onko jotain mitä pitäis poistaa?korjata?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:43:23, on 4.3.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\conime.exe
D:\bootcd\wintools\StartupMonitor.exe
D:\bootcd\wintools\autorun.exe
C:\Users\pame\AppData\Local\Temp\SpybotSD\SpybotSD.exe
C:\Users\pame\AppData\Local\Temp\Hijack.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [LayoutM] KLayMgr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [V0260Cfg.exe] V0260Cfg.exe /d:3
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O13 - Gopher Prefix:
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

--
End of file - 3943 bytes

 

Poista lisää poista sovelutuksesta

ShoppingReport

Poista vikasiedossa kansio

C:\Program Files\ShoppingReport


scannaa hjt:llä merkkaa paina Fix checked

O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll

================

1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

 

Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1035.18.2493 [GMT 2:00]
Running from: C:\Users\pame\Desktop\Downloads\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\koos.exe
C:\Windows\system32\kprof
C:\Windows\system32\poof

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-02-04 to 2008-03-04 )))))))))))))))))
.

2008-03-04 23:57 . 2007-03-15 03:52 1,152,000 --a------ C:\Windows\System32\themecpl.dll
2008-03-04 23:57 . 2007-07-20 01:55 233,888 --a------ C:\Windows\System32\DreamScene.dll
2008-03-04 23:56 . 2006-12-20 08:03 229,888 --a------ C:\Windows\System32\msshsq.dll
2008-03-04 23:27 . 2008-03-04 23:27 <KANSIO> d-------- C:\Users\pame\AppData\Roaming\Uniblue
2008-03-03 22:59 . 2008-01-02 08:37 176,128 --a------ C:\Windows\System32\igfxres.dll
2008-03-03 22:08 . 2008-03-03 22:08 2,688 --a------ C:\Windows\System32\io02.sys
2008-03-03 15:39 . 2008-03-03 15:39 <KANSIO> d-------- C:\Users\All Users\InstallShield
2008-03-03 15:39 . 2008-03-03 15:39 <KANSIO> d-------- C:\PROGRA~2\InstallShield
2008-03-03 15:39 . 2004-04-16 11:24 61,440 --a------ C:\Windows\System32\ISUSPM.cpl
2008-03-02 15:03 . 2008-03-02 15:03 319 --a------ C:\Windows\game.ini
2008-03-02 14:37 . 2008-03-02 14:37 <KANSIO> d-------- C:\Program Files\Activision
2008-03-02 14:27 . 2008-03-02 14:27 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
2008-03-02 14:21 . 2008-03-02 14:21 <KANSIO> d-------- C:\Users\pame\AppData\Roaming\DAEMON Tools
2008-03-02 14:21 . 2008-03-02 14:21 716,272 --a------ C:\Windows\System32\drivers\sptd.sys
2008-03-02 02:07 . 2008-03-02 02:09 <KANSIO> d--h----- C:\Windows\msdownld.tmp
2008-03-01 23:07 . 2008-03-05 01:21 <KANSIO> d-------- C:\Users\pame\sarjat
2008-03-01 12:42 . 2008-03-01 12:42 <KANSIO> d-------- C:\perflogs
2008-02-29 22:59 . 2008-02-29 22:59 <KANSIO> d-------- C:\Program Files\ProPilkki2
2008-02-29 20:48 . 2008-02-29 20:48 <KANSIO> d-------- C:\Users\pame\AppData\Roaming\PeerNetworking
2008-02-29 10:24 . 2006-11-29 13:06 3,426,072 --a------ C:\Windows\System32\d3dx9_32.dll
2008-02-29 10:23 . 2008-02-29 10:23 <KANSIO> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-02-29 10:21 . 2008-02-29 10:21 <KANSIO> d-------- C:\Windows\PCHEALTH
2008-02-29 10:18 . 2008-02-29 10:42 <KANSIO> d-------- C:\Users\All Users\WLInstaller
2008-02-29 10:18 . 2008-02-29 15:54 <KANSIO> d-------- C:\Program Files\Windows Live
2008-02-29 10:18 . 2008-02-29 10:21 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-29 10:18 . 2008-02-29 10:42 <KANSIO> d-------- C:\PROGRA~2\WLInstaller
2008-02-28 21:54 . 2008-02-28 21:54 <KANSIO> d-------- C:\Program Files\IZArc
2008-02-28 21:18 . 1998-06-25 00:00 1,409,024 --a------ C:\Windows\System32\temp.003
2008-02-28 21:18 . 1998-06-24 00:00 609,584 --a------ C:\Windows\System32\Comctl32.ocx
2008-02-28 21:18 . 1999-02-04 00:00 598,288 --a------ C:\Windows\System32\temp.002
2008-02-28 21:18 . 1998-06-17 00:00 254,005 --a------ C:\Windows\System32\temp.000
2008-02-28 21:18 . 1998-06-24 00:00 209,192 --a------ C:\Windows\System32\Tabctl32.ocx
2008-02-28 21:18 . 1999-02-04 00:00 164,112 --a------ C:\Windows\System32\temp.001
2008-02-28 21:18 . 1999-02-04 00:00 147,728 --a------ C:\Windows\System32\temp.005
2008-02-28 21:18 . 1998-06-24 00:00 140,096 --a------ C:\Windows\System32\Comdlg32.ocx
2008-02-28 21:18 . 1998-04-24 00:00 37,136 --a------ C:\Windows\System32\temp.006
2008-02-28 21:18 . 1999-02-04 00:00 17,920 --a------ C:\Windows\System32\temp.007
2008-02-28 21:18 . 1998-09-01 11:18 6,144 --a------ C:\Windows\System32\temp.004
2008-02-28 00:28 . 2008-02-28 01:03 <KANSIO> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-02-28 00:28 . 2008-02-28 01:03 <KANSIO> d-------- C:\PROGRA~2\Spybot - Search & Destroy
2008-02-28 00:13 . 2008-02-28 00:13 <KANSIO> d-------- C:\Users\pame\AppData\Roaming\Lavasoft
2008-02-28 00:09 . 2008-03-02 14:26 13,958 --a------ C:\Windows\System32\results.xml
2008-02-28 00:05 . 2008-02-28 00:05 <KANSIO> d-------- C:\Program Files\HP USB Smart Card Keyboard
2008-02-28 00:00 . 2008-02-28 00:00 <KANSIO> d-------- C:\Program Files\Intel
2008-02-28 00:00 . 2007-08-10 15:12 53,248 --a------ C:\Windows\System32\CSVer.dll
2008-02-27 23:57 . 2008-02-28 00:10 <KANSIO> d-------- C:\Intel
2008-02-27 23:57 . 2006-11-10 08:25 319,456 --a------ C:\Windows\System32\difxapi.dll
2008-02-27 23:53 . 2008-02-28 00:05 <KANSIO> d-------- C:\Windows\Downloaded Installations
2008-02-27 23:52 . 2008-02-27 23:52 <KANSIO> d-------- C:\Program Files\Broadcom
2008-02-27 23:30 . 2008-02-27 13:38 <KANSIO> d-------- C:\Windows\Panther
2008-02-27 23:29 . 2008-03-05 01:10 459,304 --a------ C:\Windows\System32\perfh00B.dat
2008-02-27 23:29 . 2008-02-27 23:28 274,158 --a------ C:\Windows\System32\perfi00B.dat
2008-02-27 23:29 . 2008-03-05 01:10 83,690 --a------ C:\Windows\System32\perfc00B.dat
2008-02-27 23:29 . 2008-02-27 23:28 36,790 --a------ C:\Windows\System32\perfd00B.dat
2008-02-27 23:28 . 2008-02-27 23:28 <KANSIO> d-------- C:\Windows\System32\fi
2008-02-27 23:28 . 2008-02-28 01:40 <KANSIO> d-------- C:\Windows\System32\drivers\fi-FI
2008-02-27 23:28 . 2008-02-27 23:28 <KANSIO> d-------- C:\Windows\System32\040B
2008-02-27 23:28 . 2008-02-27 23:28 <KANSIO> d-------- C:\Windows\fi-FI
2008-02-27 21:14 . 2008-02-27 21:14 <KANSIO> d-------- C:\Program Files\Realtek
2008-02-27 21:14 . 2008-03-03 15:39 <KANSIO> d--h----- C:\Program Files\InstallShield Installation Information
2008-02-27 21:14 . 2008-03-03 15:39 <KANSIO> d-------- C:\Program Files\Common Files\InstallShield
2008-02-27 19:53 . 2008-02-27 19:53 <KANSIO> d-------- C:\Users\pame\AppData\Roaming\vlc
2008-02-27 19:45 . 2008-02-27 19:45 <KANSIO> d-------- C:\Program Files\VideoLAN
2008-02-27 18:13 . 2008-02-27 18:14 <KANSIO> d-------- C:\Users\All Users\WinZip
2008-02-27 18:13 . 2008-02-27 18:14 <KANSIO> d-------- C:\PROGRA~2\WinZip
2008-02-27 18:12 . 2008-03-02 15:03 <KANSIO> d--hs---- C:\Windows\Installer
2008-02-27 17:05 . 2008-03-04 23:24 <KANSIO> d-------- C:\Users\pame\AppData\Roaming\uTorrent
2008-02-27 16:36 . 2008-02-27 16:36 205,824 --a------ C:\Windows\System32\msoeacct.dll
2008-02-27 16:36 . 2008-02-27 16:36 87,040 --a------ C:\Windows\System32\msoert2.dll
2008-02-27 16:36 . 2008-02-27 16:36 39,424 --a------ C:\Windows\System32\ACCTRES.dll
2008-02-27 16:34 . 2008-02-27 16:34 292,352 --a------ C:\Windows\System32\psisdecd.dll
2008-02-27 16:34 . 2008-02-27 16:34 218,624 --a------ C:\Windows\System32\psisrndr.ax
2008-02-27 16:34 . 2008-02-27 16:34 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-02-27 16:34 . 2008-02-27 16:34 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-02-27 16:34 . 2008-02-27 16:34 80,896 --a------ C:\Windows\System32\MSNP.ax
2008-02-27 16:34 . 2008-02-27 16:34 68,608 --a------ C:\Windows\System32\Mpeg2Data.ax
2008-02-27 16:34 . 2008-02-27 16:34 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
2008-02-27 16:32 . 2008-02-27 16:32 376,320 --a------ C:\Windows\System32\winsrv.dll
2008-02-27 16:32 . 2008-02-27 16:32 49,664 --a------ C:\Windows\System32\csrsrv.dll
2008-02-27 16:29 . 2008-02-27 16:29 374,456 --a------ C:\Windows\System32\mcupdate_GenuineIntel.dll
2008-02-27 16:28 . 2008-02-27 16:28 8,147,968 --a------ C:\Windows\System32\wmploc.DLL
2008-02-27 16:28 . 2008-02-27 16:28 356,864 --a------ C:\Windows\System32\MediaMetadataHandler.dll
2008-02-27 16:28 . 2008-02-27 16:28 7,680 --a------ C:\Windows\System32\spwmp.dll
2008-02-27 16:28 . 2008-02-27 16:28 4,096 --a------ C:\Windows\System32\msdxm.ocx
2008-02-27 16:28 . 2008-02-27 16:28 4,096 --a------ C:\Windows\System32\dxmasf.dll
2008-02-27 16:27 . 2008-02-27 16:27 396,800 --a------ C:\Windows\System32\MPSSVC.dll
2008-02-27 16:27 . 2008-02-27 16:27 392,192 --a------ C:\Windows\System32\FirewallAPI.dll
2008-02-27 16:27 . 2008-02-27 16:27 178,688 --a------ C:\Windows\System32\iphlpsvc.dll
2008-02-27 16:27 . 2008-02-27 16:27 86,016 --a------ C:\Windows\System32\icfupgd.dll
2008-02-27 16:27 . 2008-02-27 16:27 63,488 --a------ C:\Windows\System32\drivers\mpsdrv.sys
2008-02-27 16:27 . 2008-02-27 16:27 61,952 --a------ C:\Windows\System32\cmifw.dll
2008-02-27 16:27 . 2008-02-27 16:27 23,040 --a------ C:\Windows\System32\drivers\tunnel.sys
2008-02-27 16:27 . 2008-02-27 16:27 16,896 --a------ C:\Windows\System32\wfapigp.dll
2008-02-27 16:27 . 2008-02-27 16:27 15,360 --a------ C:\Windows\System32\drivers\TUNMP.SYS
2008-02-27 16:26 . 2008-02-27 16:26 3,504,696 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-02-27 16:26 . 2008-02-27 16:26 3,470,392 --a------ C:\Windows\System32\ntoskrnl.exe
2008-02-27 16:26 . 2008-02-27 16:26 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
2008-02-27 16:26 . 2008-02-27 16:26 211,000 --a------ C:\Windows\System32\drivers\volsnap.sys
2008-02-27 16:26 . 2008-02-27 16:26 154,624 --a------ C:\Windows\System32\drivers\nwifi.sys
2008-02-27 16:26 . 2008-02-27 16:26 109,624 --a------ C:\Windows\System32\drivers\ataport.sys

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-28 21:18 --------- d-----w C:\Program Files\Microsoft Games
2008-02-27 21:28 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-02-27 21:28 --------- d-----w C:\Program Files\Windows Journal
2008-02-27 21:28 --------- d-----w C:\Program Files\Windows Collaboration
2008-02-27 21:23 319,456 ----a-w C:\Windows\DIFxAPI.dll
2008-02-27 19:14 315,392 ----a-w C:\Windows\HideWin.exe
2008-02-27 17:53 --------- d-----w C:\Users\pame\AppData\Roaming\vlc
2008-02-27 14:56 174 --sha-w C:\Program Files\desktop.ini
2008-02-27 14:40 --------- d-----w C:\Program Files\Windows Sidebar
2008-02-27 14:40 --------- d-----w C:\Program Files\Windows Mail
2008-02-27 14:40 --------- d-----w C:\Program Files\Windows Defender
2008-02-27 14:40 --------- d-----w C:\Program Files\Windows Calendar
2008-02-27 14:37 70,144 ----a-w C:\Windows\system32\drivers\pacer.sys
2008-02-27 14:37 619,008 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys
2008-02-27 14:37 61,952 ----a-w C:\Windows\system32\drivers\wanarp.sys
2008-02-27 14:37 48,640 ----a-w C:\Windows\system32\drivers\ndproxy.sys
2008-02-27 14:37 20,480 ----a-w C:\Windows\system32\drivers\ndistapi.sys
2008-02-27 14:35 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-02-27 14:35 2,923,520 ----a-w C:\Windows\explorer.exe
2008-02-27 14:35 11,264 ----a-w C:\Windows\system32\drivers\wmiacpi.sys
2008-02-27 14:18 320,000 ----a-w C:\Windows\system32\drivers\csc.sys
2008-02-27 14:17 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-27 14:17 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-27 14:17 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-27 14:17 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-27 14:11 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-27 11:42 --------- d-sh--w C:\PROGRA~2\Työpöytä
2008-02-27 11:42 --------- d-sh--w C:\PROGRA~2\Tiedostot
2008-02-27 11:42 --------- d-sh--w C:\PROGRA~2\Suosikit
2008-02-27 11:42 --------- d-sh--w C:\PROGRA~2\Mallit
2008-02-27 11:42 --------- d-sh--w C:\PROGRA~2\Käynnistä-valikko
2008-02-01 09:17 586,752 ----a-w C:\Windows\WLXPGSS.SCR
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{100EB1FD-D03E-47FD-81F3-EE91287F9465}]
C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-02-27 16:17 1232896]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:34 125440]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-04-17 12:41 196608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-02-27 16:31 1006264]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 19:04 4423680 C:\Windows\RtHDVCpl.exe]
"LayoutM"="KLayMgr.exe" [2004-08-26 14:17 45056 C:\Windows\KLayMgr.exe]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2008-01-02 09:07 141848]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2008-01-02 09:06 166424]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2008-01-02 09:07 133656]
"V0260Cfg.exe"="V0260Cfg.exe" [2006-03-27 19:00 32874 C:\Windows\V0260Cfg.exe]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-04-13 06:07 69632]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2C370E11-CA0E-4C87-8205-623B0959D07A}"= UDP:40133:utorrent
"TCP Query User{044540A0-CB49-4DE3-9692-C81AB196122C}C:\users\pame\desktop\utorrent.exe"= UDP:C:\users\pame\desktop\utorrent.exe:utorrent.exe|Desc=utorrent.exe
"UDP Query User{E8B4281A-15E6-4AD0-98FB-7CE30BF7384F}C:\users\pame\desktop\utorrent.exe"= TCP:C:\users\pame\desktop\utorrent.exe:utorrent.exe|Desc=utorrent.exe
"{24E70D5D-8F3A-43EC-B8D1-B589B4BA4DF1}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)|Edge=TRUE|
"TCP Query User{5E5DE2B5-EA86-447B-8AF3-38A9C7199A33}C:\program files\propilkki2\propilkki2.exe"= UDP:C:\program files\propilkki2\propilkki2.exe:Main executable for PP2|Desc=Main executable for PP2
"UDP Query User{BD485325-1F28-4E6F-A9E6-5E3A985C5AC5}C:\program files\propilkki2\propilkki2.exe"= TCP:C:\program files\propilkki2\propilkki2.exe:Main executable for PP2|Desc=Main executable for PP2
"TCP Query User{4AD32EE5-29F9-4B10-A4D2-B4FACBD93BD9}C:\program files\mozilla firefox\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox|Desc=Firefox
"UDP Query User{82259176-B3C6-4400-97BB-0C6B08C0DAA8}C:\program files\mozilla firefox\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox|Desc=Firefox
"{8AC6A42F-0DEA-44CC-A6A9-B4D7C45D5FBC}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{7B2CD546-5B34-45CF-83E9-78C554BF10A7}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 16:52]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-11-29 16:56]
R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-01-02 08:48]
R3 V0260VID;Live! Cam Vista IM;C:\Windows\system32\DRIVERS\V0260Vid.sys [2006-11-04 00:45]
S3 io02;Hardware Access Driver;C:\Windows\system32\io02.sys [2008-03-03 22:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97443618-e853-11dc-91e6-0017a41e9a71}]
\shell\AutoRun\command - E:\setup\rsrc\Autorun.exe
\shell\dinstall\command - E:\Directx\dxsetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce8af37f-e528-11dc-b0a4-0017a41e9a71}]
\shell\AutoRun\command - F:\LaunchU3.exe -a

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-05 01:29:02
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\system32\conime.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
.
**************************************************************************
.
Completion time: 2008-03-05 1:31:24 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-04 23:31:17
.
2008-03-04 21:57:38 --- E O F ---

 

yritin mennä vikasietotilaan mut se jämähtää valikkokohtaan sit ei tapahdu mitään Esc joten poistin sen shopping reportin C:asemasta ilman
vikasietotilaa...muutenkin käynnistyksessä ongelmia kun yritän uudelleen käynnistystä niin jämähtää, täytyy aina sammuttaa kone kokonaan et käynnistyy normaalisti.

 

scannaa uusi hjt:n loki

===============
et siis pääse vikasietotilan
aja vaikka normaalissa tilassa alla oleva

Ohje AVG:n Anti-Spyware 7.5:n käyttöön
Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.

Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

Lataa AVG:n Anti-Spyware 7.5:n
ja tallenna ohjelma työpöydällesi.
o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
o Käynnistä AVG:n Anti-Spyware.
o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".

o Sitten "Reports" valikon alta:
o Laita täppi kohtaan "Automatically generate report after every scan"
o Ota täppi pois kohdasta"Only if threats were found"

o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
o "Resident shield is", muuta tila active:sta inactive:ksi
o Sulje ohjelma, ÄLÄ skannaa vielä.

Käynnistä koneesi vikasietotilaan,
sammuta ja käynnistä
käynnistyksen yhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina enter ja enter

Toisissa koneissa paukutetaan F8:sin sijasta F5:tä

HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"

o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:51:02, on 5.3.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
D:\bootcd\wintools\autorun.exe
C:\Windows\system32\conime.exe
C:\Users\pame\AppData\Local\Temp\Hijack.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (file missing)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [LayoutM] KLayMgr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [V0260Cfg.exe] V0260Cfg.exe /d:3
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O13 - Gopher Prefix:
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

--
End of file - 3523 bytes



avg löysi trackig cookies threat (medium) juttui muutaman ja poistin ne... hjt nyt tässä sen jälkeen

 

scannaa hjt:llä merkkaa paina Fix checked

O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (file missing)

================

Mikä on tämä
C:\Windows\V0260Cfg.exe

Tää rivi
O4 - HKLM\..\Run: [V0260Cfg.exe] V0260Cfg.exe /d:3


Lähetetääni tiedosto Virustotaliin
virustotal

1 Klikkaa Selaa... nappia
2 Selaa sitten siihen tämä tiedosto: C:\Windows\V0260Cfg.exe
3 Klikkaa Avaa nappia
4 Klikkaa Send nappia
5 Sivusto scannaa tiedostoa hetken, tallenna sitten tulokset jotka saat vaikka muistioon.

Tai sitten se löytyy tuolta
C:\V0260Cfg.exe

katos minkä firman exe ja mille se oikeen kuuluu.
mitä tekemistä sillä on.

 

ei se löydä kummassakaan muodossa sitä? enkä pysty fixaamaa tätä shopping reporttii hjt:ssä.

 

Löytyykös tuo kansio
C:\Program Files\ShoppingReport

============

scannaa uusi combofix

===========

• Avaa HiJackThis
• Klikkaa "Configure" valintaa oikealla alhaalla
• Klikkaa "Misc Tools"
• Klikkaa boxia joka sanoo "Uninstall Manager"
• Klikkaa valintaa "Save list"
• Kopioi ja liitä kyseinen lista muistiosta postiisi

 

ei löytynyt shopping reporttia..mä muute poistin sen eilen C:stä roskikseen ja tyhjensin sen... :/ tässä combofixi
ja nyt hjt:n kimppuun




(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\koos.exe
C:\Windows\system32\kprof
C:\Windows\system32\poof

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-02-05 to 2008-03-05 )))))))))))))))))
.

2008-03-05 10:42 . 2008-03-05 10:42 <KANSIO> d-------- C:\Users\pame\AppData\Roaming\Grisoft
2008-03-05 10:42 . 2008-03-05 10:42 <KANSIO> d-------- C:\Users\All Users\Grisoft
2008-03-05 10:42 . 2008-03-05 10:42 <KANSIO> d-------- C:\PROGRA~2\Grisoft
2008-03-05 10:42 . 2007-05-30 14:10 10,872 --a------ C:\Windows\System32\drivers\AvgAsCln.sys
2008-03-04 23:57 . 2007-03-15 03:52 1,152,000 --a------ C:\Windows\System32\themecpl.dll
2008-03-04 23:57 . 2007-07-20 01:55 233,888 --a------ C:\Windows\System32\DreamScene.dll
2008-03-04 23:56 . 2006-12-20 08:03 229,888 --a------ C:\Windows\System32\msshsq.dll
2008-03-04 23:27 . 2008-03-04 23:27 <KANSIO> d-------- C:\Users\pame\AppData\Roaming\Uniblue
2008-03-03 22:59 . 2008-01-02 08:37 176,128 --a------ C:\Windows\System32\igfxres.dll
2008-03-03 22:08 . 2008-03-03 22:08 2,688 --a------ C:\Windows\System32\io02.sys
2008-03-03 15:39 . 2008-03-03 15:39 <KANSIO> d-------- C:\Users\All Users\InstallShield
2008-03-03 15:39 . 2008-03-03 15:39 <KANSIO> d-------- C:\PROGRA~2\InstallShield
2008-03-03 15:39 . 2004-04-16 11:24 61,440 --a------ C:\Windows\System32\ISUSPM.cpl
2008-03-02 15:03 . 2008-03-02 15:03 319 --a------ C:\Windows\game.ini
2008-03-02 14:37 . 2008-03-02 14:37 <KANSIO> d-------- C:\Program Files\Activision
2008-03-02 14:27 . 2008-03-02 14:27 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
2008-03-02 14:21 . 2008-03-02 14:21 <KANSIO> d-------- C:\Users\pame\AppData\Roaming\DAEMON Tools
2008-03-02 14:21 . 2008-03-02 14:21 716,272 --a------ C:\Windows\System32\drivers\sptd.sys
2008-03-02 02:07 . 2008-03-02 02:09 <KANSIO> d--h----- C:\Windows\msdownld.tmp
2008-03-01 23:07 . 2008-03-05 01:21 <KANSIO> d-------- C:\Users\pame\sarjat
2008-03-01 12:42 . 2008-03-01 12:42 <KANSIO> d-------- C:\perflogs
2008-02-29 22:59 . 2008-02-29 22:59 <KANSIO> d-------- C:\Program Files\ProPilkki2
2008-02-29 20:48 . 2008-02-29 20:48 <KANSIO> d-------- C:\Users\pame\AppData\Roaming\PeerNetworking
2008-02-29 10:24 . 2006-11-29 13:06 3,426,072 --a------ C:\Windows\System32\d3dx9_32.dll
2008-02-29 10:23 . 2008-02-29 10:23 <KANSIO> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-02-29 10:21 . 2008-02-29 10:21 <KANSIO> d-------- C:\Windows\PCHEALTH
2008-02-29 10:18 . 2008-02-29 10:42 <KANSIO> d-------- C:\Users\All Users\WLInstaller
2008-02-29 10:18 . 2008-02-29 15:54 <KANSIO> d-------- C:\Program Files\Windows Live
2008-02-29 10:18 . 2008-02-29 10:21 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-29 10:18 . 2008-02-29 10:42 <KANSIO> d-------- C:\PROGRA~2\WLInstaller
2008-02-28 21:54 . 2008-02-28 21:54 <KANSIO> d-------- C:\Program Files\IZArc
2008-02-28 21:18 . 1998-06-25 00:00 1,409,024 --a------ C:\Windows\System32\temp.003
2008-02-28 21:18 . 1998-06-24 00:00 609,584 --a------ C:\Windows\System32\Comctl32.ocx
2008-02-28 21:18 . 1999-02-04 00:00 598,288 --a------ C:\Windows\System32\temp.002
2008-02-28 21:18 . 1998-06-17 00:00 254,005 --a------ C:\Windows\System32\temp.000
2008-02-28 21:18 . 1998-06-24 00:00 209,192 --a------ C:\Windows\System32\Tabctl32.ocx
2008-02-28 21:18 . 1999-02-04 00:00 164,112 --a------ C:\Windows\System32\temp.001
2008-02-28 21:18 . 1999-02-04 00:00 147,728 --a------ C:\Windows\System32\temp.005
2008-02-28 21:18 . 1998-06-24 00:00 140,096 --a------ C:\Windows\System32\Comdlg32.ocx
2008-02-28 21:18 . 1998-04-24 00:00 37,136 --a------ C:\Windows\System32\temp.006
2008-02-28 21:18 . 1999-02-04 00:00 17,920 --a------ C:\Windows\System32\temp.007
2008-02-28 21:18 . 1998-09-01 11:18 6,144 --a------ C:\Windows\System32\temp.004
2008-02-28 00:28 . 2008-02-28 01:03 <KANSIO> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-02-28 00:28 . 2008-02-28 01:03 <KANSIO> d-------- C:\PROGRA~2\Spybot - Search & Destroy
2008-02-28 00:13 . 2008-02-28 00:13 <KANSIO> d-------- C:\Users\pame\AppData\Roaming\Lavasoft
2008-02-28 00:09 . 2008-03-02 14:26 13,958 --a------ C:\Windows\System32\results.xml
2008-02-28 00:05 . 2008-02-28 00:05 <KANSIO> d-------- C:\Program Files\HP USB Smart Card Keyboard
2008-02-28 00:00 . 2008-02-28 00:00 <KANSIO> d-------- C:\Program Files\Intel
2008-02-28 00:00 . 2007-08-10 15:12 53,248 --a------ C:\Windows\System32\CSVer.dll
2008-02-27 23:57 . 2008-02-28 00:10 <KANSIO> d-------- C:\Intel
2008-02-27 23:57 . 2006-11-10 08:25 319,456 --a------ C:\Windows\System32\difxapi.dll
2008-02-27 23:53 . 2008-02-28 00:05 <KANSIO> d-------- C:\Windows\Downloaded Installations
2008-02-27 23:52 . 2008-02-27 23:52 <KANSIO> d-------- C:\Program Files\Broadcom
2008-02-27 23:30 . 2008-02-27 13:38 <KANSIO> d-------- C:\Windows\Panther
2008-02-27 23:29 . 2008-03-05 11:45 459,304 --a------ C:\Windows\System32\perfh00B.dat
2008-02-27 23:29 . 2008-02-27 23:28 274,158 --a------ C:\Windows\System32\perfi00B.dat
2008-02-27 23:29 . 2008-03-05 11:45 83,690 --a------ C:\Windows\System32\perfc00B.dat
2008-02-27 23:29 . 2008-02-27 23:28 36,790 --a------ C:\Windows\System32\perfd00B.dat
2008-02-27 23:28 . 2008-02-27 23:28 <KANSIO> d-------- C:\Windows\System32\fi
2008-02-27 23:28 . 2008-02-28 01:40 <KANSIO> d-------- C:\Windows\System32\drivers\fi-FI
2008-02-27 23:28 . 2008-02-27 23:28 <KANSIO> d-------- C:\Windows\System32\040B
2008-02-27 23:28 . 2008-02-27 23:28 <KANSIO> d-------- C:\Windows\fi-FI
2008-02-27 21:14 . 2008-02-27 21:14 <KANSIO> d-------- C:\Program Files\Realtek
2008-02-27 21:14 . 2008-03-03 15:39 <KANSIO> d--h----- C:\Program Files\InstallShield Installation Information
2008-02-27 21:14 . 2008-03-03 15:39 <KANSIO> d-------- C:\Program Files\Common Files\InstallShield
2008-02-27 19:53 . 2008-02-27 19:53 <KANSIO> d-------- C:\Users\pame\AppData\Roaming\vlc
2008-02-27 19:45 . 2008-02-27 19:45 <KANSIO> d-------- C:\Program Files\VideoLAN
2008-02-27 18:13 . 2008-02-27 18:14 <KANSIO> d-------- C:\Users\All Users\WinZip
2008-02-27 18:13 . 2008-02-27 18:14 <KANSIO> d-------- C:\PROGRA~2\WinZip
2008-02-27 18:12 . 2008-03-02 15:03 <KANSIO> d--hs---- C:\Windows\Installer
2008-02-27 17:05 . 2008-03-04 23:24 <KANSIO> d-------- C:\Users\pame\AppData\Roaming\uTorrent
2008-02-27 16:36 . 2008-02-27 16:36 205,824 --a------ C:\Windows\System32\msoeacct.dll
2008-02-27 16:36 . 2008-02-27 16:36 87,040 --a------ C:\Windows\System32\msoert2.dll
2008-02-27 16:36 . 2008-02-27 16:36 39,424 --a------ C:\Windows\System32\ACCTRES.dll
2008-02-27 16:34 . 2008-02-27 16:34 292,352 --a------ C:\Windows\System32\psisdecd.dll
2008-02-27 16:34 . 2008-02-27 16:34 218,624 --a------ C:\Windows\System32\psisrndr.ax
2008-02-27 16:34 . 2008-02-27 16:34 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-02-27 16:34 . 2008-02-27 16:34 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-02-27 16:34 . 2008-02-27 16:34 80,896 --a------ C:\Windows\System32\MSNP.ax
2008-02-27 16:34 . 2008-02-27 16:34 68,608 --a------ C:\Windows\System32\Mpeg2Data.ax
2008-02-27 16:34 . 2008-02-27 16:34 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
2008-02-27 16:32 . 2008-02-27 16:32 376,320 --a------ C:\Windows\System32\winsrv.dll
2008-02-27 16:32 . 2008-02-27 16:32 49,664 --a------ C:\Windows\System32\csrsrv.dll
2008-02-27 16:29 . 2008-02-27 16:29 374,456 --a------ C:\Windows\System32\mcupdate_GenuineIntel.dll
2008-02-27 16:28 . 2008-02-27 16:28 8,147,968 --a------ C:\Windows\System32\wmploc.DLL
2008-02-27 16:28 . 2008-02-27 16:28 356,864 --a------ C:\Windows\System32\MediaMetadataHandler.dll
2008-02-27 16:28 . 2008-02-27 16:28 7,680 --a------ C:\Windows\System32\spwmp.dll
2008-02-27 16:28 . 2008-02-27 16:28 4,096 --a------ C:\Windows\System32\msdxm.ocx
2008-02-27 16:28 . 2008-02-27 16:28 4,096 --a------ C:\Windows\System32\dxmasf.dll
2008-02-27 16:27 . 2008-02-27 16:27 396,800 --a------ C:\Windows\System32\MPSSVC.dll
2008-02-27 16:27 . 2008-02-27 16:27 392,192 --a------ C:\Windows\System32\FirewallAPI.dll
2008-02-27 16:27 . 2008-02-27 16:27 178,688 --a------ C:\Windows\System32\iphlpsvc.dll
2008-02-27 16:27 . 2008-02-27 16:27 86,016 --a------ C:\Windows\System32\icfupgd.dll
2008-02-27 16:27 . 2008-02-27 16:27 63,488 --a------ C:\Windows\System32\drivers\mpsdrv.sys
2008-02-27 16:27 . 2008-02-27 16:27 61,952 --a------ C:\Windows\System32\cmifw.dll
2008-02-27 16:27 . 2008-02-27 16:27 23,040 --a------ C:\Windows\System32\drivers\tunnel.sys
2008-02-27 16:27 . 2008-02-27 16:27 16,896 --a------ C:\Windows\System32\wfapigp.dll
2008-02-27 16:27 . 2008-02-27 16:27 15,360 --a------ C:\Windows\System32\drivers\TUNMP.SYS
2008-02-27 16:26 . 2008-02-27 16:26 3,504,696 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-02-27 16:26 . 2008-02-27 16:26 3,470,392 --a------ C:\Windows\System32\ntoskrnl.exe

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-28 21:18 --------- d-----w C:\Program Files\Microsoft Games
2008-02-27 21:28 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-02-27 21:28 --------- d-----w C:\Program Files\Windows Journal
2008-02-27 21:28 --------- d-----w C:\Program Files\Windows Collaboration
2008-02-27 21:23 319,456 ----a-w C:\Windows\DIFxAPI.dll
2008-02-27 19:14 315,392 ----a-w C:\Windows\HideWin.exe
2008-02-27 17:53 --------- d-----w C:\Users\pame\AppData\Roaming\vlc
2008-02-27 14:56 174 --sha-w C:\Program Files\desktop.ini
2008-02-27 14:40 --------- d-----w C:\Program Files\Windows Sidebar
2008-02-27 14:40 --------- d-----w C:\Program Files\Windows Mail
2008-02-27 14:40 --------- d-----w C:\Program Files\Windows Defender
2008-02-27 14:40 --------- d-----w C:\Program Files\Windows Calendar
2008-02-27 14:37 70,144 ----a-w C:\Windows\system32\drivers\pacer.sys
2008-02-27 14:37 619,008 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys
2008-02-27 14:37 61,952 ----a-w C:\Windows\system32\drivers\wanarp.sys
2008-02-27 14:37 48,640 ----a-w C:\Windows\system32\drivers\ndproxy.sys
2008-02-27 14:37 20,480 ----a-w C:\Windows\system32\drivers\ndistapi.sys
2008-02-27 14:35 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-02-27 14:35 2,923,520 ----a-w C:\Windows\explorer.exe
2008-02-27 14:35 11,264 ----a-w C:\Windows\system32\drivers\wmiacpi.sys
2008-02-27 14:18 320,000 ----a-w C:\Windows\system32\drivers\csc.sys
2008-02-27 14:17 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-27 14:17 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-27 14:17 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-27 14:17 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-27 14:11 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-27 11:42 --------- d-sh--w C:\PROGRA~2\Työpöytä
2008-02-27 11:42 --------- d-sh--w C:\PROGRA~2\Tiedostot
2008-02-27 11:42 --------- d-sh--w C:\PROGRA~2\Suosikit
2008-02-27 11:42 --------- d-sh--w C:\PROGRA~2\Mallit
2008-02-27 11:42 --------- d-sh--w C:\PROGRA~2\Käynnistä-valikko
2008-02-01 09:17 586,752 ----a-w C:\Windows\WLXPGSS.SCR
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{100EB1FD-D03E-47FD-81F3-EE91287F9465}]
C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-02-27 16:17 1232896]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:34 125440]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-04-17 12:41 196608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-02-27 16:31 1006264]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 19:04 4423680 C:\Windows\RtHDVCpl.exe]
"LayoutM"="KLayMgr.exe" [2004-08-26 14:17 45056 C:\Windows\KLayMgr.exe]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2008-01-02 09:07 141848]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2008-01-02 09:06 166424]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2008-01-02 09:07 133656]
"V0260Cfg.exe"="V0260Cfg.exe" [2006-03-27 19:00 32874 C:\Windows\V0260Cfg.exe]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-04-13 06:07 69632]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2C370E11-CA0E-4C87-8205-623B0959D07A}"= UDP:40133:utorrent
"TCP Query User{044540A0-CB49-4DE3-9692-C81AB196122C}C:\users\pame\desktop\utorrent.exe"= UDP:C:\users\pame\desktop\utorrent.exe:utorrent.exe|Desc=utorrent.exe
"UDP Query User{E8B4281A-15E6-4AD0-98FB-7CE30BF7384F}C:\users\pame\desktop\utorrent.exe"= TCP:C:\users\pame\desktop\utorrent.exe:utorrent.exe|Desc=utorrent.exe
"{24E70D5D-8F3A-43EC-B8D1-B589B4BA4DF1}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)|Edge=TRUE|
"TCP Query User{5E5DE2B5-EA86-447B-8AF3-38A9C7199A33}C:\program files\propilkki2\propilkki2.exe"= UDP:C:\program files\propilkki2\propilkki2.exe:Main executable for PP2|Desc=Main executable for PP2
"UDP Query User{BD485325-1F28-4E6F-A9E6-5E3A985C5AC5}C:\program files\propilkki2\propilkki2.exe"= TCP:C:\program files\propilkki2\propilkki2.exe:Main executable for PP2|Desc=Main executable for PP2
"TCP Query User{4AD32EE5-29F9-4B10-A4D2-B4FACBD93BD9}C:\program files\mozilla firefox\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox|Desc=Firefox
"UDP Query User{82259176-B3C6-4400-97BB-0C6B08C0DAA8}C:\program files\mozilla firefox\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox|Desc=Firefox
"{8AC6A42F-0DEA-44CC-A6A9-B4D7C45D5FBC}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{7B2CD546-5B34-45CF-83E9-78C554BF10A7}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 16:52]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-11-29 16:56]
R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-01-02 08:48]
R3 V0260VID;Live! Cam Vista IM;C:\Windows\system32\DRIVERS\V0260Vid.sys [2006-11-04 00:45]
S3 io02;Hardware Access Driver;C:\Windows\system32\io02.sys [2008-03-03 22:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97443618-e853-11dc-91e6-0017a41e9a71}]
\shell\AutoRun\command - E:\setup\rsrc\Autorun.exe
\shell\dinstall\command - E:\Directx\dxsetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce8af37f-e528-11dc-b0a4-0017a41e9a71}]
\shell\AutoRun\command - F:\LaunchU3.exe -a

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-05 12:59:21
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\system32\conime.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
.
**************************************************************************
.
Completion time: 2008-03-05 13:01:49 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-05 11:01:41
ComboFix2.txt 2008-03-04 23:31:25
.
2008-03-04 21:57:38 --- E O F ---

 

tässä uninstall lista


Adobe Flash Player Plugin
avast! Antivirus
AVG Anti-Spyware 7.5
Broadcom NetXtreme Ethernet Controller
Call of Duty(R) 4 - Modern Warfare(TM)
Creative Live! Cam Vista IM Driver (1.01.03.1104)
ffdshow [rev 1873] [2008-02-26]
HP USB Smart Card Keyboard
Intel(R) Graphics Media Accelerator Driver
IZArc 3.81
Microsoft Speech Recognition Engine 4.0 (English)
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (2.0.0.12)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 Parser and SDK
Pro Pilkki 2
Realtek High Definition Audio Driver
VideoLAN VLC media player 0.8.6d
Windows Live installer
Windows Live Messenger
Windows Liven sähköposti
Windows Liven valokuvavalikoima
WinZip 11.1

 

Joo sitten tehään näin

Avaa Windows Defender.
Klikkaa Tools ja General Settings.
Selaa alas ja ota rasti pois Turn on real-time protection (recommended)-kohdasta.
Tämän jälkeen klikkaa Save ja sulje Windows Defender.

sitten fixsaa tuo rivi

O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (file missing)

=============

Mites tuo virustotaal juttu

 

tässä hjt:loki ei mikään ihme ettei pystyny poistamaan kun yritin cd:ltä
suoraan hjt:n kanssa poistamaan :/ kävin imaisemas download.fi:stä ohjelman koneelle ni onnistui poisto..nyt koneessa uusi emo ja näytönohjain ja antecin kotelo.kiitos taas


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:28:17, on 6.3.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\taskeng.exe
C:\Users\pame\Desktop\utorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [LayoutM] KLayMgr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O13 - Gopher Prefix:
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

--
End of file - 4060 bytes

 

että rauta puoli hajalla.

 

halusin vaihtaa koppaa ni vaihdoin samal emon ja otin samal näytönohjaimen..prossun pidin..ei se hajalla ollut, 2v. vanha vaa..oliko tos lokis jotain ihmeellistä?

 

et oo ilmeisesti laitanut aloitus sivua ie puolelle

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

 

voiko siihen laittaa mozillan? :¤

 

elisa.net