------- d-----w C:\ProgramData\WinZip
    2008-02-22 13:36 --------- d-----w C:\Users\Tarja ja Matti\AppData\Roaming\picture001
    2008-02-22 12:17 --------- d-----w C:\Program Files\TightVNC
    2008-02-20 14:20 --------- d-----w C:\Users\Tarja ja Matti\AppData\Roaming\LimeWire
    2008-02-18 13:32 67,072 ----a-w C:\Users\Tarja ja Matti\AppData\Roaming\NMLHook.dll
    2008-02-16 20:50 --------- d-----w C:\Program Files\Full Tilt Poker
    2008-02-15 19:41 --------- d-----w C:\Program Files\LimeWire
    2008-02-14 13:34 194,560 ----a-w C:\Windows\System32\WebClnt.dll
    2008-02-14 13:34 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
    2008-02-14 13:29 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
    2008-02-14 13:29 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
    2008-02-14 13:29 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
    2008-02-14 13:29 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
    2008-02-14 13:29 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
    2008-02-14 13:29 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
    2008-02-14 13:29 110,136 ----a-w C:\Windows\system32\drivers\ataport.sys
    2008-02-14 13:28 --------- d-----w C:\ProgramData\Microsoft Help
    2008-02-14 13:26 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
    2008-02-14 13:26 24,064 ----a-w C:\Windows\System32\netcfg.exe
    2008-02-14 13:26 22,016 ----a-w C:\Windows\System32\netiougc.exe
    2008-02-14 13:26 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
    2008-02-14 13:26 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
    2008-02-14 13:24 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
    2008-02-14 13:24 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
    2008-02-14 13:24 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
    2008-02-14 13:24 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
    2008-02-14 13:24 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
    2008-02-14 13:24 1,686,528 ----a-w C:\Windows\System32\gameux.dll
    2008-02-14 13:17 824,832 ----a-w C:\Windows\System32\wininet.dll
    2008-02-14 13:17 56,320 ----a-w C:\Windows\System32\iesetup.dll
    2008-02-14 13:17 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
    2008-02-14 13:17 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
    2008-02-13 18:54 --------- d-----w C:\Users\Tarja ja Matti\AppData\Roaming\Canon
    2008-02-13 12:31 --------- d-----w C:\Program Files\Norton 360
    2008-02-12 17:31 --------- d-----w C:\Users\Tarja ja Matti\AppData\Roaming\Symantec
    2008-02-12 15:10 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF
    2008-02-12 15:10 123,952 ----a-w C:\Windows\system32\drivers\SYMEVENT.SYS
    2008-02-12 15:10 10,740 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT
    2008-02-12 15:10 --------- d-----w C:\Program Files\Symantec
    2008-02-12 15:08 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-02-10 16:00 --------- d-----w C:\Program Files\Norton Security Scan
    2008-02-10 09:38 22,328 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys
    2008-02-10 09:38 107,832 ----a-w C:\Windows\System32\PnkBstrB.exe
    2008-02-09 18:47 --------- d-----w C:\ProgramData\Ball noun debug
    2008-02-09 18:21 --------- d-----w C:\Program Files\Norman
    2008-02-07 17:44 --------- d-----w C:\Program Files\Pcsx2_0.9.4
    2008-02-07 14:37 --------- d-----w C:\Program Files\BitComet
    2008-02-06 19:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-02-06 19:35 --------- d-----w C:\Program Files\MagicISO
    2008-02-06 19:35 --------- d-----w C:\Program Files\HoldemInspector2
    2008-02-06 19:35 --------- d-----w C:\Program Files\Holdem Indicator
    2008-02-06 19:35 --------- d-----w C:\Program Files\Hold'em Partner, Inc
    2008-02-02 13:00 --------- d-----w C:\Users\Tarja ja Matti\AppData\Roaming\Nokia Multimedia Player
    2008-01-25 20:30 --------- d-----w C:\Program Files\Web Publish
    2008-01-25 14:23 --------- d-----w C:\Users\Tarja ja Matti\AppData\Roaming\Thinstall
    2008-01-20 14:36 --------- d---a-w C:\ProgramData\TEMP
    2008-01-18 10:06 294,912 ----a-w C:\Windows\System32\iebrowserc.dll
    2008-01-15 07:54 10,537 ----a-w C:\Windows\system32\drivers\COH_Mon.cat
    2008-01-15 03:28 706 ----a-w C:\Windows\system32\drivers\COH_Mon.inf
    2008-01-12 19:24 --------- d-----w C:\ProgramData\Lavasoft
    2008-01-12 19:24 --------- d-----w C:\Program Files\Lavasoft
    2008-01-12 19:23 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-01-12 16:32 23,904 ----a-w C:\Windows\system32\drivers\COH_Mon.sys
    2008-01-10 14:45 --------- d-----w C:\Program Files\Nokia
    2008-01-10 12:52 --------- d-----w C:\Program Files\Windows Sidebar
    2008-01-10 12:52 --------- d-----w C:\Program Files\Windows Mail
    2008-01-10 12:49 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
    2008-01-10 12:49 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
    2008-01-10 12:48 11,776 ----a-w C:\Windows\System32\sbunattend.exe
    2008-01-09 13:57 --------- d-----w C:\Users\Tarja ja Matti\AppData\Roaming\Nokia
    2008-01-08 14:10 --------- d-----w C:\Users\Tarja ja Matti\AppData\Roaming\PC Suite
    2008-01-08 14:10 --------- d-----w C:\ProgramData\PC Suite
    2008-01-08 14:08 --------- d-----w C:\Program Files\DIFX
    2008-01-08 14:08 --------- d-----w C:\Program Files\Common Files\PCSuite
    2008-01-08 14:08 --------- d-----w C:\Program Files\Common Files\Nokia
    2008-01-08 14:06 --------- d-----w C:\Program Files\PC Connectivity Solution
    2008-01-08 14:04 --------- d-----w C:\ProgramData\Installations
    2008-01-06 18:27 86,438 ----a-w C:\Windows\system32\drivers\INF.log
    2008-01-04 20:52 26,624 --s---w C:\Users\Tarja ja Matti\ctr.exe
    2007-12-30 20:44 --------- d-----w C:\ProgramData\Messenger Plus!
    2007-12-28 20:15 40,734 ----a-w C:\Windows\System32\superiorads-uninst.exe
    2007-12-21 18:37 80,097 ----a-w C:\Windows\System32\dcads-remove.exe
    2007-12-13 07:23 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
    2007-12-13 07:23 223,232 ----a-w C:\Windows\System32\WMASF.DLL
    2007-12-13 07:23 1,327,104 ----a-w C:\Windows\System32\quartz.dll
    2007-09-08 18:47 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    2007-09-08 18:47 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    2007-09-08 18:47 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93}]
    2008-01-18 12:06 294912 --a------ C:\Windows\system32\iebrowserc.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4AD44D3E-7316-4251-B754-9B10EC96AF92}]
    C:\Windows\system32\sprt_ads.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6FC3C36D-7635-4D43-BA62-0D9D2F2CD06E}]
    C:\Windows\system32\nsm28DE.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-10 14:48 1232896]
    "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:34 201728]
    "{9B71D88C-C598-4935-C5D1-43AA4DB90836}"="C:\Users\Tarja ja Matti\AppData\Roaming\upx.exe" [ ]
    "taskmngr.exe"="C:\Users\Tarja ja Matti\Desktop\mods\projektit\taskmngr.exe" [ ]
    "mstwain32"="C:\Users\Tarja ja Matti\Desktop\mods\projektit\Taskmngr.exe" [ ]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-05-08 14:55 1006264]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 19:04 4423680 C:\Windows\RtHDVCpl.exe]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 14:40 155648]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
    "Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CAMTRAY.EXE" [2004-07-30 10:04 245760]
    "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 23:47 31016]
    "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 23:14 155648]
    "OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 12:19 69632]
    "CorelDRAW Graphics Suite 11b"="C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" [ ]
    "reghostm"="C:\Windows\system32\reghostm.exe" [2007-07-04 22:11 24576]
    "MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [ ]
    "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 01:59 115816]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "TCP Query User{B966BA60-71D0-4757-84F7-E4305F2D4C77}C:\program files\bitcomet\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client|Desc=BitComet - a BitTorrent Client
    "UDP Query User{BF1FE3E1-6FF2-449C-9EF6-3CEB3F777E62}C:\program files\bitcomet\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client|Desc=BitComet - a BitTorrent Client
    "{BF2B1584-C0BE-4411-A3F4-CEEC01A0FBA8}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
    "{0FF69F33-9506-4B32-BDFA-5B32496DCE32}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
    "TCP Query User{A8B9DA87-F1A9-4177-AD81-66F33F4B57C6}C:\program files\dc++\dcplusplus.exe"= UDP:C:\program files\dc++\dcplusplus.exe:DC++|Desc=DC++
    "UDP Query User{536FA395-CE6D-498D-B6A0-7A3890FAE7B1}C:\program files\dc++\dcplusplus.exe"= TCP:C:\program files\dc++\dcplusplus.exe:DC++|Desc=DC++
    "TCP Query User{4BC588A8-4464-4834-ACC1-AF74AB3C8DD7}C:\program files\ea games\battlefield vietnam\bfvietnam.exe"= UDP:C:\program files\ea games\battlefield vietnam\bfvietnam.exe:bfvietnam|Desc=bfvietnam
    "UDP Query User{A0CB55E5-BB88-4D97-B68D-A29B41D5B448}C:\program files\ea games\battlefield vietnam\bfvietnam.exe"= TCP:C:\program files\ea games\battlefield vietnam\bfvietnam.exe:bfvietnam|Desc=bfvietnam
    "TCP Query User{B4AC97CE-C2B2-495E-8D06-39B486CD8477}C:\program files\wolfenstein - enemy territory\etded.exe"= UDP:C:\program files\wolfenstein - enemy territory\etded.exe:ETDED|Desc=ETDED
    "UDP Query User{E7E67C87-3E3B-475E-9504-16033018ED1A}C:\program files\wolfenstein - enemy territory\etded.exe"= TCP:C:\program files\wolfenstein - enemy territory\etded.exe:ETDED|Desc=ETDED
    "TCP Query User{EC1EC0F5-E4D7-4F64-9AFF-A184700CB195}C:\program files\sixteen tons entertainment\emergency 4\em4.exe"= UDP:C:\program files\sixteen tons entertainment\emergency 4\em4.exe:Em4|Desc=Em4
    "UDP Query User{97DFEAB4-775A-4791-AC6F-AF9A5D5977D2}C:\program files\sixteen tons entertainment\emergency 4\em4.exe"= TCP:C:\program files\sixteen tons entertainment\emergency 4\em4.exe:Em4|Desc=Em4
    "TCP Query User{304C9F81-83BB-4A65-AE1A-A699E657A219}C:\program files\jowood\rally trophy\rallytrophylobby.exe"= UDP:C:\program files\jowood\rally trophy\rallytrophylobby.exe:RallyTrophyLobby|Desc=RallyTrophyLobby
    "UDP Query User{95A75FC5-E89A-41DA-A531-0C462D451238}C:\program files\jowood\rally trophy\rallytrophylobby.exe"= TCP:C:\program files\jowood\rally trophy\rallytrophylobby.exe:RallyTrophyLobby|Desc=RallyTrophyLobby
    "{C6617025-E8E8-4CB9-8D73-D89C72F13C2D}"= UDP:16046:BitComet 16046 TCP
    "{07832638-4693-4BF2-9812-E9AE579F80BB}"= TCP:16046:BitComet 16046 UDP
    "{E223F4FB-2AE2-4951-8BE3-0FAB565A1E50}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "{B1C5AE00-5DE1-481B-A9FA-1272F568CBBB}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{D17A2E37-5753-43B2-AA4C-87A00C9AE2B2}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{93AFA692-548E-4E79-8060-539DCFD72D1E}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{BC00C8F5-49C9-449E-8A3F-2B7D645857AB}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "TCP Query User{2630227E-CB0F-4DE7-8A2C-25F7B702AB3E}C:\program files\mozilla firefox\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox|Desc=Firefox
    "UDP Query User{DF238B53-2DFA-4804-BB4D-10C6549282A2}C:\program files\mozilla firefox\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox|Desc=Firefox
    "TCP Query User{1D55C45D-A60C-4230-8569-14FE0831D3D3}C:\program files\messengerdiscovery\messengerdiscovery live.exe"= UDP:C:\program files\messengerdiscovery\messengerdiscovery live.exe:MessengerDiscovery Live the Windows Live Messenger addon|Desc=MessengerDiscovery Live the Windows Live Messenger addon
    "UDP Query User{96F62008-4128-450E-A090-0EE7C1CB99B3}C:\program files\messengerdiscovery\messengerdiscovery live.exe"= TCP:C:\program files\messengerdiscovery\messengerdiscovery live.exe:MessengerDiscovery Live the Windows Live Messenger addon|Desc=MessengerDiscovery Live the Windows Live Messenger addon
    "TCP Query User{BB475A4D-6624-43AD-85F5-18CAC0997BFE}C:\program files\messengerdiscovery\messengerdiscovery live.exe"= UDP:C:\program files\messengerdiscovery\messengerdiscovery live.exe:MessengerDiscovery Live the Windows Live Messenger addon|Desc=MessengerDiscovery Live the Windows Live Messenger addon
    "UDP Query User{2040493F-932A-4E5B-BBD2-92DFA421F6AE}C:\program files\messengerdiscovery\messengerdiscovery live.exe"= TCP:C:\program files\messengerdiscovery\messengerdiscovery live.exe:MessengerDiscovery Live the Windows Live Messenger addon|Desc=MessengerDiscovery Live the Windows Live Messenger addon
    "TCP Query User{629AD491-DD91-4B63-95E9-4C926AF1E480}C:\program files\limewire\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire|Desc=LimeWire
    "UDP Query User{943FE8F6-B51F-40BF-BAEE-2F3F8205BDCA}C:\program files\limewire\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire|Desc=LimeWire
    "TCP Query User{A190E148-AC07-4D2C-AC47-2F37F10C246A}C:\users\tarja ja matti\desktop\mods\rubyrat 1.0\rubyrat.exe"= UDP:C:\users\tarja ja matti\desktop\mods\rubyrat 1.0\rubyrat.exe:rubyrat.exe|Desc=rubyrat.exe
    "UDP Query User{38299575-21FA-4AC5-AD22-8717C397279E}C:\users\tarja ja matti\desktop\mods\rubyrat 1.0\rubyrat.exe"= TCP:C:\users\tarja ja matti\desktop\mods\rubyrat 1.0\rubyrat.exe:rubyrat.exe|Desc=rubyrat.exe
    "TCP Query User{D0FDE191-F913-4BDC-80C3-B84B3DC42A61}C:\windows\system32\plm.exe"= UDP:C:\windows\system32\plm.exe:Digital Keylogger 2.0 Server|Desc=Digital Keylogger 2.0 Server
    "UDP Query User{4DE5BDD1-E0E3-4906-8962-CDE680A024D6}C:\windows\system32\plm.exe"= TCP:C:\windows\system32\plm.exe:Digital Keylogger 2.0 Server|Desc=Digital Keylogger 2.0 Server
    "{D58DA466-260F-4A11-9E2F-2B9D623AE387}"= UDP:C:\Program Files\ACSPMonitor\ASMonitor.exe:System
    "{4AAE8D17-C53D-430C-8C4E-4643989E75B7}"= TCP:C:\Program Files\ACSPMonitor\ASMonitor.exe:System
    "TCP Query User{3D6E2621-1FC9-4859-8850-0AAE9BB3200C}C:\program files\mozilla firefox\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox|Desc=Firefox
    "UDP Query User{7CA0E738-F63A-46AD-84BB-F7BA7432B1EE}C:\program files\mozilla firefox\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox|Desc=Firefox
    "{F2E93669-1DA5-493B-9A61-CA80B46403D8}"= UDP:C:\Windows\System32\drivers\winlogon.exe:.NET Framework
    "{1F62FC51-EBFB-4AFE-A7C4-49163CBB78A2}"= TCP:C:\Windows\System32\drivers\winlogon.exe:.NET Framework
    "{568052F9-EC65-4A24-9408-7F11B4537635}"= UDP:16046:BitComet 16046 TCP
    "{402E88CF-CBF0-491A-8663-369313D8F815}"= TCP:16046:BitComet 16046 UDP
    "TCP Query User{5DC61729-DC12-41E5-93E4-0F45B39A5DA0}C:\program files\bitcomet\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client|Desc=BitComet - a BitTorrent Client
    "UDP Query User{B2D8DFDF-C07F-4380-99DD-86D2F25AF17C}C:\program files\bitcomet\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client|Desc=BitComet - a BitTorrent Client
    "TCP Query User{21D078DA-C220-46BF-8E72-82D43D3358B1}C:\users\tarja ja matti\appdata\local\temp\rar$ex01.925\srvc.exe"= UDP:C:\users\tarja ja matti\appdata\local\temp\rar$ex01.925\srvc.exe:srvc.exe|Desc=srvc.exe
    "UDP Query User{A7446B9A-3ADE-46F6-827F-3FD3EC264468}C:\users\tarja ja matti\appdata\local\temp\rar$ex01.925\srvc.exe"= TCP:C:\users\tarja ja matti\appdata\local\temp\rar$ex01.925\srvc.exe:srvc.exe|Desc=srvc.exe
    "TCP Query User{899FC035-6E69-4AFD-972E-DA67BD2972DD}C:\users\tarja ja matti\desktop\mods\cdhaksor\srvc.exe"= UDP:C:\users\tarja ja matti\desktop\mods\cdhaksor\srvc.exe:srvc.exe|Desc=srvc.exe
    "UDP Query User{9529C9EE-E3CC-43FC-8D85-FACBC72494FE}C:\users\tarja ja matti\desktop\mods\cdhaksor\srvc.exe"= TCP:C:\users\tarja ja matti\desktop\mods\cdhaksor\srvc.exe:srvc.exe|Desc=srvc.exe
    "TCP Query User{0FAE593B-DB05-4BFA-BEB1-99004907A498}C:\program files\tightvnc\winvnc.exe"= UDP:C:\program files\tightvnc\winvnc.exe:TightVNC Win32 Server|Desc=TightVNC Win32 Server
    "UDP Query User{33F05C87-7953-49C5-92D7-6B413AB3AE72}C:\program files\tightvnc\winvnc.exe"= TCP:C:\program files\tightvnc\winvnc.exe:TightVNC Win32 Server|Desc=TightVNC Win32 Server
    "TCP Query User{A8B2A51E-EF6A-4844-9841-498144F1BA56}C:\program files\microsoft visual studio\vb98\vb6.exe"= UDP:C:\program files\microsoft visual studio\vb98\vb6.exe:Visual Basic|Desc=Visual Basic
    "UDP Query User{15AE6D90-B7BA-4B91-8E7C-1A6727309288}C:\program files\microsoft visual studio\vb98\vb6.exe"= TCP:C:\program files\microsoft visual studio\vb98\vb6.exe:Visual Basic|Desc=Visual Basic
    "TCP Query User{A83773F1-F3CD-4C1A-88B4-D7BE207993FC}C:\users\tarja ja matti\desktop\keskustelu server.exe"= UDP:C:\users\tarja ja matti\desktop\keskustelu server.exe:keskustelu server.exe|Desc=keskustelu server.exe
    "UDP Query User{BA4F947C-DC8C-4007-A30B-05903E13BC6A}C:\users\tarja ja matti\desktop\keskustelu server.exe"= TCP:C:\users\tarja ja matti\desktop\keskustelu server.exe:keskustelu server.exe|Desc=keskustelu server.exe
    "TCP Query User{F600E54F-65AB-4F2B-8EDD-634EA99AC531}C:\users\tarja ja matti\desktop\mods\remote access\server.exe"= UDP:C:\users\tarja ja matti\desktop\mods\remote access\server.exe:server.exe|Desc=server.exe
    "UDP Query User{C8E14936-68C2-4BAB-8D28-9BF45E487C51}C:\users\tarja ja matti\desktop\mods\remote access\server.exe"= TCP:C:\users\tarja ja matti\desktop\mods\remote access\server.exe:server.exe|Desc=server.exe
    "{7743314B-8C37-4D0F-9FD5-73786A4B5A57}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)|Edge=TRUE|

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
    "EnableFirewall"= 0 (0x0)

    R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 11:22]
    R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080221.003\IDSvix86.sys [2008-02-13 18:18]
    R2 TestHandler;Fujitsu Siemens Computers Diagnostic Testhandler;C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe [2006-12-08 19:52]
    R3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-02-02 22:09]
    R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-01-09 18:32]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a29b0aeb-5652-11dc-b025-001a92c20918}]
    \shell\AutoRun\command - G:\LaunchU3.exe -a

    *Newly Created Service* - COMHOST

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
    msiexec /fums {395787D8-AB35-3BCE-772B-1C50144B1CDC} /qb
    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-02-25 15:00:00 C:\Windows\Tasks\RegCure Program Check.job"
    - C:\Program Files\RegCure\RegCure.exe
    "2008-02-25 13:39:37 C:\Windows\Tasks\RegCure.job"
    - C:\Program Files\RegCure\RegCure.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-25 19:34:27
    Windows 6.0.6000 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\Windows\Explorer.exe [6.00.6000.16549]
    -> C:\Program Files\ArcSoft\PhotoImpression 5\share\pihook.dll
    .
    Completion time: 2008-02-25 19:35:32
    .
    2008-02-22 10:58:02 --- E O F ---
     
    olssku, Feb 25, 2008
    #3
  4. Hujo

    Hujo Guest

    scannaa hjt;llä merkkaa paina Fix checked

    O2 - BHO: BrowserCmp - {1D8282E6-BC4F-469B-AAED-7E4FF077AD93} - C:\Windows\system32\iebrowserc.dll
    O2 - BHO: superiorads - {4AD44D3E-7316-4251-B754-9B10EC96AF92} - C:\Windows\system32\sprt_ads.dll (file missing)
    O2 - BHO: dcads - {6FC3C36D-7635-4D43-BA62-0D9D2F2CD06E} - C:\Windows\system32\nsm28DE.dll (file missing)
    O4 - HKLM\..\Run: [spa_start] C:\Windows\System32\Rundll32.exe "C:\Windows\system32\sprt_ads.dll" DllStart
    O4 - HKLM\..\Run: [Winlogon] C:\Windows\system32\drivers\winlogon.exe
    O4 - HKLM\..\Run: [Services] C:\Windows\system32\drivers\services.exe

    ============

    Ohje AVG:n Anti-Spyware 7.5:n käyttöön
    Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.

    Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

    Lataa AVG:n Anti-Spyware 7.5:n
    ja tallenna ohjelma työpöydällesi.
    o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    o Käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

    o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

    o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".

    o Sitten "Reports" valikon alta:
    o Laita täppi kohtaan "Automatically generate report after every scan"
    o Ota täppi pois kohdasta"Only if threats were found"

    o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    o "Resident shield is", muuta tila active:sta inactive:ksi
    o Sulje ohjelma, ÄLÄ skannaa vielä.

    Käynnistä koneesi vikasietotilaan,
    sammuta ja käynnistä
    käynnistyksen yhteydessä naputtele F8
    valitse nuoli näppäimellä vikasietotila
    paina enter ja enter

    Toisissa koneissa paukutetaan F8:sin sijasta F5:tä

    HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
    o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.

    ========

    Lataa tuolta http://www.ccleaner.com/download/builds.aspx
    CCleaner v2.03.532- Standard Build, ÄLÄ aseenna Yahoo toolbaria!

    laita asetukset näin:
    Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

    aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
    aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi
     
    Last edited by a moderator: Feb 25, 2008
    Hujo, Feb 25, 2008
    #4

Share This Page