1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Miten poistaa kovin agressiivinen virus tai troijalainen?

Discussion in 'Virukset ja haittaohjelmat' started by Sasu76, Mar 14, 2009.

Page 3 of 5
  1. Sasu76

    Sasu76 Regular member

    Joined:
    May 17, 2007
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    26
    No niin...

    c:\windows\$NtServicePackUninstall$\userinit.exe
    **************
    Scan taken on 16 Mar 2009 08:32:29 (GMT)
    A-Squared Found nothing
    AntiVir Found nothing
    ArcaVir Found nothing
    Avast Found nothing
    AVG Antivirus Found nothing
    BitDefender Found nothing
    ClamAV Found nothing
    CPsecure Found nothing
    Dr.Web Found nothing
    F-Prot Antivirus Found nothing
    F-Secure Anti-Virus Found nothing
    Ikarus Found nothing
    Kaspersky Anti-Virus Found nothing
    NOD32 Found nothing
    Norman Virus Control Found nothing
    Panda Antivirus Found nothing
    Quick Heal Found nothing
    Sophos Antivirus Found nothing
    VirusBuster Found nothing
    VBA32 Found nothing
    ***************


    c:\windows\ServicePackFiles\i386\userinit.exe
    *******************
    Scan taken on 16 Mar 2009 08:40:29 (GMT)
    A-Squared Found nothing
    AntiVir Found nothing
    ArcaVir Found nothing
    Avast Found nothing
    AVG Antivirus Found nothing
    BitDefender Found nothing
    ClamAV Found nothing
    CPsecure Found nothing
    Dr.Web Found nothing
    F-Prot Antivirus Found nothing
    F-Secure Anti-Virus Found nothing
    Ikarus Found nothing
    Kaspersky Anti-Virus Found nothing
    NOD32 Found nothing
    Norman Virus Control Found nothing
    Panda Antivirus Found nothing
    Quick Heal Found nothing
    Sophos Antivirus Found nothing
    VirusBuster Found nothing
    VBA32 Found nothing
    **************************

    c:\windows\system32\userinit.exe
    ***************
    Scan taken on 16 Mar 2009 08:43:30 (GMT)
    A-Squared Found Trojan-Dropper.Agent!IK
    AntiVir Found TR/Dldr.Agent.bkyp
    ArcaVir Found nothing
    Avast Found nothing
    AVG Antivirus Found nothing
    BitDefender Found nothing
    ClamAV Found nothing
    CPsecure Found nothing
    Dr.Web Found nothing
    F-Prot Antivirus Found nothing
    F-Secure Anti-Virus Found Trojan-Downloader.Win32.Agent.bkyp
    Ikarus Found Trojan-Dropper.Agent
    Kaspersky Anti-Virus Found Trojan-Downloader.Win32.Agent.bkyp
    NOD32 Found nothing
    Norman Virus Control Found nothing
    Panda Antivirus Found nothing
    Quick Heal Found nothing
    Sophos Antivirus Found Mal/EncPk-HJ
    VirusBuster Found nothing
    VBA32 Found Trojan-PSW.Pinch.34 (paranoid heuristics) (probable variant)
    ******************
     
    Sasu76, Mar 16, 2009
    #41
  2. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Tarkistapa vielä tämä c:\windows\system32\dllcache\user32.dll siellä, niin varmistutaan että se on puhdas ennen kuin aletaan korvata saastunutta userinit.exeä.
     
    Last edited: Mar 16, 2009
    -kemisti-, Mar 16, 2009
    #42
  3. Sasu76

    Sasu76 Regular member

    Joined:
    May 17, 2007
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    26
    En löytänyt tuota user32.dll tiedostoa dllcache kansiosta, mutta samanniminen löytyi suoraan system32:n alta. Onko sama tiedosto?

    c:\windows\system32\user32.dll

    ********************
    Scan taken on 16 Mar 2009 09:49:56 (GMT)
    A-Squared Found nothing
    AntiVir Found nothing
    ArcaVir Found nothing
    Avast Found nothing
    AVG Antivirus Found nothing
    BitDefender Found nothing
    ClamAV Found nothing
    CPsecure Found nothing
    Dr.Web Found nothing
    F-Prot Antivirus Found nothing
    F-Secure Anti-Virus Found nothing
    Ikarus Found nothing
    Kaspersky Anti-Virus Found nothing
    NOD32 Found nothing
    Norman Virus Control Found nothing
    Panda Antivirus Found nothing
    Quick Heal Found nothing
    Sophos Antivirus Found nothing
    VirusBuster Found nothing
    VBA32 Found nothing
     
    Sasu76, Mar 16, 2009
    #43
  4. Sasu76

    Sasu76 Regular member

    Joined:
    May 17, 2007
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    26
    Malwarebytes' Anti-Malware alkoi toimimaan, joten ajan tietsikan sillä läpi... laitan tänne sitten siitä tulevan lokin...
     
    Sasu76, Mar 16, 2009
    #44
  5. BlackPawn

    BlackPawn Regular member

    Joined:
    Mar 4, 2009
    Messages:
    111
    Likes Received:
    0
    Trophy Points:
    26
    Anteeksi offtopic, mutta ymmärsinkö oikein aikaisemmista viesteistä, että on olemassa HjT- kouluja??? Huh huh. Onko Suomessa tällaisia?
     
    BlackPawn, Mar 16, 2009
    #45
  6. Sasu76

    Sasu76 Regular member

    Joined:
    May 17, 2007
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    26
    Tässä vielä Malwarebytes' Anti-Malware loki, jos siitä on vielä jotain apua...

    ************
    Malwarebytes' Anti-Malware 1.34
    Tietokantaversio: 1854
    Windows 5.1.2600 Service Pack 3

    16.3.2009 14:53:59
    mbam-log-2009-03-16 (14-53-50).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|K:\|)
    Tarkistetut kohteet: 193844
    Kulunut aika: 1 hour(s), 14 minute(s), 16 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 3

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    C:\Casino\Casino.com\_SetupCasino.exe (Adware.Casino) -> No action taken.
    C:\System Volume Information\_restore{40C1D1C0-4C28-4721-A4C6-96F06392E398}\RP979\A0051575.exe (Trojan.Dropper) -> No action taken.
    C:\System Volume Information\_restore{40C1D1C0-4C28-4721-A4C6-96F06392E398}\RP948\A0048908.exe (Adware.Casino) -> No action taken.
     
    Sasu76, Mar 16, 2009
    #46
  7. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    @BlackPawn: Kyllä on sekä suomessa että ulkomailla; niitä on ollut jo vuosia. Suomen hjt-koulu on ketjussa jo mainitulla sivulla

    @Sasu76:

    Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

    Tallenna nimellä CFScript (itse asiassa combofix tunnistaa tuon vaikka tiedostopääte ei olisi
    edes .txt).

    Sitten raahaa CFScript ComboFix.exeen kuten alla.

    [​IMG]

    Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne uuden HJT-lokin kera.
     
    -kemisti-, Mar 16, 2009
    #47
  8. Sasu76

    Sasu76 Regular member

    Joined:
    May 17, 2007
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    26
    Ennen tuota olisi varmaan pitänyt sulkea palomuuri ja virustorjuntaohjelma, sillä sain varoituksen, että combofix on havainnut, että seuraavat reaaliaikasuojat ovat päällä: Avg...

    Mutta nyt en saa taas tuota Avg:ta pois, koska saan taas yhden errorin juuri ennenkuin ohjelma olisi lähes poistettu ja en uskalla riskeerata, että ohjelma onkin päällä vaikka olen mukamas sulkenut sen...
     
    Sasu76, Mar 16, 2009
    #48
  9. Sasu76

    Sasu76 Regular member

    Joined:
    May 17, 2007
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    26
    Saan siis tällaisen errorin:

    Local machine: installation failed
    Installation:
    Error: Action failed for registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: creating registry key....
    Error 0x80070005
     
    Sasu76, Mar 16, 2009
    #49
  10. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Yleensä reaaliaikasuojat eivät aiheuta mahdottomia, vaikka olisivatkin päällä.

    Halutessasi voit suorittaa asian vikasietotilassa.

    Mikäli AVG on edelleenkin päällä vikasietotilassa, niin voit ohittaa tuon ilmoituksen.

    Tuo on yleinen ilmoitus ja liittyy siihen, että ei ole oikeuksia tiettyyn avaimeen. Grisoftin foorumilta löytyy siitä asiasta ketjuja.
     
    -kemisti-, Mar 16, 2009
    #50
  11. Sasu76

    Sasu76 Regular member

    Joined:
    May 17, 2007
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    26
    Mut miten pääsen tästä tilanteesta eteenpäin? Avg ei suostu lähtemään ja ComboFix:n varoitus sanoo, että ohjelma pitää saada pois päältä, ennenkuin valitsen 'OK'. Eli onko turvallista painaa ikkunan X:ää ja mennä vikasietotilaan vai mitä pitäisi tehdä?
     
    Sasu76, Mar 16, 2009
    #51
  12. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Voit valita OK siitä huolimatta.

    Jos se ei jostain syystä auta, niin sitten toimi niin kuin jo ehdotit.
     
    -kemisti-, Mar 16, 2009
    #52
  13. Sasu76

    Sasu76 Regular member

    Joined:
    May 17, 2007
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    26
    Painoin X:ää, mutta sain vain uuden varoituksen "AVG realiaikasuojat ovat päällä, mutta ComboFix käynnistyy silti. Huomioi, että tämä tapahtuu omalla vastuullasi".

    Eli X:n painaminen ei taida auttaa mitään. Jos suljen nyt koneen noteeraamatta tuota ilmoitusta ja menen vikasietotilaan niin aiheutanko enemmän ongelmia??
     
    Sasu76, Mar 16, 2009
    #53
  14. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Siis tuon ilmoituksen mukaan combofix on päällä, koska se käynnistyy.

    Mikäli näin on, niin anna sen ajaa rauhassa :)
     
    -kemisti-, Mar 16, 2009
    #54
  15. Sasu76

    Sasu76 Regular member

    Joined:
    May 17, 2007
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    26
    No niin... täällä taas...

    ComboFix loki
    ********************
    ComboFix 09-03-15.01 - winner 2009-03-16 19:08:11.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1035.18.1023.564 [GMT 2:00]
    Sijainti: c:\documents and settings\winner\Työpöytä\ComboFix.exe
    Käytetyt komentorivivalitsimet :: c:\documents and settings\winner\Työpöytä\CFScript.txt
    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
    FW: COMODO Firewall Pro *disabled*
    * Uusi palautuspiste luotu

    FILE ::
    c:\windows\system32\50hl8p3u.exe
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\Tasks\At1.job
    c:\windows\Tasks\At10.job
    c:\windows\Tasks\At11.job
    c:\windows\Tasks\At12.job
    c:\windows\Tasks\At13.job
    c:\windows\Tasks\At14.job
    c:\windows\Tasks\At15.job
    c:\windows\Tasks\At16.job
    c:\windows\Tasks\At17.job
    c:\windows\Tasks\At18.job
    c:\windows\Tasks\At19.job
    c:\windows\Tasks\At2.job
    c:\windows\Tasks\At20.job
    c:\windows\Tasks\At21.job
    c:\windows\Tasks\At22.job
    c:\windows\Tasks\At23.job
    c:\windows\Tasks\At24.job
    c:\windows\Tasks\At3.job
    c:\windows\Tasks\At4.job
    c:\windows\Tasks\At5.job
    c:\windows\Tasks\At6.job
    c:\windows\Tasks\At7.job
    c:\windows\Tasks\At8.job
    c:\windows\Tasks\At9.job

    .
    --------------- FCopy ---------------

    c:\windows\ServicePackFiles\i386\userinit.exe --> c:\windows\system32\userinit.exe
    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-02-16 to 2009-03-16 )))))))))))))))))
    .

    2009-03-16 13:27 . 2009-03-16 13:27 <KANSIO> d-------- c:\documents and settings\winner\Application Data\Malwarebytes
    2009-03-16 13:26 . 2009-03-16 13:26 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-03-16 13:26 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
    2009-03-16 13:26 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
    2009-03-16 13:25 . 2009-03-16 13:27 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
    2009-03-16 01:33 . 2009-03-16 01:33 <KANSIO> d-------- c:\program files\AskSBar
    2009-03-16 01:33 . 2009-03-16 01:33 249,592 --a------ c:\windows\system32\cssdll32.dll
    2009-03-16 01:32 . 2009-03-16 01:33 <KANSIO> d-------- c:\program files\COMODO
    2009-03-16 01:32 . 2009-03-16 01:32 <KANSIO> d-------- c:\documents and settings\winner\Application Data\Comodo
    2009-03-16 01:32 . 2009-03-16 02:08 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\comodo
    2009-03-16 01:32 . 2009-03-16 01:32 143,104 --a------ c:\windows\system32\guard32.dll
    2009-03-16 01:32 . 2009-03-16 01:32 87,056 --a------ c:\windows\system32\drivers\cmdguard.sys
    2009-03-16 01:32 . 2009-03-16 01:32 24,208 --a------ c:\windows\system32\drivers\cmdhlp.sys
    2009-03-16 01:28 . 2009-03-15 23:26 15,688 --a------ c:\windows\system32\lsdelete.exe
    2009-03-15 23:36 . 2009-03-15 23:36 <KANSIO> d-------- c:\documents and settings\LocalService\Työpöytä
    2009-03-15 23:26 . 2009-03-15 23:26 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
    2009-03-15 23:24 . 2009-03-15 23:24 <KANSIO> d-------- c:\program files\Lavasoft
    2009-03-15 23:24 . 2009-03-15 23:24 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
    2009-03-15 23:24 . 2009-03-15 23:24 <KANSIO> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
    2009-03-15 23:01 . 2009-03-15 23:05 <KANSIO> d-------- c:\windows\system32\drivers\Avg
    2009-03-15 23:01 . 2009-03-16 14:37 <KANSIO> d-------- c:\documents and settings\winner\Application Data\AVGTOOLBAR
    2009-03-15 23:01 . 2009-03-15 23:01 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
    2009-03-15 23:01 . 2009-03-15 23:01 10,520 --a------ c:\windows\system32\avgrsstx.dll
    2009-03-15 18:21 . 2009-03-15 18:21 <KANSIO> d-------- C:\fsaua.data
    2009-03-15 17:59 . 2009-03-15 17:59 <KANSIO> d-------- c:\program files\Trend Micro
    2009-03-15 11:23 . 2009-03-15 11:23 579,072 --a--c--- c:\windows\system32\dllcache\user32.dll
    2009-03-15 11:21 . 2009-03-15 11:21 <KANSIO> d-------- c:\windows\ERUNT
    2009-03-15 08:44 . 2009-03-15 08:44 118 --a------ c:\windows\system32\MRT.INI
    2009-03-09 18:58 . 2009-03-09 18:58 54,156 --ah----- c:\windows\QTFont.qfn
    2009-03-09 18:58 . 2009-03-09 18:58 1,409 --a------ c:\windows\QTFont.for

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-03-16 16:56 --------- d-----w c:\documents and settings\All Users\Application Data\Avg8
    2009-03-12 09:24 --------- d-----w c:\documents and settings\winner\Application Data\LimeWire
    2008-08-30 14:41 16,384 --sha-w c:\windows\system32\config\systemprofile\Cookies\index.dat
    2008-08-30 14:41 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Sivuhistoria\History.IE5\index.dat
    2008-08-30 14:41 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Sivuhistoria\History.IE5\MSHist012008083020080831\index.dat
    2008-08-30 14:41 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-03-15_22.58.03.28 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-04-14 16:12:31 26,112 -c--a-w c:\windows\system32\dllcache\userinit.exe
    + 2009-03-15 21:01:39 26,824 ----a-w c:\windows\system32\drivers\avgmfx86.sys
    + 2009-03-15 23:32:52 79,760 ----a-w c:\windows\system32\drivers\inspect.sys
    + 2009-03-15 21:26:23 64,160 -c--a-w c:\windows\system32\DRVSTORE\lbd_1D149FE61E2CD0936E43877117FE3EF0674B9944\Lbd.sys
    + 2009-03-16 17:13:20 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_678.dat
    + 2008-07-29 06:05:06 161,784 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\atl90.dll
    + 2008-07-29 01:54:08 225,280 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcm90.dll
    + 2008-07-29 06:05:08 572,928 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcp90.dll
    + 2008-07-29 06:05:08 655,872 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcr90.dll
    + 2008-07-29 01:54:12 312,832 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\msvcm90d.dll
    + 2008-07-29 06:05:08 875,520 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\msvcp90d.dll
    + 2008-07-29 06:05:08 1,180,672 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\msvcr90d.dll
    + 2008-07-29 06:05:12 5,937,144 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfc90d.dll
    + 2008-07-29 06:05:12 5,982,720 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfc90ud.dll
    + 2008-07-29 04:07:42 80,896 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfcm90d.dll
    + 2008-07-29 04:07:42 80,896 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfcm90ud.dll
    + 2008-07-29 06:05:08 3,768,312 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90.dll
    + 2008-07-29 06:05:10 3,783,672 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90u.dll
    + 2008-07-29 04:07:42 59,904 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90.dll
    + 2008-07-29 04:07:42 59,904 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90u.dll
    + 2008-07-29 06:05:06 38,912 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90chs.dll
    + 2008-07-29 06:05:06 39,936 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90cht.dll
    + 2008-07-29 06:05:08 66,560 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90deu.dll
    + 2008-07-29 06:05:08 56,832 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90enu.dll
    + 2008-07-29 06:05:06 65,024 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esn.dll
    + 2008-07-29 06:05:08 65,024 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esp.dll
    + 2008-07-29 06:05:06 66,048 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90fra.dll
    + 2008-07-29 06:05:08 64,512 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90ita.dll
    + 2008-07-29 06:05:08 46,592 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90jpn.dll
    + 2008-07-29 06:05:08 46,080 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90kor.dll
    + 2008-07-29 06:05:08 62,976 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90rus.dll
    .
    -- Snapshot nollattu tähän hetkeen --
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-03-20 1267040]
    "{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"= "c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2009-03-16 66912]

    [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
    [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

    [HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
    2009-03-16 01:33 66912 --a------ c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-02 68856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-10-29 4620288]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-10-29 86016]
    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-10-29 286720]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-01 136600]
    "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-12-22 1862144]
    "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-02-21 366400]
    "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-15 1234712]
    "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-15 515416]
    "COMODO SafeSurf"="c:\program files\COMODO\SafeSurf\cssurf.exe" [2009-03-16 278264]
    "COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2009-03-16 1655552]
    "nwiz"="nwiz.exe" [2004-10-29 c:\windows\system32\nwiz.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]

    c:\documents and settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-29 113664]
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2009-03-16 19:17 10520 c:\windows\system32\avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-484763869-492894223-725345543-1132\Scripts\Logon\0\0]
    "Script"=\\espoonkm.espoonkeittiomaailma.com\SysVol\espoonkm.espoonkeittiomaailma.com\scripts\logon2.cmd

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-484763869-492894223-725345543-1132\Scripts\Logon\0\1]
    "Script"=c:\winnt\SYSVOL\sysvol\espoonkm.espoonkeittiomaailma.com\scripts\logon.cmd

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-484763869-492894223-725345543-1149\Scripts\Logon\0\0]
    "Script"=\\espoonkm.espoonkeittiomaailma.com\SysVol\espoonkm.espoonkeittiomaailma.com\scripts\logon2.cmd

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-484763869-492894223-725345543-1149\Scripts\Logon\0\1]
    "Script"=c:\winnt\SYSVOL\sysvol\espoonkm.espoonkeittiomaailma.com\scripts\logon.cmd

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-484763869-492894223-725345543-1151\Scripts\Logon\0\0]
    "Script"=\\espoonkm.espoonkeittiomaailma.com\SysVol\espoonkm.espoonkeittiomaailma.com\scripts\logon2.cmd

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-484763869-492894223-725345543-1151\Scripts\Logon\0\1]
    "Script"=c:\winnt\SYSVOL\sysvol\espoonkm.espoonkeittiomaailma.com\scripts\logon.cmd

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-484763869-492894223-725345543-1622\Scripts\Logon\0\0]
    "Script"=\\espoonkm.espoonkeittiomaailma.com\SysVol\espoonkm.espoonkeittiomaailma.com\scripts\logon2.cmd

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-484763869-492894223-725345543-1622\Scripts\Logon\0\1]
    "Script"=c:\winnt\SYSVOL\sysvol\espoonkm.espoonkeittiomaailma.com\scripts\logon.cmd

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
    "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
    "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\Program Files\\WS_FTP\\WS_FTP95.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "12137:TCP"= 12137:TCP:BitComet 12137 TCP
    "12137:UDP"= 12137:UDP:BitComet 12137 UDP

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-03-15 64160]
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-03-15 97928]
    R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2009-03-16 87056]
    R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2009-03-16 24208]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-15 298264]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 951632]
    R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [2005-05-12 1287296]
    S3 F-Secure BlackLight Sensor;F-Secure BlackLight Sensor;c:\docume~1\winner\LOCALS~1\Temp\F-Secure\Anti-Virus\fsblsrv.exe --> c:\docume~1\winner\LOCALS~1\Temp\F-Secure\Anti-Virus\fsblsrv.exe [?]
    S3 fsbl;F-Secure BlackLight Engine Driver;\??\c:\docume~1\winner\LOCALS~1\Temp\OnlineScanner\Anti-Virus\fsbldrv.sys --> c:\docume~1\winner\LOCALS~1\Temp\OnlineScanner\Anti-Virus\fsbldrv.sys [?]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fc57c530-b013-11dc-a179-0011098ea989}]
    \Shell\AutoRun\command - k:\wd_windows_tools\setup.exe
    .
    'Ajoitetut tehtävät'-kansion sisältö

    2009-03-15 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-15 23:26]

    2009-03-02 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42]

    2009-03-15 c:\windows\Tasks\User_Feed_Synchronization-{890AD39B-77E2-4D21-996B-D36D5D50EE0D}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-13 18:36]
    .
    .
    ------- Täydentävä tarkistus -------
    .
    uStart Page = hxxp://www.comodo.com/search/
    IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
    IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
    IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
    IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
    IE: Vie Microsoft E&xceliin - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    Trusted Zone: visiotili.com\citrix
    DPF: {3B36B017-7E49-426B-95B0-B5CECD83C2E2} - hxxp://fika-web.ifolor.net/OrderingGeneral/LowRes/app_support/ActiveX/IfolorUploader_fika.cab
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-03-16 19:15:15
    Windows 5.1.2600 Service Pack 3 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    --------------------- LUKITUT REKISTERIAVAIMET ---------------------

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\�•€|ÿÿÿÿ"•€|þ»Ów*]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\PUBPLACE.HTT"
    .
    --------------------- Prosesseihin ladatut DLLt ---------------------

    - - - - - - - > 'winlogon.exe'(664)
    c:\windows\system32\avgrsstx.dll
    .
    ------------------------ Muut prosessit ------------------------
    .
    c:\program files\COMODO\Firewall\cmdagent.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    c:\windows\system32\nvsvc32.exe
    c:\windows\system32\wbem\unsecapp.exe
    c:\windows\system32\wbem\wmiapsrv.exe
    c:\windows\system32\rundll32.exe
    c:\windows\system32\wscntfy.exe
    c:\progra~1\AVG\AVG8\avgupd.exe
    c:\program files\AVG\AVG8\avgtray.exe
    .
    **************************************************************************
    .
    Valmistumisajankohta: 2009-03-16 19:19:33 - kone käynnistettiin uudelleen
    ComboFix-quarantined-files.txt 2009-03-16 17:19:28
    ComboFix2.txt 2009-03-15 20:58:50

    Ennen ajoa: 155 260 796 928 tavua vapaana
    Ajon jälkeen: 155,231,182,848 tavua vapaana

    263 --- E O F --- 2009-03-15 06:44:46

    **************** HIJACK THIS LOKI *************

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:56:48, on 16.3.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16791)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\COMODO\Firewall\cmdagent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\Program Files\Winamp\winampa.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\COMODO\SafeSurf\cssurf.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\COMODO\Firewall\cfp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\AVG\AVG8\avgui.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comodo.com/search/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
    R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
    O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
    O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.espoonkeittiomaailma.com
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    O16 - DPF: {3B36B017-7E49-426B-95B0-B5CECD83C2E2} (IfolorUploader Control) - http://fika-web.ifolor.net/OrderingGeneral/LowRes/app_support/ActiveX/IfolorUploader_fika.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1110101021193
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD5/JSCDL/...jc.cab&File=jinstall-6u10-windows-i586-jc.cab
    O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
    O23 - Service: F-Secure BlackLight Sensor - Unknown owner - C:\DOCUME~1\winner\LOCALS~1\Temp\F-Secure\Anti-Virus\fsblsrv.exe (file missing)
    O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

    --
    End of file - 10214 bytes
     
    Sasu76, Mar 16, 2009
    #55
  16. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Näyttää jo paremmalta :)

    Sinulla on myös virustorjunta.netissä ketju näemmä, jossa Shulender auttaa eli seuraavaksi pitää päättää kummassa jatkat. Molemmissa paikoissa putsaus ei jatku samanaikaisesti.
     
    -kemisti-, Mar 16, 2009
    #56
  17. Sasu76

    Sasu76 Regular member

    Joined:
    May 17, 2007
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    26
    Juu sain alussa neuvon laittaa lokit sinne. Mutta jatkan mieluusti täällä tätä koneen puhdistusta!
     
    Sasu76, Mar 16, 2009
    #57
  18. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Selvä juttu eli informoi siis Shulenderia.

    Onko vielä popuppeja?
     
    -kemisti-, Mar 16, 2009
    #58
  19. Sasu76

    Sasu76 Regular member

    Joined:
    May 17, 2007
    Messages:
    105
    Likes Received:
    0
    Trophy Points:
    26
    Informoitu jo :)

    Pop up:eja ei ole esiintynyt vähään aikaan ja exe tiedostot toimivat!
     
    Sasu76, Mar 16, 2009
    #59
  20. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Se on mukava kuulla :)

    Poista ohjauspaneelista:

    Ask Search Assistant tai vastaava

    Sen jälkeen poista tämä hakemisto:

    C:\Program Files\AskSBar

    Ja sitten:

    Skannaa koneesi Kaspersky Online Skannerilla

    http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

    1. Lue läpi vaatimukset ja yksityisyyssäännökset ja klikkaa Accept.
    2. Skannerin ja virustietokannan lataus alkaa. Sinulta kysytään sallitko Kasperskyltä tulevan ohjelman asentamisen. Klikkaa Aja/Run.
    3. Kun lataus on valmis, klikkaa Settings.
    4. Varmistu, että seuraavat kohdat on valittu. Jos ne eivät ole, valitse ne ja klikkaa Save:
      • Spyware, Adware, Dialers, and other potentially dangerous programs
        Archives
        Mail databases
    5. Klikkaa Oma Tietokone, My Computer Scan-kohdan alapuolelta.
    6. Kun tarkistus on valmis, tulokset näytetään. Klikkaa View Scan Report.
    7. Näet listan saastuneista kohteista. Klikkaa Save Report As....
    8. Tallenna tiedosto työpöydällesi. Muuta Tiedostotyyppi/Files of type muotoon Tekstitiedosto/Text file(.txt) ennen kuin klikkaat Save.
    9. Kopioi ja liitä tiedoston sisältö seuraavaan vastaukseesi uuden HijackThis-lokin kera
     
    Last edited: Mar 16, 2009
    -kemisti-, Mar 16, 2009
    #60
Page 3 of 5

Share This Page