Mesevirusta pukkaa vaikka jo kerran poistettu

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Topeelius, Jun 2, 2008.

  1. Topeelius

    Topeelius Member

    Joined:
    Jun 12, 2013
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Nonni

    Kerran jo poistin meseviruksen mutta sehän on tullu uudestaan. ilmeisesti jotain filuja kuitenkin jäi koneelle. Kyllä sielä ainakin
    Vundo.exe:ä on mutta jos joku viitsisi vielä tarkistaa mitkä kaikki filut pitää poistaa niin saatais kerralla puhdasta :).

    Tässä Combofix - loki:

    2008-05-30 03:00 . 2008-06-01 23:23 <KANSIO> d-------- C:\Program Files\mIRC
    2008-05-30 01:58 . 2008-05-30 01:58 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-05-30 01:58 . 2008-05-30 01:58 <KANSIO> d-------- C:\Documents and Settings\Topi Heikkilä\Application Data\Malwarebytes
    2008-05-30 01:58 . 2008-05-30 01:58 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-30 01:58 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-30 01:58 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-05-30 01:03 . 2008-05-30 01:03 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-05-29 20:42 . 2008-05-29 20:42 249,496 --a------ C:\sexy.exe
    2008-05-29 20:18 . 2008-05-29 20:18 86,340 --a------ C:\img.com
    2008-05-29 19:38 . 2008-05-29 19:38 40,960 --a------ C:\dsdc.exe
    2008-05-29 15:35 . 2008-05-29 22:51 60,132 --a------ C:\ddc.exe
    2008-05-29 15:14 . 2008-05-29 18:12 56,832 --a------ C:\fa.com
    2008-05-28 23:47 . 2008-05-28 23:47 369 --a------ C:\vundoFIX.exe
    2008-05-28 20:26 . 2008-05-28 20:26 40,960 --a------ C:\dczi.exe
    2008-05-28 19:27 . 2008-05-28 20:10 56,832 --a------ C:\sxy1.com
    2008-05-28 19:21 . 2008-05-28 19:21 56,832 --a------ C:\sxy.com
    2008-05-28 01:47 . 2008-05-28 01:47 <KANSIO> d-------- C:\WINDOWS\nvidia icons
    2008-05-28 01:47 . 2008-05-28 01:49 <KANSIO> d-------- C:\WINDOWS\NV48324800.TMP
    2008-05-28 01:47 . 2008-05-02 22:46 182,347 --a------ C:\WINDOWS\system32\nvapps.nvb
    2008-05-28 01:46 . 2008-05-28 01:46 <KANSIO> d-------- C:\NVIDIA
    2008-05-28 01:46 . 2008-04-30 17:27 442,368 --a------ C:\WINDOWS\system32\NVUNINST.EXE
    2008-05-27 23:36 . 2008-05-27 23:36 40,960 --a------ C:\dcis.exe
    2008-05-27 23:25 . 2008-05-28 13:48 40,960 --a------ C:\dciz.exe
    2008-05-27 19:07 . 2008-05-27 20:38 40,960 --a------ C:\dchi.exe
    2008-05-27 18:53 . 2008-05-29 16:29 3,422 --a------ C:\dci.exe
    2008-05-19 13:57 . 2008-06-01 23:33 <KANSIO> d-------- C:\Program Files\SystemRequirementsLab
    2008-05-19 13:56 . 2008-05-19 13:57 <KANSIO> d-------- C:\Documents and Settings\Topi Heikkilä\Application Data\SystemRequirementsLab
    2008-05-13 02:01 . 2008-05-13 02:01 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\media center programs
    2008-05-13 01:13 . 2008-05-13 01:13 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Funcom

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-02 06:12 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\OpenOffice.org2
    2008-06-02 06:12 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\nView_Wallpaper
    2008-06-02 06:12 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\Hamachi
    2008-06-01 23:18 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\mIRC
    2008-06-01 20:39 --------- d-----w C:\Program Files\SpeedFan
    2008-06-01 19:41 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\uTorrent
    2008-05-30 00:22 --------- d-----w C:\Program Files\Windows Live
    2008-05-30 00:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-05-28 20:47 369 ----a-w C:\vundoFIX.exe
    2008-05-25 11:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
    2008-05-14 17:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-05-05 21:13 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
    2008-04-28 19:47 --------- d-----w C:\Program Files\OpenOffice.org 2.3
    2008-04-10 20:13 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\Syntrillium
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-05 13:03 479,752 ----a-w C:\WINDOWS\system32\XAudio2_0.dll
    2008-03-05 13:03 238,088 ----a-w C:\WINDOWS\system32\xactengine3_0.dll
    2008-03-05 13:00 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_3.dll
    2008-03-05 12:56 3,786,760 ----a-w C:\WINDOWS\system32\D3DX9_37.dll
    2008-03-05 12:56 1,420,824 ----a-w C:\WINDOWS\system32\D3DCompiler_37.dll
    2007-12-09 11:21 22,328 ------w C:\Documents and Settings\Topi Heikkilä\Application Data\PnkBstrK.sys
    2006-06-23 06:48 32,768 ------r C:\WINDOWS\inf\UpdateUSB.exe
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{AD6E6555-FB2C-47D4-8339-3E2965509877}"= "C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL" [2007-11-07 11:20 527360]

    [HKEY_CLASSES_ROOT\clsid\{ad6e6555-fb2c-47d4-8339-3e2965509877}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12 15360]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 11:21 153136]
    "Steam"="D:\Pelit\HalfLife2\\Steam.exe" [2008-03-28 12:29 1271032]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 19:24 1694208]
    "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 16:34 868352]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-20 18:16 37376]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 02:19 79224]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
    "Launch LGDCore"="C:\Program Files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 18:31 1122304]
    "Launch LCDMon"="C:\Program Files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 18:14 497152]
    "TerraTec Remote Control"="C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe" [2007-11-23 16:46 1097728]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 22:46 13529088]
    "nwiz"="nwiz.exe" [2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe]
    "iTunesHelper"="F:\Ohjelmia\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 22:46 86016]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-14 16:12 15360]

    C:\Documents and Settings\Topi Heikkil„\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    hamachi.lnk - F:\Hamachi\hamachi.exe [2008-01-27 22:20:18 624416]
    OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    APC UPS Status.lnk - C:\Program Files\APC\APC PowerChute Personal Edition\Display.exe [2007-11-28 01:32:42 221247]
    Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-11-29 02:03:59 67128]
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-11-29 02:02:13 692224]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]
    Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2000-08-06 02:03:20 69632]
    ZyXEL G-302 v3 Utility.lnk - C:\Program Files\ZyXEL\G-302v3\G-302v3.exe [2007-11-28 19:35:34 12894720]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.asv2"= asusasv2.dll
    "VIDC.YV12"= yv12vfw.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvrHelper.exe"=
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\tvtvSetup\\tvtv_Wizard.exe"=
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvr.exe"=
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvrUpdate\\CinergyDvrUp_date.exe"=
    "D:\\Pelit\\WoW\\World of Warcraft\\WoW-2.3.0-enGB-downloader.exe"=
    "D:\\Pelit\\WoW\\World of Warcraft\\Launcher.exe"=
    "C:\\Program Files\\Alwil Software\\Avast4\\ashAvast.exe"=
    "D:\\Pelit\\HalfLife2\\Steam.exe"=
    "C:\\Program Files\\ZyXEL\\G-302v3\\G-302v3.exe"=
    "C:\\Program Files\\APC\\APC PowerChute Personal Edition\\PowerChute.exe"=
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "C:\\Program Files\\mIRC\\mirc.exe"=
    "D:\\Pelit\\HalfLife2\\SteamApps\\kungfutse\\counter-strike source\\hl2.exe"=
    "D:\\Pelit\\HalfLife2\\SteamApps\\kungfutse\\half-life 2 deathmatch\\hl2.exe"=
    "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\AdventNet\\ME\\AppManager8\\working\\jre\\bin\\javaw.exe"=
    "C:\\Program Files\\AdventNet\\ME\\AppManager8\\working\\mysql\\bin\\mysqld-nt.exe"=
    "C:\\Program Files\\AdventNet\\ME\\AppManager8\\working\\jre\\bin\\rmiregistry.exe"=
    "F:\\FlatOut 2\\FlatOut2.exe"=
    "F:\\Hamachi\\hamachi.exe"=
    "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "F:\\Ohjelmia\\iTunes\\iTunes.exe"=
    "F:\\Wc3\\Warcraft III\\Frozen Throne.exe"=
    "D:\\Pelit\\Diablo II\\Diablo II\\Diablo II.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "D:\\Pelit\\WoW\\World of Warcraft\\BackgroundDownloader.exe"=
    "F:\\Wc3\\Warcraft III\\Warcraft III.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    S3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys [2007-07-12 11:03]
    S3 ASUSVRC;ASUSTeK Virtual Capture Device;C:\WINDOWS\system32\DRIVERS\AsusVRC.sys [2007-01-29 18:12]
    S3 mod7700;Cinergy DT USB XS Diversity Capture Service;C:\WINDOWS\system32\DRIVERS\mod7700.sys [2007-10-03 17:21]
    S3 MODRC;Cinergy DT USB XS Diversity IR Service;C:\WINDOWS\system32\DRIVERS\modrc.sys [2007-07-11 11:06]
    S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 12:57]
    S3 UltraMonMirror;UltraMonMirror;C:\WINDOWS\system32\DRIVERS\UltraMonMirror.sys []
    S3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys []

    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-02 09:48:56
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Ja sitten vielä hjt - loki:

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Winamp\winampa.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
    C:\Program Files\Logitech\G-series Software\LGDCore.exe
    C:\Program Files\Logitech\G-series Software\LCDMon.exe
    C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe
    F:\Ohjelmia\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Analog Devices\SoundMAX\smax4.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
    C:\WINDOWS\system32\rundll32.exe
    D:\Pelit\HalfLife2\Steam.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
    F:\Hamachi\hamachi.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
    C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\NOTEPAD.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: &TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
    O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
    O4 - HKLM\..\Run: [TerraTec Remote Control] "C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [iTunesHelper] "F:\Ohjelmia\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [Steam] D:\Pelit\HalfLife2\\Steam.exe -silent
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: hamachi.lnk = F:\Hamachi\hamachi.exe
    O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
    O4 - Global Startup: APC UPS Status.lnk = ?
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    O4 - Global Startup: ZyXEL G-302 v3 Utility.lnk = C:\Program Files\ZyXEL\G-302v3\G-302v3.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 9467 bytes

    Kiitos sille joka viitsii tarkistaa.
     
    Topeelius, Jun 2, 2008
    #1
  2. Hujo

    Hujo Guest

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
     
    Hujo, Jun 2, 2008
    #2
  3. Topeelius

    Topeelius Member

    Joined:
    Jun 12, 2013
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Nonii tässä Malwarebytes - loki:

    Malwarebytes' Anti-Malware 1.12
    Tietokantaversio: 799

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|F:\|)
    Tarkistetut kohteet: 101436
    Kulunut aika: 21 minute(s), 37 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)
     
    Topeelius, Jun 2, 2008
    #3
  4. Hujo

    Hujo Guest

    ajas tuo combofix uudelleen

    ==============

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Hujo, Jun 3, 2008
    #4
  5. Topeelius

    Topeelius Member

    Joined:
    Jun 12, 2013
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Tässä ois combofix:n uusin loki:

    ComboFix 08-06-01.6 - Topi Heikkilä 2008-06-03 12:49:29.5 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1431 [GMT 3:00]
    Running from: C:\Documents and Settings\Topi Heikkilä\Työpöytä\Comboviksi.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-03 to 2008-06-03 )))))))))))))))))
    .

    2008-05-30 03:00 . 2008-06-01 23:23 <KANSIO> d-------- C:\Program Files\mIRC
    2008-05-30 01:58 . 2008-05-30 01:58 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-05-30 01:58 . 2008-05-30 01:58 <KANSIO> d-------- C:\Documents and Settings\Topi Heikkilä\Application Data\Malwarebytes
    2008-05-30 01:58 . 2008-05-30 01:58 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-30 01:58 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-30 01:58 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-05-30 01:03 . 2008-05-30 01:03 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-05-29 20:42 . 2008-05-29 20:42 249,496 --a------ C:\sexy.exe
    2008-05-29 20:18 . 2008-05-29 20:18 86,340 --a------ C:\img.com
    2008-05-29 19:38 . 2008-05-29 19:38 40,960 --a------ C:\dsdc.exe
    2008-05-29 15:35 . 2008-05-29 22:51 60,132 --a------ C:\ddc.exe
    2008-05-29 15:14 . 2008-05-29 18:12 56,832 --a------ C:\fa.com
    2008-05-28 23:47 . 2008-05-28 23:47 369 --a------ C:\vundoFIX.exe
    2008-05-28 20:26 . 2008-05-28 20:26 40,960 --a------ C:\dczi.exe
    2008-05-28 19:27 . 2008-05-28 20:10 56,832 --a------ C:\sxy1.com
    2008-05-28 19:21 . 2008-05-28 19:21 56,832 --a------ C:\sxy.com
    2008-05-28 01:47 . 2008-05-28 01:47 <KANSIO> d-------- C:\WINDOWS\nvidia icons
    2008-05-28 01:47 . 2008-05-28 01:49 <KANSIO> d-------- C:\WINDOWS\NV48324800.TMP
    2008-05-28 01:47 . 2008-05-02 22:46 182,347 --a------ C:\WINDOWS\system32\nvapps.nvb
    2008-05-28 01:46 . 2008-05-28 01:46 <KANSIO> d-------- C:\NVIDIA
    2008-05-28 01:46 . 2008-04-30 17:27 442,368 --a------ C:\WINDOWS\system32\NVUNINST.EXE
    2008-05-27 23:36 . 2008-05-27 23:36 40,960 --a------ C:\dcis.exe
    2008-05-27 23:25 . 2008-05-28 13:48 40,960 --a------ C:\dciz.exe
    2008-05-27 19:07 . 2008-05-27 20:38 40,960 --a------ C:\dchi.exe
    2008-05-27 18:53 . 2008-05-29 16:29 3,422 --a------ C:\dci.exe
    2008-05-19 13:57 . 2008-06-01 23:33 <KANSIO> d-------- C:\Program Files\SystemRequirementsLab
    2008-05-19 13:56 . 2008-05-19 13:57 <KANSIO> d-------- C:\Documents and Settings\Topi Heikkilä\Application Data\SystemRequirementsLab
    2008-05-13 02:01 . 2008-05-13 02:01 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\media center programs
    2008-05-13 01:13 . 2008-05-13 01:13 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Funcom

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-03 09:47 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\OpenOffice.org2
    2008-06-03 09:47 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\nView_Wallpaper
    2008-06-03 09:47 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\Hamachi
    2008-06-02 14:21 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\uTorrent
    2008-06-01 23:18 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\mIRC
    2008-06-01 20:39 --------- d-----w C:\Program Files\SpeedFan
    2008-05-30 00:22 --------- d-----w C:\Program Files\Windows Live
    2008-05-30 00:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-05-28 20:47 369 ----a-w C:\vundoFIX.exe
    2008-05-25 11:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
    2008-05-14 17:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-05-05 21:13 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
    2008-04-28 19:47 --------- d-----w C:\Program Files\OpenOffice.org 2.3
    2008-04-10 20:13 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\Syntrillium
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-05 13:03 479,752 ----a-w C:\WINDOWS\system32\XAudio2_0.dll
    2008-03-05 13:03 238,088 ----a-w C:\WINDOWS\system32\xactengine3_0.dll
    2008-03-05 13:00 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_3.dll
    2008-03-05 12:56 3,786,760 ----a-w C:\WINDOWS\system32\D3DX9_37.dll
    2008-03-05 12:56 1,420,824 ----a-w C:\WINDOWS\system32\D3DCompiler_37.dll
    2007-12-09 11:21 22,328 ------w C:\Documents and Settings\Topi Heikkilä\Application Data\PnkBstrK.sys
    2006-06-23 06:48 32,768 ------r C:\WINDOWS\inf\UpdateUSB.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-06-02_ 9.50.14,51 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-06-02 06:11:34 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-03 09:46:39 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-03 09:46:53 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5a8.dat
    + 2008-06-03 09:46:42 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_6ec.dat
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{AD6E6555-FB2C-47D4-8339-3E2965509877}"= "C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL" [2007-11-07 11:20 527360]

    [HKEY_CLASSES_ROOT\clsid\{ad6e6555-fb2c-47d4-8339-3e2965509877}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12 15360]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 11:21 153136]
    "Steam"="D:\Pelit\HalfLife2\\Steam.exe" [2008-03-28 12:29 1271032]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 19:24 1694208]
    "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 16:34 868352]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-20 18:16 37376]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 02:19 79224]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
    "Launch LGDCore"="C:\Program Files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 18:31 1122304]
    "Launch LCDMon"="C:\Program Files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 18:14 497152]
    "TerraTec Remote Control"="C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe" [2007-11-23 16:46 1097728]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 22:46 13529088]
    "nwiz"="nwiz.exe" [2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe]
    "iTunesHelper"="F:\Ohjelmia\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 22:46 86016]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-14 16:12 15360]

    C:\Documents and Settings\Topi Heikkil„\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    hamachi.lnk - F:\Hamachi\hamachi.exe [2008-01-27 22:20:18 624416]
    OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    APC UPS Status.lnk - C:\Program Files\APC\APC PowerChute Personal Edition\Display.exe [2007-11-28 01:32:42 221247]
    Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-11-29 02:03:59 67128]
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-11-29 02:02:13 692224]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]
    Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2000-08-06 02:03:20 69632]
    ZyXEL G-302 v3 Utility.lnk - C:\Program Files\ZyXEL\G-302v3\G-302v3.exe [2007-11-28 19:35:34 12894720]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.asv2"= asusasv2.dll
    "VIDC.YV12"= yv12vfw.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvrHelper.exe"=
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\tvtvSetup\\tvtv_Wizard.exe"=
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvr.exe"=
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvrUpdate\\CinergyDvrUp_date.exe"=
    "D:\\Pelit\\WoW\\World of Warcraft\\WoW-2.3.0-enGB-downloader.exe"=
    "D:\\Pelit\\WoW\\World of Warcraft\\Launcher.exe"=
    "C:\\Program Files\\Alwil Software\\Avast4\\ashAvast.exe"=
    "D:\\Pelit\\HalfLife2\\Steam.exe"=
    "C:\\Program Files\\ZyXEL\\G-302v3\\G-302v3.exe"=
    "C:\\Program Files\\APC\\APC PowerChute Personal Edition\\PowerChute.exe"=
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "C:\\Program Files\\mIRC\\mirc.exe"=
    "D:\\Pelit\\HalfLife2\\SteamApps\\kungfutse\\counter-strike source\\hl2.exe"=
    "D:\\Pelit\\HalfLife2\\SteamApps\\kungfutse\\half-life 2 deathmatch\\hl2.exe"=
    "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\AdventNet\\ME\\AppManager8\\working\\jre\\bin\\javaw.exe"=
    "C:\\Program Files\\AdventNet\\ME\\AppManager8\\working\\mysql\\bin\\mysqld-nt.exe"=
    "C:\\Program Files\\AdventNet\\ME\\AppManager8\\working\\jre\\bin\\rmiregistry.exe"=
    "F:\\FlatOut 2\\FlatOut2.exe"=
    "F:\\Hamachi\\hamachi.exe"=
    "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "F:\\Ohjelmia\\iTunes\\iTunes.exe"=
    "F:\\Wc3\\Warcraft III\\Frozen Throne.exe"=
    "D:\\Pelit\\Diablo II\\Diablo II\\Diablo II.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "D:\\Pelit\\WoW\\World of Warcraft\\BackgroundDownloader.exe"=
    "F:\\Wc3\\Warcraft III\\Warcraft III.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    S3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys [2007-07-12 11:03]
    S3 ASUSVRC;ASUSTeK Virtual Capture Device;C:\WINDOWS\system32\DRIVERS\AsusVRC.sys [2007-01-29 18:12]
    S3 mod7700;Cinergy DT USB XS Diversity Capture Service;C:\WINDOWS\system32\DRIVERS\mod7700.sys [2007-10-03 17:21]
    S3 MODRC;Cinergy DT USB XS Diversity IR Service;C:\WINDOWS\system32\DRIVERS\modrc.sys [2007-07-11 11:06]
    S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 12:57]
    S3 UltraMonMirror;UltraMonMirror;C:\WINDOWS\system32\DRIVERS\UltraMonMirror.sys []
    S3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys []

    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-03 12:50:52
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-03 12:52:36
    ComboFix-quarantined-files.txt 2008-06-03 09:52:10
    ComboFix2.txt 2008-06-02 06:50:59
    ComboFix3.txt 2008-05-29 22:52:04

    Pre-Run: 6,870,544,384 tavua vapaana
    Post-Run: 6,879,940,608 tavua vapaana

    178 --- E O F --- 2008-06-02 18:31:15
     
    Topeelius, Jun 3, 2008
    #5
  6. Hujo

    Hujo Guest

    viskaa nyt nuo pois koneelta

    C:\sxy.com
    C:\sxy1.com
    C:\sexy.exe
     
    Hujo, Jun 3, 2008
    #6
  7. Topeelius

    Topeelius Member

    Joined:
    Jun 12, 2013
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Joo selvä tämän teen.. ajattelinkin että ne taitaa olla osa ongelmaa. ja tässä sdfix - loki:

    SDFix: Version 1.187
    Run by Topi Heikkil„ on ti 03.06.2008 at 13:16

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\DOCUME~1\TOPIHE~1\TYPYT~1\SDFix

    Checking Services :


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-03 13:21:45
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    scanning hidden registry entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvrHelper.exe"="C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvrHelper.exe:*:Enabled:TerraTec Home Cinema (Setup)"
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\tvtvSetup\\tvtv_Wizard.exe"="C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\tvtvSetup\\tvtv_Wizard.exe:*:Enabled:TerraTec tvtv Setup"
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvr.exe"="C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvr.exe:*:Enabled:TerraTec Home Cinema"
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvrUpdate\\CinergyDvrUp_date.exe"="C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvrUpdate\\CinergyDvrUp_date.exe:*:Enabled:TerraTec Auto Update"
    "D:\\Pelit\\WoW\\World of Warcraft\\WoW-2.3.0-enGB-downloader.exe"="D:\\Pelit\\WoW\\World of Warcraft\\WoW-2.3.0-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
    "D:\\Pelit\\WoW\\World of Warcraft\\Launcher.exe"="D:\\Pelit\\WoW\\World of Warcraft\\Launcher.exe:*:Enabled:World of Warcraft"
    "C:\\Program Files\\Alwil Software\\Avast4\\ashAvast.exe"="C:\\Program Files\\Alwil Software\\Avast4\\ashAvast.exe:*:Enabled:avast! Antivirus"
    "D:\\Pelit\\HalfLife2\\Steam.exe"="D:\\Pelit\\HalfLife2\\Steam.exe:*:Enabled:Steam"
    "C:\\Program Files\\ZyXEL\\G-302v3\\G-302v3.exe"="C:\\Program Files\\ZyXEL\\G-302v3\\G-302v3.exe:*:Enabled:ZyXEL G-302 v3 Utility"
    "C:\\Program Files\\APC\\APC PowerChute Personal Edition\\PowerChute.exe"="C:\\Program Files\\APC\\APC PowerChute Personal Edition\\PowerChute.exe:*:Enabled:APC PowerChute Personal Edition"
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
    "C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
    "D:\\Pelit\\HalfLife2\\SteamApps\\kungfutse\\counter-strike source\\hl2.exe"="D:\\Pelit\\HalfLife2\\SteamApps\\kungfutse\\counter-strike source\\hl2.exe:*:Enabled:hl2"
    "D:\\Pelit\\HalfLife2\\SteamApps\\kungfutse\\half-life 2 deathmatch\\hl2.exe"="D:\\Pelit\\HalfLife2\\SteamApps\\kungfutse\\half-life 2 deathmatch\\hl2.exe:*:Enabled:hl2"
    "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"="C:\\Program Files\\GameSpy Arcade\\Aphex.exe:*:Enabled:GameSpy Arcade"
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:pnkBstrA"
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:pnkBstrB"
    "C:\\Program Files\\AdventNet\\ME\\AppManager8\\working\\jre\\bin\\javaw.exe"="C:\\Program Files\\AdventNet\\ME\\AppManager8\\working\\jre\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\AdventNet\\ME\\AppManager8\\working\\mysql\\bin\\mysqld-nt.exe"="C:\\Program Files\\AdventNet\\ME\\AppManager8\\working\\mysql\\bin\\mysqld-nt.exe:*:Enabled:mysqld-nt"
    "C:\\Program Files\\AdventNet\\ME\\AppManager8\\working\\jre\\bin\\rmiregistry.exe"="C:\\Program Files\\AdventNet\\ME\\AppManager8\\working\\jre\\bin\\rmiregistry.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "F:\\FlatOut 2\\FlatOut2.exe"="F:\\FlatOut 2\\FlatOut2.exe:*:Enabled:FlatOut2"
    "F:\\Hamachi\\hamachi.exe"="F:\\Hamachi\\hamachi.exe:*:Enabled:Hamachi Client"
    "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
    "F:\\Ohjelmia\\iTunes\\iTunes.exe"="F:\\Ohjelmia\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "F:\\Wc3\\Warcraft III\\Frozen Throne.exe"="F:\\Wc3\\Warcraft III\\Frozen Throne.exe:*:Enabled:Warcraft III - The Frozen Throne"
    "D:\\Pelit\\Diablo II\\Diablo II\\Diablo II.exe"="D:\\Pelit\\Diablo II\\Diablo II\\Diablo II.exe:*:Enabled:Diablo II - Lord of Destruction"
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
    "D:\\Pelit\\WoW\\World of Warcraft\\BackgroundDownloader.exe"="D:\\Pelit\\WoW\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
    "F:\\Wc3\\Warcraft III\\Warcraft III.exe"="F:\\Wc3\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    Remaining Files :



    Files with Hidden Attributes :

    Wed 4 Apr 2001 28,738 ...HR --- "C:\Program Files\Office\MSDE2000\SQLRESLD.DLL"
    Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0045d90d3c637c74f834c75fe192b558\BIT4.tmp"
    Thu 21 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0a67b6c406b1d7e0f5c1e6f6d44a3f6e\BIT6.tmp"
    Thu 21 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\18b19374451d28a8fbaf1939cf31ff45\BIT9.tmp"
    Thu 21 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\26924cbc8132a10b438ce6e2b49d4652\BIT5.tmp"
    Wed 28 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\28daf2e1f8ef97b772dfdbad9c3d0bd9\BIT3A.tmp"
    Thu 21 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\3cf0038d9844b330cbc012d961537773\BITA.tmp"
    Thu 21 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\445ce037cf936bf0308bd0a2bf4516e5\BIT8.tmp"
    Thu 1 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b7e6c7771d289926881287eb0ecc2a85\BIT5.tmp"
    Thu 21 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d7ce22e444dc91400829a7d1a2d39aa2\BITB.tmp"
    Thu 21 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ddfab57ae20e024ecd85b4ea1a62ef6f\BIT7.tmp"

    Finished!

     
    Topeelius, Jun 3, 2008
    #7
  8. Hujo

    Hujo Guest

    jeps...

    mites kone jakselee..
     
    Hujo, Jun 3, 2008
    #8
  9. Topeelius

    Topeelius Member

    Joined:
    Jun 12, 2013
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Muuten ihna ok , mutta netti tuntuu toimivan tahmeesti.. ei vissiin ainakaan enää mesessä lähettele linkkejä muille , eikä muutenkaan tunnu olevan poikkeavaa käytöstä.

    Täytyy vielä ajaa noi scannit kerran läpi ja todeta että ei o mitää ylimäärästä koneel.. Kiitos avusta :)
     
    Topeelius, Jun 3, 2008
    #9
  10. Topeelius

    Topeelius Member

    Joined:
    Jun 12, 2013
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Laitan tähän viel viimeiset combofix - ja hjt - lokit:

    Combofix:

    ComboFix 08-06-01.6 - Topi Heikkilä 2008-06-03 15:58:45.7 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1561 [GMT 3:00]
    Running from: C:\Documents and Settings\Topi Heikkilä\Työpöytä\Comboviksi.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-03 to 2008-06-03 )))))))))))))))))
    .

    2008-06-03 13:14 . 2008-06-03 13:14 <KANSIO> d-------- C:\WINDOWS\ERUNT
    2008-06-03 13:00 . 2008-06-01 19:13 <KANSIO> d-------- C:\SDFix
    2008-05-30 03:00 . 2008-06-01 23:23 <KANSIO> d-------- C:\Program Files\mIRC
    2008-05-30 01:58 . 2008-05-30 01:58 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-05-30 01:58 . 2008-05-30 01:58 <KANSIO> d-------- C:\Documents and Settings\Topi Heikkilä\Application Data\Malwarebytes
    2008-05-30 01:58 . 2008-05-30 01:58 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-30 01:58 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-30 01:58 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-05-30 01:03 . 2008-05-30 01:03 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-05-29 20:18 . 2008-05-29 20:18 86,340 --a------ C:\img.com
    2008-05-29 19:38 . 2008-05-29 19:38 40,960 --a------ C:\dsdc.exe
    2008-05-29 15:35 . 2008-05-29 22:51 60,132 --a------ C:\ddc.exe
    2008-05-29 15:14 . 2008-05-29 18:12 56,832 --a------ C:\fa.com
    2008-05-28 23:47 . 2008-05-28 23:47 369 --a------ C:\vundoFIX.exe
    2008-05-28 20:26 . 2008-05-28 20:26 40,960 --a------ C:\dczi.exe
    2008-05-28 01:47 . 2008-05-28 01:47 <KANSIO> d-------- C:\WINDOWS\nvidia icons
    2008-05-28 01:47 . 2008-05-28 01:49 <KANSIO> d-------- C:\WINDOWS\NV48324800.TMP
    2008-05-28 01:47 . 2008-05-02 22:46 182,347 --a------ C:\WINDOWS\system32\nvapps.nvb
    2008-05-28 01:46 . 2008-05-28 01:46 <KANSIO> d-------- C:\NVIDIA
    2008-05-28 01:46 . 2008-04-30 17:27 442,368 --a------ C:\WINDOWS\system32\NVUNINST.EXE
    2008-05-27 23:36 . 2008-05-27 23:36 40,960 --a------ C:\dcis.exe
    2008-05-27 23:25 . 2008-05-28 13:48 40,960 --a------ C:\dciz.exe
    2008-05-27 19:07 . 2008-05-27 20:38 40,960 --a------ C:\dchi.exe
    2008-05-27 18:53 . 2008-05-29 16:29 3,422 --a------ C:\dci.exe
    2008-05-19 13:57 . 2008-06-01 23:33 <KANSIO> d-------- C:\Program Files\SystemRequirementsLab
    2008-05-19 13:56 . 2008-05-19 13:57 <KANSIO> d-------- C:\Documents and Settings\Topi Heikkilä\Application Data\SystemRequirementsLab
    2008-05-13 02:01 . 2008-05-13 02:01 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\media center programs
    2008-05-13 01:13 . 2008-05-13 01:13 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Funcom

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-03 12:45 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\nView_Wallpaper
    2008-06-03 10:25 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\OpenOffice.org2
    2008-06-03 10:24 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\Hamachi
    2008-06-02 14:21 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\uTorrent
    2008-06-01 23:18 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\mIRC
    2008-06-01 20:39 --------- d-----w C:\Program Files\SpeedFan
    2008-05-30 00:22 --------- d-----w C:\Program Files\Windows Live
    2008-05-30 00:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-05-28 20:47 369 ----a-w C:\vundoFIX.exe
    2008-05-25 11:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
    2008-05-14 17:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-05-05 21:13 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
    2008-04-28 19:47 --------- d-----w C:\Program Files\OpenOffice.org 2.3
    2008-04-10 20:13 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\Syntrillium
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-05 13:03 479,752 ----a-w C:\WINDOWS\system32\XAudio2_0.dll
    2008-03-05 13:03 238,088 ----a-w C:\WINDOWS\system32\xactengine3_0.dll
    2008-03-05 13:00 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_3.dll
    2008-03-05 12:56 3,786,760 ----a-w C:\WINDOWS\system32\D3DX9_37.dll
    2008-03-05 12:56 1,420,824 ----a-w C:\WINDOWS\system32\D3DCompiler_37.dll
    2007-12-09 11:21 22,328 ------w C:\Documents and Settings\Topi Heikkilä\Application Data\PnkBstrK.sys
    2006-06-23 06:48 32,768 ------r C:\WINDOWS\inf\UpdateUSB.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-06-02_ 9.50.14,51 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-06-02 06:11:34 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-03 10:20:29 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-01 16:12:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
    + 2008-06-03 10:14:32 5,955,584 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
    + 2008-06-03 10:14:32 397,312 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
    + 2008-06-01 16:12:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
    + 2008-06-03 10:14:19 5,955,584 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
    + 2008-06-03 10:14:19 397,312 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
    + 2008-06-03 10:20:33 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_340.dat
    + 2008-06-03 10:20:32 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_704.dat
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{AD6E6555-FB2C-47D4-8339-3E2965509877}"= "C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL" [2007-11-07 11:20 527360]

    [HKEY_CLASSES_ROOT\clsid\{ad6e6555-fb2c-47d4-8339-3e2965509877}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12 15360]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 11:21 153136]
    "Steam"="D:\Pelit\HalfLife2\\Steam.exe" [2008-03-28 12:29 1271032]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 19:24 1694208]
    "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 16:34 868352]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-20 18:16 37376]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 02:19 79224]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
    "Launch LGDCore"="C:\Program Files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 18:31 1122304]
    "Launch LCDMon"="C:\Program Files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 18:14 497152]
    "TerraTec Remote Control"="C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe" [2007-11-23 16:46 1097728]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 22:46 13529088]
    "nwiz"="nwiz.exe" [2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe]
    "iTunesHelper"="F:\Ohjelmia\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 22:46 86016]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-14 16:12 15360]

    C:\Documents and Settings\Topi Heikkil„\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    hamachi.lnk - F:\Hamachi\hamachi.exe [2008-01-27 22:20:18 624416]
    OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    APC UPS Status.lnk - C:\Program Files\APC\APC PowerChute Personal Edition\Display.exe [2007-11-28 01:32:42 221247]
    Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-11-29 02:03:59 67128]
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-11-29 02:02:13 692224]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]
    Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2000-08-06 02:03:20 69632]
    ZyXEL G-302 v3 Utility.lnk - C:\Program Files\ZyXEL\G-302v3\G-302v3.exe [2007-11-28 19:35:34 12894720]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.asv2"= asusasv2.dll
    "VIDC.YV12"= yv12vfw.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

    Ja sitten hjt:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:57:47, on 3.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: &TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
    O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
    O4 - HKLM\..\Run: [TerraTec Remote Control] "C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [iTunesHelper] "F:\Ohjelmia\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [Steam] D:\Pelit\HalfLife2\\Steam.exe -silent
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: hamachi.lnk = F:\Hamachi\hamachi.exe
    O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
    O4 - Global Startup: APC UPS Status.lnk = ?
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    O4 - Global Startup: ZyXEL G-302 v3 Utility.lnk = C:\Program Files\ZyXEL\G-302v3\G-302v3.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 8070 bytes


    Puhtaalta näyttäis mut jos vielä viittisit varmistaa ;)

    Ja kiitti avusta , täytyy toi toinen kone viel putsata kun pikkuveli sai senkin saastutettua :D
     
    Topeelius, Jun 3, 2008
    #10
  11. Hujo

    Hujo Guest

    Lataa Winsockfix
    työpöydällesi
    pura zip, Avaa Winsockfix paina Fix
     
    Hujo, Jun 3, 2008
    #11

Share This Page