NDT2.sys

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Juuba, Mar 15, 2008.

  1. Juuba

    Juuba Member

    Joined:
    Nov 22, 2003
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    16
    No niin...tässä tämä. Ja kiitos. Oli selvät ohjeet:)
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:27:46, on 15.3.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\IFXTCS.exe
    C:\Program Files\HPQ\IAM\bin\asghost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\IFXSPMGT.exe
    C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\perfs.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\routing.exe
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\WINDOWS\system32\mqsvc.exe
    C:\WINDOWS\system32\mqtgsvc.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\WINDOWS\system32\AccelerometerSt.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE
    C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
    C:\WINDOWS\SMINST\Scheduler.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
    C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    C:\Program Files\anysee\anysee-E30Plus\anysee_TR.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\BTTray.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\WINDOWS\system32\ndt2.sys
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saunalahti.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O1 - Hosts: 82.98.86.172 du-bank.com
    O1 - Hosts: 82.98.86.172 v3editing.com
    O1 - Hosts: 82.98.86.172 hostwing.com
    O1 - Hosts: Á+s6“t http�¬…¨ž­kþa
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll
    O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: (no name) - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - (no file)
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
    O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
    O4 - HKLM\..\Run: [AccelerometerSysTrayApplet] C:\WINDOWS\system32\AccelerometerSt.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule
    O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
    O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
    O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
    O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    O4 - HKLM\..\Run: [anysee_TR] C:\Program Files\anysee\anysee-E30Plus\anysee_TR.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
    O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
    O16 - DPF: {3B36B017-7E49-426B-95B0-B5CECD83C2E2} (IfolorUploader Control) - http://fika-web.ifolor.net/OrderingGeneral/LowRes/app_support/ActiveX/IfolorUploader_fika.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://fi.photobox.com/clients/uploader_v2.2.0.6.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: OneCard - C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\IFXSPMGT.exe
    O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\IFXTCS.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
    O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINDOWS\system32\perfs.exe
    O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINDOWS\system32\routing.exe

    --
    End of file - 16190 bytes
     
    Juuba, Mar 15, 2008
    #1
  2. Hujo

    Hujo Guest

    Lataa CWShredder
    http://www.trendmicro.com/ftp/products/online-tools/cwshredder.exe
    Ja tallenna se työpöydälle

    -Scannaa kone CWShredder avulla : Muista sulkea selain + kaikki muut ikkunat ennenkuin käytät tuota CWShredderiä.
    -Paina Fix-->näppäintä.
    -Vastaa ohjelman kysymyksiin OK.
    -Ohjelman käytyä kohteet läpi paina Next-->näppäintä.
    -Loppuyhteenvedon tulos tulee tämän jälkeen.
    -puhdistuksen jälkeen käynnistä kone uudelleen.

    Lähetä CWShredder raportti.

    ==============

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Hujo, Mar 15, 2008
    #2
  3. Juuba

    Juuba Member

    Joined:
    Nov 22, 2003
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    16
    No niin tässä tämä cwshredder raportti, muuta en vielä tehnyt. Seuraavaksi????
    ** Run Keys ****

    RUN: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    RUN: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    RUN: [nwiz] nwiz.exe /installquiet /nodetect
    RUN: [MsmqIntCert] regsvr32 /s mqrt.dll
    RUN: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    RUN: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
    RUN: [AccelerometerSysTrayApplet] C:\WINDOWS\system32\AccelerometerSt.exe
    RUN: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    RUN: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
    RUN: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    RUN: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    RUN: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    RUN: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    RUN: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule
    RUN: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    RUN: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
    RUN: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
    RUN: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
    RUN: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
    RUN: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
    RUN: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    RUN: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    RUN: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    RUN: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
    RUN: []
    RUN: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    RUN: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    RUN: [anysee_TR] C:\Program Files\anysee\anysee-E30Plus\anysee_TR.exe
    RUN: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    RUN: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    RUN: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    RUN: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    RUN: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    RUN: [MFServer] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe


    **** Browser Helper Objects ****

    BHO: [Adobe PDF Reader Link Helper] C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    BHO: [Skype add-on (mastermind)] C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    BHO: [DriveLetterAccess] C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    BHO: [SSVHelper Class] C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    BHO: [SSVHelper Class] C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    BHO: [Windows Live Sign-in Helper] C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: [Google Toolbar Helper] c:\program files\google\googletoolbar3.dll
    BHO: [Adobe PDF Conversion Toolbar Helper] C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    BHO: [Google Toolbar Notifier BHO] C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    BHO: [HP Credential Manager for ProtectTools] C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll
    BHO: [FlashFXP Helper for Internet Explorer] C:\PROGRA~1\FlashFXP\IEFlash.dll


    **** IE Toolbars ****

    TOOLBAR: [&Google] c:\program files\google\googletoolbar3.dll
    TOOLBAR: [Adobe PDF] C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    TOOLBAR: [Adobe PDF] C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll


    **** IE Extensions ****

    IEExt: []
    IEExt: [Skype]
    IEExt: [Research]
    IEExt: [Research]
    IEExt: [Messenger] C:\Program Files\Messenger\msmsgs.exe


    **** Hosts File Entries ****

    HOSTS: 82.98.86.172 du-bank.com
    HOSTS: 82.98.86.172 v3editing.com
    HOSTS: 82.98.86.172 hostwing.com
    HOSTS: Á+s6“t http�¬…¨ž­kþa
    HOSTS: Á+s6“t http�¬…¨ž­kþa


    **** IE Settings ****

    Default Page: http://go.microsoft.com/fwlink/?LinkId=69157
    Default Search: http://go.microsoft.com/fwlink/?LinkId=54896
    Local Page: C:\WINDOWS\system32\blank.htm
    Search Page: http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch


    **** IE Context Menu (Right click) ****

    IEContext: [Append to existing PDF] res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IEContext: [Convert link target to Adobe PDF] res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IEContext: [Convert link target to existing PDF] res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IEContext: [Convert selected links to Adobe PDF] res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IEContext: [Convert selected links to existing PDF] res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IEContext: [Convert selection to Adobe PDF] res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IEContext: [Convert selection to existing PDF] res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IEContext: [Convert to Adobe PDF] res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IEContext: [E&xport to Microsoft Excel] res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000


    **** Layered Service Providers ****

    LSP: F-Secure Protocol Scanner [MSAFD Tcpip [TCP/IP]]
    LSP: F-Secure Protocol Scanner [MSAFD Tcpip [UDP/IP]]
    LSP: F-Secure Protocol Scanner [MSAFD Pgm (RDM)]
    LSP: F-Secure Protocol Scanner [MSAFD Pgm (Stream)]
    LSP: F-Secure Protocol Scanner [MSAFD NetBIOS [\Device\NetBT_Tcpip_{2063BBB0-52C2-4051-9821-8CBD47CC73F6}] SEQPACKET 5]
    LSP: F-Secure Protocol Scanner [MSAFD NetBIOS [\Device\NetBT_Tcpip_{2063BBB0-52C2-4051-9821-8CBD47CC73F6}] DATAGRAM 5]
    LSP: F-Secure Protocol Scanner [MSAFD NetBIOS [\Device\NetBT_Tcpip_{24E50748-5C2B-44F0-A70F-4494EFFF49AA}] SEQPACKET 4]
    LSP: F-Secure Protocol Scanner [MSAFD NetBIOS [\Device\NetBT_Tcpip_{24E50748-5C2B-44F0-A70F-4494EFFF49AA}] DATAGRAM 4]
    LSP: F-Secure Protocol Scanner [MSAFD NetBIOS [\Device\NetBT_Tcpip_{952DC757-6D4E-4401-974D-34B977D549C6}] SEQPACKET 3]
    LSP: F-Secure Protocol Scanner [MSAFD NetBIOS [\Device\NetBT_Tcpip_{952DC757-6D4E-4401-974D-34B977D549C6}] DATAGRAM 3]
    LSP: F-Secure Protocol Scanner [MSAFD NetBIOS [\Device\NetBT_Tcpip_{4FEB6202-54E6-42EC-8A76-CD5139E14522}] SEQPACKET 0]
    LSP: F-Secure Protocol Scanner [MSAFD NetBIOS [\Device\NetBT_Tcpip_{4FEB6202-54E6-42EC-8A76-CD5139E14522}] DATAGRAM 0]
    LSP: F-Secure Protocol Scanner [MSAFD NetBIOS [\Device\NetBT_Tcpip_{1DBE9B01-778E-4E8F-91E6-F4DB23F7DCD3}] SEQPACKET 1]
    LSP: F-Secure Protocol Scanner [MSAFD NetBIOS [\Device\NetBT_Tcpip_{1DBE9B01-778E-4E8F-91E6-F4DB23F7DCD3}] DATAGRAM 1]
    LSP: F-Secure Protocol Scanner [MSAFD NetBIOS [\Device\NetBT_Tcpip_{38BFC4D6-03D2-4404-BBD9-7919A8B71AD4}] SEQPACKET 2]
    LSP: F-Secure Protocol Scanner [MSAFD NetBIOS [\Device\NetBT_Tcpip_{38BFC4D6-03D2-4404-BBD9-7919A8B71AD4}] DATAGRAM 2]
    LSP: MSAFD Tcpip [TCP/IP]
    LSP: MSAFD Tcpip [UDP/IP]
    LSP: RSVP UDP Service Provider
    LSP: RSVP TCP Service Provider
    LSP: MSAFD Pgm (RDM)
    LSP: MSAFD Pgm (Stream)
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{2063BBB0-52C2-4051-9821-8CBD47CC73F6}] SEQPACKET 5
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{2063BBB0-52C2-4051-9821-8CBD47CC73F6}] DATAGRAM 5
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{24E50748-5C2B-44F0-A70F-4494EFFF49AA}] SEQPACKET 4
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{24E50748-5C2B-44F0-A70F-4494EFFF49AA}] DATAGRAM 4
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{952DC757-6D4E-4401-974D-34B977D549C6}] SEQPACKET 3
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{952DC757-6D4E-4401-974D-34B977D549C6}] DATAGRAM 3
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4FEB6202-54E6-42EC-8A76-CD5139E14522}] SEQPACKET 0
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4FEB6202-54E6-42EC-8A76-CD5139E14522}] DATAGRAM 0
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{1DBE9B01-778E-4E8F-91E6-F4DB23F7DCD3}] SEQPACKET 1
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{1DBE9B01-778E-4E8F-91E6-F4DB23F7DCD3}] DATAGRAM 1
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{38BFC4D6-03D2-4404-BBD9-7919A8B71AD4}] SEQPACKET 2
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{38BFC4D6-03D2-4404-BBD9-7919A8B71AD4}] DATAGRAM 2


    **** Blocked Control Panel Items ****

    BLOCKED: [ncpa.cpl] No
    BLOCKED: [odbccp32.cpl] No


    **** Downloaded Program Files ****

    {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} [http://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab] C:\WINDOWS\system32\OGACheckControl.DLL
    {0B79F48A-E8D6-11DB-9283-E25056D89593} [http://support.f-secure.com/ols/fscax.cab] C:\WINDOWS\Downloaded Program Files\daas_s.dll C:\WINDOWS\Downloaded Program Files\fsauc.dll C:\WINDOWS\Downloaded Program Files\fscax.dll
    {166B1BCA-3F9C-11CF-8075-444553540000} [http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab]
    {3B36B017-7E49-426B-95B0-B5CECD83C2E2} [http://fika-web.ifolor.net/OrderingGeneral/LowRes/app_support/ActiveX/IfolorUploader_fika.cab]
    {5ED80217-570B-4DA9-BF44-BE107C0EC166} [http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab]
    {8AD9C840-044E-11D1-B3E9-00805F499D93} [http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab]
    {B8BE5E93-A60C-4D26-A2DC-220313175592} [http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab]
    {BD393C14-72AD-4790-A095-76522973D6B8} [http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab]
    {C3F79A2B-B9B4-4A66-B012-3EE46475B072} [http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab]
    {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} [http://office.microsoft.com/officeupdate/content/opuc4.cab]
    {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} [http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab]
    {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} [http://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab]
    {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} [http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab]
    {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} [http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab]
    {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} [http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab]
    {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} [http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab]
    {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab]
    {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} [http://fi.photobox.com/clients/uploader_v2.2.0.6.cab]
    {D27CDB6E-AE6D-11CF-96B8-444553540000} [http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab]


    **** Windows Services ****

    [Alerter] %SystemRoot%\system32\svchost.exe -k LocalService
    [ALG] %SystemRoot%\System32\alg.exe
    [Apple Mobile Device] "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
    [AppMgmt] %SystemRoot%\system32\svchost.exe -k netsvcs
    [ASChannel] %SystemRoot%\System32\svchost.exe -k Cognizance
    [aspnet_state] %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
    [AudioSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
    [BITS] %SystemRoot%\system32\svchost.exe -k netsvcs
    [Browser] %SystemRoot%\system32\svchost.exe -k netsvcs
    [btwdins] C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
    [CCALib8] C:\Program Files\Canon\CAL\CALMAIN.exe
    [CiSvc] %SystemRoot%\system32\cisvc.exe
    [ClipSrv] %SystemRoot%\system32\clipsrv.exe
    [clr_optimization_v2.0.50727_32] C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    [COMSysApp] C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
    [CryptSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
    [DcomLaunch] %SystemRoot%\system32\svchost -k DcomLaunch
    [Dhcp] %SystemRoot%\system32\svchost.exe -k netsvcs
    [dmadmin] %SystemRoot%\System32\dmadmin.exe /com
    [dmserver] %SystemRoot%\System32\svchost.exe -k netsvcs
    [Dnscache] %SystemRoot%\system32\svchost.exe -k NetworkService
    [ERSvc] %SystemRoot%\System32\svchost.exe -k netsvcs
    [Eventlog] %SystemRoot%\system32\services.exe
    [EventSystem] C:\WINDOWS\system32\svchost.exe -k netsvcs
    [F-Secure Gatekeeper Handler Starter] "C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe"
    [F-Secure Network Request Broker] "C:\Program Files\F-Secure\Common\FNRB32.EXE"
    [FastUserSwitchingCompatibility] %SystemRoot%\System32\svchost.exe -k netsvcs
    [FLEXnet Licensing Service] "C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"
    [FontCache3.0.0.0] C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
    [FSAUA] "C:\Program Files\F-Secure\FSAUA\program\fsaua.exe"
    [FSDFWD] "C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe"
    [FSMA] "C:\Program Files\F-Secure\Common\FSMA32.EXE"
    [gusvc] "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
    [helpsvc] %SystemRoot%\System32\svchost.exe -k netsvcs
    [HidServ] %SystemRoot%\System32\svchost.exe -k netsvcs
    [hpqwmiex] C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    [HTTPFilter] %SystemRoot%\System32\svchost.exe -k HTTPFilter
    [IDriverT] "c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"
    [idsvc] "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe"
    [IFXSpMgtSrv] C:\WINDOWS\system32\IFXSPMGT.exe
    [IFXTCS] C:\WINDOWS\system32\IFXTCS.exe
    [ImapiService] C:\WINDOWS\system32\imapi.exe
    [InCDsrv] C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    [iPod Service] "C:\Program Files\iPod\bin\iPodService.exe"
    [lanmanserver] %SystemRoot%\system32\svchost.exe -k netsvcs
    [lanmanworkstation] %SystemRoot%\system32\svchost.exe -k netsvcs
    [LightScribeService] "C:\Program Files\Common Files\LightScribe\LSSrvc.exe"
    [LmHosts] %SystemRoot%\system32\svchost.exe -k LocalService
    [Messenger] %SystemRoot%\system32\svchost.exe -k netsvcs
    [mnmsrvc] C:\WINDOWS\system32\mnmsrvc.exe
    [MSDTC] C:\WINDOWS\system32\msdtc.exe
    [MSIServer] C:\WINDOWS\system32\msiexec.exe /V
    [MSMQ] C:\WINDOWS\system32\mqsvc.exe
    [MSMQTriggers] C:\WINDOWS\system32\mqtgsvc.exe
    [NBService] C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    [NetDDE] %SystemRoot%\system32\netdde.exe
    [NetDDEdsdm] %SystemRoot%\system32\netdde.exe
    [Netlogon] %SystemRoot%\system32\lsass.exe
    [Netman] %SystemRoot%\System32\svchost.exe -k netsvcs
    [NetTcpPortSharing] "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"
    [Nla] %SystemRoot%\system32\svchost.exe -k netsvcs
    [NMIndexingService] "C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe"
    [NtLmSsp] %SystemRoot%\system32\lsass.exe
    [NtmsSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
    [NVSvc] %SystemRoot%\system32\nvsvc32.exe
    [odserv] "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"
    [ose] "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    [PCA] C:\WINDOWS\SMINST\PCAngel.exe
    [perfmons] C:\WINDOWS\system32\perfs.exe
    [PersonalSecureDriveService] "C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE"
    [PlugPlay] %SystemRoot%\system32\services.exe
    [PnkBstrA] C:\WINDOWS\system32\PnkBstrA.exe
    [PolicyAgent] %SystemRoot%\system32\lsass.exe
    [ProtectedStorage] %SystemRoot%\system32\lsass.exe
    [RasAuto] %SystemRoot%\system32\svchost.exe -k netsvcs
    [RasMan] %SystemRoot%\system32\svchost.exe -k netsvcs
    [RDSessMgr] C:\WINDOWS\system32\sessmgr.exe
    [RemoteAccess] %SystemRoot%\system32\svchost.exe -k netsvcs
    [RemoteRegistry] %SystemRoot%\system32\svchost.exe -k LocalService
    [Routing] C:\WINDOWS\system32\routing.exe
    [RpcLocator] %SystemRoot%\system32\locator.exe
    [RpcSs] %SystemRoot%\system32\svchost -k rpcss
    [RSVP] %SystemRoot%\system32\rsvp.exe
    [SamSs] %SystemRoot%\system32\lsass.exe
    [SCardSvr] %SystemRoot%\System32\SCardSvr.exe
    [Schedule] %SystemRoot%\System32\svchost.exe -k netsvcs
    [seclogon] %SystemRoot%\System32\svchost.exe -k netsvcs
    [SENS] %SystemRoot%\system32\svchost.exe -k netsvcs
    [SharedAccess] %SystemRoot%\system32\svchost.exe -k netsvcs
    [ShellHWDetection] %SystemRoot%\System32\svchost.exe -k netsvcs
    [Spooler] %SystemRoot%\system32\spoolsv.exe
    [srservice] %SystemRoot%\system32\svchost.exe -k netsvcs
    [SSDPSRV] %SystemRoot%\system32\svchost.exe -k LocalService
    [stisvc] %SystemRoot%\system32\svchost.exe -k imgsvc
    [SwPrv] C:\WINDOWS\system32\dllhost.exe /Processid:{2CBD01E5-8CB2-4173-BB43-382139C4C8EE}
    [SysmonLog] %SystemRoot%\system32\smlogsvc.exe
    [TapiSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
    [TermService] %SystemRoot%\System32\svchost -k DComLaunch
    [Themes] %SystemRoot%\System32\svchost.exe -k netsvcs
    [TlntSvr] C:\WINDOWS\system32\tlntsvr.exe
    [TrkWks] %SystemRoot%\system32\svchost.exe -k netsvcs
    [upnphost] %SystemRoot%\system32\svchost.exe -k LocalService
    [UPS] %SystemRoot%\System32\ups.exe
    [usnjsvc] "C:\Program Files\MSN Messenger\usnsvc.exe"
    [VSS] %SystemRoot%\System32\vssvc.exe
    [W32Time] %SystemRoot%\System32\svchost.exe -k netsvcs
    [WebClient] %SystemRoot%\system32\svchost.exe -k LocalService
    [winmgmt] %systemroot%\system32\svchost.exe -k netsvcs
    [WmdmPmSN] %SystemRoot%\System32\svchost.exe -k netsvcs
    [Wmi] %SystemRoot%\System32\svchost.exe -k netsvcs
    [WmiApSrv] C:\WINDOWS\system32\wbem\wmiapsrv.exe
    [WMPNetworkSvc] "C:\Program Files\Windows Media Player\WMPNetwk.exe"
    [wscsvc] %SystemRoot%\System32\svchost.exe -k netsvcs
    [wuauserv] %systemroot%\system32\svchost.exe -k netsvcs
    [WudfSvc] %SystemRoot%\system32\svchost.exe -k WudfServiceGroup
    [WZCSVC] %SystemRoot%\System32\svchost.exe -k netsvcs
    [xmlprov] %SystemRoot%\System32\svchost.exe -k netsvcs


    **** Custom IE Search Items ****

    SEARCH: [CustomizeSearch] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
    SEARCH: [SearchAssistant] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm


    **** Complete IE Options ****

    IEOPT: [NoUpdateCheck]
    IEOPT: [NoJITSetup]
    IEOPT: [Disable Script Debugger] yes
    IEOPT: [Show_ChannelBand] No
    IEOPT: [Anchor Underline] yes
    IEOPT: [Cache_Update_Frequency] Once_Per_Session
    IEOPT: [Display Inline Images] yes
    IEOPT: [Do404Search]
    IEOPT: [Local Page] C:\WINDOWS\system32\blank.htm
    IEOPT: [Save_Session_History_On_Exit] no
    IEOPT: [Show_FullURL] no
    IEOPT: [Show_StatusBar] yes
    IEOPT: [Show_ToolBar] yes
    IEOPT: [Show_URLinStatusBar] yes
    IEOPT: [Show_URLToolBar] yes
    IEOPT: [Start Page] http://www.saunalahti.fi/
    IEOPT: [Use_DlgBox_Colors] yes
    IEOPT: [Search Page] http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    IEOPT: [XMLHTTP]
    IEOPT: [UseClearType] yes
    IEOPT: [Enable Browser Extensions] yes
    IEOPT: [Play_Background_Sounds] yes
    IEOPT: [Play_Animations] yes
    IEOPT: [CompatibilityFlags]
    IEOPT: [FullScreen] no
    IEOPT: [SearchMigrated]
    IEOPT: [Window_Placement] ,
    IEOPT: [NotifyDownloadComplete] yes
    IEOPT: [Secondary Start Pages] http://www.google.fi/
    IEOPT: [Use FormSuggest] yes
    IEOPT: [AutoSearch]
    IEOPT: [Show image placeholders]
    IEOPT: [Enable AutoImageResize] yes
    IEOPT: [Expand Alt Text] no
    IEOPT: [Move System Caret] no
    IEOPT: [AllowWindowReuse]
    IEOPT: [UseThemes]
    IEOPT: [Friendly http errors] yes
    IEOPT: [Error Dlg Displayed On Every Error] no
    IEOPT: [Page_Transitions]
    IEOPT: [Force Offscreen Composition]
    IEOPT: [DisableScriptDebuggerIE] yes
    IEOPT: [EnableSearchPane]
    IEOPT: [NscSingleExpand]
    IEOPT: [SmoothScroll]
    IEOPT: [Print_Background] no
    IEOPT: [AutoHide] yes
    IEOPT: [ControlTooltipCount]
    IEOPT: [FormSuggest Passwords] yes
    IEOPT: [FormSuggest PW Ask] yes
    IEOPT: [ShowedCheckBrowser] Yes
    IEOPT: [Check_Associations] no
    IEOPT: [IE8RunOnceLastShown]
    IEOPT: [IE8RunOnceLastShown_TIMESTAMP]
    IEOPT: [IE8RunOnceCompleted]
    IEOPT: [StatusBarWeb]
    IEOPT: [AlwaysShowMenus]
    IEOPT: [RunOnceHasShown]
    IEOPT: [RunOnceComplete]
    IEOPT: [Default_Page_URL] http://go.microsoft.com/fwlink/?LinkId=69157
    IEOPT: [Default_Search_URL] http://go.microsoft.com/fwlink/?LinkId=54896
    IEOPT: [Search Page] http://go.microsoft.com/fwlink/?LinkId=54896
    IEOPT: [Enable_Disk_Cache] yes
    IEOPT: [Cache_Percent_of_Disk]
    IEOPT: [Delete_Temp_Files_On_Exit] yes
    IEOPT: [Local Page] %SystemRoot%\system32\blank.htm
    IEOPT: [Anchor_Visitation_Horizon]
    IEOPT: [Use_Async_DNS] yes
    IEOPT: [Placeholder_Width]
    IEOPT: [Placeholder_Height]
    IEOPT: [Start Page] http://go.microsoft.com/fwlink/?LinkId=69157
    IEOPT: [CompanyName] Microsoft Corporation
    IEOPT: [Custom_Key] MICROSO
    IEOPT: [Wizard_Version] 6.0.2600.0000
    IEOPT: [FullScreen] no
    IEOPT: [Default_Secondary_Page_URL]
    IEOPT: [Extensions Off Page] about:NoAdd-ons
    IEOPT: [Security Risk Page] about:SecurityRisk
    IEOPT: [Check_Associations] yes
     
    Juuba, Mar 15, 2008
    #3
  4. Hujo

    Hujo Guest

    jatka sdfixsillä ja scannaa uusi hjt:n loki
     
    Hujo, Mar 15, 2008
    #4
  5. Juuba

    Juuba Member

    Joined:
    Nov 22, 2003
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    16
    No niin...SDF fix tässä

    SDFix: Version 1.157

    Run by XXXXX on la 15.03.2008 at 13:23

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\DOCUME~1\XXXXX\TYPYT~1\SDFix

    Checking Services :


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting


    Checking Files :

    Trojan Files Found:

    C:\WINDOWS\system32\comsa32.sys - Deleted
    C:\WINDOWS\system32\perfs.txt - Deleted





    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-15 13:29:01
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ESENT]
    "EventMessageFile"=str(2):"c:\windows\system32\ESENT.dll"
    "CategoryMessageFile"=str(2):"c:\windows\system32\ESENT.dll"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s1"=dword:a398173d
    "s2"=dword:cc82edd8
    "h0"=dword:00000001

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "h0"=dword:00000000
    "khjeh"=hex:91,5e,db,3c,a8,ce,7a,b7,78,41,a5,1a,4f,f6,38,75,36,7d,f0,45,ca,..
    "p0"="C:\Program Files\DAEMON Tools\"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,02,69,7a,9d,7b,09,d2,58,d6,26,07,7b,22,7e,c4,b4,b4,..
    "khjeh"=hex:43,44,c9,02,e5,0a,67,9f,55,38,07,81,59,74,25,63,04,4b,e2,56,52,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:fd,d0,3b,95,1d,f6,5d,fc,39,84,43,2e,bf,27,26,1d,d3,31,ea,76,21,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "h0"=dword:00000000
    "khjeh"=hex:91,5e,db,3c,a8,ce,7a,b7,78,41,a5,1a,4f,f6,38,75,36,7d,f0,45,ca,..
    "p0"="C:\Program Files\DAEMON Tools\"

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,02,69,7a,9d,7b,09,d2,58,d6,26,07,7b,22,7e,c4,b4,b4,..
    "khjeh"=hex:43,44,c9,02,e5,0a,67,9f,55,38,07,81,59,74,25,63,04,4b,e2,56,52,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:fd,d0,3b,95,1d,f6,5d,fc,39,84,43,2e,bf,27,26,1d,d3,31,ea,76,21,..

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xfe\xbb\xd3w\2]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"

    scanning hidden files ...


    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 1


    Remaining Services :



    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\WINDOWS\\system32\\mqsvc.exe"="C:\\WINDOWS\\system32\\mqsvc.exe:*:Enabled:Message Queuing"
    "C:\\WINDOWS\\SMINST\\Scheduler.exe"="C:\\WINDOWS\\SMINST\\Scheduler.exe:*:Enabled:Scheduler "
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
    "C:\\Documents and Settings\\Jussi\\Ty”p”yt„\\V„liaikaiset\\utorrent-1.6.1-beta-build-483.exe"="C:\\Documents and Settings\\Jussi\\Ty”p”yt„\\V„liaikaiset\\utorrent-1.6.1-beta-build-483.exe:*:Enabled:æTorrent"
    "C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"="C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe:*:Enabled:Sunbelt Kerio Firewall GUI"
    "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
    "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"="C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe:*:Enabled:Battlefield 2"
    "C:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"="C:\\Program Files\\Joost\\xulrunner\\tvprunner.exe:*:Enabled:tvprunner"
    "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
    "C:\\Program Files\\FlashFXP\\FlashFXP.exe"="C:\\Program Files\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3"
    "C:\\Documents and Settings\\Jussi\\Application Data\\Opera\\Opera\\profile\\cache4\\temporary_download\\incredimail_install.exe"="C:\\Documents and Settings\\Jussi\\Application Data\\Opera\\Opera\\profile\\cache4\\temporary_download\\incredimail_install.exe:*:Enabled:IncrediMail Installer"
    "C:\\Program Files\\IncrediMail\\bin\\ImApp.exe"="C:\\Program Files\\IncrediMail\\bin\\ImApp.exe:*:Enabled:IncrediMail"
    "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe:*:Enabled:IncrediMail"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\WINDOWS\\system32\\mqsvc.exe"="C:\\WINDOWS\\system32\\mqsvc.exe:*:Enabled:Message Queuing"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
    "C:\\Program Files\\FlashFXP\\FlashFXP.exe"="C:\\Program Files\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

    Remaining Files :


    File Backups: - C:\DOCUME~1\xxxxx\TYPYT~1\SDFix\backups\backups.zip

    Files with Hidden Attributes :

    Sun 30 Dec 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
    Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d7ce22e444dc91400829a7d1a2d39aa2\BIT12.tmp"

    Finished!

    JA tässä uusi Hijack:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:41:27, on 15.3.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\IFXTCS.exe
    C:\Program Files\HPQ\IAM\bin\asghost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\IFXSPMGT.exe
    C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\perfs.exe
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\routing.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\mqsvc.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\mqtgsvc.exe
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\WINDOWS\system32\AccelerometerSt.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE
    C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
    C:\WINDOWS\SMINST\Scheduler.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
    C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    C:\Program Files\anysee\anysee-E30Plus\anysee_TR.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\BTTray.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saunalahti.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll
    O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: (no name) - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - (no file)
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
    O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
    O4 - HKLM\..\Run: [AccelerometerSysTrayApplet] C:\WINDOWS\system32\AccelerometerSt.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule
    O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
    O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
    O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
    O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    O4 - HKLM\..\Run: [anysee_TR] C:\Program Files\anysee\anysee-E30Plus\anysee_TR.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
    O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
    O16 - DPF: {3B36B017-7E49-426B-95B0-B5CECD83C2E2} (IfolorUploader Control) - http://fika-web.ifolor.net/OrderingGeneral/LowRes/app_support/ActiveX/IfolorUploader_fika.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://fi.photobox.com/clients/uploader_v2.2.0.6.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: OneCard - C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\IFXSPMGT.exe
    O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\IFXTCS.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
    O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINDOWS\system32\perfs.exe
    O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINDOWS\system32\routing.exe

    --
    End of file - 16041 bytes

     
    Juuba, Mar 15, 2008
    #5
  6. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: (no name) - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - (no file)
     
    Hujo, Mar 15, 2008
    #6
  7. Juuba

    Juuba Member

    Joined:
    Nov 22, 2003
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    16
    Nyt on kaikki tehty. Onkohan koneeni nyt puhdas?? Paljon kiitoksia avustasi Hujo.
     
    Juuba, Mar 15, 2008
    #7
  8. Hujo

    Hujo Guest

    Lataa tuolta http://www.ccleaner.com/download/builds.aspx
    CCleaner v2.05.555- Standard Build, ÄLÄ aseenna Yahoo toolbaria!

    laita asetukset näin:
    Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

    aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
    aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi
     
    Hujo, Mar 15, 2008
    #8

Share This Page