netti hidas, takkuilee, kaatuilee kone hidas. Mitä teen

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by pike86, Aug 19, 2008.

  1. pike86

    pike86 Member

    Joined:
    May 29, 2006
    Messages:
    44
    Likes Received:
    0
    Trophy Points:
    16
    Mitä poistan? millä puhdistan? Missä vika netti hidas?

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 0:27:18, on 20.8.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    C:\Program Files\Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
    C:\Program Files\Tietoturvapalvelu\Common\FSMA32.EXE
    C:\Program Files\Tietoturvapalvelu\Common\FSMB32.EXE
    C:\Program Files\Spyware Terminator\sp_rsser.exe
    C:\Program Files\Tietoturvapalvelu\Common\FCH32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Tietoturvapalvelu\Common\FAMEH32.EXE
    C:\Program Files\Tietoturvapalvelu\Anti-Virus\fsqh.exe
    C:\Program Files\Tietoturvapalvelu\FSAUA\program\fsaua.exe
    C:\Program Files\Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    C:\Program Files\Tietoturvapalvelu\Anti-Virus\fssm32.exe
    C:\Program Files\Tietoturvapalvelu\FSAUA\program\fsus.exe
    C:\Program Files\Tietoturvapalvelu\Anti-Virus\fsav32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\igfxtray.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\ltmoh\Ltmoh.exe
    C:\Program Files\Launch Manager\LaunchAp.exe
    C:\Program Files\Launch Manager\PowerKey.exe
    C:\Program Files\Launch Manager\HotkeyApp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Launch Manager\CtrlVol.exe
    C:\Program Files\Launch Manager\Wbutton.exe
    C:\Program Files\Tietoturvapalvelu\Common\FSM32.EXE
    C:\Program Files\Windows Live\Perheturva\fssui.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Tietoturvapalvelu\FSGUI\fsguidll.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTC07.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60076
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60076
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Windows Live OneCare Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Perheturva\fssbho.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [LaunchApp] LaunApp
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
    O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [LtMoh] "C:\Program Files\ltmoh\Ltmoh.exe"
    O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
    O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
    O4 - HKLM\..\Run: [HotkeyApp] "C:\Program Files\Launch Manager\HotkeyApp.exe"
    O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
    O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Tietoturvapalvelu\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Tietoturvapalvelu\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Perheturva\fssui.exe" -autorun
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5036.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1207993436656
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1207925977821
    O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
    O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E1E73B44-2D20-47A9-9CA2-B534CEBBF856} (F-Secure Health Check 1.0) - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: BOCore - Unknown owner - C:\Program Files\Comodo\CBOClean\BOCORE.exe (file missing)
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Tietoturvapalvelu\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Tietoturvapalvelu\Common\FSMA32.EXE
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

    --
    End of file - 8824 bytes
    _________________________________________________________


    Malwarebytes' Anti-Malware 1.24
    Tietokantaversio: 1061
    Windows 5.1.2600 Service Pack 2

    14:46:23 19.8.2008
    mbam-log-8-19-2008 (14-46-23).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|)
    Tarkistetut kohteet: 78030
    Kulunut aika: 1 hour(s), 36 minute(s), 3 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)
     
    pike86, Aug 19, 2008
    #1
  2. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, Aug 20, 2008
    #2
  3. pike86

    pike86 Member

    Joined:
    May 29, 2006
    Messages:
    44
    Likes Received:
    0
    Trophy Points:
    16
    tässä vielä se combofix logi

    ComboFix 08-08-18.05 - Pirjo Moilanen 2008-08-20 14:08:44.1 - FAT32x86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.44 [GMT 3:00]
    Running from: C:\Documents and Settings\Pirjo Moilanen\Työpöytä\ComboFix.exe
    * Created a new restore point
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Pirjo Moilanen\UserData
    C:\Documents and Settings\Pirjo Moilanen\UserData\14XVHFV1\IsOnIE6tbPromo[1].xml
    C:\Documents and Settings\Pirjo Moilanen\UserData\FQI1AGDN\oXMLStoreUnit[1].xml
    C:\Documents and Settings\Pirjo Moilanen\UserData\index.dat
    C:\Documents and Settings\Pirjo Moilanen\UserData\RBSLL3S6\oWindowsUpdate[1].xml

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-07-20 to 2008-08-20 )))))))))))))))))
    .

    2008-08-20 13:30 . 2008-08-20 13:30 <KANSIO> d-------- C:\WINDOWS\LastGood
    2008-08-19 15:35 . 2008-08-19 15:35 <KANSIO> d-------- C:\Downloads
    2008-08-19 15:35 . 2008-08-19 15:35 <KANSIO> d-------- C:\Bases
    2008-08-19 15:22 . 2008-08-19 15:22 <KANSIO> d-------- C:\Kaspersky
    2008-08-17 22:54 . 2008-08-17 22:54 <KANSIO> d-------- C:\Documents and Settings\Pirjo Moilanen\Application Data\Malwarebytes
    2008-08-17 22:53 . 2008-08-17 22:53 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-17 22:53 . 2008-08-17 22:53 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-17 22:53 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-08-17 22:53 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-08-17 21:13 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-08-17 21:10 . 2008-08-17 21:10 <KANSIO> d-------- C:\Program Files\Common Files\Java
    2008-08-16 23:29 . 2008-08-16 23:29 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-08-15 19:33 . 2008-06-23 19:29 826,368 --------- C:\WINDOWS\system32\dllcache\wininet.dll
    2008-08-15 15:48 . 2008-08-15 15:48 261 --a------ C:\WINDOWS\boc426.ini
    2008-08-11 20:02 . 2008-08-11 20:02 <KANSIO> d-------- C:\Program Files\WS_FTP
    2008-08-07 11:51 . 2008-08-07 11:51 <KANSIO> d-------- C:\Program Files\WinClamAVShield
    2008-08-05 00:25 . 2008-08-05 00:25 <KANSIO> d-------- C:\Documents and Settings\Pirjo Moilanen\Application Data\Uniblue
    2008-08-04 21:25 . 2008-08-04 21:25 <KANSIO> d-------- C:\Program Files\Uniblue
    2008-07-28 22:32 . 2008-07-28 22:32 <KANSIO> d-------- C:\Program Files\Vodafone
    2008-07-28 00:24 . 2008-07-28 00:24 <KANSIO> d-------- C:\Documents and Settings\Pirjo Moilanen\Application Data\Apple Computer
    2008-07-28 00:20 . 2008-07-28 00:20 <KANSIO> d-------- C:\Program Files\iPod
    2008-07-28 00:17 . 2008-07-28 00:17 <KANSIO> d-------- C:\Program Files\iTunes
    2008-07-28 00:12 . 2008-07-28 00:12 <KANSIO> d-------- C:\Program Files\Bonjour
    2008-07-28 00:06 . 2008-07-28 00:06 <KANSIO> d-------- C:\Program Files\QuickTime
    2008-07-28 00:06 . 2008-07-28 00:06 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-07-28 00:04 . 2008-07-28 00:04 <KANSIO> d-------- C:\Program Files\Apple Software Update
    2008-07-27 23:58 . 2008-07-27 23:58 <KANSIO> d-------- C:\Program Files\Common Files\Apple
    2008-07-27 23:57 . 2008-07-27 23:57 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-07-19 09:14 141,312 ----a-w C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
    2008-07-19 09:12 --------- d-----w C:\Documents and Settings\Pirjo Moilanen\Application Data\Spyware Terminator
    2008-07-19 09:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spyware Terminator
    2008-07-19 09:10 --------- d-----w C:\Program Files\Spyware Terminator
    2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
    2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
    2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
    2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
    2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
    2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
    2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
    2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
    2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
    2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
    2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
    2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
    2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
    2008-07-18 19:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
    2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
    2008-07-17 10:09 --------- d-----w C:\Program Files\Windows Live Safety Center
    2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
    2008-07-07 20:31 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
    2008-07-05 12:06 --------- d-----w C:\Program Files\NOS
    2008-07-05 12:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\NOS
    2008-06-28 20:29 --------- d-----w C:\Program Files\a-squared Free
    2008-06-28 15:50 --------- d-----w C:\Program Files\Lavasoft
    2008-06-28 15:46 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
    2008-06-24 16:23 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll
    2008-06-24 07:29 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
    2008-06-23 09:21 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
    2008-06-23 09:21 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
    2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-06-21 05:23 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
    2008-06-20 17:41 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-20 17:41 246,784 ------w C:\WINDOWS\system32\dllcache\mswsock.dll
    2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
    2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
    2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\dllcache\afd.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
    2008-06-14 17:59 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys
    2008-05-30 19:33 164 ----a-w C:\install.dat
    2008-05-27 18:36 14 ----a-w C:\Documents and Settings\Pirjo Moilanen\getfile.dat
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LaunchApp"="LaunApp" [X]
    "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2002-10-15 23:18 155648]
    "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2002-10-15 23:05 114688]
    "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2002-11-15 17:40 126976]
    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2002-11-18 09:34 561152]
    "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2002-08-01 09:36 163840]
    "LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2002-12-02 10:22 32768]
    "PowerKey"="C:\Program Files\Launch Manager\PowerKey.exe" [2002-08-30 15:02 94208]
    "HotkeyApp"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2002-11-06 16:24 53322]
    "CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2002-10-23 17:18 163840]
    "Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2002-12-03 18:24 53248]
    "F-Secure Manager"="C:\Program Files\Tietoturvapalvelu\Common\FSM32.EXE" [2008-02-13 13:38 184800]
    "F-Secure TNB"="C:\Program Files\Tietoturvapalvelu\FSGUI\TNBUtil.exe" [2008-02-13 13:38 741800]
    "fssui"="C:\Program Files\Windows Live\Perheturva\fssui.exe" [2007-12-17 11:12 243240]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
    "SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-08-07 11:49 1783808]
    "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
    "AGRSMMSG"="AGRSMMSG.exe" [2002-10-18 11:07 87751 C:\WINDOWS\AGRSMMSG.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 16:12 15360]
    "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38 39264]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]
    Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-06-02 23:11:37 113664]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoResolveSearch"= 1 (0x1)
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Windows Live\\Mail\\wlmail.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Tietoturvapalvelu\\FSGUI\\fsavgui.exe"=
    "C:\\Program Files\\Tietoturvapalvelu\\FSGUI\\FsDiagUi.exe"=
    "C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Kaspersky\\kavupd.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:mad:xpsp2res.dll,-22009

    R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-02-13 13:38]
    R1 dmiproxy;dmiproxy;C:\WINDOWS\system32\drivers\dmiproxy.sys [2002-11-06 23:26]
    R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Tietoturvapalvelu\HIPS\fshs.sys [2008-04-11 20:35]
    R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2002-10-29 14:25]
    R1 mmkmd;mmkmd;C:\WINDOWS\system32\drivers\mmkmd.sys [2002-11-06 23:26]
    R1 nbmkmd;nbmkmd;C:\WINDOWS\system32\drivers\nbmkmd.sys [2002-11-06 23:26]
    R1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys [2002-10-23 11:25]
    R2 fssfltr;FssFltr;C:\WINDOWS\system32\DRIVERS\fssfltr.sys [2007-10-17 13:53]
    R2 fsssvc;Windows Live OneCare – perheturva;C:\Program Files\Windows Live\Perheturva\fsssvc.exe [2007-12-17 11:13]
    R3 {5C8B2B65-A385-11d5-A78B-00104B672758};AIM 3.0 Part 01 Codec Driver CH-7017-B;C:\WINDOWS\system32\drivers\A310.sys [2002-10-25 09:03]
    R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Tietoturvapalvelu\Anti-Virus\minifilter\fsgk.sys [2008-02-13 13:38]
    R3 POWERKEY;POWERKEY;C:\Program Files\Launch Manager\POWERKEY.sys [2000-12-19 18:29]
    S3 F-Secure Standalone Minifilter;F-Secure Standalone Minifilter;C:\DOCUME~1\PIRJOM~1\LOCALS~1\Temp\OnlineScanner\Anti-Virus\fsgk.sys []
    S3 FileObjInfo;STFileDriver;C:\Documents and Settings\All Users\Application Data\Spyware Terminator\FileObjInfo.sys [2008-07-19 12:14]
    S3 IKM07f0;IKM07f0;C:\WINDOWS\Temp\IKM07f0.sys []
    S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Tietoturvapalvelu\Anti-Virus\Win2K\FSfilter.sys [2008-02-13 13:38]
    S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Tietoturvapalvelu\Anti-Virus\Win2K\FSrec.sys [2008-02-13 13:38]

    *Newly Created Service* - CATCHME
    *Newly Created Service* - PROCEXP90
    .
    'Ajoitetut tehtävät'-kansion sisältö

    2008-08-20 C:\WINDOWS\Tasks\Scheduled scanning task.job
    - C:\PROGRA~1\TIETOT~1\ANTI-V~1\fsav.exe [2008-02-13 13:38]

    2008-07-27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

    2008-08-04 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job
    - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []

    2008-08-15 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job
    - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []

    2008-08-16 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1208351629.job
    - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 00:52]

    2008-08-20 C:\WINDOWS\Tasks\MP Scheduled Scan.job
    - C:\Program Files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]
    .
    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Pirjo Moilanen\Application Data\Mozilla\Firefox\Profiles\qngxb0kk.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://center.regionline.fi/
    FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
    FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-08-20 14:44:59
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-08-20 14:48:45
    ComboFix-quarantined-files.txt 2008-08-20 11:48:28

    Pre-Run: 26,853,081,088 tavua vapaana
    Post-Run: 26,953,285,632 tavua vapaana

    206 --- E O F --- 2008-08-16 10:49:34
     
    pike86, Aug 20, 2008
    #3
  4. Hujo

    Hujo Guest

    Lataa Tästä Ccleaner
    CCleaner v2.05.555- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
    Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
    Asennuksen jälkeen aukaise CCleaner.
    Valitse vasemmalta pystyrivistä Options.
    Valitse viereisestä pystyrivistä Settings.
    Language kohtaan valitse Suomi.

    Puhdistaja
    Valitse vasemmalta pystyrivistä Puhdistaja.
    Paina alhaalta Tutki.
    Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
    Kun tutkiminen on valmis, paina Aja CCleaner.
    Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.

    Rekisterin virheiden korjaus
    Valitse vasemmalta pystyrivistä Rekisteri.
    Paina alhaalta Etsi rekisterin virheitä.
    Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
    Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
    Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
    Saat vielä varmistus kysymyksen, paina Ok.
    Kun virheet on korjattu, paina Sulje.
    Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.

    ============

    Lataa OTMoveIt
    OTMoveIt ja tallenna se työpöydällesi.

    Tuplaklikkaa OTMoveIt.exe.
    Klikkaa CleanUp!.
    Valitse Yes kun kysytään "Begin cleanup Process?".
    Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.

    HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.
     
    Hujo, Aug 20, 2008
    #4

Share This Page