netti alko hidastelemaan

Eli asensin aidon xp koneelle ja koitin nettimittarilla netin nopeutta ja se antoikin 15,4 mb 24 megasella liittymällä..ihan hyvin kun modeemiin ei anna ku 18,5mb.Mutta nyt jostain syystä nopeus on pudonnut 6 mb paikkeille.Missähän vois olla vikaa??Päivitin verkkokortin ajuritkin... tästä vois olla apua jollekkin paremmin tietävälle.Avast virustorjunnassa ja winukan oma palomuuri


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22:22:10, on 1.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\VentSrv\ventrilo_srv.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\Opera\Opera.exe
E:\HiJackThis_v2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Windows Media Playerin verkkojakamispalvelu (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

--
End of file - 5156 bytes

 

Toi beetta versio pois koneelta ja tuosta uusi

Lataa TÄSTÄ HJTInstall.exe

* Tallenna HJTInstall.exe työpöydällesi.
* Tuplaklikkaa HJTInstall.exe-kuvaketta työpöydälläsi.
* Oletuksena se asentaa itsensä hakemistoon C:\Program Files\Trend Micro\HijackThis.
* Klikkaa Install.
* Asennusohjelma luo HijackThis-kuvakkeen työpöydälle.
* Kun asennus on valmis, se käynnistää HijackThisin.
* Klikkaa Do a system scan and save a logfile-painiketta. Ohjelma aloittaa skannauksen ja lokin pitäisi avautua Muistioon.
* Klikkaa ensin "Muokkaa > Valitse kaikki" sitten "Muokkaa > Kopioi" kopioidaksesi koko lokin sisällön.
* Liitä lokin sisältö seuraavaan vastaukseesi.
* ÄLÄ käytä Analyse This-nappulaa, sen löydöt ovat vaarallisia väärinymmärrettyinä.
* ÄLÄ fixaa HijackThis-ohjelmalla vielä mitään. Suurin osa sen löydöistä ovat joko harmittomia tai jopa tarpeellisia.

============

Lataa Winsockfix
http://www.tacktech.com/display.cfm?ttid=257
työpöydällesi
pura zip, Avaa Winsockfix paina Fix

 

Tässäpä tämä

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:07:53, on 1.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 3678 bytes

 

scannaa hjt:llä merkkaa paina Fix checked

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

===============

1.Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

 

ComboFix 08-02.01.6 - Lt.puppy 2008-02-01 23:38:31.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1663 [GMT 2:00]
Running from: E:\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\system32\slootniw01.dll

----- BITS: Possible infected sites -----

hxxp://www.download.windowsupdate.com
hxxp://au.download.windowsupdate.com
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-01 to 2008-02-01 )))))))))))))))))
.

2008-02-01 23:07 . 2008-02-01 23:07 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-02-01 22:59 . 2008-02-01 22:59 <KANSIO> d-------- C:\Program Files\ffdshow
2008-02-01 22:59 . 2006-10-02 13:44 5,120 --a------ C:\WINDOWS\system32\ff_vfw.dll
2008-02-01 22:59 . 2006-08-05 12:06 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-01-31 11:31 . 2008-01-31 11:31 25,992 --a------ C:\WINDOWS\system32\pgdfgsvc.exe
2008-01-31 11:24 . 2008-01-31 11:24 <KANSIO> d-------- C:\Program Files\Page Defrag
2008-01-30 07:41 . 2008-01-30 07:41 <KANSIO> d-------- C:\Program Files\TechSmith
2008-01-30 07:41 . 2008-01-30 07:41 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\TechSmith
2008-01-27 18:07 . 2004-04-30 09:37 160,640 --a------ C:\WINDOWS\system32\drivers\a347bus.sys
2008-01-27 18:07 . 2004-04-30 09:33 5,248 --a------ C:\WINDOWS\system32\drivers\a347scsi.sys
2008-01-27 17:05 . 2008-01-27 17:48 <KANSIO> d-------- C:\Program Files\Alcohol Soft
2008-01-27 16:56 . 2008-01-27 16:56 <KANSIO> d-------- C:\Documents and Settings\Lt.puppy\Application Data\LEAPS
2008-01-27 16:53 . 2008-01-27 16:53 <KANSIO> d-------- C:\Documents and Settings\Lt.puppy\Application Data\Pegasys Inc
2008-01-27 00:40 . 2008-01-27 00:40 <KANSIO> d-------- C:\Program Files\CCleaner
2008-01-25 23:02 . 2008-01-25 23:02 <KANSIO> d-------- C:\ProgramData
2008-01-25 23:02 . 2008-01-25 23:02 <KANSIO> d-------- C:\Program Files\Electronic Arts
2008-01-25 22:12 . 2007-03-30 15:47 13,840 --a------ C:\WINDOWS\system32\wnaspi32.dll
2008-01-23 20:42 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-01-23 20:42 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-01-23 20:42 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-01-23 17:27 . 2008-01-23 17:27 <KANSIO> d-------- C:\Documents and Settings\Lt.puppy\Contacts
2008-01-23 17:18 . 2008-01-23 17:26 <KANSIO> d-------- C:\Program Files\Windows Live
2008-01-23 17:18 . 2008-01-23 17:26 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-23 17:18 . 2008-01-23 17:22 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-22 21:39 . 2008-01-22 21:39 <KANSIO> d-------- C:\Program Files\Godlike Developers
2008-01-22 21:35 . 2008-01-22 21:35 <KANSIO> d-------- C:\Documents and Settings\Lt.puppy\Application Data\SlySoft
2008-01-22 21:32 . 2008-01-22 21:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\SlySoft
2008-01-22 21:28 . 2008-01-22 21:28 <KANSIO> d-------- C:\Program Files\SlySoft
2008-01-22 21:28 . 2008-01-22 21:32 24 ---hs---- C:\WINDOWS\S9A5AAC7C.tmp
2008-01-22 20:53 . 2008-01-22 20:53 <KANSIO> d-------- C:\Program Files\CBS Software
2008-01-22 20:27 . 2008-01-22 20:27 <KANSIO> d-------- C:\Program Files\Windows Media Connect 2
2008-01-22 20:26 . 2008-01-22 20:26 <KANSIO> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-01-22 16:55 . 2008-01-22 16:55 <KANSIO> dr------- C:\WINDOWS\AsDmiHtm
2008-01-19 21:23 . 2008-01-19 21:23 <KANSIO> d-------- C:\Program Files\Hattrick Manager
2008-01-19 21:15 . 2008-01-19 21:39 <KANSIO> d-------- C:\Program Files\Uniblue
2008-01-19 21:15 . 2008-01-19 21:41 <KANSIO> d-------- C:\Documents and Settings\Lt.puppy\Application Data\Uniblue
2008-01-18 22:05 . 2008-02-01 22:42 <KANSIO> d-------- C:\Documents and Settings\Lt.puppy\Application Data\Azureus
2008-01-18 22:05 . 2008-01-18 22:05 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2008-01-18 21:57 . 2008-01-18 21:57 <KANSIO> d-------- C:\Program Files\Azureus
2008-01-18 21:48 . 2008-01-29 10:27 <KANSIO> d-------- C:\Program Files\RevConnect
2008-01-18 21:47 . 2008-02-01 23:00 <KANSIO> d-------- C:\Program Files\Media player classic
2008-01-18 21:47 . 2008-01-18 21:47 <KANSIO> d-------- C:\Documents and Settings\Lt.puppy\Application Data\Media Player Classic
2008-01-18 21:00 . 2008-02-01 23:12 <KANSIO> d-------- C:\WINDOWS\system32\LogFiles
2008-01-18 21:00 . 2008-02-01 12:08 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-01-18 21:00 . 2008-01-18 21:00 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-01-18 21:00 . 2008-02-01 12:09 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-18 20:36 . 2004-08-03 23:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-01-18 20:36 . 2004-08-03 23:07 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-01-18 20:35 . 2008-01-18 20:35 <KANSIO> d-------- C:\Program Files\Analog Devices
2008-01-18 20:35 . 2001-09-19 14:47 765,952 -ra------ C:\WINDOWS\system\crlds3d.dll
2008-01-18 20:35 . 2006-03-17 19:18 392,960 -ra------ C:\WINDOWS\system32\drivers\senfilt.sys
2008-01-18 20:35 . 2007-01-16 11:09 293,888 -ra------ C:\WINDOWS\system32\drivers\ADIHdAud.sys
2008-01-18 20:35 . 2006-08-07 08:57 93,952 -ra------ C:\WINDOWS\system32\drivers\aeaudio.sys
2008-01-18 20:01 . 2008-01-18 20:01 <KANSIO> d-------- C:\Program Files\DAEMON Tools
2008-01-18 19:32 . 2008-01-18 19:32 <KANSIO> d-------- C:\Program Files\EA GAMES
2008-01-18 19:19 . 2008-01-18 19:19 <KANSIO> d-------- C:\Documents and Settings\Lt.puppy\Application Data\atitray
2008-01-18 19:16 . 2008-01-18 19:16 <KANSIO> d-------- C:\Program Files\DVD Shrink
2008-01-18 19:16 . 2008-01-18 19:16 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-01-18 19:15 . 2008-01-18 19:15 <KANSIO> d-------- C:\Program Files\Foxit Software
2008-01-18 19:14 . 2008-01-18 19:14 <KANSIO> d-------- C:\Program Files\Ray Adams
2008-01-18 19:12 . 2008-01-18 20:09 <KANSIO> d-------- C:\Program Files\Disk Cleaner
2008-01-18 19:12 . 2008-01-27 17:41 715,248 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-01-18 19:11 . 2008-01-18 19:11 <KANSIO> d-------- C:\Program Files\ToniArts
2008-01-18 19:06 . 2008-01-18 19:06 <KANSIO> d-------- C:\Documents and Settings\Lt.puppy\Application Data\Ventrilo
2008-01-18 19:01 . 2008-01-18 19:01 <KANSIO> d-------- C:\Program Files\Opera
2008-01-18 18:55 . 2008-01-18 18:55 <KANSIO> d-------- C:\Documents and Settings\Lt.puppy\Application Data\ATI
2008-01-18 18:46 . 2008-01-19 21:21 <KANSIO> d-------- C:\Program Files\Common Files\ATI Technologies
2008-01-18 18:39 . 2008-01-19 21:21 <KANSIO> d-------- C:\Program Files\ATI Technologies
2008-01-18 18:39 . 2007-10-16 21:05 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2008-01-18 18:22 . 2008-01-21 18:35 283 --a------ C:\WINDOWS\system32\61xx.xml
2008-01-18 18:22 . 2008-01-18 18:22 108 --a------ C:\WINDOWS\za_mv_raid.ev
2008-01-18 18:19 . 2008-01-18 18:19 <KANSIO> d-------- C:\temp
2008-01-18 18:17 . 2008-01-22 17:59 <KANSIO> d-------- C:\Program Files\Marvell
2008-01-18 18:17 . 2008-01-18 18:17 <KANSIO> d-------- C:\Documents and Settings\Lt.puppy\Application Data\TMP
2008-01-18 18:13 . 2006-09-25 17:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-01-18 18:11 . 2008-01-18 18:11 <KANSIO> d-------- C:\WINDOWS\ASUSInstAll
2008-01-18 18:03 . 2008-01-26 00:59 <KANSIO> d--h----- C:\Program Files\InstallShield Installation Information
2008-01-18 18:00 . 2008-01-23 17:26 <KANSIO> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-01-18 18:00 . 2008-01-18 18:00 <KANSIO> d-------- C:\Program Files\DIFX
2008-01-18 18:00 . 2006-06-18 23:40 39,424 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-30 05:38 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-18 17:07 --------- d-----w C:\Program Files\VentSrv
2008-01-18 16:37 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-18 15:41 --------- d-----w C:\Program Files\Ventrilo
2008-01-18 15:40 53,248 ----a-w C:\WINDOWS\system32\GenSvcInst.exe
2008-01-18 15:40 33,408 ----a-w C:\WINDOWS\system32\drivers\CDRBSDRV.SYS
2008-01-18 15:40 118,784 ----a-w C:\WINDOWS\system32\bgsvcgen.exe
2008-01-18 15:40 --------- d-----w C:\Program Files\Pegasys Inc
2008-01-18 15:39 --------- d-----w C:\Program Files\Alwil Software
2008-01-18 15:32 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-06 07:51 285,952 ----a-w C:\WINDOWS\system32\drivers\yk51x86.sys
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-07 09:28 722,432 ----a-w C:\WINDOWS\system32\lsasrv.dll
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12 15360]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-04 00:29 165784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-14 16:12 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuPinnedList"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 0 (0x0)
"NoUserNameInStartMenu"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinterTabs"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoSetFolders"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AWWFSPU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
-ra------ 2006-12-18 23:34 868352 C:\Program Files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
--a------ 2007-07-24 11:29 1863960 C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue SpeedUpMyPC]
--a------ 2007-05-16 10:45 8975904 C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe

R1 atitray;atitray;C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [2007-05-22 11:04]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-01 23:39:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-01 23:39:09
ComboFix-quarantined-files.txt 2008-02-01 21:39:08
.
2008-01-22 19:38:49 --- E O F ---

 

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:
" Käynnistä tietokone
" Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
" Seuraavaksi pitäisi ilmestyä valikko
" Valitse valikosta vikasietotila.

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

 

SDFix: Version 1.135

Run by Lt.puppy on pe 01.02.2008 at 23:59

Microsoft Windows XP [versio 5.1.2600]

Running From: C:\DOCUME~1\LT553C~1.PUS\TYPYT~1\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found






Removing Temp Files...

ADS Check:



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-02 00:02:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:cc,f8,38,c1,a5,1e,41,a2,f3,96,8b,67,30,5b,e7,14,56,c5,ba,ac,d2,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:66,da,ec,be,b5,ac,54,27,3e,84,1d,68,3d,8a,94,02,b7,15,8a,1a,a1,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,e3,b5,3c,f9,28,53,3c,87,1f,0b,c5,b8,15,01,39,f6,45,..
"khjeh"=hex:a4,35,ba,6e,c6,fe,f0,c4,ba,bf,52,f9,e5,2e,18,43,3a,ab,44,8e,86,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:e9,a2,03,61,8c,c4,27,e7,a1,97,18,77,c9,1e,37,db,40,0b,a3,f1,13,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:cc,f8,38,c1,a5,1e,41,a2,f3,96,8b,67,30,5b,e7,14,56,c5,ba,ac,d2,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:66,da,ec,be,b5,ac,54,27,3e,84,1d,68,3d,8a,94,02,b7,15,8a,1a,a1,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,e3,b5,3c,f9,28,53,3c,87,1f,0b,c5,b8,15,01,39,f6,45,..
"khjeh"=hex:a4,35,ba,6e,c6,fe,f0,c4,ba,bf,52,f9,e5,2e,18,43,3a,ab,44,8e,86,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:e9,a2,03,61,8c,c4,27,e7,a1,97,18,77,c9,1e,37,db,40,0b,a3,f1,13,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xfe\xbb\xd3w\2]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\D\n\21]
"DisplayName"="\xb973\x7791"
"DeviceDesc"="\xb973\x7791"
"ProviderName"="\x27fc\21\xee18\x7c90\x286c\21\b"
"MFG"="\xc1bf\b\xe12b\x1803\x5fc"
"ReinstallString"=".10.1000.7"
"DeviceInstanceIds"=str(7):"d:\drivers\chipset\driver\x86_x64\smbus\smbusati.inf"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}]
"DisplayName"="Alcohol 120%"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------


Files with Hidden Attributes:

Tue 22 Jan 2008 24 ..SH. --- "C:\WINDOWS\S9A5AAC7C.tmp"

Finished!



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:04:52, on 2.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\bgsvcgen.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 3512 bytes

 

Lataa GMER http://www.gmer.net/gmer.zip ja tallenna se työpöydällesi:

• Pura se työpöydälle ja tuplaklikkaa tiedostoa GMER.exe
• Klikkaa rootkit-välilehteä ja sitten klikkaa scan.
• Älä rastita "Show All" boksia skannauksen aikana!
• Kun skannaus on valmis, klikkaa Copy.
• Tämä kopioi lokin leikepöydälle (voit tallentaa lokin varmuuden vuoksi tekstitiedostoon).
• Liitä loki sitten viestiketjuusi.

 

GMER 1.0.14.14116 - http://www.gmer.net
Rootkit scan 2008-02-02 00:17:48
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.14 ----

SSDT a347bus.sys (Plug and Play BIOS Extension/ ) ZwClose [0xB9E77028]
SSDT a347bus.sys (Plug and Play BIOS Extension/ ) ZwCreateKey [0xB9E76FE0]
SSDT a347bus.sys (Plug and Play BIOS Extension/ ) ZwCreatePagingFile [0xB9E6AB00]
SSDT a347bus.sys (Plug and Play BIOS Extension/ ) ZwEnumerateKey [0xB9E6B5DC]
SSDT a347bus.sys (Plug and Play BIOS Extension/ ) ZwEnumerateValueKey [0xB9E77120]
SSDT a347bus.sys (Plug and Play BIOS Extension/ ) ZwOpenFile [0xB9E6AB40]
SSDT a347bus.sys (Plug and Play BIOS Extension/ ) ZwOpenKey [0xB9E76FA4]
SSDT a347bus.sys (Plug and Play BIOS Extension/ ) ZwQueryKey [0xB9E6B5FC]
SSDT a347bus.sys (Plug and Play BIOS Extension/ ) ZwQueryValueKey [0xB9E77076]
SSDT a347bus.sys (Plug and Play BIOS Extension/ ) ZwSetSystemPowerState [0xB9E76550]
SSDT spxv.sys ZwSetValueKey [0xB9EC819A]

INT 0x01 \SystemRoot\system32\DRIVERS\ati2mtag.sys B5AF5541
INT 0x03 \SystemRoot\system32\DRIVERS\ati2mtag.sys B5AF55E7

---- Kernel code sections - GMER 1.0.14 ----

? spxv.sys Määritettyä tiedostoa ei löydy. !
.text USBPORT.SYS!DllUnload B58FC62C 5 Bytes JMP 89A0B1D8
? System32\Drivers\aokeqrlx.SYS Määritettyä tiedostoa ei löydy. !
? C:\DOCUME~1\LT553C~1.PUS\LOCALS~1\Temp\catchme.sys Määritettyä tiedostoa ei löydy. !

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 89BE21F8

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\usbohci \Device\USBPDO-0 898361F8
Device \Driver\dmio \Device\DmControl\DmIoDaemon 89BE41F8
Device \Driver\dmio \Device\DmControl\DmConfig 89BE41F8
Device \Driver\dmio \Device\DmControl\DmPnP 89BE41F8
Device \Driver\dmio \Device\DmControl\DmInfo 89BE41F8
Device \Driver\usbohci \Device\USBPDO-1 898361F8
Device \Driver\PCI_PNP1404 \Device\00000045 spxv.sys
Device \Driver\usbohci \Device\USBPDO-2 898361F8
Device \Driver\usbohci \Device\USBPDO-3 898361F8
Device \Driver\usbohci \Device\USBPDO-4 898361F8

AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\usbehci \Device\USBPDO-5 898161F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 89C541F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 89C541F8
Device \FileSystem\Rdbss \Device\FsWrap 897CFCB8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 897A52A0
Device \Driver\atapi \Device\Ide\IdePort0 897A52A0
Device \Driver\atapi \Device\Ide\IdePort1 897A52A0
Device \Driver\atapi \Device\Ide\IdePort2 897A52A0
Device \Driver\atapi \Device\Ide\IdePort3 897A52A0
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-12 897A52A0
Device \Driver\NetBT \Device\NetBt_Wins_Export 892BD500
Device \Driver\NetBT \Device\NetbiosSmb 892BD500
Device \Driver\sptd \Device\4271483904 spxv.sys
Device \FileSystem\Srv \Device\LanmanServer 8910E480

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\usbohci \Device\USBFDO-0 898361F8
Device \Driver\usbohci \Device\USBFDO-1 898361F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 890401F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 897CECB0
Device \Driver\usbohci \Device\USBFDO-2 898361F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 890401F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 897CECB0
Device \Driver\NetBT \Device\NetBT_Tcpip_{686CDC6E-0338-4B2A-AAEE-6266F44C58D3} 892BD500
Device \Driver\usbohci \Device\USBFDO-3 898361F8
Device \FileSystem\Npfs \Device\NamedPipe 89A16170
Device \Driver\usbohci \Device\USBFDO-4 898361F8
Device \Driver\Ftdisk \Device\FtControl 89C541F8
Device \FileSystem\Msfs \Device\Mailslot 893713E0
Device \Driver\usbehci \Device\USBFDO-5 898161F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 8908A720
Device \Driver\a347scsi \Device\Scsi\a347scsi1 8908A720
Device \Driver\aokeqrlx \Device\Scsi\aokeqrlx1Port4Path0Target0Lun0 897A73C8
Device \Driver\aokeqrlx \Device\Scsi\aokeqrlx1 897A73C8
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer 892CBA88
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer 892CBA88
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer 892CBA88
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer 892CBA88
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer 892CBA88
Device \FileSystem\Cdfs \Cdfs 892EB500
Device \FileSystem\Cdfs \Cdfs 89996100

---- Modules - GMER 1.0.14 ----

Module _________ B9DCD000-B9DE5000 (98304 bytes)

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xCC 0xF8 0x38 0xC1 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x66 0xDA 0xEC 0xBE ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xA4 0x35 0xBA 0x6E ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xE9 0xA2 0x03 0x61 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xCC 0xF8 0x38 0xC1 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x66 0xDA 0xEC 0xBE ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xA4 0x35 0xBA 0x6E ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xE9 0xA2 0x03 0x61 ...
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\�&#8226;&#8364;|ÿÿÿÿ"&#8226;&#8364;|þ»Ów
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\�&#8226;&#8364;|ÿÿÿÿ"&#8226;&#8364;|þ»Ów@b049C053C7D38EE4AB9A00CB3B5D2472 C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\D

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\D
@DisplayName ??
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\D
@DeviceDesc ??
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\D
@ProviderName ???????
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\D
@MFG ?????
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\D
@ReinstallString .10.1000.7
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\D
@DeviceInstanceIds d:\drivers\chipset\driver\x86_x64\smbus\smbusati.inf
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}@DisplayName Alcohol 120%
Reg HKLM\SOFTWARE\Classes\Installer\Products\32418F9EE1126B64A90E8365B85CFCF6@ProductName Alcohol 120%

---- EOF - GMER 1.0.14 ----

 

Lataa OTMoveIt
OTMoveIt ja tallenna se työpöydällesi.

Tuplaklikkaa OTMoveIt.exe.
Klikkaa CleanUp!.
Valitse Yes kun kysytään "Begin cleanup Process?".
Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.


HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.

=================

Lataa tuolta http://www.ccleaner.com/download/builds.aspx
CCleaner v2.03.532- Standard Build, ÄLÄ aseenna Yahoo toolbaria!

laita asetukset näin:
Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi

 

näin tein ja nettimittari antaa 6,76 mb

 

annas mulle sen nettimittarin osoite

 

https://nettimittari.ficora.fi/nettimittari/clients.aspx

tuosta teliasonera

 

ei kyllä tule täältäkään ftp://ftp.funet.fi/dev/ , ku n.800kt/s


en tiijä pitää varmaan asentaa windows uudestaan...

 

Mikä pitäis olla sun netin nopeus

 

24/1 mutta antaa modeemille n.18,5 mb

Alux toimi mut sitte yhtäkkiä ei toiminukkaa "täysillä" Sama homma oli edellisessä koneessa...siinä en vaa saanu kertaakaan tulemaan yli 6mb... nyt tuliterät osat kiinni.Voiskohan joku ohjelma tehä sen...ei kyllä oo mitn ylimääräistä käynnissä.Ei muuten haittaa mutta ei kehtais turhasta maksaa.. 8/1:kin riittäis jos ei yli 6:den mb pääse

 

Mullakin jää tuo 2/512 alle myös

katos mitä tuolla kehutaan

http://keskustelu.afterdawn.com/thread_view.cfm/580011

 

joo ...en tiedä tuosta keskuksesta miten kaukana on mutta ihmettelen tätä että hetkessä putoo nopeus yli puolella...pitää koittaa keksiä syytä ja laittaa tänne sit vastausta...jos ei muu auta ni asennan koko paskan uudestaan. Kiitos sulle kuitenkii tästä...on ainakii kone seulattu tarkasti läpi.

 

juu hyvä olis tietää mitä tapahtuu uudelleen asennuksen jälkeen ... tai nouseeko millään suuremmaksi

 

Nyt anto reilu 11 mb -> http://www.msoynet.fi/speed.htm , kun eilen ei tullu ku 6mb.Samuutin modeemista virran yöx ja otin puhelinpistokkeen irti.Modeemi on Zyxel p-660h-d1.Nyt tuntuu taas toimivan...mutta mitenkä pitkään...