onko kone puhdas?jotain vikoja? (hjt-log)

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by toope92, Feb 27, 2008.

Page 1 of 5
  1. toope92

    toope92 Regular member

    Joined:
    Nov 8, 2006
    Messages:
    140
    Likes Received:
    0
    Trophy Points:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:17:25, on 27.2.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe
    C:\WINDOWS\system32\ptlg.exe
    c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\IObit\Advanced WindowsCare V2\MemCleaner.exe
    C:\WINDOWS\arservice.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Ares\Ares.exe
    C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Last.fm\LastFMHelper.exe
    c:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Comodo\Firewall\cmdagent.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\PROGRA~1\AVG\AVG8\avgam.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    c:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\AVG\AVG8\avgui.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\AVG\AVG8\avgscanx.exe
    C:\Program Files\iTunes\iTunes.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "c:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe"
    O4 - HKLM\..\Run: [msptlg] C:\WINDOWS\ptlg.exe
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
    O4 - HKLM\..\Run: [SmartRAM] C:\Program Files\IObit\Advanced WindowsCare V2\MemCleaner.exe /m
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
    O4 - HKCU\..\Run: [Ares Galaxy Super Speed] C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe
    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
    O4 - Global Startup: ATI CATALYST -ilmaisinalue.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
    O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1204033224265
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - c:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - c:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: OneStep Search Service - Unknown owner - C:\Program Files\OneStepSearch\onestep.exe (file missing)
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
    O23 - Service: ptlg - Unknown owner - C:\WINDOWS\system32\ptlg.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

    --
    End of file - 9205 bytes
     
    toope92, Feb 27, 2008
    #1
  2. stauf

    stauf Regular member

    Joined:
    Feb 14, 2005
    Messages:
    571
    Likes Received:
    0
    Trophy Points:
    26
    Viisaammat korjatkoon jos olen väärässä, mun mielestä seuraavat olisi syytä fixata:


    C:\Program Files\Ares\Ares.exe

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE


    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O23 - Service: OneStep Search Service - Unknown owner - C:\Program Files\OneStepSearch\onestep.exe (file missing)
     
    stauf, Feb 27, 2008
    #2
  3. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina fix checked

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O23 - Service: OneStep Search Service - Unknown owner - C:\Program Files\OneStepSearch\onestep.exe (file missing)

    Mitäs virusohjelmaa käytät


    Kopioi / liitä seuraava teksti alapuolella tyhjään muistioFiluun
    Varmista että tiedoston tyyppi on ”all Files” ja tallenna se Poisto.bat. nimisenä
    työpöydällesi.

    @echo off
    sc stop ”OneStep Search Service”
    sc delete ”OneStep Search Service”


    Tupla-klikkaa Poisto.bat. filua työpöydälläsi , ikkuna avautuu ja Sulkeutuu tämä on normaalia.

    =================

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.


     
    Hujo, Feb 27, 2008
    #3
  4. toope92

    toope92 Regular member

    Joined:
    Nov 8, 2006
    Messages:
    140
    Likes Received:
    0
    Trophy Points:
    26
    virusturvana käytän avg antivirus professional edition 8.0

    ComboFix 08-02-25.3 - HP_Administrator 2008-02-28 0:18:48.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.563 [GMT 2:00]
    Running from: C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.IE5\DZGRS0FR\ComboFix[1].exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\assys.dll
    C:\WINDOWS\ffnsys.dll
    C:\WINDOWS\gstcore.dll
    C:\WINDOWS\mfnsys.dll
    C:\WINDOWS\rsczsys.dll
    C:\WINDOWS\snsys.dll
    C:\WINDOWS\uawin.dll

    .
    ((((((((((((((((((((((((( Files Created from 2008-01-27 to 2008-02-27 )))))))))))))))))))))))))))))))
    .

    2008-02-28 00:04 . 2008-02-28 00:04 86 --a------ C:\Poisto.bat
    2008-02-27 20:18 . 2007-02-22 10:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
    2008-02-27 18:26 . 2008-02-27 20:19 <DIR> d-------- C:\WINDOWS\LastGood
    2008-02-27 17:34 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-02-27 17:34 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-02-27 16:45 . 2008-02-27 18:02 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
    2008-02-27 16:45 . 2008-02-27 16:45 <DIR> d-------- C:\Program Files\AVG
    2008-02-27 16:45 . 2008-02-27 16:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
    2008-02-27 16:45 . 2008-02-27 16:45 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
    2008-02-27 16:45 . 2008-02-27 16:45 73,864 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
    2008-02-27 16:45 . 2008-02-27 16:45 14,104 --a------ C:\WINDOWS\system32\avgrsstx.dll
    2008-02-27 16:45 . 2008-02-27 16:45 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys
    2008-02-27 16:27 . 2005-05-06 22:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7I.DLL
    2008-02-27 16:27 . 2005-05-06 22:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7I.DLL
    2008-02-27 15:16 . 2008-02-27 15:16 <DIR> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
    2008-02-27 15:15 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
    2008-02-27 15:15 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys
    2008-02-27 15:14 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
    2008-02-27 15:14 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys
    2008-02-27 15:08 . 2008-02-27 15:08 <DIR> d-------- C:\WINDOWS\system32\tr-tr
    2008-02-27 15:08 . 2008-02-27 15:08 <DIR> d-------- C:\WINDOWS\system32\sv-se
    2008-02-27 00:14 . 2008-02-27 00:14 <DIR> d-------- C:\d243b376bc34650a1058be
    2008-02-27 00:14 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
    2008-02-26 23:47 . 2008-02-26 15:05 <DIR> d-a------ C:\WINDOWS\I386
    2008-02-26 23:31 . 2008-02-27 15:15 <DIR> dr-hs---- C:\WINDOWS\system32\dllcache
    2008-02-26 20:36 . 2006-10-24 12:30 716,288 --------- C:\WINDOWS\system32\WindowsCodecs.dll
    2008-02-26 20:36 . 2006-10-24 12:30 412,160 --------- C:\WINDOWS\system32\photometadatahandler.dll
    2008-02-26 20:36 . 2006-10-24 12:29 352,256 --------- C:\WINDOWS\system32\WindowsCodecsExt.dll
    2008-02-26 20:36 . 2006-10-24 12:30 276,992 --------- C:\WINDOWS\system32\WMPhoto.dll
    2008-02-26 20:35 . 2006-10-14 20:22 1,698,048 --------- C:\WINDOWS\system32\XpsSvcs.dll
    2008-02-26 20:35 . 2006-10-14 20:22 1,698,048 --------- C:\WINDOWS\system32\dllcache\XpsSvcs.dll
    2008-02-26 20:35 . 2006-10-14 16:44 671,744 --------- C:\WINDOWS\system32\dllcache\PrintFilterPipelineSvc.exe
    2008-02-26 20:35 . 2006-10-14 20:21 580,352 --------- C:\WINDOWS\system32\XPSSHHDR.dll
    2008-02-26 20:35 . 2006-10-14 20:21 580,352 --------- C:\WINDOWS\system32\dllcache\XPSSHHDR.dll
    2008-02-26 20:35 . 2006-11-13 08:02 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll
    2008-02-26 20:35 . 2006-10-14 16:43 124,416 --------- C:\WINDOWS\system32\prntvpt.dll
    2008-02-26 20:35 . 2006-11-13 08:02 116,736 --------- C:\WINDOWS\system32\aaclient.dll
    2008-02-26 20:35 . 2006-11-13 08:02 36,352 --------- C:\WINDOWS\system32\tsgqec.dll
    2008-02-26 20:35 . 2006-10-14 16:43 27,648 --------- C:\WINDOWS\system32\dllcache\FilterPipelinePrintProc.dll
    2008-02-26 20:33 . 2005-10-28 23:49 151,552 --------- C:\WINDOWS\system32\ifxcardm.dll
    2008-02-26 20:33 . 2005-10-28 23:49 133,120 --------- C:\WINDOWS\system32\axaltocm.dll
    2008-02-26 20:33 . 2005-10-28 16:40 96,792 --------- C:\WINDOWS\system32\basecsp.dll
    2008-02-26 20:33 . 2005-10-28 23:49 84,480 --------- C:\WINDOWS\system32\pintool.exe
    2008-02-26 20:33 . 2005-10-28 23:49 25,600 --------- C:\WINDOWS\system32\bcsprsrc.dll
    2008-02-26 20:17 . 2008-02-26 20:17 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Comodo
    2008-02-26 20:17 . 2008-02-26 20:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Comodo
    2008-02-26 20:13 . 2008-02-26 20:13 <DIR> d-------- C:\Program Files\Comodo
    2008-02-26 20:13 . 2008-02-26 20:13 3,724,840 --a------ C:\WINDOWS\sprmvr.exe
    2008-02-26 20:13 . 2008-02-26 15:07 281 --a------ C:\boot.ini.comodofirewall
    2008-02-26 18:12 . 2008-02-26 18:12 1,452,487 --a------ C:\WINDOWS\system32\ptlg.exe
    2008-02-26 18:12 . 2008-02-26 18:12 1,452,487 --a------ C:\WINDOWS\ptlg.exe
    2008-02-26 18:12 . 2008-02-26 18:12 466,432 --a------ C:\WINDOWS\ IEXPLORE.EXE
    2008-02-26 16:34 . 2007-02-28 11:10 2,180,352 --------- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
    2008-02-26 16:34 . 2007-02-28 11:08 2,136,064 --------- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
    2008-02-26 16:34 . 2007-02-28 10:38 2,057,600 --------- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
    2008-02-26 16:34 . 2007-02-28 10:38 2,015,744 --------- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
    2008-02-26 16:32 . 2006-05-05 11:41 453,120 --------- C:\WINDOWS\system32\dllcache\mrxsmb.sys
    2008-02-26 16:32 . 2006-06-01 20:47 163,840 --------- C:\WINDOWS\system32\dllcache\jgdw400.dll
    2008-02-26 16:32 . 2006-03-17 03:05 28,672 --------- C:\WINDOWS\system32\verclsid.exe
    2008-02-26 16:32 . 2006-06-01 20:47 27,648 --------- C:\WINDOWS\system32\dllcache\jgpl400.dll
    2008-02-26 16:28 . 2007-06-25 14:02 475,136 --a------ C:\WINDOWS\system32\SkinCrafter2.dll
    2008-02-26 16:17 . 2008-02-27 17:37 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-02-26 16:17 . 2008-02-26 16:17 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-02-26 15:31 . 2008-02-26 15:31 <DIR> d-------- C:\SystemRoot
    2008-02-26 15:28 . 2008-02-27 20:20 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
    2008-02-26 15:28 . 2006-07-18 21:05 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe
    2008-02-26 15:19 . 2008-02-27 11:52 <DIR> d-------- C:\temp
    2008-02-26 15:04 . 2008-02-26 15:04 1,841 -rahs---- C:\WINDOWS\system32\drivers\103C_HP_CPC_EP061AA-ABX m7350.fi_YC_0Pavi_QCZB602_E61FIemMPC1_48_IAMETHYST-M_SMSI_V1.0_B3.40_T051213_WXP2_L409_M1023_J250_7AMD_8Athlon 64_92.19_#060301_N10EC8139_Z_G10027146_OTSSTcorp CD DVDW TS-H552L_DSAM0115.MRK
    2008-02-26 15:03 . 2005-01-02 14:20 <DIR> d-------- C:\Documents and Settings\HP_Administrator\WINDOWS
    2008-02-26 15:03 . 2008-02-26 15:05 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Symantec
    2008-02-26 15:03 . 2005-01-02 14:03 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\ATI
    2008-02-26 15:01 . 2005-01-02 14:20 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\WINDOWS
    2008-02-26 14:58 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
    2008-02-26 14:58 . 2004-08-04 00:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
    2008-02-26 14:58 . 2004-08-03 22:58 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
    2008-02-26 14:58 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
    2008-02-26 14:58 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
    2008-02-26 14:58 . 2001-08-17 22:36 8,704 --a------ C:\WINDOWS\system32\kbdjpn.dll
    2008-02-26 14:58 . 2001-08-17 14:55 6,144 --a------ C:\WINDOWS\system32\kbd106.dll
    2008-02-23 23:22 . 2008-02-23 23:31 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Canon
    2008-02-20 18:44 . 2008-02-20 18:45 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\DivX
    2008-02-19 19:04 . 2008-02-19 19:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Last.fm
    2008-02-19 19:03 . 2008-02-19 19:04 <DIR> d-------- C:\Program Files\Last.fm
    2008-02-19 16:50 . 2008-02-19 16:50 <DIR> d--hs---- C:\Documents and Settings\LocalService\UserData
    2008-02-17 17:30 . 2008-02-17 17:30 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\IObit
    2008-02-17 14:06 . 2008-02-17 14:06 <DIR> d-------- C:\Program Files\NeroInstall.bak
    2008-02-10 19:47 . 2008-02-10 19:47 <DIR> d-------- C:\Program Files\WinCustomize
    2008-02-10 19:47 . 2008-02-10 19:47 <DIR> d-------- C:\Program Files\Common Files\Stardock
    2008-02-10 19:29 . 2008-02-10 23:31 <DIR> d-------- C:\Program Files\themexp
    2008-02-10 19:29 . 2008-02-10 23:31 <DIR> d-------- C:\Program Files\Save
    2008-02-09 21:58 . 2006-11-02 04:34 418,304 --a------ C:\WINDOWS\system\shellstyle.dll
    2008-02-09 20:18 . 2008-02-09 20:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
    2008-02-08 21:29 . 2008-02-08 21:29 <DIR> d-------- C:\Program Files\GIMP-2.0
    2008-02-02 18:52 . 2008-02-26 15:26 <DIR> d-------- C:\Program Files\MSN Messenger
    2008-01-31 23:13 . 2008-01-31 23:13 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
    2008-01-31 23:13 . 2008-01-31 23:13 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-02-27 16:37 --------- d-----w C:\Program Files\OneStepSearch
    2008-02-27 16:31 --------- d-----w C:\Program Files\Windows Live Safety Center
    2008-02-27 14:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-02-27 13:30 1,130 ----a-w C:\Documents and Settings\HP_Administrator\Application Data\wklnhst.dat
    2008-02-27 13:26 --------- d-----w C:\Program Files\DivX
    2008-02-27 09:52 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-02-26 16:16 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-02-26 14:28 --------- d-----w C:\Program Files\AresGalaxySuperSpeed
    2008-02-26 14:16 --------- d-----w C:\Program Files\QuickTime
    2008-02-26 13:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-02-26 13:33 --------- d-----w C:\Program Files\Symantec
    2008-02-26 13:33 --------- d-----w C:\Program Files\Google
    2008-02-26 13:14 139,264 ----a-w C:\WINDOWS\system32\hpzjrd01.dll
    2008-02-26 13:09 --------- d-----w C:\Program Files\Windows Live Toolbar
    2008-02-26 13:04 1,841 --sha-r C:\WINDOWS\system32\drivers\103C_HP_CPC_EP061AA-ABX m7350.fi_YC_0Pavi_QCZB602_E61FIemMPC1_48_IAMETHYST-M_SMSI_V1.0_B3.40_T051213_WXP2_L409_M1023_J250_7AMD_8Athlon 64_92.19_#060301_N10EC8139_Z_G10027146_OTSSTcorp CD DVDW TS-H552L_DSAM0115.MRK
    2008-02-26 12:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-02-23 18:39 --------- d-----w C:\Program Files\iTunes
    2008-02-23 18:39 --------- d-----w C:\Program Files\iPod
    2008-02-11 19:07 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Nokia
    2008-02-10 15:35 --------- d-----w C:\Program Files\Subdownloader
    2008-02-09 18:28 --------- d-----w C:\Program Files\Bonjour
    2008-02-09 18:27 --------- d-----w C:\Program Files\QuickTime Alternative
    2008-02-09 18:14 --------- d-----w C:\Program Files\CCleaner
    2008-02-07 20:42 --------- d-----w C:\Program Files\Managed DirectX (0901)
    2008-02-03 19:16 --------- d-----w C:\Program Files\Yahoo!
    2008-01-22 18:13 --------- d-----w C:\Program Files\Common Files\ScanSoft Shared
    2008-01-22 18:11 --------- d-----w C:\Program Files\Canon
    2008-01-22 15:10 --------- d-----w C:\Program Files\Windows Doctor
    2008-01-21 19:21 --------- d-----w C:\Program Files\VideoLAN
    2008-01-21 19:21 --------- d-----w C:\Program Files\IObit
    2008-01-19 10:22 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-01-18 20:11 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Apple Computer
    2008-01-18 20:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-01-18 05:21 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\AdobeUM
    2008-01-17 19:13 --------- d-----w C:\Program Files\Windows Media Connect 2
    2008-01-16 22:36 --------- d-----w C:\Documents and Settings\Heviä Perkele\Application Data\HPQ
    2008-01-16 22:30 --------- d-----w C:\Documents and Settings\Heviä Perkele\Application Data\Nero
    2008-01-16 22:09 --------- d-----w C:\Program Files\Audible
    2008-01-16 22:07 --------- d--h--w C:\Program Files\Creative Installation Information
    2008-01-16 17:25 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\ScanSoft
    2008-01-16 13:16 --------- d-----w C:\Program Files\Mozilla Firefox 3 Beta 2
    2008-01-14 14:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
    2008-01-13 14:16 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\vlc
    2008-01-13 13:10 --------- d-----w C:\Program Files\RegCure
    2008-01-13 13:08 --------- d-----w C:\Program Files\ExpressZIP
    2008-01-13 01:34 210,593 ----a-w C:\! Ahead Nero 8 all versions crack.exe
    2008-01-12 17:35 --------- d-----w C:\Program Files\Creative
    2008-01-12 09:19 --------- d-----w C:\Program Files\SymNetDrv
    2008-01-12 08:54 --------- d-----w C:\Program Files\Save(4)
    2008-01-11 22:23 --------- d-----w C:\Program Files\HP DigitalMedia Archive
    2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
    2008-01-10 22:00 --------- d-----w C:\Program Files\Common Files\Nero
    2008-01-09 15:23 --------- d-----w C:\Program Files\Lavasoft
    2008-01-09 15:22 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-01-09 15:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-01-09 13:44 --------- d-----w C:\Program Files\Panda Security
    2008-01-08 22:56 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\WinBatch
    2008-01-08 22:02 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\HPQ
    2008-01-08 21:57 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\gtk-2.0
    2008-01-07 18:59 --------- d-----w C:\Program Files\Nero
    2008-01-07 18:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
    2008-01-07 17:41 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Template
    2008-01-07 13:53 --------- d-----w C:\Program Files\RegistryFix
    2008-01-06 19:19 --------- d-----w C:\Program Files\Shareaza Applications
    2008-01-06 19:19 --------- d-----w C:\Program Files\RegistrySmart
    2008-01-06 19:11 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\RegistrySmart
    2008-01-06 14:04 --------- d-----w C:\Program Files\Red Kawa
    2008-01-06 14:04 --------- d-----w C:\Program Files\AviSynth 2.5
    2008-01-06 13:03 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\DAEMON Tools
    2008-01-05 20:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Creative
    2008-01-05 18:59 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Nero
    2008-01-05 17:43 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\iolo
    2008-01-05 17:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\iolo
    2008-01-05 17:18 --------- d-----w C:\Program Files\WinClamAVShield
    2008-01-04 23:57 --------- d-----w C:\Program Files\Ares
    2008-01-04 23:07 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\LimeWire
    2008-01-04 22:47 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Sonic
    2008-01-04 22:44 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Leadertech
    2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
    2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
    2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
    2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
    2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
    2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
    2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
    2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
    2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
    2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
    2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
    2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
    2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
    2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
    2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
    2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
    2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
    2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
    2008-01-04 21:35 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Creative
    2008-01-04 15:57 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\InterVideo
    2008-01-04 15:23 --------- d-----w C:\Program Files\Common Files\Creative
    2008-01-03 22:50 --------- d-----w C:\Program Files\Common Files\Download Manager
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-02-26 15:08 171448]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 14:00 15360]
    "ares"="C:\Program Files\Ares\Ares.exe" [2008-02-20 16:33 963072]
    "Ares Galaxy Super Speed"="C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe" [2008-01-22 10:31 610304]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HPHUPD08"="c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 08:35 49152]
    "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 22:14 237568]
    "Reminder"="C:\Windows\Creator\Remind_XP.exe" [2004-12-14 02:23 663552]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 06:12 49152]
    "KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44 61440]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
    "iTunesHelper"="c:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
    "Adobe Photo Downloader"="C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe" [2007-12-04 02:07 61440]
    "msptlg"="C:\WINDOWS\ptlg.exe" [2008-02-26 18:12 1452487]
    "SmartRAM"="C:\Program Files\IObit\Advanced WindowsCare V2\MemCleaner.exe" [2007-10-29 16:43 662016]
    "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-02-27 16:45 899864]
    "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 14:10 271360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 09:17 1241088]

    C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\
    Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-02-19 19:04:00 106496]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    ATI CATALYST -ilmaisinalue.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [2005-10-02 18:13:42 57344]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 06:23:26 282624]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
    "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoResolveSearch"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=avgrsstx.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "C:\\Program Files\\MSN Messenger\\livecall.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Ares\\Ares.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

    R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-02-27 16:45]
    R0 dontgo;Promise Removable Disk Control Driver;C:\WINDOWS\system32\DRIVERS\DontGo.sys [2004-06-30 06:25]
    R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-02-27 16:45]
    R2 Automattinen LiveUpdate-ajastustoiminto;Automattinen LiveUpdate-ajastustoiminto;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2006-08-03 17:58]
    R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-02-27 16:45]
    R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-02-27 16:45]
    R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-02-27 16:45]
    R3 3xHybrid;ASUSTek SAA713x PCI Card;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2007-01-26 10:42]
    S2 ptlg;ptlg;C:\WINDOWS\system32\ptlg.exe [2008-02-26 18:12]
    S3 WN5301;LIteon Wireless PCI Network Adapter Service;C:\WINDOWS\system32\DRIVERS\wn5301.sys [2005-10-05 19:44]
    S3 WN5401;Liteon Wireless LAN PCI 802.11 a/b/g adapter WN5401A;C:\WINDOWS\system32\DRIVERS\wn5401.sys [2005-01-07 02:08]
    S4 OneStep Search Service;OneStep Search Service;"C:\Program Files\OneStepSearch\onestep.exe" "C:\Program Files\OneStepSearch\onestep.dll" Service []

    *Newly Created Service* - AVG8EMC
    *Newly Created Service* - AVG8WD
    *Newly Created Service* - AVGLDX86
    *Newly Created Service* - AVGMFX86
    *Newly Created Service* - AVGTDIX
    *Newly Created Service* - SERVICELAYER
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-02-22 15:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
    - C:\Program Files\TuneUp Utilities 2008\OneClick.exe
    "2008-02-26 14:15:58 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - c:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-02-25 23:41:00 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
    - C:\Program Files\Windows Defender\MpCmdRun.exe
    "2008-02-25 18:00:00 C:\WINDOWS\Tasks\Norton Internet Security - Suorita täyd. järj.tarkistus - shit.job"
    - C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
    "2008-01-12 01:30:00 C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job"
    - C:\Program Files\RegistrySmart\RegistrySmart.ex
    - C:\Program Files\RegistrySmart
    "2008-02-27 21:40:02 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    "2008-02-27 22:20:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{AAA277C7-6104-4946-AEFF-D1A95C0FE36F}.job"
    - C:\WINDOWS\system32\msfeedssync.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-28 00:23:30
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-02-28 0:24:04
    ComboFix-quarantined-files.txt 2008-02-27 22:23:56
    ComboFix2.txt 2008-01-03 12:31:10
    .
    2008-02-26 15:13:29 --- E O F ---
     
    toope92, Feb 27, 2008
    #4
  5. Hujo

    Hujo Guest

    Jos nortoni löytyy lisää poista sovelutuksesta poista sieltä ensin

    lataa ja suorita
    Nortonin poisto kalu

    ===================


    scannaa hjt:llä merkkaa paina Fix checked

    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

    ==========

    Kopioi / liitä seuraava teksti alapuolella tyhjään muistioFiluun
    Varmista että tiedoston tyyppi on ”all Files” ja tallenna se Poisto.bat. nimisenä
    työpöydällesi.

    @echo off
    sc stop LiveUpdate
    sc delete LiveUpdate
    sc stop SNDSrvc
    sc delete SNDSrvc

    Tupla-klikkaa Poisto.bat. filua työpöydälläsi , ikkuna avautuu ja Sulkeutuu tämä on normaalia.


    ===================

    * Klikkaa Käynnistä.
    * Avaa Oma Tietokone.
    * Valitse Työkalut ylämenusta ja klikkaa Kansion asetukset.
    * Valitse Näytä välilehti.
    * Piilotiedostot/kansiot kohdalla valitse Näytä piilotetut tiedostot ja kansiot.
    * Poista rasti ruudusta -> Piilota suojatut käyttöjärjestelmätiedostot
    * Klikkaa Kyllä varmistaaksesi muutokset.
    * Klikkaa OK.


    Poista kansiot vikasiedossa

    C:\Program Files\Save
    C:\Documents and Settings\HP_Administrator\Application Data\LimeWire
    c:\Program Files\Common Files\Symantec Shared
    C:\Documents and Settings\HP_Administrator\Application Data\Symantec
    C:\Program Files\Symantec

    ================

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Last edited by a moderator: Feb 27, 2008
    Hujo, Feb 27, 2008
    #5
  6. toope92

    toope92 Regular member

    Joined:
    Nov 8, 2006
    Messages:
    140
    Likes Received:
    0
    Trophy Points:
    26
    En ole varma onko tämä se report mitä haitte!
    a-squared Command Line Scanner v. 3.0.0.126
    (C) 2003-2007 Emsi Software GmbH - www.emsisoft.com

    ID Object
    0 Value: HKEY_CURRENT_USER\Software\Ares --> Extra.ShowActiveCaption detected: Trace.Registry.Ares
    1 Value: HKEY_CURRENT_USER\Software\Ares --> Playlist.PreviousM3UApp detected: Trace.Registry.Ares
    2 Value: HKEY_CURRENT_USER\Software\Ares --> Network.DHTID detected: Trace.Registry.Ares
    3 c:\program files\ares\data\gui\general\prefs.txt detected: Trace.File.Ares
    4 c:\program files\ares\lang\french.txt detected: Trace.File.Ares
    5 Value: HKEY_CURRENT_USER\Software\Ares --> Transfer.ServerPort detected: Trace.Registry.Ares
    6 Value: HKEY_CURRENT_USER\Software\Ares --> PrivateMessage.AllowBrowse detected: Trace.Registry.Ares
    7 Value: HKEY_CURRENT_USER\Software\Ares --> Hashing.Priority detected: Trace.Registry.Ares
    8 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.CUpSpeed detected: Trace.Registry.Ares
    9 c:\program files\ares\asyncex.ax detected: Trace.File.Ares
    10 c:\program files\ares\data\blocked.txt.sample detected: Trace.File.Ares
    11 c:\program files\ares\lang\french.txt detected: Trace.File.Ares
    12 Value: HKEY_CURRENT_USER\Software\Ares --> Privacy.SendRegularPath detected: Trace.Registry.Ares
    13 C:\Documents and Settings\Bloodpuppet\My Documents\My Music\MuZaa\My Music\PhotoShop CS3 Extended Keygen + Activation.rar\PhotoShop CS3 Extended Keygen + Activation.rar detected: Trojan-Spy.Win32.Banker.gez
    14 c:\program files\ares\asyncex.ax detected: Trace.File.Ares
    15 Value: HKEY_CURRENT_USER\Software\Ares --> GUI.LastLibrary detected: Trace.Registry.Ares
    16 Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ares --> URLInfoAbout detected: Trace.Registry.Ares
    17 Value: HKEY_CURRENT_USER\Software\Ares\Columns\Transfers --> Download detected: Trace.Registry.Ares
    18 C:\Documents and Settings\Bloodpuppet\Application Data\Mozilla\Firefox\Profiles\502fgxza.default\cookies.txt:12 detected: Trace.TrackingCookie
    19 Value: HKEY_CURRENT_USER\Software\Ares --> Extra.ShowActiveCaption detected: Trace.Registry.Ares
    20 c:\program files\ares\data\blocked_keywords.txt.sample detected: Trace.File.Ares
    21 Value: HKEY_CURRENT_USER\Software\Ares --> General.AutoConnect detected: Trace.Registry.Ares
    22 c:\program files\ares\lang detected: Trace.Directory.Ares
    23 Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ares --> UninstallString detected: Trace.Registry.Ares
    24 c:\documents and settings\hp_administrator\start menu\programs\ares detected: Trace.Directory.Ares
    25 c:\program files\ares\data\blocked.txt.sample detected: Trace.File.Ares
    26 Value: HKEY_CURRENT_USER\Software\Ares --> General.AutoStartUp detected: Trace.Registry.Ares
    27 Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ares --> Publisher detected: Trace.Registry.Ares
    28 c:\program files\ares\lang\italian.txt detected: Trace.File.Ares
    29 C:\Program Files\OneStepSearch\uninstall.exe detected: Adware.Win32.OneStep.c
    30 c:\program files\ares\lang\slovak.txt detected: Trace.File.Ares
    31 Value: HKEY_CURRENT_USER\Software\Ares --> GUI.LastLibrary detected: Trace.Registry.Ares
    32 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.CUpSpeed detected: Trace.Registry.Ares
    33 Value: HKEY_CURRENT_USER\Software\Ares --> Network.DHTID detected: Trace.Registry.Ares
    34 Value: HKEY_CURRENT_USER\Software\Ares\Positions\Transfers --> Download detected: Trace.Registry.Ares
    35 Value: HKEY_CLASSES_ROOT\arlnk --> URL Protocol detected: Trace.Registry.Ares
    36 C:\WINDOWS\Explorer.EXE detected: Adware.Win32.OneStep.d
    37 C:\hp\bin\KillWind.exe detected: Riskware.RiskTool.Win32.PsKill.p
    38 c:\program files\myglobalsearch detected: Trace.Directory.MyGlobalSearchToolbar
    39 Value: HKEY_CURRENT_USER\Software\Ares --> ChatRoom.AutoAddToFavorites detected: Trace.Registry.Ares
    40 c:\program files\ares\data\gui\general\transfer.bmp detected: Trace.File.Ares
    41 c:\program files\ares\data\gui\general\searchpnl.bmp detected: Trace.File.Ares
    42 c:\program files\ares\data\gui\general\emotic.bmp detected: Trace.File.Ares
    43 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.LstCaQuery detected: Trace.Registry.Ares
    44 Value: HKEY_CURRENT_USER\Software\Ares\Data --> AresNet1 detected: Trace.Registry.Ares
    45 c:\program files\ares\data\gui\general\mimesmall.bmp detected: Trace.File.Ares
    46 c:\program files\ares\lang\dutch.txt detected: Trace.File.Ares
    47 Value: HKEY_CURRENT_USER\Software\Ares --> Playlist.PreviousM3UApp detected: Trace.Registry.Ares
    48 Value: HKEY_CURRENT_USER\Software\Ares\Columns\Transfers --> Queue detected: Trace.Registry.Ares
    49 c:\program files\ares\data\chanlistfilter.txt detected: Trace.File.Ares
    50 Value: HKEY_CURRENT_USER\Software\Ares\Data --> AresNet1 detected: Trace.Registry.Ares
    51 c:\program files\ares\ares.exe detected: Trace.File.Ares
    52 Value: HKEY_CURRENT_USER\Software\Ares --> General.MSNSongNotif detected: Trace.Registry.Ares
    53 C:\Documents and Settings\Bloodpuppet\My Documents\My Music\MuZaa\My Music\PhotoShop CS3 Extended Keygen + Activation.rar\PhotoShop CS3 Extended Keygen + Activation.rar detected: Trojan-Spy.Win32.Banker.gez
    54 c:\program files\ares\data\p2pfilter.txt detected: Trace.File.Ares
    55 Value: HKEY_CURRENT_USER\Software\Ares --> General.LastLibraryMode detected: Trace.Registry.Ares
    56 Key: HKEY_LOCAL_MACHINE\software\kazaa detected: Trace.Registry.KaZaA
    57 c:\program files\ares\lang\spanish.txt detected: Trace.File.Ares
    58 c:\documents and settings\bloodpuppet\start menu\programs\ares detected: Trace.Directory.Ares
    59 Value: HKEY_CLASSES_ROOT\CLSID\{3E0FA044-926C-42D9-BA12-EF16E980913B}\InprocServer32 --> ThreadingModel detected: Trace.Registry.Ares
    60 c:\program files\ares\data\gui\general\libbig.bmp detected: Trace.File.Ares
    61 Value: HKEY_LOCAL_MACHINE\software\kazaa\cloudload --> sharedir detected: Trace.Registry.KaZaA
    62 Value: HKEY_CURRENT_USER\Software\Ares --> ChatRoom.AutoClose detected: Trace.Registry.Ares
    63 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.CFRTime detected: Trace.Registry.Ares
    64 c:\documents and settings\hp_administrator\desktop\ares.lnk detected: Trace.File.Ares
    65 c:\documents and settings\hp_administrator\start menu\programs\ares\ares.lnk detected: Trace.File.Ares
    66 C:\Program Files\Mozilla Firefox\firefox.exe detected: Adware.Win32.OneStep.d
    67 C:\Program Files\ATI Technologies\ATI.ACE\cli.exe detected: Adware.Win32.OneStep.d
    68 Value: HKEY_CURRENT_USER\Software\Ares --> GUI.LastSearch detected: Trace.Registry.Ares
    69 Value: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run --> reminder detected: Trace.Registry.FTPAttack
    70 c:\documents and settings\bloodpuppet\start menu\programs\ares\ares.lnk detected: Trace.File.Ares
    71 c:\program files\ares\lang\swedish.txt detected: Trace.File.Ares
    72 Value: HKEY_CURRENT_USER\Software\Ares --> Playlist.PreviousASXApp detected: Trace.Registry.Ares
    73 c:\program files\ares\tcpip_patcher.sys detected: Trace.File.Ares
    74 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.LstCaQueryInt detected: Trace.Registry.Ares
    75 c:\program files\ares\lang\turkish.txt detected: Trace.File.Ares
    76 Value: HKEY_CURRENT_USER\Software\Ares --> General.MSNSongNotif detected: Trace.Registry.Ares
    77 Value: HKEY_CURRENT_USER\Software\Ares --> Playlist.PreviousWAXApp detected: Trace.Registry.Ares
    78 Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ares --> Publisher detected: Trace.Registry.Ares
    79 Value: HKEY_CURRENT_USER\Software\Ares --> PrivateMessage.AwayMessage detected: Trace.Registry.Ares
    80 C:\Program Files\OneStepSearch\onestep.exe detected: Adware.Win32.OneStep.b
    81 Value: HKEY_CURRENT_USER\Software\Ares --> PrivateMessage.AwayMessage detected: Trace.Registry.Ares
    82 Value: HKEY_CURRENT_USER\Software\Ares\Data --> JI.AresNet1 detected: Trace.Registry.Ares
    83 c:\program files\ares\ares.exe detected: Trace.File.Ares
    84 c:\program files\macrogaming\sweetim detected: Trace.Directory.Sweet IM
    85 c:\program files\ares\data\gui\general\emotic.bmp detected: Trace.File.Ares
    86 c:\program files\ares\chatserver.exe detected: Trace.File.Ares
    87 c:\program files\ares\lang detected: Trace.Directory.Ares
    88 c:\program files\ares\lang\polish.txt detected: Trace.File.Ares
    89 Value: HKEY_CURRENT_USER\Software\Ares\Columns\Transfers --> Upload detected: Trace.Registry.Ares
    90 Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ares --> UninstallString detected: Trace.Registry.Ares
    91 c:\program files\ares\chatserver.exe detected: Trace.File.Ares
    92 Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ares --> DisplayVersion detected: Trace.Registry.Ares
    93 Value: HKEY_CURRENT_USER\Software\Ares\Positions\Transfers --> Queue detected: Trace.Registry.Ares
    94 c:\program files\ares\data\gui\general\mshareset.bmp detected: Trace.File.Ares
    95 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.LstCaQueryInt detected: Trace.Registry.Ares
    96 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.CAvgTime detected: Trace.Registry.Ares
    97 C:\HP\KBD\KBD.EXE detected: Adware.Win32.OneStep.d
    98 Value: HKEY_CURRENT_USER\Software\Ares --> PrivateMessage.AllowBrowse detected: Trace.Registry.Ares
    99 c:\program files\ares\lang\czech.txt detected: Trace.File.Ares
    100 Value: HKEY_CURRENT_USER\Software\Ares\Columns\Transfers --> Upload detected: Trace.Registry.Ares
    101 Key: HKEY_CLASSES_ROOT\clsid\{9afb8248-617f-460d-9366-d71cdeda3179} detected: Trace.Registry.FunWebProducts
    102 C:\Documents and Settings\Bloodpuppet\Desktop\SDFix.exe detected: Riskware.RiskTool.Win32.Processor.20
    103 C:\Documents and Settings\Bloodpuppet\My Documents\My Music\MuZaa\My Music\PhotoShop CS3 Extended Keygen + Activation.rar\PhotoShop CS3 Extended Keygen + Activation.rar detected: Trojan-Spy.Win32.Banker.gez
    104 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.LstCaQuery detected: Trace.Registry.Ares
    105 C:\Program Files\Logitech\SetPoint\SetPoint.exe detected: Adware.Win32.OneStep.d
    106 Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ares --> URLInfoAbout detected: Trace.Registry.Ares
    107 Value: HKEY_CURRENT_USER\Software\Ares --> Transfer.ServerPort detected: Trace.Registry.Ares
    108 Value: HKEY_CLASSES_ROOT\arlnk --> URL Protocol detected: Trace.Registry.Ares
    109 Value: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run --> ares detected: Trace.Registry.Ares
    110 Value: HKEY_CURRENT_USER\Software\Ares\Columns\Transfers --> Download detected: Trace.Registry.Ares
    111 C:\Program Files\Mozilla Firefox\plugins\NPMyGlSh.dll detected: Adware.Win32.MyWebSearch.i
    112 c:\program files\ares\data\gui\general\searchpnl.bmp detected: Trace.File.Ares
    113 Value: HKEY_CURRENT_USER\Software\Ares\bounds --> Main.Maximized detected: Trace.Registry.Ares
    114 c:\program files\ares\data\gui\general\logo.bmp detected: Trace.File.Ares
    115 Value: HKEY_CURRENT_USER\Software\Ares --> General.LastLibraryMode detected: Trace.Registry.Ares
    116 Value: HKEY_CURRENT_USER\Software\Ares\bounds --> Main.Maximized detected: Trace.Registry.Ares
    117 c:\program files\ares\data\gui\general\searchstars.bmp detected: Trace.File.Ares
    118 c:\program files\ares\data\gui\general\transfer.bmp detected: Trace.File.Ares
    119 c:\program files\ares detected: Trace.Directory.Ares
    120 c:\program files\ares\data\blocked_keywords.txt.sample detected: Trace.File.Ares
    121 Value: HKEY_CURRENT_USER\Software\Ares\Positions\Transfers --> Download detected: Trace.Registry.Ares
    122 c:\program files\ares\data\chanlistfilter.txt detected: Trace.File.Ares
    123 Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ares --> DisplayName detected: Trace.Registry.Ares
    124 c:\program files\ares\lang\czech.txt detected: Trace.File.Ares
    125 C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0lxfxzw4.default\cookies.txt:22 detected: Trace.TrackingCookie
    126 c:\program files\ares\tcpippatcherdll.dll detected: Trace.File.Ares
    127 c:\program files\ares\data\gui\general\logo.bmp detected: Trace.File.Ares
    128 c:\program files\ares\lang\german.txt detected: Trace.File.Ares
    129 Value: HKEY_CURRENT_USER\Software\Ares --> Transfer.MaximizeUpBandOnIdle detected: Trace.Registry.Ares
    130 c:\program files\ares\lang\slovak.txt detected: Trace.File.Ares
    131 Value: HKEY_CURRENT_USER\Software\Ares\Data --> JI.AresNet1 detected: Trace.Registry.Ares
    132 c:\program files\ares\data\gui\general\tabssmall.bmp detected: Trace.File.Ares
    133 Value: HKEY_CURRENT_USER\Software\Ares --> General.Language detected: Trace.Registry.Ares
    134 Value: HKEY_CURRENT_USER\Software\Ares --> Hashing.Priority detected: Trace.Registry.Ares
    135 c:\program files\ares\tcpippatcherdll.dll detected: Trace.File.Ares
    136 c:\program files\ares\lang\italian.txt detected: Trace.File.Ares
    137 c:\program files\ares detected: Trace.Directory.Ares
    138 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.CFRTime detected: Trace.Registry.Ares
    139 Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ares --> URLUpdateInfo detected: Trace.Registry.Ares
    140 c:\program files\ares\data\gui\general\chat.bmp detected: Trace.File.Ares
    141 Value: HKEY_CURRENT_USER\Software\Ares --> GUI.LastSearch detected: Trace.Registry.Ares
    142 Value: HKEY_CURRENT_USER\Software\Ares\Positions\Transfers --> Upload detected: Trace.Registry.Ares
    143 c:\program files\ares\libfaad2.dll detected: Trace.File.Ares
    144 Value: HKEY_CURRENT_USER\Software\Ares --> ChatRoom.ShowTaskBtn detected: Trace.Registry.Ares
    145 Value: HKEY_CURRENT_USER\Software\Ares --> Privacy.SendRegularPath detected: Trace.Registry.Ares
    146 Value: HKEY_CURRENT_USER\Software\Ares --> Transfer.MaximizeUpBandOnIdle detected: Trace.Registry.Ares
    147 Value: HKEY_CURRENT_USER\Software\Ares\Columns\Transfers --> Queue detected: Trace.Registry.Ares
    148 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.HasLQCa detected: Trace.Registry.Ares
    149 Value: HKEY_CLASSES_ROOT\Media Type\Extensions\.avi --> Source Filter detected: Trace.Registry.DivoCodec
    150 C:\Program Files\OneStepSearch\onestep.exe detected: Adware.Win32.OneStep.b
    151 c:\program files\ares\lang\turkish.txt detected: Trace.File.Ares
    152 c:\program files\ares detected: Trace.Directory.Ares
    153 c:\program files\ares\mp3source.ax detected: Trace.File.Ares
    154 C:\WINDOWS\Explorer.EXE detected: Adware.Win32.OneStep.d
    155 c:\program files\ares\lang\dutch.txt detected: Trace.File.Ares
    156 Value: HKEY_CURRENT_USER\Software\Ares\Positions\Transfers --> Upload detected: Trace.Registry.Ares
    157 Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ares --> DisplayVersion detected: Trace.Registry.Ares
    158 c:\program files\ares\lang\german.txt detected: Trace.File.Ares
    159 C:\Program Files\OneStepSearch\onestep.exe detected: Adware.Win32.OneStep.b
    160 c:\program files\ares\lang\japanese.txt detected: Trace.File.Ares
    161 Value: HKEY_CURRENT_USER\Software\Ares --> ChatRoom.AutoAddToFavorites detected: Trace.Registry.Ares
    162 Value: HKEY_CURRENT_USER\Software\Ares --> ChatRoom.ShowTaskBtn detected: Trace.Registry.Ares
    163 c:\program files\ares\data detected: Trace.Directory.Ares
    164 c:\program files\ares\lang\spanish.txt detected: Trace.File.Ares
    165 c:\program files\ares\data\gui\general\searchstars.bmp detected: Trace.File.Ares
    166 c:\program files\ares\mp3source.ax detected: Trace.File.Ares
    167 c:\program files\ares\ares.exe detected: Trace.File.Ares
    168 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.CDnSpeed detected: Trace.Registry.Ares
    169 Value: HKEY_CURRENT_USER\Software\Ares --> GUI.LastChatRoomBrowse detected: Trace.Registry.Ares
    170 c:\program files\ares\data\gui\general\mshareset.bmp detected: Trace.File.Ares
    171 Value: HKEY_CURRENT_USER\Software\Ares --> General.AutoConnect detected: Trace.Registry.Ares
    172 Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ares --> DisplayName detected: Trace.Registry.Ares
    173 c:\program files\ares\data\gui\general\mimesmall.bmp detected: Trace.File.Ares
    174 c:\program files\ares\tcpip_patcher.sys detected: Trace.File.Ares
    175 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.CTtUptime detected: Trace.Registry.Ares
    176 Value: HKEY_CURRENT_USER\Software\Ares --> General.HookBitTorrentExt detected: Trace.Registry.Ares
    177 C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe detected: Adware.Win32.OneStep.d
    178 c:\program files\ares\lang\polish.txt detected: Trace.File.Ares
    179 c:\program files\mywebsearchwb detected: Trace.Directory.WeatherBug
    180 Value: HKEY_CURRENT_USER\Software\Ares --> Personal.GUID detected: Trace.Registry.Ares
    181 c:\program files\ares\libfaad2.dll detected: Trace.File.Ares
    182 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.HasLQCa detected: Trace.Registry.Ares
    183 c:\documents and settings\bloodpuppet\desktop\ares.lnk detected: Trace.File.Ares
    184 Value: HKEY_CURRENT_USER\Software\Ares --> GUI.LastChatRoomBrowse detected: Trace.Registry.Ares
    185 Value: HKEY_CURRENT_USER\Software\Ares --> General.HookBitTorrentExt detected: Trace.Registry.Ares
    186 Value: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run --> ares detected: Trace.Registry.Ares
    187 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.CAvgTime detected: Trace.Registry.Ares
    188 c:\program files\ares\lang\arabic.txt detected: Trace.File.Ares
    189 Value: HKEY_CURRENT_USER\Software\Ares --> General.AutoStartUp detected: Trace.Registry.Ares
    190 c:\program files\ares\lang\arabic.txt detected: Trace.File.Ares
    191 c:\program files\ares\data detected: Trace.Directory.Ares
    192 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.CTtUptime detected: Trace.Registry.Ares
    193 C:\Program Files\OneStepSearch\onestep.dll detected: Adware.Win32.OneStep.d
    194 c:\program files\macrogaming\sweetimbarforie detected: Trace.Directory.SweetIMBarForIE
    195 C:\Documents and Settings\Bloodpuppet\My Documents\My Music\MuZaa\My Music\PhotoShop CS3 Extended Keygen + Activation.rar\PhotoShop CS3 Extended Keygen + Activation.rar detected: Trojan-Spy.Win32.Banker.gez
    196 C:\Documents and Settings\Bloodpuppet\My Documents\My Music\MuZaa\My Music\Registry-Mechanic___7.0.0.10.Incl + Keygen\rminstall.exe detected: Trojan-Downloader.Win32.Delf.cee
    197 c:\program files\ares\data\gui\general\prefs.txt detected: Trace.File.Ares
    198 C:\Documents and Settings\Bloodpuppet\Application Data\Mozilla\Firefox\Profiles\502fgxza.default\cookies.txt:11 detected: Trace.TrackingCookie
    199 Value: HKEY_CURRENT_USER\Software\Ares --> Personal.GUID detected: Trace.Registry.Ares
    200 Value: HKEY_CURRENT_USER\Software\Ares --> Stats.CDnSpeed detected: Trace.Registry.Ares
    201 c:\program files\ares\data\p2pfilter.txt detected: Trace.File.Ares
    202 Value: HKEY_CLASSES_ROOT\CLSID\{3E0FA044-926C-42D9-BA12-EF16E980913B}\InprocServer32 --> ThreadingModel detected: Trace.Registry.Ares
    203 c:\program files\ares\lang\swedish.txt detected: Trace.File.Ares
    204 c:\program files\ares\data\gui\general\libbig.bmp detected: Trace.File.Ares
    205 Value: HKEY_CURRENT_USER\Software\Ares --> General.Language detected: Trace.Registry.Ares
    206 c:\program files\ares\data\gui\general\tabssmall.bmp detected: Trace.File.Ares
    207 c:\program files\ares\lang\japanese.txt detected: Trace.File.Ares
    208 Value: HKEY_CURRENT_USER\Software\Ares --> GUI.LastPMBrowse detected: Trace.Registry.Ares
    209 Value: HKEY_CURRENT_USER\Software\Ares --> GUI.LastPMBrowse detected: Trace.Registry.Ares
    210 Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ares --> URLUpdateInfo detected: Trace.Registry.Ares
    211 Value: HKEY_CURRENT_USER\Software\Ares --> ChatRoom.AutoClose detected: Trace.Registry.Ares
    212 c:\program files\registry cleaner trial detected: Trace.Directory.RegistryCleaner
    213 C:\Program Files\OneStepSearch\onestep.exe detected: Adware.Win32.OneStep.b
    214 c:\program files\ares\data\gui\general\chat.bmp detected: Trace.File.Ares
    215 Value: HKEY_CURRENT_US

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:16:56, on 28.2.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\arservice.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    c:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\PROGRA~1\AVG\AVG8\avgam.exe
    C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    C:\HP\KBD\KBD.EXE
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\Program Files\IObit\Advanced WindowsCare V2\MemCleaner.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Ares\Ares.exe
    C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\Last.fm\LastFMHelper.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    c:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\PROGRA~1\AVG\AVG8\avgscanx.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\Program Files\iTunes\iTunes.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\WINDOWS\system32\cmd.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "c:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe"
    O4 - HKLM\..\Run: [msptlg] C:\WINDOWS\ptlg.exe
    O4 - HKLM\..\Run: [SmartRAM] C:\Program Files\IObit\Advanced WindowsCare V2\MemCleaner.exe /m
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
    O4 - HKCU\..\Run: [Ares Galaxy Super Speed] C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe
    O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
    O4 - Global Startup: ATI CATALYST -ilmaisinalue.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
    O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase370.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1204033224265
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - c:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - c:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
    O23 - Service: ptlg - Unknown owner - C:\WINDOWS\system32\ptlg.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 9071 bytes
     
    toope92, Feb 28, 2008
    #6
  7. Hujo

    Hujo Guest

    Lataa SmitfraudFix (c) S!Ri
    Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

    Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita tämän tekstitiedoston sisältö viestiketjuusi.

    Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.

    =========

    Javan päivitys ja välimuistin tyhjennys:

    1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
    2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
    Niissä pitäisi olla seuraava kuva vieressä: [​IMG]

    3. Valitse kaikki entiset Java versiosi ja valitse Poista.
    4. Asenna uusin Java päivitys seuraavasta linkistä..
    5. Käynnistä kone uudelleen asennuksen jälkeen:

    http://java.sun.com/javase/downloads/index.jsp

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u4

    Paina Download

    Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

    7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

    8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

    *Applications and Applets

    *Trace and Log Files

    Ja paina OK -nappia

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.

    10. Klikkaa OK jättääksesi Java asetusikkunasi.
     
    Last edited by a moderator: Feb 28, 2008
    Hujo, Feb 28, 2008
    #7
  8. toope92

    toope92 Regular member

    Joined:
    Nov 8, 2006
    Messages:
    140
    Likes Received:
    0
    Trophy Points:
    26
    Onkohan koneessani vielä viruksia tai troijalaisia ymym? sillä koneelleni ilmestyy epämääräinen explorer sivu mitä en ole avannutkaan ja se estää hetkeksi muihin ohjelmiin pääsyn .

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:12:38, on 1.3.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\ptlg.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Ares\Ares.exe
    C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Last.fm\LastFMHelper.exe
    C:\WINDOWS\arservice.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    c:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\PROGRA~1\AVG\AVG8\avgam.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    c:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\AVG\AVG8\avgscanx.exe
    C:\Program Files\Adobe\Adobe Photoshop CS3\Photoshop.exe
    C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\lightroom.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
    O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "c:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe"
    O4 - HKLM\..\Run: [msptlg] C:\WINDOWS\ptlg.exe
    O4 - HKLM\..\Run: [SmartRAM] C:\Program Files\IObit\Advanced WindowsCare V2\MemCleaner.exe /m
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
    O4 - HKLM\..\Run: [MP10_EnsureFileVer] C:\WINDOWS\inf\unregmp2.exe /EnsureFileVersions
    O4 - HKLM\..\RunOnce: [WMFSDK11_DRMUpgrade] C:\WINDOWS\system32\drmupgds.exe
    O4 - HKLM\..\RunOnce: [KB926239] rundll32.exe apphelp.dll,ShimFlushCache
    O4 - HKLM\..\RunOnce: [WMC_RebootCheck] C:\WINDOWS\inf\unregmp2.exe /FixUps
    O4 - HKLM\..\RunOnce: [MP11_EnsureDeviceRescan] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\wpd_ci.dll,DoCmd remove rescan
    O4 - HKLM\..\RunOnce: [InstallShieldSetup] C:\PROGRA~1\INSTAL~1\{1B2DB~1\SETUP.EXE -rebootC:\PROGRA~1\INSTAL~1\{1B2DB~1\reboot.ini -l0x9
    O4 - HKLM\..\RunOnce: [MDU] "C:\Program Files\InstallShield Installation Information\{56005CE7-718A-4814-A433-DE06D7C9B27C}\tmp00\Setup.exe" /InstallMDU /s
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
    O4 - HKCU\..\Run: [Ares Galaxy Super Speed] C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKCU\..\RunOnce: [MPlayer2_FixUp] C:\WINDOWS\inf\unregmp2.exe /Fixups
    O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O4 - Startup: Get a FREE audiobook!.lnk = C:\Documents and Settings\HP_Administrator\Local Settings\Temp\Get a FREE audiobook!.exe
    O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
    O4 - Global Startup: ATI CATALYST -ilmaisinalue.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
    O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase370.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1204033224265
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - c:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - c:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
    O23 - Service: ptlg - Unknown owner - C:\WINDOWS\system32\ptlg.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 9599 bytes
     
    toope92, Mar 1, 2008
    #8
  9. Hujo

    Hujo Guest

    Hujo, Mar 1, 2008
    #9
  10. toope92

    toope92 Regular member

    Joined:
    Nov 8, 2006
    Messages:
    140
    Likes Received:
    0
    Trophy Points:
    26
    File C:\Program Files\AskTBar\bar\1.bin\A5POPSWT.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.az. No Action Taken.
    File C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.az. No Action Taken.
     
    toope92, Mar 1, 2008
    #10
  11. Hujo

    Hujo Guest

    Poista kansio

    C:\Program Files\AskTBar
     
    Hujo, Mar 1, 2008
    #11
  12. toope92

    toope92 Regular member

    Joined:
    Nov 8, 2006
    Messages:
    140
    Likes Received:
    0
    Trophy Points:
    26
    poistin juuri kyseisen kansion,mutta silti epämääräinen sivu aukeaa yhä mikä voisi olla syynä? mikä ratkaisu
     
    toope92, Mar 2, 2008
    #12
  13. Hujo

    Hujo Guest

    missä on smitfraudfix raportti
     
    Last edited by a moderator: Mar 2, 2008
    Hujo, Mar 2, 2008
    #13
  14. toope92

    toope92 Regular member

    Joined:
    Nov 8, 2006
    Messages:
    140
    Likes Received:
    0
    Trophy Points:
    26
    SmitFraudFix v2.299

    Scan done at 12:44:01,31, su 02.03.2008
    Run from C:\Documents and Settings\HP_Administrator\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Ares\Ares.exe
    C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\ptlg.exe
    C:\Program Files\Last.fm\LastFMHelper.exe
    c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\arservice.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    c:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgam.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    c:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Adobe\Adobe Photoshop CS3\Photoshop.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\Program Files\iTunes\iTunes.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

    C:\WINDOWS\ IEXPLORE.EXE FOUND !
    C:\WINDOWS\ptlg.exe FOUND !
    C:\WINDOWS\sprmvr.exe FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

    C:\WINDOWS\system32\ptlg.exe FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Administrator


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Administrator\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\HP_ADM~1\FAVORI~1


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="My Current Home Page"


    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, following keys are not inevitably infected!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, following keys are not inevitably infected!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Rustock



    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Packet Scheduler Miniport
    DNS Server Search Order: 192.168.0.254

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{9B1D4CEB-7960-4FC5-834A-9F629A758F5C}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{9B1D4CEB-7960-4FC5-834A-9F629A758F5C}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{9B1D4CEB-7960-4FC5-834A-9F629A758F5C}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{9B1D4CEB-7960-4FC5-834A-9F629A758F5C}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End
     
    toope92, Mar 2, 2008
    #14
  15. Hujo

    Hujo Guest

    Printtaa ohjeet ulos

    Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.

    Vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.

    Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.

    Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".

    Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
    Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
    Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.

    Varoitus : Ajamalla optio 2:n EI-tarttuneessa tietokoneessa, poistaa sinun työpöytäsi taustakuvan.
     
    Hujo, Mar 2, 2008
    #15
  16. toope92

    toope92 Regular member

    Joined:
    Nov 8, 2006
    Messages:
    140
    Likes Received:
    0
    Trophy Points:
    26
    SmitFraudFix v2.299

    Scan done at 12:55:11,89, su 02.03.2008
    Run from C:\Documents and Settings\HP_Administrator\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    127.0.0.1 localhost

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

    S!Ri's WS2Fix: LSP not Found.


    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

    C:\WINDOWS\ IEXPLORE.EXE Deleted
    C:\WINDOWS\ptlg.exe Deleted
    C:\WINDOWS\sprmvr.exe Deleted
    C:\WINDOWS\system32\ptlg.exe Deleted

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Packet Scheduler Miniport
    DNS Server Search Order: 192.168.0.254

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{9B1D4CEB-7960-4FC5-834A-9F629A758F5C}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{9B1D4CEB-7960-4FC5-834A-9F629A758F5C}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{9B1D4CEB-7960-4FC5-834A-9F629A758F5C}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{9B1D4CEB-7960-4FC5-834A-9F629A758F5C}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End

     
    toope92, Mar 2, 2008
    #16
  17. Hujo

    Hujo Guest

    Ohje oli ajaa se vikasiedossa smitfraudfix opito 2
    Fix run in normal mode


    Ohje AVG:n Anti-Spyware 7.5:n käyttöön
    Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.

    Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

    Lataa AVG:n Anti-Spyware 7.5:n
    ja tallenna ohjelma työpöydällesi.
    o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    o Käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

    o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

    o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".

    o Sitten "Reports" valikon alta:
    o Laita täppi kohtaan "Automatically generate report after every scan"
    o Ota täppi pois kohdasta"Only if threats were found"

    o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    o "Resident shield is", muuta tila active:sta inactive:ksi
    o Sulje ohjelma, ÄLÄ skannaa vielä.

    Käynnistä koneesi vikasietotilaan,
    sammuta ja käynnistä
    käynnistyksen yhteydessä naputtele F8
    valitse nuoli näppäimellä vikasietotila
    paina enter ja enter

    Toisissa koneissa paukutetaan F8:sin sijasta F5:tä

    HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
    o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.

    =================

    scannaa uusi hjt:n loki avg:n anti-spywaren ajon jälkeen.
     
    Last edited by a moderator: Mar 2, 2008
    Hujo, Mar 2, 2008
    #17
  18. toope92

    toope92 Regular member

    Joined:
    Nov 8, 2006
    Messages:
    140
    Likes Received:
    0
    Trophy Points:
    26
    no kuinkas tuo sama suoritettaa avg uudemmallaversiolla avg professional edition 8.0
     
    toope92, Mar 2, 2008
    #18
  19. Hujo

    Hujo Guest

    No tuo on scanneri avg:n anti-spyware 7.5 aja se vikasiedossa kuten ohje on.
     
    Last edited by a moderator: Mar 2, 2008
    Hujo, Mar 2, 2008
    #19
  20. toope92

    toope92 Regular member

    Joined:
    Nov 8, 2006
    Messages:
    140
    Likes Received:
    0
    Trophy Points:
    26
    AVG Anti-Spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 15:02:26 2.3.2008

    + Scan result:



    C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP33\A0006811.exe -> Backdoor.Agent.duj : Error during cleaning.
    C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP33\A0006703.dll -> Not-A-Virus.Adware.OneStep : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP33\A0006810.exe -> Not-A-Virus.Adware.OneStep : Cleaned with backup (quarantined).
    C:\Documents and Settings\Heviä Perkele\Cookies\heviä_perkele@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\LocalService\Cookies\system@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.41:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.42:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.43:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.15:C:\Documents and Settings\Heviä Perkele\Application Data\Mozilla\Firefox\Profiles\ae7pd0en.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.16:C:\Documents and Settings\Heviä Perkele\Application Data\Mozilla\Firefox\Profiles\ae7pd0en.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.17:C:\Documents and Settings\Heviä Perkele\Application Data\Mozilla\Firefox\Profiles\ae7pd0en.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.34:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.35:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.36:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.37:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    C:\Documents and Settings\Heviä Perkele\Cookies\heviä_perkele@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
    :mozilla.20:C:\Documents and Settings\Heviä Perkele\Application Data\Mozilla\Firefox\Profiles\ae7pd0en.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
    :mozilla.6:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
    C:\Documents and Settings\Heviä Perkele\Cookies\heviä_perkele@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
    :mozilla.71:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.72:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.73:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.74:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.75:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.38:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Linkbuddies : Cleaned.
    C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Cleaned.
    :mozilla.7:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
    :mozilla.9:C:\Documents and Settings\Heviä Perkele\Application Data\Mozilla\Firefox\Profiles\ae7pd0en.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
    C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : Cleaned.
    C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@statistik-gallup[2].txt -> TrackingCookie.Statistik-gallup : Cleaned.
    C:\Documents and Settings\Heviä Perkele\Cookies\heviä_perkele@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : Cleaned.
    :mozilla.45:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
    :mozilla.46:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
    C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned.
    C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned.
    :mozilla.78:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    :mozilla.18:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
    :mozilla.61:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.62:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.63:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.64:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.


    ::Report end

     
    toope92, Mar 2, 2008
    #20
Page 1 of 5

Share This Page