Käynnistäessäni koneen avast ilmoittaa ensin yhdestä rootkitistä, ja kun klikkaan poista, heti perään pomppaa toinen rootkit varoitus. Tämän jälkeen kone pelittää ihan normaalisti, mutta kun suljen koneen ja käynnistän uudelleen, niin samat ilmoitukset ilmestyy aina uudelleen. Olen yrittänyt poistaa rootkittejä myös mcafee rootkitdetectivellä, mutta sekään ei tunnu tepsivän. Onko kellään samanlaisia kokemuksia? löytyykö tohon rootkit poistoon mahdollisesti joku toimivampi ohjelma? Hyviä neuvoja kaivataan.
Lataa TÄSTÄ HJTInstall.exe * Tallenna HJTInstall.exe työpöydällesi. * Tuplaklikkaa HJTInstall.exe-kuvaketta työpöydälläsi. * Oletuksena se asentaa itsensä hakemistoon C:\Program Files\Trend Micro\HijackThis. * Klikkaa Install. * Asennusohjelma luo HijackThis-kuvakkeen työpöydälle. * Kun asennus on valmis, se käynnistää HijackThisin. * Klikkaa Do a system scan and save a logfile-painiketta. Ohjelma aloittaa skannauksen ja lokin pitäisi avautua Muistioon. * Klikkaa ensin "Muokkaa > Valitse kaikki" sitten "Muokkaa > Kopioi" kopioidaksesi koko lokin sisällön. * Liitä lokin sisältö seuraavaan vastaukseesi. * ÄLÄ käytä Analyse This-nappulaa, sen löydöt ovat vaarallisia väärinymmärrettyinä. * ÄLÄ fixaa HijackThis-ohjelmalla vielä mitään. Suurin osa sen löydöistä ovat joko harmittomia tai jopa tarpeellisia. =============== Tarkista koneesi F-Securen online skannerilla Huom, skanneri toimii vain Internet Explorer selaimella * Lue sivun ohjeet huolella läpi * Klikkaa Start scanning * Mikäli saat Internet Explorer -suojausvaroituksen, klikkaa Asenna * Klikkaa Accept * Klikkaa Custom Scan * Säädä asetukset seuraavasti o "Virus Scan Option" kohdasta valitse Scan whole system o "Other Scan Option" kohdasta valitse Scan All Files o Valitse Scan whole system for rootkits o Valitse Scan whole system for spyware o Laita ruksi kohtaan Scan inside archives o Varmista että Use advanced heuristics on valittuna * Klikkaa Start * Skannaus käynnistyy kun tarvittavat tiedostot/päivitykset on ladattu * Odota kärsivällisesti * Kun sakannaus on suoritettu, klikkaa Automatic cleaning * Klikkaa Show Report * Raportti aukeaa selaimessa, kopioi teksti kokonaan * Liitä kopioitu teksti esim. muistioon tai Wordiin ja tallenna työpöydälle * Voit sulkea skannerin * Lähetä raportti viestiketjuusi Älä tee muuta sillä voi aiheuttaa koneen jumiutumisen
Sain ton hjt login nyt tehtyä, mutta ton F-Securen skanneria en saanu ajettua kunnolla. Koetin kaksi kertaa ajaa sen, ja pöpöjä näytti olevan, mutta molemmilla kerroilla kun siinä lopussa klikkas että Automatic cleaning niin selaimen kaikki ikkunat sulkeutu, eikä missään vaiheessa tullu näkyville mitään ikkunaa mistä ois voinu klikkaa show report? No tässä nyt kuitenkin tää hjt loki, jos siitä vaikka olis jotain apua. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:50:26, on 24.4.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\ASUS\GamerOSD\GamerOSD.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Razer\razerhid.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\drivers\spools.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\NetDrive\wdService.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Razer\razertra.exe C:\Program Files\Razer\razerofa.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\HIJACK~1.EXE C:\WINDOWS\explorer.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: (no name) - {4DA9E62F-36F7-45C7-AD83-7F2B500A8AF0} - C:\WINDOWS\system32\awtqNfdB.dll O2 - BHO: (no name) - {F50B3F5E-856E-4757-9BB1-B35D46CA7719} - C:\WINDOWS\system32\wvUkKEuU.dll O2 - BHO: {8bc60ce7-f848-7d4a-00e4-183c1ba0abdf} - {fdba0ab1-c381-4e00-a4d7-848f7ec06cb8} - C:\WINDOWS\system32\gdqvqjja.dll O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\PROGRA~1\QUICKT~1\qttask.exe" -atboottime O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Sakari\cftmon.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [advap32] C:\DOCUME~1\Sakari\LOCALS~1\Temp\6370.tmp/r O4 - HKLM\..\Run: [BM1355d45c] Rundll32.exe "C:\WINDOWS\system32\tqvcjcit.dll",s O4 - HKLM\..\Run: [1066e7c0] rundll32.exe "C:\WINDOWS\system32\nqvfaiub.dll",b O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Sakari\cftmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.5.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\SYSTEM32\WLCtrl32.dll O20 - Winlogon Notify: wvUkKEuU - C:\WINDOWS\SYSTEM32\wvUkKEuU.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Tehtävien ajoitus (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\NetDrive\wdService.exe -- End of file - 8562 bytes
Lataa TÄSTÄ VundoFix.exe työpöydällesi. Tupla-klikkaa VundoFix.exe ajaaksesi sen. Klikkaa Scan for Vundo valintaa. Kun skannaus on valmis, klikkaa Remove Vundo valintaa. Sinulta kysytään haluatko poistaa filut - klikkaa YES. Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa. Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK. Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö. Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan. Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä. =============== 1.Lataa combofix.exe työpöydällesi yhdestä linkistä: combofix1 combofix2 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. ================ Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi. Käynnistä koneesi vikasietotilaan: sammuta ja käynnistä käynnistyksen yhteydessä hakkaa F8 nappia valitse nuolinäppäimellä vikasietotila paina enter ja enter valitse käyttäjätilisi paina kyllä Jossakin koneissa hakataan F8:sin sijasta F5:tä " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix. " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman. " Paina Y käynnistääksesi skriptin. " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot". " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen. " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta. " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished". " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle. " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera. ===================== Lataa Malwarebytes' Anti-Malware työpöydällesi. 1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. 2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish. 3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. 4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan. 5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset. 6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected. 7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt 8. Lähetä lokin sisältö seuraavassa viestissäsi.
No niin sain noi ohjelmat ajettuu, ja vaikutusta tuntu olevan. Rootkit varoitusta ei ainakaan ole enää tullut. Tässä tuore HJT loki: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:32:54, on 25.4.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\NetDrive\wdService.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\ASUS\GamerOSD\GamerOSD.exe C:\Program Files\Razer\razerhid.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Razer\razertra.exe C:\Program Files\Razer\razerofa.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: {8bc60ce7-f848-7d4a-00e4-183c1ba0abdf} - {fdba0ab1-c381-4e00-a4d7-848f7ec06cb8} - C:\WINDOWS\system32\gdqvqjja.dll (file missing) O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\PROGRA~1\QUICKT~1\qttask.exe" -atboottime O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.5.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O20 - Winlogon Notify: wvUkKEuU - wvUkKEuU.dll (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\NetDrive\wdService.exe -- End of file - 7330 bytes
laita raportit niistä ========= scannaa hjt:llä merkkaa paina Fix checked O2 - BHO: {8bc60ce7-f848-7d4a-00e4-183c1ba0abdf} - {fdba0ab1-c381-4e00-a4d7-848f7ec06cb8} - C:\WINDOWS\system32\gdqvqjja.dll (file missing) O20 - Winlogon Notify: wvUkKEuU - wvUkKEuU.dll (file missing)
Tässä näitä raportteja nyt taas olis: VundoFix V7.0.3 Scan started at 13:13:51 25.4.2008 Listing files found while scanning.... C:\WINDOWS\system32\gdqvqjja.dll Beginning removal... Attempting to delete C:\WINDOWS\system32\gdqvqjja.dll C:\WINDOWS\system32\gdqvqjja.dll Has been deleted! Performing Repairs to the registry. Done! ------------------------------------------------------------ Malwarebytes' Anti-Malware 1.11 Tietokantaversio: 679 Tarkistustyyppi: Täysi tarkistus (C:\|) Tarkistetut kohteet: 95849 Kulunut aika: 22 minute(s), 51 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 3 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 20 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: C:\QooBox\Quarantine\C\WINDOWS\system32\awtqNfdB.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\QooBox\Quarantine\C\WINDOWS\system32\nqvfaiub.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\QooBox\Quarantine\C\WINDOWS\system32\wvUkKEuU.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\QooBox\Quarantine\C\WINDOWS\system32\xygtncqr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\spools.exe.vir (Worm.Socks) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{EB0035DF-6890-42E7-A4DA-DCCD0367C706}\RP42\A0007680.exe (Worm.Socks) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{EB0035DF-6890-42E7-A4DA-DCCD0367C706}\RP42\A0008702.exe (Worm.Socks) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{EB0035DF-6890-42E7-A4DA-DCCD0367C706}\RP42\A0009705.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{EB0035DF-6890-42E7-A4DA-DCCD0367C706}\RP42\A0009715.exe (Worm.Socks) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{EB0035DF-6890-42E7-A4DA-DCCD0367C706}\RP43\A0009728.exe (Worm.Socks) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{EB0035DF-6890-42E7-A4DA-DCCD0367C706}\RP43\A0009730.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{EB0035DF-6890-42E7-A4DA-DCCD0367C706}\RP43\A0009733.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{EB0035DF-6890-42E7-A4DA-DCCD0367C706}\RP43\A0009734.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{EB0035DF-6890-42E7-A4DA-DCCD0367C706}\RP43\A0009743.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{EB0035DF-6890-42E7-A4DA-DCCD0367C706}\RP43\A0010788.exe (Worm.Socks) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{EB0035DF-6890-42E7-A4DA-DCCD0367C706}\RP43\A0010789.exe (Worm.Socks) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{EB0035DF-6890-42E7-A4DA-DCCD0367C706}\RP43\A0010790.exe (Worm.Socks) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{EB0035DF-6890-42E7-A4DA-DCCD0367C706}\RP43\A0010799.exe (Worm.Socks) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{EB0035DF-6890-42E7-A4DA-DCCD0367C706}\RP43\A0010800.exe (Worm.Socks) -> Quarantined and deleted successfully. C:\VundoFix Backups\gdqvqjja.dll.bad (Trojan.Vundo) -> Quarantined and deleted successfully. --------------------------------------------------------------------- ComboFix 08-04-22.5 - Sakari 2008-04-25 13:24:48.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1496 [GMT 3:00] Running from: C:\Documents and Settings\Sakari\Työpöytä\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . (((((((((((((((((((((((((((((((((((((( Muut poistot )))))))))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\cookies.ini C:\WINDOWS\pskt.ini C:\WINDOWS\system32\awtqNfdB.dll C:\WINDOWS\system32\BdfNqtwa.ini C:\WINDOWS\system32\BdfNqtwa.ini2 C:\WINDOWS\system32\buiafvqn.ini C:\WINDOWS\system32\crypts.dll C:\WINDOWS\system32\drivers\spools.exe C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\nqvfaiub.dll C:\WINDOWS\system32\oxqvxsde.dll C:\WINDOWS\system32\tqvcjcit.dll C:\WINDOWS\system32\WLCtrl32.dl_ C:\WINDOWS\system32\WLCtrl32.dll C:\WINDOWS\system32\wvUkKEuU.dll C:\WINDOWS\system32\xygtncqr.dll C:\WINDOWS\winlogon.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_Schedule -------\Service_Schedule ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-03-25 to 2008-04-25 ))))))))))))))))) . 2008-04-25 13:13 . 2008-04-25 13:20 <KANSIO> d-------- C:\VundoFix Backups 2008-04-24 23:49 . 2008-04-24 23:49 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-04-23 21:25 . 2008-04-23 21:25 <KANSIO> d-------- C:\fsaua.data 2008-04-23 19:45 . 2008-04-23 19:45 129,536 --a----t- C:\WINDOWS\system32\DarkSpyKernel.sys 2008-04-23 19:26 . 2008-04-23 19:26 <KANSIO> d-------- C:\Program Files\Trend Micro 2008-04-23 19:22 . 2008-04-24 17:35 1,541,503 ---hs---- C:\WINDOWS\system32\skxoftdp.ini 2008-04-23 19:17 . 2008-04-25 12:59 109,756 --a------ C:\WINDOWS\BM1355d45c.xml 2008-04-22 21:15 . 2008-04-22 21:11 7,168 --a------ C:\Documents and Settings\LocalService\cftmon.exe 2008-04-22 21:11 . 2008-04-22 21:11 7,168 --a------ C:\Documents and Settings\Sakari\cftmon.exe 2008-04-22 21:11 . 2008-04-22 21:11 7,168 --a------ C:\d.exe 2008-04-22 21:11 . 2008-04-22 21:11 2 --a------ C:\275179375 2008-04-22 19:36 . 2008-04-22 19:45 <KANSIO> d-------- C:\Documents and Settings\Sakari\Application Data\Microsoft Games 2008-04-22 19:06 . 2008-04-22 19:06 <KANSIO> d-------- C:\Program Files\Microsoft Games 2008-04-20 15:49 . 2008-04-20 15:49 <KANSIO> d-------- C:\Program Files\Ubisoft 2008-04-19 12:25 . 2008-04-19 12:25 <KANSIO> d-------- C:\Documents and Settings\Sakari\Application Data\Apple Computer 2008-04-19 12:22 . 2008-04-19 12:22 <KANSIO> d-------- C:\Program Files\QuickTime 2008-04-19 12:22 . 2008-04-19 12:22 <KANSIO> d-------- C:\Program Files\Apple Software Update 2008-04-19 12:22 . 2008-04-19 12:22 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-04-19 12:22 . 2008-04-19 12:22 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-04-19 12:22 . 2008-04-24 22:33 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-04-19 12:22 . 2008-04-19 12:23 1,409 --a------ C:\WINDOWS\QTFont.for 2008-04-16 22:12 . 2008-04-16 22:12 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet 2008-04-16 21:32 . 2008-04-16 21:32 <KANSIO> d-------- C:\Program Files\Bonjour 2008-04-16 21:25 . 2008-04-16 21:25 <KANSIO> d-------- C:\Program Files\Common Files\Macrovision Shared 2008-04-15 19:05 . 2008-04-15 19:05 <KANSIO> d-------- C:\Program Files\Chami 2008-04-15 18:55 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-04-15 18:55 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-04-15 18:55 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2008-04-15 18:55 . 2004-09-14 16:11 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll 2008-04-15 18:55 . 2004-09-14 16:07 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2008-04-15 18:55 . 2004-09-14 16:07 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys 2008-04-13 14:11 . 2008-04-13 14:11 <KANSIO> d-------- C:\Documents and Settings\Sakari\Application Data\Download Manager 2008-04-12 22:17 . 2004-11-28 21:09 679,936 --a------ C:\WINDOWS\system32\xvidcore.dll 2008-04-12 22:11 . 2008-04-12 22:11 <KANSIO> d-------- C:\Program Files\AC3Filter 2008-04-12 22:11 . 2007-08-18 10:54 380,928 --a------ C:\WINDOWS\system32\ac3filter.acm 2008-04-12 13:32 . 2008-04-12 13:32 <KANSIO> dr-h----- C:\Documents and Settings\Sakari\Application Data\SecuROM 2008-04-12 13:32 . 2008-04-12 13:32 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-04-12 13:20 . 2008-04-19 12:11 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-04-11 17:51 . 2008-04-11 17:51 <KANSIO> d-------- C:\Program Files\GameSpy 2008-04-11 17:50 . 2008-04-11 17:50 <KANSIO> d-------- C:\WINDOWS\system32\URTTemp 2008-04-11 17:49 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll 2008-04-11 17:49 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll 2008-04-11 17:49 . 2008-04-11 17:49 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe 2008-04-11 17:49 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll 2008-04-11 17:43 . 2008-04-12 13:25 <KANSIO> d-------- C:\Program Files\Electronic Arts 2008-04-11 17:37 . 2008-04-11 17:37 <KANSIO> d--h----- C:\WINDOWS\PIF 2008-04-11 17:31 . 2008-04-16 21:32 <KANSIO> d-------- C:\Program Files\Common Files\Adobe 2008-04-11 17:26 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-04-11 17:26 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-04-11 17:26 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-04-11 17:22 . 2008-04-11 17:22 <KANSIO> d-------- C:\Program Files\Microsoft Visual Studio 8 2008-04-11 17:18 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll 2008-04-11 17:17 . 2008-04-11 17:17 <KANSIO> d-------- C:\Program Files\MSBuild 2008-04-11 17:17 . 2008-04-11 17:17 <KANSIO> d-------- C:\Program Files\Microsoft Works 2008-04-11 17:15 . 2008-04-11 17:21 <KANSIO> d-------- C:\WINDOWS\SHELLNEW 2008-04-11 17:14 . 2008-04-11 17:14 <KANSIO> dr-h----- C:\MSOCache 2008-04-11 17:14 . 2008-04-14 16:03 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-04-10 23:05 . 2008-04-17 23:41 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-04-10 23:05 . 2008-04-17 23:41 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-04-10 23:05 . 2008-04-17 23:41 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-04-10 23:05 . 2008-04-11 17:49 22,328 --a------ C:\Documents and Settings\Sakari\Application Data\PnkBstrK.sys 2008-04-10 23:00 . 2008-04-10 23:00 <KANSIO> d-------- C:\Program Files\Activision 2008-04-10 22:56 . 2008-04-10 22:56 <KANSIO> d--hs---- C:\WINDOWS\ftpcache 2008-04-10 22:56 . 2008-04-10 22:56 <KANSIO> d-------- C:\Program Files\DaemonTools_WhenUSave_Installer 2008-04-10 22:55 . 2008-04-10 22:55 <KANSIO> d-------- C:\Program Files\DAEMON Tools 2008-04-10 22:36 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-04-10 21:56 . 2008-04-10 21:56 <KANSIO> d-------- C:\Program Files\Gabest 2008-04-10 21:55 . 2008-04-10 21:55 <KANSIO> d-------- C:\Program Files\GordianKnot 2008-04-10 21:55 . 2008-04-10 21:55 <KANSIO> d-------- C:\Program Files\DivXCodec 2008-04-10 21:55 . 2008-04-10 21:55 414,272 --a------ C:\WINDOWS\system32\DivXc32f.dll 2008-04-10 21:55 . 2008-04-10 21:55 414,272 --a------ C:\WINDOWS\system32\DivXc32.dll 2008-04-10 21:55 . 2008-04-10 21:55 291,408 --a------ C:\WINDOWS\system32\DivXa32.acm 2008-04-10 21:55 . 2008-04-10 21:55 240,400 --a------ C:\WINDOWS\system32\DivX_c32.ax 2008-04-10 21:55 . 2008-04-10 21:55 196,608 --a------ C:\WINDOWS\system32\avisynth.dll 2008-04-10 21:55 . 2008-04-10 21:55 33,280 --a------ C:\WINDOWS\system32\HUFFYUV.DLL 2008-04-10 21:53 . 2008-04-10 21:53 <KANSIO> d-------- C:\Documents and Settings\Sakari\Application Data\Media Player Classic 2008-04-10 20:16 . 2008-04-24 23:22 <KANSIO> d-------- C:\Program Files\mIRC 2008-04-10 20:16 . 2008-04-24 23:35 <KANSIO> d-------- C:\Documents and Settings\Sakari\Application Data\mIRC 2008-04-10 18:00 . 2008-04-10 18:00 <KANSIO> d-------- C:\Program Files\NetDrive 2008-04-10 18:00 . 2003-06-04 12:49 503,808 --a------ C:\WINDOWS\system32\RFHelper.dll 2008-04-10 18:00 . 2003-06-04 12:20 221,184 --a------ C:\WINDOWS\system32\rfwdres.dll 2008-04-10 18:00 . 2003-03-26 12:52 139,264 --a------ C:\WINDOWS\system32\RFNP32.dll 2008-04-10 18:00 . 2003-06-04 10:58 126,976 --a------ C:\WINDOWS\system32\rfshext.dll 2008-04-10 18:00 . 2001-08-23 09:24 32,768 --a------ C:\WINDOWS\system32\rfhres.dll 2008-04-10 18:00 . 2001-07-28 16:33 24,576 --a------ C:\WINDOWS\system32\rfshres.dll 2008-04-10 18:00 . 2002-04-12 15:19 20,480 --a------ C:\WINDOWS\system32\rfstrres.dll 2008-04-10 17:59 . 1998-10-29 19:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-04-10 16:55 . 2008-04-10 16:55 <KANSIO> d-------- C:\Program Files\Windows Media Connect 2 2008-04-10 16:54 . 2008-04-10 23:05 <KANSIO> d-------- C:\WINDOWS\system32\LogFiles 2008-04-10 16:54 . 2008-04-10 16:55 <KANSIO> d-------- C:\WINDOWS\system32\drivers\UMDF 2008-04-10 16:09 . 2008-04-10 16:10 <KANSIO> d-------- C:\WINDOWS\system32\fi-fi 2008-04-10 16:05 . 2008-03-01 16:01 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-04-10 16:05 . 2007-07-01 06:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-04-10 16:05 . 2007-07-01 06:36 1,011,712 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-04-10 16:05 . 2008-03-01 16:01 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-04-10 16:05 . 2008-03-01 16:01 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-04-10 16:05 . 2008-03-01 16:01 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-04-10 16:05 . 2008-03-01 16:01 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2008-04-10 16:05 . 2008-03-01 16:01 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-04-10 16:05 . 2008-02-22 13:00 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-04-10 02:15 . 2008-04-10 02:15 <KANSIO> d-------- C:\Documents and Settings\Sakari\Application Data\Grisoft 2008-04-10 02:10 . 2008-04-10 02:10 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-04-10 01:50 . 2008-04-11 17:27 <KANSIO> d-------- C:\Downloads 2008-04-10 01:50 . 2008-04-10 01:50 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2008-04-10 01:49 . 2008-04-10 01:50 <KANSIO> d-------- C:\Program Files\BitComet 2008-04-10 01:47 . 2008-04-10 01:47 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-04-10 01:47 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-04-10 01:35 . 2008-04-10 01:35 <KANSIO> d-------- C:\Program Files\Common Files\LightScribe 2008-04-10 01:34 . 2008-04-19 12:07 <KANSIO> d-------- C:\Documents and Settings\Sakari\Application Data\Ahead 2008-04-10 01:32 . 2008-04-10 01:32 <KANSIO> d-------- C:\Program Files\Nero 2008-04-10 01:32 . 2008-04-10 01:35 <KANSIO> d-------- C:\Program Files\Common Files\Ahead 2008-04-10 01:32 . 2008-04-10 01:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Nero 2008-04-10 01:30 . 2008-04-22 20:39 <KANSIO> d-------- C:\Program Files\RevConnect 2008-04-10 01:23 . 2008-04-22 21:13 <KANSIO> d-------- C:\Program Files\SpywareBlaster 2008-04-10 01:23 . 2008-04-10 01:23 <KANSIO> d-------- C:\Program Files\Alwil Software 2008-04-10 01:23 . 2008-04-22 21:13 <KANSIO> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-04-10 01:20 . 2008-04-10 01:20 <KANSIO> d--hs---- C:\Documents and Settings\Sakari\UserData 2008-04-10 01:17 . 2008-04-10 01:17 <KANSIO> d-------- C:\Program Files\Razer 2008-04-10 01:17 . 2004-12-16 22:52 53,248 --a------ C:\WINDOWS\system32\razer.cpl 2008-04-10 01:17 . 2005-04-24 22:43 13,225 --a------ C:\WINDOWS\system32\drivers\Razerlow.sys 2008-04-10 01:15 . 2008-04-10 23:24 <KANSIO> d--h----- C:\WINDOWS\$hf_mig$ 2008-04-10 01:13 . 2006-06-14 13:44 12,288 -ra------ C:\WINDOWS\system32\drivers\EIO_XP.sys 2008-04-10 01:12 . 2008-04-10 01:12 <KANSIO> d-------- C:\Program Files\ASUS 2008-04-10 01:11 . 2008-04-10 01:11 <KANSIO> d-------- C:\Program Files\My Company Name 2008-04-10 01:10 . 2008-04-10 01:10 <KANSIO> d-------- C:\WINDOWS\nview . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-23 17:55 196,608 ----a-w C:\WINDOWS\system32\drivers\nStandard.bin 2008-04-09 22:12 12,288 ----a-w C:\WINDOWS\system32\drivers\EIO64_xp.sys 2008-04-09 22:05 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-04-09 21:58 --------- d-----w C:\Program Files\microsoft frontpage 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-01 13:01 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll . (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„ [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fdba0ab1-c381-4e00-a4d7-848f7ec06cb8}] C:\WINDOWS\system32\gdqvqjja.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12 15360] "ASUS SmartDoctor"="C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe" [2007-11-09 17:29 1126400] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04 139264] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SkyTel"="SkyTel.EXE" [2006-05-16 13:04 2879488 C:\WINDOWS\SkyTel.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-01-30 13:54 16116224 C:\WINDOWS\RTHDCPL.EXE] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-11-06 12:30 8523776] "nwiz"="nwiz.exe" [2007-11-06 12:30 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-11-06 12:30 81920] "ASUSGamerOSD"="C:\Program Files\ASUS\GamerOSD\GamerOSD.exe" [2007-10-23 17:48 380928] "razer"="C:\Program Files\Razer\razerhid.exe" [2005-05-17 18:21 147456] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "QuickTime Task"="C:\PROGRA~1\QUICKT~1\qttask.exe" [2008-03-28 23:37 413696] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-14 16:12 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvUkKEuU] wvUkKEuU.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.asv2"= asusasv2.dll "VIDC.HFYU"= huffyuv.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm "msacm.ac3filter"= ac3filter.acm [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Gcb77.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Rgf55.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Sxg22.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Tbj11.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Uop88.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\RevConnect\\DCPlusPlus.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"= "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "7008:TCP"= 7008:TCP:BitComet 7008 TCP "7008:UDP"= 7008:UDP:BitComet 7008 UDP R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 20:31] R1 EIO_XP;EIO_XP;C:\WINDOWS\system32\drivers\EIO_XP.sys [2006-06-14 13:44] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 20:35] R2 WebDriveFSD;WebDrive File System Driver;C:\Program Files\NetDrive\rffsd.sys [2002-11-27 13:40] R3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys [2007-10-23 17:48] R3 ASUSVRC;ASUSTeK Virtual Capture Device;C:\WINDOWS\system32\DRIVERS\AsusVRC.sys [2007-01-29 17:12] R3 Razerlow;Razerlow USB Filter Driver;C:\WINDOWS\system32\Drivers\Razerlow.sys [2005-04-24 22:43] S0 Gcb77;Gcb77;C:\WINDOWS\system32\Drivers\Gcb77.sys [] S0 Rgf55;Rgf55;C:\WINDOWS\system32\Drivers\Rgf55.sys [] S0 Sxg22;Sxg22;C:\WINDOWS\system32\Drivers\Sxg22.sys [] S0 Tbj11;Tbj11;C:\WINDOWS\system32\Drivers\Tbj11.sys [] S0 Uop88;Uop88;C:\WINDOWS\system32\Drivers\Uop88.sys [] S3 ALLOW-IO;ALLOW-IO;D:\ALLOW-IO.sys [] S3 chkproc1;chkproc1;C:\Documents and Settings\Sakari\Ty?p?yt?\Helios\Helios\chkproc.sys [] S3 DarkSpy;DarkSpy;C:\WINDOWS\system32\DarkSpyKernel.sys [2008-04-23 19:45] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da828804-07d0-11dd-a50d-00508dbc457a}] \Shell\AutoRun\command - F:\Launcher.exe . 'Ajoitetut teht„v„t'-kansion sis„lt” "2008-04-19 09:22:32 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-25 13:29:26 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\RFHelper.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\NetDrive\wdService.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\WgaTray.exe C:\Program Files\Razer\razertra.exe C:\Program Files\Razer\razerofa.exe . ************************************************************************** . Completion time: 2008-04-25 13:32:24 - machine was rebooted ComboFix-quarantined-files.txt 2008-04-25 10:32:04 Pre-Run: 156,720,918,528 tavua vapaana Post-Run: 156,978,274,304 tavua vapaana 297 --- E O F --- 2008-04-22 19:33:46 --------------------------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:37:49, on 26.4.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\NetDrive\wdService.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\ASUS\GamerOSD\GamerOSD.exe C:\Program Files\Razer\razerhid.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Razer\razertra.exe C:\Program Files\Razer\razerofa.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.5.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\NetDrive\wdService.exe -- End of file - 7281 bytes
Lataa: RegSeeker.zip työpöydälle: Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman. Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen. Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken). Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin. Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK". Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK". Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen.
