msn-virus +muuta?

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by sumppi12, May 27, 2008.

  1. sumppi12

    sumppi12 Regular member

    Joined:
    Sep 13, 2007
    Messages:
    188
    Likes Received:
    0
    Trophy Points:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:12:54, on 27.5.2008
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    D:\ohjelmistot\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Windows\system32\wbem\unsecapp.exe
    D:\ohjelmistot\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    D:\ohjelmistot\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: (no name) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\OHJELM~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\ohjelmistot\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKLM\..\RunOnce: [AskSBar Uninstall] rundll32 C:\PROGRA~1\UNINST~1.DLL,O -3
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\ohjelmistot\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] D:\ohjelmistot\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] D:\ohjelmistot\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\OHJELM~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\OHJELM~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\OHJELM~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\OHJELM~1\SPYBOT~1\SDHelper.dll
    O13 - Gopher Prefix:
    O16 - DPF: {664088B0-6AF3-4514-AF9D-A0DC3A3DF24A} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols3beta/fscax.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: bw+0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw+0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: bwg0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwg0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0s - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: offline-8876480 - {116EE858-C8B4-43E6-AC80-CD5A9E6FC4C2} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - D:\ohjelmistot\Spybot - Search & Destroy\SDWinSec.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 19221 bytes

    Kiitos jo etukäteen.
     
    sumppi12, May 27, 2008
    #1
  2. Hujo

    Hujo Guest

    Poista lisää poista sovelutuksesta

    Logitech Desktop Messenger

    scannaa hjt:llä merkkaa paina Fix checked

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: (no name) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
    O4 - HKLM\..\RunOnce: [AskSBar Uninstall] rundll32 C:\PROGRA~1\UNINST~1.DLL,O -3

    ==============

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    ==========

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
     
    Hujo, May 27, 2008
    #2
  3. sumppi12

    sumppi12 Regular member

    Joined:
    Sep 13, 2007
    Messages:
    188
    Likes Received:
    0
    Trophy Points:
    26
    Combofix:

    ComboFix 08-05-27.4 - Käyttäjä 2008-05-28 14:43:58.1 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1035.18.2093 [GMT 3:00]
    Running from: C:\Users\Käyttäjä\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-28 to 2008-05-28 )))))))))))))))))
    .

    Tiedostoja ei ole luotu tällä aikavälillä

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-28 11:44 2,621,440 --sha-w C:\Users\Käyttäjä\NTUSER.DAT
    2008-05-28 11:44 2,621,440 --sha-w C:\Users\Käyttäjä\NTUSER.DAT
    2008-05-27 16:58 22,328 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys
    2008-05-27 16:58 103,736 ----a-w C:\Windows\System32\PnkBstrB.exe
    2008-05-27 15:02 --------- d-----w C:\Program Files\Windows Live
    2008-05-22 18:46 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
    2008-05-15 23:18 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
    2008-05-14 19:30 --------- d-----w C:\Program Files\Windows Mail
    2008-05-12 14:50 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
    2008-05-09 14:32 --------- d---a-w C:\ProgramData\TEMP
    2008-05-06 16:14 --------- d-----w C:\Users\Käyttäjä\AppData\Roaming\uTorrent
    2008-04-29 17:14 66,872 ----a-w C:\Windows\System32\PnkBstrA.exe
    2008-04-29 16:19 22,328 ----a-w C:\Users\Käyttäjä\AppData\Roaming\PnkBstrK.sys
    2008-04-21 19:03 174 --sha-w C:\Program Files\desktop.ini
    2008-04-21 18:57 --------- d-----w C:\Program Files\Windows Sidebar
    2008-04-21 18:57 --------- d-----w C:\Program Files\Windows Photo Gallery
    2008-04-21 18:57 --------- d-----w C:\Program Files\Windows Journal
    2008-04-21 18:57 --------- d-----w C:\Program Files\Windows Defender
    2008-04-21 18:57 --------- d-----w C:\Program Files\Windows Collaboration
    2008-04-21 18:57 --------- d-----w C:\Program Files\Windows Calendar
    2008-04-21 18:44 82,432 ----a-w C:\Windows\System32\axaltocm.dll
    2008-04-21 18:44 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
    2008-04-05 17:15 86,016 ----a-w C:\Windows\System32\OpenAL32.dll
    2008-04-05 17:15 262,144 ----a-w C:\Windows\System32\wrap_oal.dll
    2008-04-04 14:35 669,184 ----a-w C:\Windows\System32\pbsvc.exe
    2008-04-04 14:34 --------- d-----w C:\ProgramData\Media Center Programs
    2008-04-04 13:27 --------- d-s---w C:\Users\Käyttäjä\AppData\Roaming\Microsoft
    2008-04-03 17:46 107,888 ----a-w C:\Windows\System32\CmdLineExt.dll
    2008-04-03 14:31 --------- d--h--r C:\Users\Käyttäjä\AppData\Roaming\SecuROM
    2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll
    2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe
    2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe
    2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll
    2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll
    2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll
    2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
    2008-02-29 04:21 2,032,128 ----a-w C:\Windows\System32\win32k.sys
    2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe
    2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe
    2008-02-28 17:43 267,592 ----a-w C:\Program Files\Uninstall Ask Toolbar.dll
    2008-02-24 10:01 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    2008-02-24 10:01 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    2008-02-24 10:01 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    .

    ------- Sigcheck -------

    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 10:33 1233920]
    "LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 14:26 484904]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-04 11:39 149040]
    "Power2GoExpress"="" []
    "SpybotSD TeaTimer"="D:\ohjelmistot\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-05-10 12:10 4468736 C:\Windows\RtHDVCpl.exe]
    "Skytel"="Skytel.exe" [2007-05-07 13:51 1826816 C:\Windows\SkyTel.exe]
    "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 16:10 56928]
    "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 23:55 54832]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-05-04 11:59 161328]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 02:19 79224]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
    "PCSuiteTrayApplication"="D:\ohjelmistot\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 16:10 271360]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "Nokia.PCSync"="D:\ohjelmistot\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 11:17 1241088]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.clmp3enc"= C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List]
    "D:\\pelit\\flatout2.exe"= D:\pelit\flatout2.exe:*:Enabled:FlatOut2

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "TCP Query User{2FAFA4C8-46C1-4429-A4A4-845F53CBB405}C:\\program files\\logitech\\desktop messenger\\8876480\\program\\logitechdesktopmessenger.exe"= UDP:C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe:Logitech Desktop Messenger
    "UDP Query User{18410BB7-53E2-405A-94CB-603F468013F2}C:\\program files\\logitech\\desktop messenger\\8876480\\program\\logitechdesktopmessenger.exe"= TCP:C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe:Logitech Desktop Messenger
    "{33229C8C-61A5-44C2-B08A-040D9A8781E2}"= C:\Program Files\CyberLink\PowerDirector Express\PDX.EXE:CyberLink PowerDirector Express
    "{37DFF3A4-3D76-4250-AF47-C98821E3CAB4}"= UDP:C:\Windows\System32\PnkBstrA.exe:pnkBstrA
    "{F0AB338F-1831-45AE-977F-38C447CDC44C}"= TCP:C:\Windows\System32\PnkBstrA.exe:pnkBstrA
    "{90AECF4E-3B4F-4D4D-93D8-B1B32CBD9AEA}"= UDP:C:\Windows\System32\PnkBstrB.exe:pnkBstrB
    "{8C896129-125F-4A09-ABED-A8047A684B6B}"= TCP:C:\Windows\System32\PnkBstrB.exe:pnkBstrB
    "TCP Query User{7EAA3335-B330-4F2F-B3EA-AE768836821D}C:\\program files\\nero\\nero 7\\nero home\\nerohome.exe"= UDP:C:\program files\nero\nero 7\nero home\nerohome.exe:Nero Home
    "UDP Query User{0CA28461-B56A-48BC-8801-2BD5488EBC2F}C:\\program files\\nero\\nero 7\\nero home\\nerohome.exe"= TCP:C:\program files\nero\nero 7\nero home\nerohome.exe:Nero Home
    "{4711357D-E09B-4D29-A902-9F0AA25721D3}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
    "{2915C81D-1F5E-4672-91E7-59760B7AD193}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
    "{6450E7FD-1CD3-4079-8E8C-B000D62469CE}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
    "{34F2F3C4-8E95-4ABB-9E3F-A578714BE626}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
    "{9F1749B6-2BD4-4126-B73A-7FC1B9AA248E}"= UDP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
    "{CB3CC93A-A0C8-481D-B286-C8FC1DF803B2}"= TCP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
    "{686D0263-ED9E-42C0-BF26-830A8F912C74}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
    "{3414F39F-E815-4665-9A07-C569E1094A47}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
    "{DC58F5C8-F184-4A03-ACB3-090E32CC9956}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
    "TCP Query User{BACE5BF3-20AC-4B2E-8FAB-2C300D1E5DD6}D:\\pelit\\wolfet\\et.exe"= UDP:D:\pelit\wolfet\et.exe:ET
    "UDP Query User{03B12BE3-078C-41B3-949E-94F0DB6D6114}D:\\pelit\\wolfet\\et.exe"= TCP:D:\pelit\wolfet\et.exe:ET
    "{EFA009A4-D813-4C87-9AEB-DC8A277085A9}"= UDP:C:\Program Files\Winamp\winamp.exe:Winamp
    "{8D787FDB-7EEE-425D-B4FD-010F091E226A}"= TCP:C:\Program Files\Winamp\winamp.exe:Winamp
    "TCP Query User{B3BB2D40-A257-4702-BE6A-DF386632BD9B}D:\\ohjelmistot\\limewire\\limewire.exe"= UDP:D:\ohjelmistot\limewire\limewire.exe:LimeWire
    "UDP Query User{880E39E9-28D9-44C8-AFD9-026AD88D9987}D:\\ohjelmistot\\limewire\\limewire.exe"= TCP:D:\ohjelmistot\limewire\limewire.exe:LimeWire
    "TCP Query User{3E31397D-75FC-4267-AF78-CC51B6671D73}D:\\ohjelmistot\\dc++\\dcplusplus.exe"= UDP:D:\ohjelmistot\dc++\dcplusplus.exe:DC++
    "UDP Query User{52D0934A-2C5E-4630-BA3D-84D9E2409BD0}D:\\ohjelmistot\\dc++\\dcplusplus.exe"= TCP:D:\ohjelmistot\dc++\dcplusplus.exe:DC++
    "TCP Query User{972D217C-855F-4C5C-8CBF-530AF00B3F87}D:\\ohjelmistot\\frostwire\\frostwire.exe"= UDP:D:\ohjelmistot\frostwire\frostwire.exe:FrostWire
    "UDP Query User{4BBC755C-0133-4735-AC21-542464F513DD}D:\\ohjelmistot\\frostwire\\frostwire.exe"= TCP:D:\ohjelmistot\frostwire\frostwire.exe:FrostWire
    "TCP Query User{C1030ED9-05BB-494C-8D00-5952B8F93E79}D:\\ohjelmistot\\bitlord2\\bitlord.exe"= UDP:D:\ohjelmistot\bitlord2\bitlord.exe:
    "UDP Query User{240DA7A0-390F-48ED-8063-2F049F5C4F18}D:\\ohjelmistot\\bitlord2\\bitlord.exe"= TCP:D:\ohjelmistot\bitlord2\bitlord.exe:
    "{5BABEADB-336B-4902-88C9-8733A7E7CE21}"= UDP:C:\Program Files\DNA\btdna.exe:DNA
    "{4974DF53-84D2-4CEA-A3FE-FD0DCCE9F995}"= TCP:C:\Program Files\DNA\btdna.exe:DNA
    "{CB0DBA7D-F11F-4404-A120-39933A830513}"= UDP:D:\ohjelmistot\BitTorrent\bittorrent.exe:BitTorrent
    "{12B74D78-5D39-482D-90B9-BECDCF3A93D8}"= TCP:D:\ohjelmistot\BitTorrent\bittorrent.exe:BitTorrent
    "TCP Query User{D4ED0FBD-275A-47D2-856A-E7569321C8FE}D:\\ohjelmistot\\emule\\emule.exe"= UDP:D:\ohjelmistot\emule\emule.exe:eMule Plus
    "UDP Query User{311EB0CB-17A2-4683-BED6-6C753E9D4991}D:\\ohjelmistot\\emule\\emule.exe"= TCP:D:\ohjelmistot\emule\emule.exe:eMule Plus
    "TCP Query User{C9591CB4-B071-4562-B521-9C1C27536469}C:\\users\\käyttäjä\\program files\\dna\\btdna.exe"= UDP:C:\users\käyttäjä\program files\dna\btdna.exe:btdna.exe
    "UDP Query User{834AC211-7C57-4FBF-825F-9677BF486AF1}C:\\users\\käyttäjä\\program files\\dna\\btdna.exe"= TCP:C:\users\käyttäjä\program files\dna\btdna.exe:btdna.exe
    "TCP Query User{4ED9B883-B19C-412F-A78F-2C8839BBB3BF}D:\\pelit\\flatout\\flatout2.exe"= UDP:D:\pelit\flatout\flatout2.exe:FlatOut2
    "UDP Query User{67A5D66E-9A9A-4C91-88AC-4C9F919EC478}D:\\pelit\\flatout\\flatout2.exe"= TCP:D:\pelit\flatout\flatout2.exe:FlatOut2
    "{C48085A5-207A-4C99-92C2-5C39F25045B8}"= UDP:D:\pelit\Bin32\Crysis.exe:Crysis_32
    "{D099FA50-C4A8-4422-8306-63A1FBA494AE}"= TCP:D:\pelit\Bin32\Crysis.exe:Crysis_32
    "{11DC8EC9-70D7-4AA1-B5DC-A13C5F1E44B1}"= UDP:D:\pelit\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
    "{00FC7AF5-64A0-4D07-A544-FBAFC9F52E30}"= TCP:D:\pelit\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
    "{BD172010-ADE6-4033-826B-C28AA6B31DA1}"= UDP:D:\pelit\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
    "{B8382AFB-B0C8-4500-9C3B-64DA8D13C328}"= TCP:D:\pelit\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
    "{D28FAE22-56D4-40DC-B97B-5B4B5000ABFB}"= UDP:D:\pelit\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
    "{BD009F9F-DE80-452D-BC25-FCB42EE7ACD9}"= TCP:D:\pelit\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
    "D:\\pelit\\flatout2.exe"= D:\pelit\flatout2.exe:*:Enabled:FlatOut2
    "D:\\ohjelmistot\\BitTorrent\\bittorrent.exe"= D:\ohjelmistot\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

    R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 02:18]
    R2 SBSDWSCService;SBSD Security Center Service;D:\ohjelmistot\Spybot - Search & Destroy\SDWinSec.exe [2008-01-28 11:43]
    R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-01-23 00:39]
    S4 ThreatFire;ThreatFire;D:\ohjelmistot\ThreatFire\TFService.exe service []

    *Newly Created Service* - CATCHME

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-28 14:45:50
    Windows 6.0.6001 Service Pack 1 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-05-28 14:46:38
    ComboFix-quarantined-files.txt 2008-05-28 11:46:35

    Järjestelmä ei löydä sanomaa numerolle 0x2379 ohjelman Application sanomatiedostossa.
    Järjestelmä ei löydä sanomaa numerolle 0x2379 ohjelman Application sanomatiedostossa.

    166 --- E O F --- 2008-05-23 15:43:51
     
    sumppi12, May 28, 2008
    #3
  4. sumppi12

    sumppi12 Regular member

    Joined:
    Sep 13, 2007
    Messages:
    188
    Likes Received:
    0
    Trophy Points:
    26
    Malwarebytes' Anti-Malware:

    Malwarebytes' Anti-Malware 1.12
    Tietokantaversio: 793

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
    Tarkistetut kohteet: 130429
    Kulunut aika: 15 minute(s), 24 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)
     
    sumppi12, May 28, 2008
    #4
  5. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, May 28, 2008
    #5
  6. sumppi12

    sumppi12 Regular member

    Joined:
    Sep 13, 2007
    Messages:
    188
    Likes Received:
    0
    Trophy Points:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:43:36, on 29.5.2008
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    D:\ohjelmistot\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    D:\ohjelmistot\Spybot - Search & Destroy\TeaTimer.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    D:\ohjelmistot\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\OHJELM~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\ohjelmistot\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\ohjelmistot\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] D:\ohjelmistot\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] D:\ohjelmistot\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\OHJELM~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\OHJELM~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\OHJELM~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\OHJELM~1\SPYBOT~1\SDHelper.dll
    O13 - Gopher Prefix:
    O16 - DPF: {664088B0-6AF3-4514-AF9D-A0DC3A3DF24A} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols3beta/fscax.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - D:\ohjelmistot\Spybot - Search & Destroy\SDWinSec.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 6862 bytes
     
    sumppi12, May 29, 2008
    #6

Share This Page