kone tökkii alla HJT-logi Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:25:13, on 2.6.2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\MSI\BToes Bluetooth Software\bin\btwdins.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ASUS\Asus Probe\AsusProb.exe C:\WINDOWS\system32\carpserv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Windows Defender\MSASCui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\MSI\BToes Bluetooth Software\BTTray.exe C:\PROGRA~1\MSI\BTOESB~1\BTSTAC~1.EXE C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Asus Probe\AsusProb.exe O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\MSI\BToes Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\BToes Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\BToes Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://www.nelonen.fi O16 - DPF: {3B36B017-7E49-426B-95B0-B5CECD83C2E2} (IfolorUploader Control) - http://fika-web.ifolor.net/OrderingGeneral/LowRes/app_support/ActiveX/IfolorUploader_fika.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {5CE72DD0-4695-4D18-A4D3-3367ACD37578} (F-Secure Health Check 1.0) - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1202207984875 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1202208096359 O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_02) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6-windows-i586.cab O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://fi.photobox.com/clients/uploader_v2.2.0.6.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - O17 - HKLM\System\CCS\Services\Tcpip\..\{4E48DA8A-7B31-4CDA-AB28-1EC3D2FF6092}: NameServer = 213.139.190.3 212.50.131.153 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\MSI\BToes Bluetooth Software\bin\btwdins.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 9514 bytes
Javan päivitys ja välimuistin tyhjennys: 1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa. 2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... ) Niissä pitäisi olla seuraava kuva vieressä: 3. Valitse kaikki entiset Java versiosi ja valitse Poista. 4. Asenna uusin Java päivitys seuraavasta linkistä.. 5. Käynnistä kone uudelleen asennuksen jälkeen: http://java.sun.com/javase/downloads/index.jsp Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u6 Paina Download Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se. 6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi). 7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia. (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa. Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle). 8. Varmista että kaikki kaksi valintaa ovat rastitettuja: *Applications and Applets *Trace and Log Files Ja paina OK -nappia 9. Klikkaa OK "Temporary Files Settings" -ikkunassasi. 10. Klikkaa OK jättääksesi Java asetusikkunasi. ============ Lataa Malwarebytes' Anti-Malware työpöydällesi. 1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. 2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish. 3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. 4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan. 5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset. 6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected. 7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt 8. Lähetä lokin sisältö seuraavassa viestissäsi.
Tässä ois tää logi Malwarebytes' Anti-Malware 1.17 Tietokantaversio: 846 17:08:43 11.6.2008 mbam-log-6-11-2008 (17-08-43).txt Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|) Tarkistetut kohteet: 97144 Kulunut aika: 30 minute(s), 10 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 0 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 0 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: (Haitallisia kohteita ei löydetty)
1.Lataa combofix.exe työpöydällesi yhdestä linkistä: combofix1 combofix2 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
ComboFix 08-06-15.4 - Omistaja 2008-06-16 17:28:36.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.660 [GMT 3:00] Running from: C:\Documents and Settings\Omistaja\Työpöytä\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-16 to 2008-06-16 ))))))))))))))))) . 2008-06-13 11:53 . 2008-04-14 18:59 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-13 11:53 . 2008-05-08 17:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-06-11 16:36 . 2008-06-11 16:36 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-06-11 16:36 . 2008-06-11 16:36 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Malwarebytes 2008-06-11 16:36 . 2008-06-11 16:36 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-06-11 16:36 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-06-11 16:36 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-06-11 16:22 . 2008-06-11 16:22 <KANSIO> d-------- C:\Program Files\Common Files\Java 2008-06-11 16:22 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-06-11 00:14 . 2008-06-11 00:14 <KANSIO> d-------- C:\Documents and Settings\LocalService\Omat tiedostot 2008-06-09 22:19 . 2008-06-09 22:19 <KANSIO> d-------- C:\Program Files\PocketRAR 2008-06-09 21:30 . 2008-06-10 20:35 <KANSIO> d-------- C:\Program Files\uTorrent 2008-06-09 21:30 . 2008-06-14 18:36 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\uTorrent 2008-06-09 12:07 . 2008-06-09 12:07 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Apple Computer 2008-06-09 12:06 . 2008-06-09 12:06 0 --a------ C:\WINDOWS\ATIMMC.INI 2008-06-07 21:37 . 2008-06-09 12:05 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-07 21:37 . 2008-06-07 21:37 1,409 --a------ C:\WINDOWS\QTFont.for 2008-06-07 21:33 . 2008-06-07 21:33 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-06-07 21:32 . 2008-06-07 21:32 <KANSIO> d-------- C:\Program Files\Apple Software Update 2008-06-07 21:32 . 2008-06-07 21:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-06-07 21:26 . 2008-06-07 21:33 <KANSIO> d-------- C:\Program Files\QuickTime 2008-06-07 20:04 . 2008-06-07 20:04 <KANSIO> d-------- C:\Program Files\Avira 2008-06-07 20:04 . 2008-06-07 20:04 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-06-02 01:36 . 2008-06-02 01:38 <KANSIO> d-------- C:\Program Files\antivir 2008-05-25 00:37 . 2008-05-26 23:40 <KANSIO> d-------- C:\Program Files\Octoshape Streaming Services 2008-05-21 18:08 . 2008-05-21 18:08 <KANSIO> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-05-21 18:04 . 2008-05-21 18:04 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Avg8 2008-05-20 23:30 . 2008-06-07 21:12 <KANSIO> d-------- C:\Program Files\Norton AntiVirus 2008-05-20 23:13 . 2008-06-07 21:12 <KANSIO> d-------- C:\Program Files\Common Files\Symantec Shared 2008-05-20 23:13 . 2008-06-07 21:12 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2008-05-19 10:58 . 2008-06-13 21:33 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-05-18 19:20 . 2008-05-18 19:20 102 --a------ C:\WINDOWS\system32\UserRequest_1211127600.tmp 2008-05-18 18:57 . 2008-05-18 19:22 <KANSIO> d-------- C:\Program Files\DC++ 2008-05-18 17:51 . 2008-05-18 17:52 <KANSIO> d-------- C:\Program Files\Nero 2008-05-18 17:51 . 2008-05-18 17:51 <KANSIO> d-------- C:\Program Files\Common Files\Nero 2008-05-18 17:51 . 2008-05-18 17:51 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Nero 2008-05-18 17:51 . 2006-03-17 11:45 1,757,184 --a------ C:\WINDOWS\system32\imagX7.dll 2008-05-18 17:51 . 2006-03-17 11:45 802,816 --a------ C:\WINDOWS\system32\imagXRA7.dll 2008-05-18 17:51 . 2006-03-17 11:45 497,296 --a------ C:\WINDOWS\system32\imagXpr7.dll 2008-05-18 17:51 . 2006-03-17 14:49 368,640 --a------ C:\WINDOWS\system32\TwnLib4.dll 2008-05-18 17:51 . 2006-03-17 11:45 258,048 --a------ C:\WINDOWS\system32\imagXR7.dll 2008-05-16 23:13 . 2004-09-15 02:12 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-05-16 23:04 . 2008-05-16 23:04 <KANSIO> d-------- C:\WINDOWS\system32\fi 2008-05-16 23:04 . 2008-05-16 23:04 <KANSIO> d-------- C:\WINDOWS\l2schemas 2008-05-16 22:36 . 2008-04-14 19:11 69,120 --------- C:\WINDOWS\system32\wlanapi.dll 2008-05-16 22:36 . 2008-04-14 19:11 50,688 --------- C:\WINDOWS\system32\tspkg.dll 2008-05-16 22:34 . 2008-04-13 19:36 144,384 --------- C:\WINDOWS\system32\drivers\hdaudbus.sys 2008-05-16 22:34 . 2008-04-14 19:11 61,440 --------- C:\WINDOWS\system32\kmsvc.dll 2008-05-16 22:34 . 2008-04-14 19:11 37,376 --------- C:\WINDOWS\system32\l2gpstore.dll 2008-05-16 22:34 . 2006-12-28 22:01 19,569 --a------ C:\WINDOWS\005725_.tmp 2008-05-16 22:34 . 2008-04-14 19:10 6,144 --------- C:\WINDOWS\system32\kbdpash.dll 2008-05-16 22:34 . 2008-04-14 19:10 6,144 --------- C:\WINDOWS\system32\kbdnepr.dll 2008-05-16 22:34 . 2008-04-14 19:10 6,144 --------- C:\WINDOWS\system32\kbdiultn.dll 2008-05-16 22:34 . 2008-04-14 19:10 6,144 --------- C:\WINDOWS\system32\kbdbhc.dll 2008-05-16 22:34 . 2008-04-14 18:52 2,524 --------- C:\WINDOWS\system32\pid.inf 2008-05-16 20:03 . 2008-05-16 20:03 0 --a------ C:\WINDOWS\system32\drivers\wnmsav.dat 2008-05-16 19:06 . 2008-05-16 19:06 1,160 --a------ C:\WINDOWS\mozver.dat 2008-05-16 18:47 . 2008-05-16 22:31 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\AVGTOOLBAR 2008-05-16 18:35 . 2008-05-16 18:35 10 --a------ C:\WINDOWS\WININIT.INI 2008-05-16 18:18 . 2008-05-16 19:23 <KANSIO> d-------- C:\Program Files\AVG 2008-05-16 18:15 . 2008-05-16 18:16 <KANSIO> d-------- C:\Program Files\mozilla . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-11 13:22 --------- d-----w C:\Program Files\Java 2008-06-10 20:59 --------- d-----w C:\Program Files\RevConnect 2008-05-25 10:57 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\ZoomBrowser EX 2008-05-25 10:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser 2008-05-16 20:36 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-05-16 17:23 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\BSplayer 2008-05-16 17:10 --------- d-----w C:\Program Files\Common Files\Panda Software 2008-05-16 15:36 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-16 15:36 --------- d-----w C:\Program Files\Common Files\ATI 2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:12 1,288,704 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-19 12:00 --------- d-----w C:\Program Files\Google 2008-04-18 18:33 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE 2008-04-14 16:27 1,804 ----a-w C:\WINDOWS\system32\dcache.bin 2008-04-14 16:15 331,264 ----a-w C:\WINDOWS\system32\netsetup.exe 2008-04-14 16:11 997,888 ----a-w C:\WINDOWS\system32\msgina.dll 2008-04-14 16:10 9,344 ----a-w C:\WINDOWS\system32\framebuf.dll 2008-04-14 16:09 3,072 ----a-w C:\WINDOWS\system32\dpnlobby.dll 2008-04-14 16:09 3,072 ----a-w C:\WINDOWS\system32\dpnaddr.dll 2008-04-14 16:09 285,696 ----a-w C:\WINDOWS\system32\atmfd.dll 2008-04-14 16:09 16,896 ----a-w C:\WINDOWS\system32\cfgmgr32.dll 2008-04-14 15:49 2,191,360 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-04-14 15:49 2,068,224 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-04-14 15:48 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll 2008-04-14 15:46 79,872 ----a-w C:\WINDOWS\system32\msxml6r.dll 2008-04-14 15:45 80,384 ------w C:\WINDOWS\system32\msshavmsg.dll 2008-04-14 15:44 48,640 ----a-w C:\WINDOWS\system32\inetres.dll 2008-04-14 15:43 556,032 ----a-w C:\WINDOWS\system32\shdoclc.dll 2008-04-14 15:41 9,728 ----a-w C:\WINDOWS\system32\gpkrsrc.dll 2008-04-14 15:41 1,845,888 ----a-w C:\WINDOWS\system32\win32k.sys 2008-04-14 15:40 65,536 ----a-w C:\WINDOWS\system32\browselc.dll 2008-04-14 15:38 103,424 ----a-w C:\WINDOWS\system32\dpcdll.dll 2008-04-14 06:12 11,264 ------w C:\WINDOWS\system32\spnpinst.exe 2008-04-14 06:11 992,256 ----a-w C:\WINDOWS\system32\setupapi.dll 2008-04-14 06:11 423,936 ----a-w C:\WINDOWS\system32\licdll.dll 2008-04-13 18:44 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys 2008-04-13 18:40 440,832 ----a-w C:\WINDOWS\system32\xpob2res.dll 2008-04-13 18:36 2,921,984 ----a-w C:\WINDOWS\system32\xpsp2res.dll 2008-04-13 18:35 24,064 ----a-w C:\WINDOWS\system32\pidgen.dll 2008-04-13 18:35 186,368 ----a-w C:\WINDOWS\system32\xpsp1res.dll 2008-04-13 18:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll 2008-04-13 18:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll 2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll 2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll 2008-04-13 17:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll 2008-04-13 16:48 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll 2008-04-13 16:45 216,064 ----a-w C:\WINDOWS\system32\moricons.dll 2008-04-13 16:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll 2008-04-13 15:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll 2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll 2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 19:12 15360] "ATI Launchpad"="" [] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-06-14 13:36 77824 C:\WINDOWS\soundman.exe] "ASUS Probe"="C:\Program Files\ASUS\Asus Probe\AsusProb.exe" [2002-12-06 17:07 617984] "CARPService"="carpserv.exe" [2003-03-19 02:13 4608 C:\WINDOWS\system32\carpserv.exe] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-06-07 21:26 413696] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 19:12 15360] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264] C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\ BTTray.lnk - C:\Program Files\MSI\BToes Bluetooth Software\BTTray.exe [2004-11-30 14:30:00 565309] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.VCR2"= ATIVCR2.DLL "VIDC.DRAW"= DVIDEO.DLL "VIDC.VCR1"= ATIVCR1.DLL "VIDC.YV12"= ATIYUV12.DLL "VIDC.YU12"= ATIYUV12.DLL "vidc.ffds"= ffdshow.ax "msacm.ac3filter"= ac3filter.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\RevConnect\\DCPlusPlus.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= R3 SCR3XX2K;SCR3xx USB SmartCardReader;C:\WINDOWS\system32\DRIVERS\SCR3XX2K.sys [2007-10-18 00:11] S2 TTDec;ATI WDM Teletext Decoder;C:\WINDOWS\system32\DRIVERS\ATINTTXX.sys [2003-09-19 01:31] S3 NETIMFLT;PANDA NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\netimflt.sys [] *Newly Created Service* - CATCHME . 'Ajoitetut tehtävät'-kansion sisältö "2008-06-07 18:32:41 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-06-16 13:41:55 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-16 17:29:43 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-16 17:31:44 ComboFix-quarantined-files.txt 2008-06-16 14:31:16 Pre-Run: 51,346,796,544 tavua vapaana Post-Run: 51,413,118,976 tavua vapaana 200 --- E O F --- 2008-06-15 18:13:02
tää onkin aivan toivoton tapaus poista lisää poista sovelutuksesta Spybot - Search & Destroy Poista kansio vikasiedossa C:\Program Files\Spybot - Search & Destroy ============ Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne: Tallenna se nimellä CFScript.txt Sitten raahaa CFScript ComboFix.exeen kuten alla. Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne. =========== scannaa hjt:llä merkkaa paina Fix checked O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
ComboFix 08-06-15.4 - Omistaja 2008-06-19 21:54:18.2 - NTFSx86 MINIMAL Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.797 [GMT 3:00] Running from: C:\Documents and Settings\Omistaja\Työpöytä\ComboFix.exe Command switches used :: C:\Documents and Settings\Omistaja\Työpöytä\CFScript.txt WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! FILE :: C:\Documents and Settings\All Users\Application Data\Avg8 C:\Documents and Settings\All Users\Application Data\Avira C:\Documents and Settings\Omistaja\Application Data\AVGTOOLBAR . (((((((((((((((((((((((((((((((((((((( Muut poistot )))))))))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\antivir C:\Program Files\antivir\antivir_workstation_winu_en_h.exe C:\Program Files\AVG C:\Program Files\AVG\avg_free_stf_en_8_100a1295.exe C:\Program Files\AVG\AVG8\Firefox\Chrome\searchshield.jar.install_backup C:\Program Files\AVG\AVG8\Firefox\Components\ISearchShield.xpt.install_backup C:\Program Files\AVG\AVG8\Icons\background_middle_gray.gif.install_backup C:\Program Files\AVG\AVG8\Icons\background_middle_green.gif.install_backup C:\Program Files\AVG\AVG8\Icons\background_middle_orange.gif.install_backup C:\Program Files\AVG\AVG8\Icons\background_middle_red.gif.install_backup C:\Program Files\AVG\AVG8\Icons\background_middle_yellow.gif.install_backup C:\Program Files\AVG\AVG8\Icons\background_top_gray.gif.install_backup C:\Program Files\AVG\AVG8\Icons\background_top_green.gif.install_backup C:\Program Files\AVG\AVG8\Icons\background_top_orange.gif.install_backup C:\Program Files\AVG\AVG8\Icons\background_top_red.gif.install_backup C:\Program Files\AVG\AVG8\Icons\background_top_yellow.gif.install_backup C:\Program Files\AVG\AVG8\Icons\block-doc.gif.install_backup C:\Program Files\AVG\AVG8\Icons\blocked.gif.install_backup C:\Program Files\AVG\AVG8\Icons\border_bottom_gray.gif.install_backup C:\Program Files\AVG\AVG8\Icons\border_bottom_green.gif.install_backup C:\Program Files\AVG\AVG8\Icons\border_bottom_orange.gif.install_backup C:\Program Files\AVG\AVG8\Icons\border_bottom_red.gif.install_backup C:\Program Files\AVG\AVG8\Icons\border_bottom_yellow.gif.install_backup C:\Program Files\AVG\AVG8\Icons\border_top_gray.gif.install_backup C:\Program Files\AVG\AVG8\Icons\border_top_green.gif.install_backup C:\Program Files\AVG\AVG8\Icons\border_top_orange.gif.install_backup C:\Program Files\AVG\AVG8\Icons\border_top_red.gif.install_backup C:\Program Files\AVG\AVG8\Icons\border_top_yellow.gif.install_backup C:\Program Files\AVG\AVG8\Icons\box_bottom_red.gif.install_backup C:\Program Files\AVG\AVG8\Icons\box_top_red.gif.install_backup C:\Program Files\AVG\AVG8\Icons\caution.gif.install_backup C:\Program Files\AVG\AVG8\Icons\click_here_gray.gif.install_backup C:\Program Files\AVG\AVG8\Icons\click_here_green.gif.install_backup C:\Program Files\AVG\AVG8\Icons\click_here_orange.gif.install_backup C:\Program Files\AVG\AVG8\Icons\click_here_red.gif.install_backup C:\Program Files\AVG\AVG8\Icons\click_here_yellow.gif.install_backup C:\Program Files\AVG\AVG8\Icons\clock.gif.install_backup C:\Program Files\AVG\AVG8\Icons\close.gif.install_backup C:\Program Files\AVG\AVG8\Icons\icons_blocked.gif.install_backup C:\Program Files\AVG\AVG8\Icons\icons_caution.gif.install_backup C:\Program Files\AVG\AVG8\Icons\icons_close.gif.install_backup C:\Program Files\AVG\AVG8\Icons\icons_safe.gif.install_backup C:\Program Files\AVG\AVG8\Icons\icons_unknown.gif.install_backup C:\Program Files\AVG\AVG8\Icons\icons_warning.gif.install_backup C:\Program Files\AVG\AVG8\Icons\LS_Logo_Results.gif.install_backup C:\Program Files\AVG\AVG8\Icons\safe.gif.install_backup C:\Program Files\AVG\AVG8\Icons\unknown.gif.install_backup C:\Program Files\AVG\AVG8\Icons\warning.gif.install_backup C:\Program Files\Avira C:\Program Files\Avira\AntiVir PersonalEdition Classic\about.htm C:\Program Files\Avira\AntiVir PersonalEdition Classic\aecore.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\aeemu.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\aegen.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\aehelp.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\aeheur.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\aeoffice.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\aepack.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\aerdl.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\aescn.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\aescript.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\aeset.dat C:\Program Files\Avira\AntiVir PersonalEdition Classic\aevdf.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\alldiscs.avp C:\Program Files\Avira\AntiVir PersonalEdition Classic\alldrives.avp C:\Program Files\Avira\AntiVir PersonalEdition Classic\antivir.oem C:\Program Files\Avira\AntiVir PersonalEdition Classic\antivir0.vdf C:\Program Files\Avira\AntiVir PersonalEdition Classic\antivir1.vdf C:\Program Files\Avira\AntiVir PersonalEdition Classic\antivir2.vdf C:\Program Files\Avira\AntiVir PersonalEdition Classic\antivir3.vdf C:\Program Files\Avira\AntiVir PersonalEdition Classic\avadmin.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avarkt.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avconfig.cpl C:\Program Files\Avira\AntiVir PersonalEdition Classic\avconfig.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\avconfig.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avconfig64.cpl C:\Program Files\Avira\AntiVir PersonalEdition Classic\avevtlog.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avinet.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\avipbb.inf C:\Program Files\Avira\AntiVir PersonalEdition Classic\avipc.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\avnotify.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\avnotify.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avpref.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\avreg.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\avrep.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avwin.chm C:\Program Files\Avira\AntiVir PersonalEdition Classic\avwinll.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\avwsc.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\build.dat C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccev.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccevrc.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccgen.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccgenrc.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccgrdrc.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccguard.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\cclib.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\cclic.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\cclicrc.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccmainrc.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccmsg.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccplg.xml C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccprofil.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccquamgr.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccquarc.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccreporc.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccreport.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccscanrc.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccsched.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccscherc.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\cctpc.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccupdate.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccupdrc.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\common_msg.avr C:\Program Files\Avira\AntiVir PersonalEdition Classic\eula.txt C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\aecore.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\aeemu.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\aegen.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\aehelp.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\aeheur.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\aeoffice.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\aepack.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\aerdl.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\aescn.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\aescript.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\aeset.dat C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\aevdf.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\antivir0.vdf C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\antivir1.vdf C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\antivir2.vdf C:\Program Files\Avira\AntiVir PersonalEdition Classic\FAILSAFE\antivir3.vdf C:\Program Files\Avira\AntiVir PersonalEdition Classic\guardevt.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\guardgui.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\guardmsg.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\hbedv.key C:\Program Files\Avira\AntiVir PersonalEdition Classic\licmgr.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\licmgr.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\luke.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\lukeres.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\mfc71u.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\mgrs.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\msgclient.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\msvcp71.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\msvcr71.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\mydocs.avp C:\Program Files\Avira\AntiVir PersonalEdition Classic\netnt.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\preupd.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\process.avp C:\Program Files\Avira\AntiVir PersonalEdition Classic\prodinfo.dat C:\Program Files\Avira\AntiVir PersonalEdition Classic\rchelp.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\rcimage.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\rctext.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\readme.txt C:\Program Files\Avira\AntiVir PersonalEdition Classic\rmdiscs.avp C:\Program Files\Avira\AntiVir PersonalEdition Classic\scewxml.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\schedr.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\setup.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\setup.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\setupprf.dat C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\smtplib.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\sqlite3.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\ssmdrv.inf C:\Program Files\Avira\AntiVir PersonalEdition Classic\sweb.zip C:\Program Files\Avira\AntiVir PersonalEdition Classic\sysdir.avp C:\Program Files\Avira\AntiVir PersonalEdition Classic\sysscan.avp C:\Program Files\Avira\AntiVir PersonalEdition Classic\unacev2.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\update.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\update_msg.avr C:\Program Files\Avira\AntiVir PersonalEdition Classic\updgui.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\updguirc.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\updlib.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\updlibrc.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\weblink.url C:\Program Files\Avira\AntiVir PersonalEdition Classic\wksstats.dll C:\Program Files\Avira\AntiVir PersonalEdition Classic\wsctool.exe . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-19 to 2008-06-19 ))))))))))))))))) . 2008-06-13 11:53 . 2008-04-14 18:59 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-13 11:53 . 2008-05-08 17:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-06-11 16:36 . 2008-06-11 16:36 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-06-11 16:36 . 2008-06-11 16:36 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Malwarebytes 2008-06-11 16:36 . 2008-06-11 16:36 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-06-11 16:36 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-06-11 16:36 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-06-11 16:22 . 2008-06-11 16:22 <KANSIO> d-------- C:\Program Files\Common Files\Java 2008-06-11 16:22 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-06-11 00:14 . 2008-06-11 00:14 <KANSIO> d-------- C:\Documents and Settings\LocalService\Omat tiedostot 2008-06-09 22:19 . 2008-06-09 22:19 <KANSIO> d-------- C:\Program Files\PocketRAR 2008-06-09 21:30 . 2008-06-10 20:35 <KANSIO> d-------- C:\Program Files\uTorrent 2008-06-09 21:30 . 2008-06-17 12:11 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\uTorrent 2008-06-09 12:07 . 2008-06-09 12:07 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Apple Computer 2008-06-09 12:06 . 2008-06-09 12:06 0 --a------ C:\WINDOWS\ATIMMC.INI 2008-06-07 21:37 . 2008-06-09 12:05 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-07 21:37 . 2008-06-07 21:37 1,409 --a------ C:\WINDOWS\QTFont.for 2008-06-07 21:33 . 2008-06-07 21:33 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-06-07 21:32 . 2008-06-07 21:32 <KANSIO> d-------- C:\Program Files\Apple Software Update 2008-06-07 21:32 . 2008-06-07 21:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-06-07 21:26 . 2008-06-07 21:33 <KANSIO> d-------- C:\Program Files\QuickTime 2008-06-07 20:04 . 2008-06-07 20:04 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-05-25 00:37 . 2008-05-26 23:40 <KANSIO> d-------- C:\Program Files\Octoshape Streaming Services 2008-05-21 18:08 . 2008-05-21 18:08 <KANSIO> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-05-21 18:04 . 2008-05-21 18:04 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Avg8 2008-05-20 23:30 . 2008-06-07 21:12 <KANSIO> d-------- C:\Program Files\Norton AntiVirus 2008-05-20 23:13 . 2008-06-07 21:12 <KANSIO> d-------- C:\Program Files\Common Files\Symantec Shared 2008-05-20 23:13 . 2008-06-07 21:12 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2008-05-19 10:58 . 2008-06-17 11:58 69 --a------ C:\WINDOWS\NeroDigital.ini . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-19 18:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-17 09:14 --------- d-----w C:\Program Files\RevConnect 2008-06-11 13:22 --------- d-----w C:\Program Files\Java 2008-05-25 10:57 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\ZoomBrowser EX 2008-05-25 10:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser 2008-05-18 16:22 --------- d-----w C:\Program Files\DC++ 2008-05-18 14:52 --------- d-----w C:\Program Files\Nero 2008-05-18 14:51 --------- d-----w C:\Program Files\Common Files\Nero 2008-05-18 14:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero 2008-05-16 20:36 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-05-16 19:31 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\AVGTOOLBAR 2008-05-16 17:23 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\BSplayer 2008-05-16 17:10 --------- d-----w C:\Program Files\Common Files\Panda Software 2008-05-16 17:03 0 ----a-w C:\WINDOWS\system32\drivers\wnmsav.dat 2008-05-16 15:36 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-16 15:36 --------- d-----w C:\Program Files\Common Files\ATI 2008-05-16 15:16 --------- d-----w C:\Program Files\mozilla 2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:12 1,288,704 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-19 12:00 --------- d-----w C:\Program Files\Google 2008-04-18 18:33 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE 2008-04-14 16:27 1,804 ----a-w C:\WINDOWS\system32\dcache.bin 2008-04-14 16:15 331,264 ----a-w C:\WINDOWS\system32\netsetup.exe 2008-04-14 16:11 997,888 ----a-w C:\WINDOWS\system32\msgina.dll 2008-04-14 16:10 9,344 ----a-w C:\WINDOWS\system32\framebuf.dll 2008-04-14 16:09 3,072 ----a-w C:\WINDOWS\system32\dpnlobby.dll 2008-04-14 16:09 3,072 ----a-w C:\WINDOWS\system32\dpnaddr.dll 2008-04-14 16:09 285,696 ----a-w C:\WINDOWS\system32\atmfd.dll 2008-04-14 16:09 16,896 ----a-w C:\WINDOWS\system32\cfgmgr32.dll 2008-04-14 15:49 2,191,360 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-04-14 15:49 2,068,224 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-04-14 15:48 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll 2008-04-14 15:46 79,872 ----a-w C:\WINDOWS\system32\msxml6r.dll 2008-04-14 15:45 80,384 ------w C:\WINDOWS\system32\msshavmsg.dll 2008-04-14 15:44 48,640 ----a-w C:\WINDOWS\system32\inetres.dll 2008-04-14 15:43 556,032 ----a-w C:\WINDOWS\system32\shdoclc.dll 2008-04-14 15:41 9,728 ----a-w C:\WINDOWS\system32\gpkrsrc.dll 2008-04-14 15:41 1,845,888 ----a-w C:\WINDOWS\system32\win32k.sys 2008-04-14 15:40 65,536 ----a-w C:\WINDOWS\system32\browselc.dll 2008-04-14 15:38 103,424 ----a-w C:\WINDOWS\system32\dpcdll.dll 2008-04-14 06:12 11,264 ------w C:\WINDOWS\system32\spnpinst.exe 2008-04-14 06:11 992,256 ----a-w C:\WINDOWS\system32\setupapi.dll 2008-04-14 06:11 423,936 ----a-w C:\WINDOWS\system32\licdll.dll 2008-04-13 18:44 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys 2008-04-13 18:40 440,832 ----a-w C:\WINDOWS\system32\xpob2res.dll 2008-04-13 18:36 2,921,984 ----a-w C:\WINDOWS\system32\xpsp2res.dll 2008-04-13 18:35 24,064 ----a-w C:\WINDOWS\system32\pidgen.dll 2008-04-13 18:35 186,368 ----a-w C:\WINDOWS\system32\xpsp1res.dll 2008-04-13 18:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll 2008-04-13 18:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll 2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll 2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll 2008-04-13 17:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll 2008-04-13 16:48 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll 2008-04-13 16:45 216,064 ----a-w C:\WINDOWS\system32\moricons.dll 2008-04-13 16:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll 2008-04-13 15:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll 2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll 2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll . ((((((((((((((((((((((((((((( snapshot@2008-06-16_17.31.04,60 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-16 13:38:45 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-19 18:51:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 19:12 15360] "ATI Launchpad"="" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-06-14 13:36 77824 C:\WINDOWS\soundman.exe] "ASUS Probe"="C:\Program Files\ASUS\Asus Probe\AsusProb.exe" [2002-12-06 17:07 617984] "CARPService"="carpserv.exe" [2003-03-19 02:13 4608 C:\WINDOWS\system32\carpserv.exe] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [ ] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-06-07 21:26 413696] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 19:12 15360] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264] C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\ BTTray.lnk - C:\Program Files\MSI\BToes Bluetooth Software\BTTray.exe [2004-11-30 14:30:00 565309] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.VCR2"= ATIVCR2.DLL "VIDC.DRAW"= DVIDEO.DLL "VIDC.VCR1"= ATIVCR1.DLL "VIDC.YV12"= ATIYUV12.DLL "VIDC.YU12"= ATIYUV12.DLL "vidc.ffds"= ffdshow.ax "msacm.ac3filter"= ac3filter.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\RevConnect\\DCPlusPlus.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= S2 TTDec;ATI WDM Teletext Decoder;C:\WINDOWS\system32\DRIVERS\ATINTTXX.sys [2003-09-19 01:31] S3 NETIMFLT;PANDA NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\netimflt.sys [] S3 SCR3XX2K;SCR3xx USB SmartCardReader;C:\WINDOWS\system32\DRIVERS\SCR3XX2K.sys [2007-10-18 00:11] . 'Ajoitetut tehtävät'-kansion sisältö "2008-06-07 18:32:41 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-06-19 18:55:04 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-19 21:58:12 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\tsd32.dll -> C:\WINDOWS\system32\ac3filter.acm . Completion time: 2008-06-19 22:00:19 ComboFix-quarantined-files.txt 2008-06-19 18:59:31 ComboFix2.txt 2008-06-16 14:31:44 Pre-Run: 51,421,077,504 tavua vapaana Post-Run: 51,319,144,448 tavua vapaana 373 --- E O F --- 2008-06-18 08:03:08
Laitoin fix checked kaikkiin muihin paitsi 02 jotain ja 04 HKCU jotain niitä ei löytyny...? Oonko tehny jotain väärin...kiitos jo etukäteen..
scannaa uusi hjt:n loki ========== Luo poistolista: • Avaa HiJackThis • Klikkaa "Configure" valintaa oikealla alhaalla • Klikkaa "Misc Tools" • Klikkaa boxia joka sanoo "Uninstall Manager" • Klikkaa valintaa "Save list" • Kopioi ja liitä kyseinen lista muistiosta postiisi
HJT logi ennnen Config juttuja... Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:02:59, on 21.6.2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ASUS\Asus Probe\AsusProb.exe C:\WINDOWS\system32\carpserv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSI\BToes Bluetooth Software\BTTray.exe C:\PROGRA~1\MSI\BTOESB~1\BTSTAC~1.EXE C:\Program Files\MSI\BToes Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Asus Probe\AsusProb.exe O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\MSI\BToes Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\BToes Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\BToes Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://www.nelonen.fi O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab O16 - DPF: {3B36B017-7E49-426B-95B0-B5CECD83C2E2} (IfolorUploader Control) - http://fika-web.ifolor.net/OrderingGeneral/LowRes/app_support/ActiveX/IfolorUploader_fika.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {5CE72DD0-4695-4D18-A4D3-3367ACD37578} (F-Secure Health Check 1.0) - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1202207984875 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1202208096359 O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://fi.photobox.com/clients/uploader_v2.2.0.6.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4E48DA8A-7B31-4CDA-AB28-1EC3D2FF6092}: NameServer = 213.139.190.3 212.50.131.153 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing) O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing) O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\MSI\BToes Bluetooth Software\bin\btwdins.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 6972 bytes
No nyt on asennettu ja scannattu uusi antivirkin.. Ei vissin mikään helpoin tapaus tää meirän tapaus?
testasin malwarella et löytyykö enää saastuneita tiedostoja ja lista oli tän näkönen..., Malwarebytes' Anti-Malware 1.17 Tietokantaversio: 846 21:18:31 24.6.2008 mbam-log-6-24-2008 (21-18-31).txt Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|) Tarkistetut kohteet: 99001 Kulunut aika: 35 minute(s), 26 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 0 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 0 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: (Haitallisia kohteita ei löydetty) eli kaikki on iha OK? KIITOKSET eteenkin Hujo:lle
