PCHealthCenter tuhoaminen.

Discussion in 'Virukset ja haittaohjelmat' started by uupee, Sep 5, 2008.

Page 1 of 2
  1. uupee

    uupee Member

    Joined:
    Mar 27, 2006
    Messages:
    73
    Likes Received:
    1
    Trophy Points:
    18
    uupee, Sep 5, 2008
    #1
  2. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    * Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    * Lopuksi varmistu, että seuraavat on valittu: Päivitä Malwarebytes' Anti-Malware ja Käynnistä Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Lopeta.
    * Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    * Kun ohjelma on latautunut, valitse Suorita täysi tarkistus ja klikkaa Tarkista.
    * Kun skanni on valmis, klikkaa OK ja sitten Näytä tulokset nähdäksesi tulokset.
    * Varmistu, että kaikki on merkitty ja klikkaa Poista valitut.
    * Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös
    täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    * Lähetä lokin sisältö seuraavassa viestissäsi + uusi hjt-loki.
     
    yaht, Sep 5, 2008
    #2
  3. uupee

    uupee Member

    Joined:
    Mar 27, 2006
    Messages:
    73
    Likes Received:
    1
    Trophy Points:
    18
    Malwarebytes' Anti-Malware 1.26
    Tietokantaversio: 1116
    Windows 6.0.6001 Service Pack 1

    5.9.2008 21:42:49
    mbam-log-2008-09-05 (21-42-20).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
    Tarkistetut kohteet: 136865
    Kulunut aika: 56 minute(s), 29 second(s)

    Saastuneita muistiprosesseja: 3
    Saastuneita muistimoduuleja: 1
    Saastuneita rekisteriavaimia: 23
    Saastuneita rekisteriarvoja: 5
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 1
    Saastuneita tiedostoja: 25

    Saastuneita muistiprosesseja:
    C:\Program Files\PCHealthCenter\1.exe (Trojan.Fakealert) -> No action taken.
    C:\Program Files\PCHealthCenter\4.exe (Trojan.Fakealert) -> No action taken.
    C:\Program Files\PCHealthCenter\7.exe (Trojan.Fakealert) -> No action taken.

    Saastuneita muistimoduuleja:
    C:\Windows\System32\CodecBHO.dll (Trojan.FakeAlert) -> No action taken.

    Saastuneita rekisteriavaimia:
    HKEY_LOCAL_MACHINE\SOFTWARE\msliksur (Trojan.DNSChanger) -> No action taken.
    HKEY_CLASSES_ROOT\sunporn (Trojan.DNSChanger) -> No action taken.
    HKEY_CLASSES_ROOT\sunpornwrrb325 (Trojan.DNSChanger) -> No action taken.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msliksurserv (Rootkit.Agent) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{71359e5b-5e26-41da-81f0-2c206dcdef4b} (Trojan.FakeAlert) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webvideo (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\TypeLib\{269d7edd-abbc-4a90-b6d9-312867114a94} (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\Interface\{4fe44c22-de40-45d2-a76c-27bac9aee600} (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{eb95b22a-e37e-4eff-9a9d-4e3d3badd9e6} (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\TypeLib\{33c053f6-5347-45d2-8ba8-a6e67f225cc2} (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\Interface\{d2c5a0f0-e2b5-425a-9628-a59d5383d9a4} (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\Interface\{ef1af8c0-86cc-4740-80e3-a78cee452a35} (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{0db87c61-796b-4afd-9ae7-32d67672e1be} (Trojan.FakeAlert) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0db87c61-796b-4afd-9ae7-32d67672e1be} (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{2ad63520-a4b7-4a95-bf56-f138f7fb319e} (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\gksraemq.bbvt (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\gksraemq.toolbar.1 (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\AppID\CodecBHO.DLL (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\codecbho.codecplugin (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\codecbho.codecplugin.1 (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\codecbho.xmldomdocumenteventssink (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\codecbho.xmldomdocumenteventssink.1 (Trojan.FakeAlert) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\RichVideoCodec (Trojan.FakeAlert) -> No action taken.

    Saastuneita rekisteriarvoja:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MSAntivirus) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MSAntivirus) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\xrdwbfgn (Trojan.FakeAlert) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{eb95b22a-e37e-4eff-9a9d-4e3d3badd9e6} (Trojan.FakeAlert) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\dgksvbpn (Trojan.FakeAlert) -> No action taken.

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> No action taken.

    Saastuneita tiedostoja:
    C:\Downloads\vtl-bf2k\vtl-bf2k.exe (Trojan.Agent) -> No action taken.
    C:\Users\Hallinta\AppData\Local\Temp\tmp5DD9.tmp (Trojan.Clicker) -> No action taken.
    C:\Windows\eeka.exe (Trojan.FakeAlert) -> No action taken.
    C:\Program Files\PCHealthCenter\0.exe (Trojan.Fakealert) -> No action taken.
    C:\Program Files\PCHealthCenter\0.gif (Trojan.Fakealert) -> No action taken.
    C:\Program Files\PCHealthCenter\1.exe (Trojan.Fakealert) -> No action taken.
    C:\Program Files\PCHealthCenter\1.gif (Trojan.Fakealert) -> No action taken.
    C:\Program Files\PCHealthCenter\1.ico (Trojan.Fakealert) -> No action taken.
    C:\Program Files\PCHealthCenter\2.exe (Trojan.Fakealert) -> No action taken.
    C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> No action taken.
    C:\Program Files\PCHealthCenter\2.ico (Trojan.Fakealert) -> No action taken.
    C:\Program Files\PCHealthCenter\3.exe (Trojan.Fakealert) -> No action taken.
    C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> No action taken.
    C:\Program Files\PCHealthCenter\4.exe (Trojan.Fakealert) -> No action taken.
    C:\Program Files\PCHealthCenter\5.exe (Trojan.Fakealert) -> No action taken.
    C:\Program Files\PCHealthCenter\7.exe (Trojan.Fakealert) -> No action taken.
    C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> No action taken.
    C:\Windows\System32\MSa.cpl (Rogue.MSAntivirus) -> No action taken.
    C:\Windows\xrdwbfgn.dll (Trojan.FakeAlert) -> No action taken.
    C:\Windows\sxmaokgf.exe (Trojan.FakeAlert) -> No action taken.
    C:\Windows\gksraemq.dll (Trojan.FakeAlert) -> No action taken.
    C:\Windows\System32\CodecBHO.dll (Trojan.FakeAlert) -> No action taken.
    C:\Users\Hallinta\AppData\Local\Temp\s1265.php (Trojan.FakeAlert) -> No action taken.
    C:\Users\Hallinta\AppData\Local\Temp\lwpwer.exe (Trojan.FakeAlert) -> No action taken.
    C:\Windows\System32\drivers\msliksurserv.sys (Rootkit.Agent) -> No action taken.
     
    uupee, Sep 5, 2008
    #3
  4. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt

    Hae tuolta Malwarebytesin loki loki ;)
     
    yaht, Sep 5, 2008
    #4
  5. uupee

    uupee Member

    Joined:
    Mar 27, 2006
    Messages:
    73
    Likes Received:
    1
    Trophy Points:
    18
    Malwarebytes' Anti-Malware 1.26
    Tietokantaversio: 1116
    Windows 6.0.6001 Service Pack 1

    5.9.2008 21:43:00
    mbam-log-2008-09-05 (21-43-00).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
    Tarkistetut kohteet: 136865
    Kulunut aika: 56 minute(s), 29 second(s)

    Saastuneita muistiprosesseja: 3
    Saastuneita muistimoduuleja: 1
    Saastuneita rekisteriavaimia: 23
    Saastuneita rekisteriarvoja: 5
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 1
    Saastuneita tiedostoja: 25

    Saastuneita muistiprosesseja:
    C:\Program Files\PCHealthCenter\1.exe (Trojan.Fakealert) -> Unloaded process successfully.
    C:\Program Files\PCHealthCenter\4.exe (Trojan.Fakealert) -> Unloaded process successfully.
    C:\Program Files\PCHealthCenter\7.exe (Trojan.Fakealert) -> Unloaded process successfully.

    Saastuneita muistimoduuleja:
    C:\Windows\System32\CodecBHO.dll (Trojan.FakeAlert) -> Delete on reboot.

    Saastuneita rekisteriavaimia:
    HKEY_LOCAL_MACHINE\SOFTWARE\msliksur (Trojan.DNSChanger) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\sunporn (Trojan.DNSChanger) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\sunpornwrrb325 (Trojan.DNSChanger) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msliksurserv (Rootkit.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{71359e5b-5e26-41da-81f0-2c206dcdef4b} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webvideo (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{269d7edd-abbc-4a90-b6d9-312867114a94} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{4fe44c22-de40-45d2-a76c-27bac9aee600} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{eb95b22a-e37e-4eff-9a9d-4e3d3badd9e6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{33c053f6-5347-45d2-8ba8-a6e67f225cc2} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{d2c5a0f0-e2b5-425a-9628-a59d5383d9a4} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{ef1af8c0-86cc-4740-80e3-a78cee452a35} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{0db87c61-796b-4afd-9ae7-32d67672e1be} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0db87c61-796b-4afd-9ae7-32d67672e1be} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{2ad63520-a4b7-4a95-bf56-f138f7fb319e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\gksraemq.bbvt (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\gksraemq.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\CodecBHO.DLL (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\codecbho.codecplugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\codecbho.codecplugin.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\codecbho.xmldomdocumenteventssink (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\codecbho.xmldomdocumenteventssink.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\RichVideoCodec (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\xrdwbfgn (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{eb95b22a-e37e-4eff-9a9d-4e3d3badd9e6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\dgksvbpn (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.

    Saastuneita tiedostoja:
    C:\Downloads\vtl-bf2k\vtl-bf2k.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Users\Hallinta\AppData\Local\Temp\tmp5DD9.tmp (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Windows\eeka.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\0.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\0.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\1.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\1.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\2.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\3.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\4.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\5.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\7.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Windows\System32\MSa.cpl (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
    C:\Windows\xrdwbfgn.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Windows\sxmaokgf.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Windows\gksraemq.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Windows\System32\CodecBHO.dll (Trojan.FakeAlert) -> Delete on reboot.
    C:\Users\Hallinta\AppData\Local\Temp\s1265.php (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Users\Hallinta\AppData\Local\Temp\lwpwer.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Windows\System32\drivers\msliksurserv.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

    En nyt sit tiedä et onko tämäkään se oikea mut kun ei mulla oo mitään c:\documents and settings kansiota... varmaan kun kerta mul on vista niin siinä sit ei vissiin ole... mut anyways, tää on sen malwarebyteksen sivuilta kohdasta lokit...
     
    Last edited: Sep 5, 2008
    uupee, Sep 5, 2008
    #5
  6. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Oikean lokin löysit :D

    Näyttää ainakin lähteneen aika paljon mörkkejä pois lähetä viellä Hijackthis loki alla linkki ohjeisiin.
     
    yaht, Sep 5, 2008
    #6
  7. uupee

    uupee Member

    Joined:
    Mar 27, 2006
    Messages:
    73
    Likes Received:
    1
    Trophy Points:
    18
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:50:02, on 6.9.2008
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Launch Manager\LManager.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Windows\System32\YUR4569.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Users\Hallinta\AppData\Local\Temp\RtkBtMnt.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Internet Explorer\ieuser.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
    C:\Program Files\BitComet\BitComet.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Windows\system32\SearchFilterHost.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fi.intl.acer.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?

    LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program

    Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program

    Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search &

    Destroy\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common

    Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
    O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
    O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
    O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\alkohooli\axcmd.exe" /automount
    O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
    O4 - HKCU\..\Run: [\YUR4569.exe] C:\Windows\system32\YUR4569.exe
    O4 - HKCU\..\Run: [\YURC8FD.exe] C:\Windows\system32\YURC8FD.exe
    O4 - HKCU\..\Run: [\YUR8BAB.exe] C:\Windows\system32\YUR8BAB.exe
    O4 - HKCU\..\Run: [\YUR8583.exe] C:\Windows\system32\YUR8583.exe
    O4 - HKCU\..\Run: [\YUR8C57.exe] C:\Windows\system32\YUR8C57.exe
    O4 - HKCU\..\Run: [\YUR905C.exe] C:\Windows\system32\YUR905C.exe
    O4 - HKCU\..\Run: [\YUR952.exe] C:\Windows\system32\YUR952.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen

    palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen

    palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program

    Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program

    Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: Lähetä kuva &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth

    Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Lähetä sivu &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth

    Software\btsendto_ie.htm
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03

    \bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

    Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows

    Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-

    D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet

    Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth

    Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program

    Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program

    Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search &

    Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

    C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O13 - Gopher Prefix:
    O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) -

    http://cdn.scan.onecare.live.com/resource/download/scanner/fi-fi/wlscctrl2.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs:
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4

    \aswUpdSv.exe
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program

    Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common

    Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering

    Technology\eRecovery\eRecoveryService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel

    Matrix Storage Manager\Iaantmon.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company -

    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common

    Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec

    Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared

    Files\RichVideo.exe
    O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot -

    Search & Destroy\SDWinSec.exe
    O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program

    Files\alkohooli\StarWind\StarWindServiceAE.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 10273 bytes
     
    uupee, Sep 6, 2008
    #7
  8. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä:
    Combofix.exe
    Combofix.exe

    Avaa Combofix.exe ja seuraa näyttöön tulevia ohjeita

    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
    Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.

    Tyhjennä roskakori ja käynnistä koneesi uudelleen.

    Postita tänne seuraavat lokit:
    * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
    * (C:\ComboFix.txt) raportti
    *
     
    yaht, Sep 6, 2008
    #8
  9. uupee

    uupee Member

    Joined:
    Mar 27, 2006
    Messages:
    73
    Likes Received:
    1
    Trophy Points:
    18
    ComboFix 08-09-05.02 - Hallinta 2008-09-07 2:00:49.1 - NTFSx86
    Microsoft® Windows Vista™ Business 6.0.6001.1.1252.1.1035.18.1041 [GMT 3:00]
    Running from: D:\ComboFix.exe
    * Created a new restore point
    .
    /wow section - STAGE 40
    SED: can't read MWindows.dat: No such file or directory
    pv: No matching processes found
    SED: can't read MWindows.dat: No such file or directory


    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Windows\system32\AutoRun.inf
    C:\Windows\system32\vbzlib1.dll

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-08-06 to 2008-09-06 )))))))))))))))))
    .

    2008-09-07 01:58 . 2008-09-07 01:59 <KANSIO> d-------- C:\327882R2FWJFW
    2008-09-06 12:49 . 2008-09-06 12:49 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-09-05 20:38 . 2008-09-05 20:38 <KANSIO> d-------- C:\Users\Hallinta\AppData\Roaming\Malwarebytes
    2008-09-05 20:38 . 2008-09-05 20:38 <KANSIO> d-------- C:\Users\All Users\Malwarebytes
    2008-09-05 20:38 . 2008-09-05 20:38 <KANSIO> d-------- C:\ProgramData\Malwarebytes
    2008-09-05 20:38 . 2008-09-05 20:38 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-05 20:38 . 2008-09-02 00:16 38,528 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
    2008-09-05 20:38 . 2008-09-02 00:16 17,200 --a------ C:\Windows\System32\drivers\mbam.sys
    2008-09-05 19:14 . 2008-09-05 17:07 106,496 --a------ C:\Windows\System32\YUR4569.exe
    2008-09-05 19:08 . 2008-09-05 17:07 106,496 --a------ C:\x
    2008-09-05 19:08 . 2008-09-05 17:07 33,792 --a------ C:\Windows\System32\YURBE6E.exe
    2008-08-25 20:51 . 2008-07-16 04:32 2,048 --a------ C:\Windows\System32\tzres.dll
    2008-08-24 10:20 . 2008-08-24 10:20 <KANSIO> d-------- C:\Program Files\SEGA
    2008-08-17 19:59 . 2008-06-27 04:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
    2008-08-17 19:59 . 2008-06-27 07:15 827,392 --a------ C:\Windows\System32\wininet.dll
    2008-08-17 19:59 . 2008-06-19 06:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
    2008-08-14 06:00 . 2008-04-18 08:48 269,312 --a------ C:\Windows\System32\es.dll
    2008-08-14 05:32 . 2008-04-10 08:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
    2008-08-13 15:57 . 2008-08-13 15:57 27 --a------ C:\XeroBank.ini
    2008-08-13 15:56 . 2008-08-13 15:57 <KANSIO> d-------- C:\Program Files\XeroBank

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-05 22:02 --------- d-----w C:\Program Files\Alcohol 120%
    2008-09-05 21:22 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
    2008-09-05 21:22 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-09-05 15:19 52,736 ----a-w C:\Windows\ipuninst.exe
    2008-09-03 15:04 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-08-25 17:52 --------- d-----w C:\ProgramData\Microsoft Help
    2008-08-25 17:50 --------- d-----w C:\Program Files\Windows Mail
    2008-08-25 17:49 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-08-24 07:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-08-21 23:40 --------- d-----w C:\Program Files\Windows Live Safety Center
    2008-08-05 14:02 --------- d-----w C:\Program Files\EA GAMES
    2008-07-30 15:03 --------- d-----w C:\ProgramData\Symantec
    2008-07-28 10:47 --------- d-----w C:\Users\Hallinta\AppData\Roaming\Comodo
    2008-07-28 10:47 --------- d-----w C:\ProgramData\comodo
    2008-07-28 10:47 --------- d-----w C:\Program Files\COMODO
    2008-07-25 07:27 --------- d-----w C:\Program Files\AC3Filter
    2008-07-25 06:55 --------- d-----w C:\Program Files\DivX
    2008-07-23 17:37 --------- d-----w C:\Program Files\Alwil Software
    2008-07-23 17:33 --------- d-----w C:\Program Files\F-Secure Internet Security
    2008-07-23 17:28 --------- d-----w C:\ProgramData\F-Secure
    2008-07-21 16:31 --------- d-----w C:\Users\Hallinta\AppData\Roaming\Games
    2008-07-21 16:31 --------- d-----w C:\ProgramData\InstallShield
    2008-07-21 16:30 --------- d-----w C:\ProgramData\Tages
    2008-07-21 16:29 --------- d-----w C:\Program Files\AGEIA Technologies
    2008-07-21 16:28 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-07-21 16:23 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-07-21 07:20 --------- d-----w C:\Program Files\directx
    2008-07-21 07:04 --------- d-----w C:\Program Files\BitComet
    2008-07-20 18:33 --------- d-----w C:\Users\Hallinta\AppData\Roaming\Skype
    2008-07-20 18:31 --------- d-----w C:\Users\Hallinta\AppData\Roaming\skypePM
    2008-07-19 15:28 --------- d-----w C:\Users\Hallinta\AppData\Roaming\dvdcss
    2008-07-19 14:36 51,280 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
    2008-07-19 13:40 --------- d-----w C:\ProgramData\CyberLink
    2008-07-18 18:39 586,752 ----a-w C:\Windows\WLXPGSS.SCR
    2008-07-14 19:00 4,608 ----a-w C:\Windows\System32\w95inf32.dll
    2008-07-14 19:00 2,272 ----a-w C:\Windows\System32\w95inf16.dll
    2008-07-12 11:27 --------- d-----w C:\Program Files\Microsoft SQL Server
    2008-07-02 17:16 691,545 ----a-w C:\Windows\unins000.exe
    2008-06-29 13:19 174 --sha-w C:\Program Files\desktop.ini
    2008-06-29 12:30 82,432 ----a-w C:\Windows\System32\axaltocm.dll
    2008-06-29 12:30 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
    2008-06-28 12:04 73,216 ----a-w C:\Windows\ST6UNST.EXE
    2008-06-28 12:04 245,760 ------w C:\Windows\Setup1.exe
    2008-06-26 03:29 801,280 ----a-w C:\Windows\System32\NaturalLanguage6.dll
    2008-06-26 01:45 2,644,480 ----a-w C:\Windows\System32\NlsLexicons0009.dll
    2008-06-26 01:45 12,240,896 ----a-w C:\Windows\System32\NlsLexicons0007.dll
    2008-06-18 17:52 161,096 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
    2008-06-11 00:03 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
    2008-06-11 00:03 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
    2008-06-11 00:03 815,104 ----a-w C:\Windows\System32\divx_xx0a.dll
    2008-06-11 00:03 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
    2008-06-11 00:03 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
    2008-06-11 00:03 294,912 ----a-w C:\Windows\System32\dpu10.dll
    2008-01-06 18:47 32 ----a-w C:\Users\All Users\ezsid.dat
    2008-01-06 18:47 32 ----a-w C:\ProgramData\ezsid.dat
    2008-05-21 16:23 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    2008-05-21 16:23 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    2008-05-21 16:23 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 2097488]
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-04 165784]
    "AlcoholAutomount"="C:\Program Files\alkohooli\axcmd.exe" [2008-06-02 4608]
    "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-08-09 221184]
    "\YUR4569.exe"="C:\Windows\system32\YUR4569.exe" [2008-09-05 106496]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 815104]
    "PLFSet"="C:\Windows\PLFSet.dll" [2007-04-24 45056]
    "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-12 178712]
    "LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2007-10-17 858632]
    "WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-05-29 C:\Windows\RtHDVCpl.exe]
    "Skytel"="Skytel.exe" [2007-05-29 C:\Windows\SkyTel.exe]

    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
    BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-01-19 711472]
    Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-07-11 535336]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.XFR1"= xfcodec.dll
    "msacm.ac3filter"= ac3filter.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UacDisableNotify"=dword:00000001
    "InternetSettingsDisableNotify"=dword:00000001
    "AutoUpdateDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{C1DC7B11-B79A-4BF4-B28C-42D6DF4CB80E}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "{3F2E0E27-9CBF-436A-8031-A348E6BCE49B}"= C:\Program Files\CyberLink\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD
    "{71F1FB9D-215D-48D5-847E-4F4ECC5B799B}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
    "TCP Query User{57BB6E62-4BBE-425C-8549-4315138E4ECC}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "UDP Query User{DFF88394-DC53-414D-BC71-346CBF35E0E3}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "TCP Query User{2721AA46-3930-44F1-87DC-D9DC16BE3BCC}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "UDP Query User{A8AD16E9-C4CF-44C7-ADBB-2ACD41F900CE}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "TCP Query User{B21065C9-B844-4B3E-8DB0-959F2F577203}C:\\program files\\tvuplayer\\tvuplayer.exe"= UDP:C:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
    "UDP Query User{1905375D-6E16-4B87-B57B-FAF0C4E9A32A}C:\\program files\\tvuplayer\\tvuplayer.exe"= TCP:C:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
    "TCP Query User{BADE3BA8-5924-49D5-87B8-053F08975772}D:\\pelit\\worms armageddon - new edition\\wa.exe"= UDP:D:\pelit\worms armageddon - new edition\wa.exe:Worms Armageddon
    "UDP Query User{3D4DF362-6C70-4A78-B908-EFBE7895DE8B}D:\\pelit\\worms armageddon - new edition\\wa.exe"= TCP:D:\pelit\worms armageddon - new edition\wa.exe:Worms Armageddon
    "TCP Query User{9276862E-690B-43E5-A669-DDA1E8F5C72F}D:\\pelit\\hitman -blood money-\\hitmanbloodmoney.exe"= UDP:D:\pelit\hitman -blood money-\hitmanbloodmoney.exe:HitmanBloodMoney
    "UDP Query User{DB108A70-C498-4AD9-A54F-0B14096703B6}D:\\pelit\\hitman -blood money-\\hitmanbloodmoney.exe"= TCP:D:\pelit\hitman -blood money-\hitmanbloodmoney.exe:HitmanBloodMoney
    "{7F6AF321-DF32-43E7-A514-2DADB568B227}"= UDP:C:\Program Files\SEGA\Beijing 2008\Beijing.exe:Beijing 2008™
    "{C0BEA72B-BB5B-463E-A3F0-FFB1C760FB47}"= TCP:C:\Program Files\SEGA\Beijing 2008\Beijing.exe:Beijing 2008™
    "TCP Query User{D759DD74-4235-400B-AE3A-21E70FF0DE36}C:\\program files\\sega\\beijing 2008\\beijing.exe"= UDP:C:\program files\sega\beijing 2008\beijing.exe:Beijing 2008™
    "UDP Query User{B4A90E44-DE79-434E-A549-4C33FACA3631}C:\\program files\\sega\\beijing 2008\\beijing.exe"= TCP:C:\program files\sega\beijing 2008\beijing.exe:Beijing 2008™

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
    "EnableFirewall"= 0 (0x0)

    R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 78416]
    R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2006-11-02 17:51 13560]
    R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
    R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 51280]
    R2 BcmSqlStartupSvc;Business Contact Managerin SQL Server -käynnistyspalvelu;C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-16 30312]
    R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-01-28 810320]
    R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-07-28 2929664]
    R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-02-09 179712]
    S3 btwaudio;Bluetooth-äänilaite;C:\Windows\system32\drivers\btwaudio.sys [2007-01-09 78128]
    S3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-01-09 80688]
    S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-01-09 16560]
    S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-02-26 29183504]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
    bthsvcs REG_MULTI_SZ BthServ

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    \shell\AutoRun\command - wd_windows_tools\setup.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b29931f-ae30-11dc-8218-000000000000}]
    \shell\AutoRun\command - wd_windows_tools\setup.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a180a5a2-e908-11dc-8032-000000000000}]
    \shell\AutoRun\command - G:\autorun\autorun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eafb133e-ad94-11dc-87aa-806e6f6e6963}]
    \shell\AutoRun\command - E:\Autorun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f47adb2b-2fd0-11dd-b642-000000000000}]
    \shell\AutoRun\command - F:\autorun\autorun.exe

    *Newly Created Service* - CATCHME
    *Newly Created Service* - PROCEXP90
    .
    'Ajoitetut tehtävät'-kansion sisältö
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-\YURC8FD.exe - C:\Windows\system32\YURC8FD.exe
    HKCU-Run-\YUR8BAB.exe - C:\Windows\system32\YUR8BAB.exe
    HKCU-Run-\YUR8583.exe - C:\Windows\system32\YUR8583.exe
    HKCU-Run-\YUR8C57.exe - C:\Windows\system32\YUR8C57.exe
    HKCU-Run-\YUR905C.exe - C:\Windows\system32\YUR905C.exe
    HKCU-Run-\YUR952.exe - C:\Windows\system32\YUR952.exe


    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Users\Hallinta\AppData\Roaming\Mozilla\Firefox\Profiles\uwal04o7.default\
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-07 02:03:18
    Windows 6.0.6001 Service Pack 1 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-09-07 2:05:05
    ComboFix-quarantined-files.txt 2008-09-06 23:05:01

    Pre-Run: 4,673,794,048 tavua vapaana
    Post-Run: 4,531,879,936 tavua vapaana

    216 --- E O F --- 2008-09-06 12:22:28
     
    uupee, Sep 6, 2008
    #9
  10. uupee

    uupee Member

    Joined:
    Mar 27, 2006
    Messages:
    73
    Likes Received:
    1
    Trophy Points:
    18
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:22:23, on 7.9.2008
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Launch Manager\LManager.exe
    C:\Users\Hallinta\AppData\Local\Temp\RtkBtMnt.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Windows\System32\YUR4569.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Internet Explorer\ieuser.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
    O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
    O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
    O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\alkohooli\axcmd.exe" /automount
    O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
    O4 - HKCU\..\Run: [\YUR4569.exe] C:\Windows\system32\YUR4569.exe
    O4 - HKCU\..\Run: [\YURC8FD.exe] C:\Windows\system32\YURC8FD.exe
    O4 - HKCU\..\Run: [\YUR8BAB.exe] C:\Windows\system32\YUR8BAB.exe
    O4 - HKCU\..\Run: [\YUR8583.exe] C:\Windows\system32\YUR8583.exe
    O4 - HKCU\..\Run: [\YUR8C57.exe] C:\Windows\system32\YUR8C57.exe
    O4 - HKCU\..\Run: [\YUR905C.exe] C:\Windows\system32\YUR905C.exe
    O4 - HKCU\..\Run: [\YUR952.exe] C:\Windows\system32\YUR952.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: Lähetä kuva &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Lähetä sivu &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O13 - Gopher Prefix:
    O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/fi-fi/wlscctrl2.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs:
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\alkohooli\StarWind\StarWindServiceAE.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 9724 bytes
     
    uupee, Sep 6, 2008
    #10
  11. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    1. Käynnistä Spybot-S&D Edistyneessä tilassa
    2. Jos se ei ole Edistyneessä tilassa, mene Tila-valikkoon ja valitse Edistynyt tila
    3. Klikkaa vasemmalla Työkalut
    4. Klikkaa listassa Pysyvä suojaus
    5. Ota rasti pois kohdasta "Pysyvä TeaTimer" ja paina OK.
    6. Käynnistä kone uudelleen.


    Avaa Muistio ja kopioi/liitä Lainaus: laatikon sisältö sinne:



    Tallenna nimellä CFScript (itse asiassa combofix tunnistaa tuon vaikka tiedostopääte ei olisi
    edes .txt).

    Sitten raahaa ja pudota CFScript ComboFix.exeen kuten alla.(Älä klikkaa)

    [​IMG]


    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
    Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.

    Sammuta selain ja muut ohjelmat Fixin ajaksi. (ei virustorjuntaa)
    Käynnistä HijackThis:ja Scan ja ruksaa seuraavat punaisella listatut tiedostot sekä poista ne.(fix Chekked)


    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - (no file
    O4 - HKCU\..\Run: [\YUR4569.exe] C:\Windows\system32\YUR4569.exe
    O4 - HKCU\..\Run: [\YURC8FD.exe] C:\Windows\system32\YURC8FD.exe
    O4 - HKCU\..\Run: [\YUR8BAB.exe] C:\Windows\system32\YUR8BAB.exe
    O4 - HKCU\..\Run: [\YUR8583.exe] C:\Windows\system32\YUR8583.exe
    O4 - HKCU\..\Run: [\YUR8C57.exe] C:\Windows\system32\YUR8C57.exe
    O4 - HKCU\..\Run: [\YUR905C.exe] C:\Windows\system32\YUR905C.exe
    O4 - HKCU\..\Run: [\YUR952.exe] C:\Windows\system32\YUR952.exe


    Tyhjennä roskakori ja käynnistä koneesi uudelleen.

    Postita tänne seuraavat lokit:
    * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
    * (C:\ComboFix.txt) raportti
    *
     
    yaht, Sep 7, 2008
    #11
  12. uupee

    uupee Member

    Joined:
    Mar 27, 2006
    Messages:
    73
    Likes Received:
    1
    Trophy Points:
    18
    ComboFix 08-09-05.03 - Hallinta 2008-09-07 17:36:33.2 - NTFSx86
    Microsoft® Windows Vista™ Business 6.0.6001.1.1252.1.1035.18.1258 [GMT 3:00]
    Running from: D:\ComboFix.exe
    Command switches used :: D:\CFScript.txt
    * Created a new restore point
    .
    /wow section - STAGE 40
    SED: can't read MWindows.dat: No such file or directory
    pv: No matching processes found
    SED: can't read MWindows.dat: No such file or directory


    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Program Files\RichVideoCodec
    C:\Windows\System32\YUR4569.exe

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-08-07 to 2008-09-07 )))))))))))))))))
    .

    2008-09-07 01:58 . 2008-09-07 17:35 <KANSIO> d-------- C:\327882R2FWJFW
    2008-09-06 12:49 . 2008-09-06 12:49 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-09-05 20:38 . 2008-09-05 20:38 <KANSIO> d-------- C:\Users\Hallinta\AppData\Roaming\Malwarebytes
    2008-09-05 20:38 . 2008-09-05 20:38 <KANSIO> d-------- C:\Users\All Users\Malwarebytes
    2008-09-05 20:38 . 2008-09-05 20:38 <KANSIO> d-------- C:\ProgramData\Malwarebytes
    2008-09-05 20:38 . 2008-09-05 20:38 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-05 20:38 . 2008-09-02 00:16 38,528 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
    2008-09-05 20:38 . 2008-09-02 00:16 17,200 --a------ C:\Windows\System32\drivers\mbam.sys
    2008-09-05 19:08 . 2008-09-05 17:07 106,496 --a------ C:\x
    2008-09-05 16:25 . 2008-09-05 16:25 155,648 --a------ C:\Windows\System32\CodecBHO.dll
    2008-08-25 20:51 . 2008-07-16 04:32 2,048 --a------ C:\Windows\System32\tzres.dll
    2008-08-24 10:20 . 2008-08-24 10:20 <KANSIO> d-------- C:\Program Files\SEGA
    2008-08-17 19:59 . 2008-06-27 04:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
    2008-08-17 19:59 . 2008-06-27 07:15 827,392 --a------ C:\Windows\System32\wininet.dll
    2008-08-17 19:59 . 2008-06-19 06:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
    2008-08-14 06:00 . 2008-04-18 08:48 269,312 --a------ C:\Windows\System32\es.dll
    2008-08-14 05:32 . 2008-04-10 08:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
    2008-08-13 15:57 . 2008-08-13 15:57 27 --a------ C:\XeroBank.ini
    2008-08-13 15:56 . 2008-08-13 15:57 <KANSIO> d-------- C:\Program Files\XeroBank

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-05 22:02 --------- d-----w C:\Program Files\Alcohol 120%
    2008-09-05 21:22 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
    2008-09-05 21:22 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-09-05 15:19 52,736 ----a-w C:\Windows\ipuninst.exe
    2008-09-03 15:04 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-08-25 17:52 --------- d-----w C:\ProgramData\Microsoft Help
    2008-08-25 17:50 --------- d-----w C:\Program Files\Windows Mail
    2008-08-25 17:49 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-08-24 07:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-08-21 23:40 --------- d-----w C:\Program Files\Windows Live Safety Center
    2008-08-05 14:02 --------- d-----w C:\Program Files\EA GAMES
    2008-07-30 15:03 --------- d-----w C:\ProgramData\Symantec
    2008-07-28 10:47 --------- d-----w C:\Users\Hallinta\AppData\Roaming\Comodo
    2008-07-28 10:47 --------- d-----w C:\ProgramData\comodo
    2008-07-28 10:47 --------- d-----w C:\Program Files\COMODO
    2008-07-25 07:27 --------- d-----w C:\Program Files\AC3Filter
    2008-07-25 06:55 --------- d-----w C:\Program Files\DivX
    2008-07-23 17:37 --------- d-----w C:\Program Files\Alwil Software
    2008-07-23 17:33 --------- d-----w C:\Program Files\F-Secure Internet Security
    2008-07-23 17:28 --------- d-----w C:\ProgramData\F-Secure
    2008-07-21 16:31 --------- d-----w C:\Users\Hallinta\AppData\Roaming\Games
    2008-07-21 16:31 --------- d-----w C:\ProgramData\InstallShield
    2008-07-21 16:30 --------- d-----w C:\ProgramData\Tages
    2008-07-21 16:29 --------- d-----w C:\Program Files\AGEIA Technologies
    2008-07-21 16:28 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-07-21 16:23 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-07-21 07:20 --------- d-----w C:\Program Files\directx
    2008-07-21 07:04 --------- d-----w C:\Program Files\BitComet
    2008-07-20 18:33 --------- d-----w C:\Users\Hallinta\AppData\Roaming\Skype
    2008-07-20 18:31 --------- d-----w C:\Users\Hallinta\AppData\Roaming\skypePM
    2008-07-19 15:28 --------- d-----w C:\Users\Hallinta\AppData\Roaming\dvdcss
    2008-07-19 14:36 51,280 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
    2008-07-19 13:40 --------- d-----w C:\ProgramData\CyberLink
    2008-07-18 18:39 586,752 ----a-w C:\Windows\WLXPGSS.SCR
    2008-07-14 19:00 4,608 ----a-w C:\Windows\System32\w95inf32.dll
    2008-07-14 19:00 2,272 ----a-w C:\Windows\System32\w95inf16.dll
    2008-07-12 11:27 --------- d-----w C:\Program Files\Microsoft SQL Server
    2008-07-02 17:16 691,545 ----a-w C:\Windows\unins000.exe
    2008-06-29 13:19 174 --sha-w C:\Program Files\desktop.ini
    2008-06-29 12:30 82,432 ----a-w C:\Windows\System32\axaltocm.dll
    2008-06-29 12:30 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
    2008-06-28 12:04 73,216 ----a-w C:\Windows\ST6UNST.EXE
    2008-06-28 12:04 245,760 ------w C:\Windows\Setup1.exe
    2008-06-26 03:29 801,280 ----a-w C:\Windows\System32\NaturalLanguage6.dll
    2008-06-26 01:45 2,644,480 ----a-w C:\Windows\System32\NlsLexicons0009.dll
    2008-06-26 01:45 12,240,896 ----a-w C:\Windows\System32\NlsLexicons0007.dll
    2008-06-18 17:52 161,096 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
    2008-06-11 00:03 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
    2008-06-11 00:03 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
    2008-06-11 00:03 815,104 ----a-w C:\Windows\System32\divx_xx0a.dll
    2008-06-11 00:03 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
    2008-06-11 00:03 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
    2008-06-11 00:03 294,912 ----a-w C:\Windows\System32\dpu10.dll
    2008-01-06 18:47 32 ----a-w C:\Users\All Users\ezsid.dat
    2008-01-06 18:47 32 ----a-w C:\ProgramData\ezsid.dat
    2008-05-21 16:23 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    2008-05-21 16:23 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    2008-05-21 16:23 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    .

    ((((((((((((((((((((((((((((( snapshot@2008-09-07_ 2.04.14.34 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-09-05 21:22:34 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2008-09-07 14:30:37 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    - 2008-09-05 21:22:34 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2008-09-07 14:30:37 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2008-09-06 21:25:23 786,432 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
    + 2008-09-07 14:32:02 786,432 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
    - 2008-09-05 21:23:53 524,288 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
    + 2008-09-07 14:31:57 524,288 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
    - 2008-09-06 22:43:21 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2008-09-07 14:35:43 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2008-09-06 22:43:21 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2008-09-07 14:35:43 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2008-09-06 22:43:21 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2008-09-07 14:35:43 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2008-09-06 23:00:39 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat
    + 2008-09-07 14:36:21 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat
    + 2008-09-07 14:36:21 262,144 ---ha-w C:\Windows\System32\config\systemprofile\ntuser.dat.LOG1
    - 2008-09-05 21:27:26 120,830 ----a-w C:\Windows\System32\perfc009.dat
    + 2008-09-07 14:35:26 120,830 ----a-w C:\Windows\System32\perfc009.dat
    - 2008-09-05 21:27:26 100,582 ----a-w C:\Windows\System32\perfc00B.dat
    + 2008-09-07 14:35:26 100,582 ----a-w C:\Windows\System32\perfc00B.dat
    - 2008-09-05 21:27:26 639,406 ----a-w C:\Windows\System32\perfh009.dat
    + 2008-09-07 14:35:26 639,406 ----a-w C:\Windows\System32\perfh009.dat
    - 2008-09-05 21:27:26 488,234 ----a-w C:\Windows\System32\perfh00B.dat
    + 2008-09-07 14:35:26 488,234 ----a-w C:\Windows\System32\perfh00B.dat
    - 2008-09-05 21:24:20 8,802 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2661285725-561899849-2609845768-1004_UserData.bin
    + 2008-09-07 14:32:36 8,826 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2661285725-561899849-2609845768-1004_UserData.bin
    - 2008-09-05 21:24:20 92,776 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    + 2008-09-07 14:32:36 93,218 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    - 2008-09-05 21:24:19 63,474 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2008-09-07 14:32:36 63,924 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
    - 2008-09-06 22:36:38 257,802 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
    + 2008-09-07 07:59:11 259,888 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
    .
    -- Snapshot reset to current date --
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0db87c61-796b-4afd-9ae7-32d67672e1be}]
    2008-09-05 16:25 155648 --a------ C:\Windows\system32\CodecBHO.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-04 165784]
    "AlcoholAutomount"="C:\Program Files\alkohooli\axcmd.exe" [2008-06-02 4608]
    "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-08-09 221184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 815104]
    "PLFSet"="C:\Windows\PLFSet.dll" [2007-04-24 45056]
    "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-12 178712]
    "LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2007-10-17 858632]
    "WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-05-29 C:\Windows\RtHDVCpl.exe]
    "Skytel"="Skytel.exe" [2007-05-29 C:\Windows\SkyTel.exe]

    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
    BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-01-19 711472]
    Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-07-11 535336]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.XFR1"= xfcodec.dll
    "msacm.ac3filter"= ac3filter.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UacDisableNotify"=dword:00000001
    "InternetSettingsDisableNotify"=dword:00000001
    "AutoUpdateDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{C1DC7B11-B79A-4BF4-B28C-42D6DF4CB80E}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "{3F2E0E27-9CBF-436A-8031-A348E6BCE49B}"= C:\Program Files\CyberLink\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD
    "{71F1FB9D-215D-48D5-847E-4F4ECC5B799B}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
    "TCP Query User{57BB6E62-4BBE-425C-8549-4315138E4ECC}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "UDP Query User{DFF88394-DC53-414D-BC71-346CBF35E0E3}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "TCP Query User{2721AA46-3930-44F1-87DC-D9DC16BE3BCC}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "UDP Query User{A8AD16E9-C4CF-44C7-ADBB-2ACD41F900CE}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "TCP Query User{B21065C9-B844-4B3E-8DB0-959F2F577203}C:\\program files\\tvuplayer\\tvuplayer.exe"= UDP:C:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
    "UDP Query User{1905375D-6E16-4B87-B57B-FAF0C4E9A32A}C:\\program files\\tvuplayer\\tvuplayer.exe"= TCP:C:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
    "TCP Query User{BADE3BA8-5924-49D5-87B8-053F08975772}D:\\pelit\\worms armageddon - new edition\\wa.exe"= UDP:D:\pelit\worms armageddon - new edition\wa.exe:Worms Armageddon
    "UDP Query User{3D4DF362-6C70-4A78-B908-EFBE7895DE8B}D:\\pelit\\worms armageddon - new edition\\wa.exe"= TCP:D:\pelit\worms armageddon - new edition\wa.exe:Worms Armageddon
    "TCP Query User{9276862E-690B-43E5-A669-DDA1E8F5C72F}D:\\pelit\\hitman -blood money-\\hitmanbloodmoney.exe"= UDP:D:\pelit\hitman -blood money-\hitmanbloodmoney.exe:HitmanBloodMoney
    "UDP Query User{DB108A70-C498-4AD9-A54F-0B14096703B6}D:\\pelit\\hitman -blood money-\\hitmanbloodmoney.exe"= TCP:D:\pelit\hitman -blood money-\hitmanbloodmoney.exe:HitmanBloodMoney
    "{7F6AF321-DF32-43E7-A514-2DADB568B227}"= UDP:C:\Program Files\SEGA\Beijing 2008\Beijing.exe:Beijing 2008™
    "{C0BEA72B-BB5B-463E-A3F0-FFB1C760FB47}"= TCP:C:\Program Files\SEGA\Beijing 2008\Beijing.exe:Beijing 2008™
    "TCP Query User{D759DD74-4235-400B-AE3A-21E70FF0DE36}C:\\program files\\sega\\beijing 2008\\beijing.exe"= UDP:C:\program files\sega\beijing 2008\beijing.exe:Beijing 2008™
    "UDP Query User{B4A90E44-DE79-434E-A549-4C33FACA3631}C:\\program files\\sega\\beijing 2008\\beijing.exe"= TCP:C:\program files\sega\beijing 2008\beijing.exe:Beijing 2008™

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
    "EnableFirewall"= 0 (0x0)

    R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 78416]
    R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2006-11-02 17:51 13560]
    R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
    R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 51280]
    R2 BcmSqlStartupSvc;Business Contact Managerin SQL Server -käynnistyspalvelu;C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-16 30312]
    R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-01-28 810320]
    R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-07-28 2929664]
    R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-02-09 179712]
    S3 btwaudio;Bluetooth-äänilaite;C:\Windows\system32\drivers\btwaudio.sys [2007-01-09 78128]
    S3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-01-09 80688]
    S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-01-09 16560]
    S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-02-26 29183504]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
    bthsvcs REG_MULTI_SZ BthServ

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    \shell\AutoRun\command - wd_windows_tools\setup.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b29931f-ae30-11dc-8218-000000000000}]
    \shell\AutoRun\command - wd_windows_tools\setup.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a180a5a2-e908-11dc-8032-000000000000}]
    \shell\AutoRun\command - G:\autorun\autorun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eafb133e-ad94-11dc-87aa-806e6f6e6963}]
    \shell\AutoRun\command - E:\Autorun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f47adb2b-2fd0-11dd-b642-000000000000}]
    \shell\AutoRun\command - F:\autorun\autorun.exe
    .
    'Ajoitetut tehtävät'-kansion sisältö
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-\YUR4569.exe - C:\Windows\system32\YUR4569.exe
    HKCU-Run-\YURC8FD.exe - C:\Windows\system32\YURC8FD.exe
    HKCU-Run-\YUR8BAB.exe - C:\Windows\system32\YUR8BAB.exe
    HKCU-Run-\YUR8583.exe - C:\Windows\system32\YUR8583.exe
    HKCU-Run-\YUR8C57.exe - C:\Windows\system32\YUR8C57.exe
    HKCU-Run-\YUR905C.exe - C:\Windows\system32\YUR905C.exe
    HKCU-Run-\YUR952.exe - C:\Windows\system32\YUR952.exe



    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-07 17:38:50
    Windows 6.0.6001 Service Pack 1 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-09-07 17:40:18
    ComboFix-quarantined-files.txt 2008-09-07 14:40:15
    ComboFix2.txt 2008-09-06 23:05:06

    Pre-Run: 3,576,111,104 tavua vapaana
    Post-Run: 4,414,902,272 tavua vapaana

    249 --- E O F --- 2008-09-06 12:22:28
     
    uupee, Sep 7, 2008
    #12
  13. uupee

    uupee Member

    Joined:
    Mar 27, 2006
    Messages:
    73
    Likes Received:
    1
    Trophy Points:
    18
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:59:14, on 7.9.2008
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Users\Hallinta\AppData\Local\Temp\RtkBtMnt.exe
    C:\Program Files\Launch Manager\LManager.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Internet Explorer\ieuser.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: CodecPlugin Class - {0db87c61-796b-4afd-9ae7-32d67672e1be} - C:\Windows\system32\CodecBHO.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
    O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
    O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
    O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\alkohooli\axcmd.exe" /automount
    O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: Lähetä kuva &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Lähetä sivu &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O13 - Gopher Prefix:
    O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/fi-fi/wlscctrl2.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs:
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\alkohooli\StarWind\StarWindServiceAE.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 9123 bytes
     
    uupee, Sep 7, 2008
    #13
  14. uupee

    uupee Member

    Joined:
    Mar 27, 2006
    Messages:
    73
    Likes Received:
    1
    Trophy Points:
    18
    Jos kaikki on Yahtin mielestä nyt kunnossa, niin ei muuta kuin iso kiitos ja kummarrus. Sinusta oli erittäin paljon hyötyä ja hoidit asian ammattimaiseen tyyliin!
     
    uupee, Sep 9, 2008
    #14
  15. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Moro viellä löytyy poistettavaa.

    Onkos Windowsin oma palomuuri käytössä?

    Poista seuraava tiedosto jos sellainen löytyy.

    C:\Windows\system32\CodecBHO.dll

    Fixaa seuraavat rivit Hijacktihs:llä

    O2 - BHO: CodecPlugin Class - {0db87c61-796b-4afd-9ae7-32d67672e1be} - C:\Windows\system32\CodecBHO.dll
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

    Avaa Muistio ja kopioi seuraavat rivit siihen:

    Code:
    @echo off
sc delete LiveUpdate
sc delete "LiveUpdate Notice Ex"
sc delete "LiveUpdate Notice Service"
    Sitten documentti tallennetaan työpöydälle nimellä Poisto.bat ja tiedostotyypiksi: All Files.
    Sitten ajetaan työpöydällä oleva Poisto.bat-tiedosto.

    Tarkista koneesi F-Securen online skannerilla

    Huom, skanneri toimii vain Internet Explorer selaimella

    * Lue sivun ohjeet huolella läpi
    * Klikkaa Start scanning
    * Mikäli saat Internet Explorer -suojausvaroituksen, klikkaa Asenna
    * Klikkaa Accept
    * Klikkaa Custom Scan
    * Säädä asetukset seuraavasti

    o "Virus Scan Option" kohdasta valitse Scan whole system
    o "Other Scan Option" kohdasta valitse Scan All Files
    o Valitse Scan whole system for rootkits
    o Valitse Scan whole system for spyware
    o Laita ruksi kohtaan Scan inside archives
    o Varmista että Use advanced heuristics on valittuna

    * Klikkaa Start
    * Skannaus käynnistyy kun tarvittavat tiedostot/päivitykset on ladattu
    * Odota kärsivällisesti
    * Kun sakannaus on suoritettu, klikkaa Automatic cleaning
    * Klikkaa Show Report
    * Raportti aukeaa selaimessa, kopioi teksti kokonaan
    * Liitä kopioitu teksti esim. muistioon tai Wordiin ja tallenna työpöydälle
    * Voit sulkea skannerin
    * Lähetä raportti viestiketjuusi

    Lähetä uusi Hijackthis loki.
     
    yaht, Sep 9, 2008
    #15
  16. uupee

    uupee Member

    Joined:
    Mar 27, 2006
    Messages:
    73
    Likes Received:
    1
    Trophy Points:
    18
    Scanning Report
    Tuesday, September 09, 2008 17:25:15 - 21:32:09

    Computer name: OMISTAJA-PC
    Scanning type: Scan system for malware, rootkits
    Target: C:\ D:\
    Result: 21 malware found
    TrackingCookie.2o7 (spyware)

    * System

    TrackingCookie.Adbrite (spyware)

    * System

    TrackingCookie.Adform (spyware)

    * System

    TrackingCookie.Adtech (spyware)

    * System

    TrackingCookie.Adtoma (spyware)

    * System

    TrackingCookie.Advertising (spyware)

    * System

    TrackingCookie.Zanox (spyware)

    * System

    Trojan-Downloader.Java.OpenConnection.ar (virus)

    * C:\Users\Hallinta\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\59ef263f-48dd202c\Java2SE.class

    Trojan-Downloader.Win32.Agent (virus)

    * System

    Trojan-Downloader.Win32.Agent.aflr (virus)

    * C:\x
    * C:\QooBox\Quarantine\C\Windows\System32\YUR4569.exe.vir (Renamed & Submitted)

    Trojan-Downloader.Win32.BHO.sz (virus)

    * C:\Program Files\Trend Micro\HijackThis\backups\backup-20080909-165950-462.dll (Renamed & Submitted)
    * C:\Pelit\Fallout2\fallout 2.exe.exe (Renamed & Submitted)
    * C:\Downloads\fallout 2.exe.exe (Renamed & Submitted)
    * D:\pelit\Fallout2\fallout 2.exe.exe (Renamed & Submitted)

    Trojan-Downloader.Win32.Zlob.ych (virus)

    * C:\Downloads\Setup_ver1.1773.0.exe (Renamed & Submitted)

    Trojan.Win32.FraudPack.gen (virus)

    * C:\Users\Hallinta\AppData\Local\Mozilla\Firefox\Profiles\uwal04o7.default\Cache\797C5E38d01 (Renamed & Submitted)

    Trojan.Win32.Vapsup.jzi (virus)

    * C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\Report1c02ea1e\Report.cab\s1265.php.xor
    * C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\Report1a089a51\Report.cab\s1265.php.xor
    * C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Report1c02ea1e\Report.cab\s1265.php.xor
    * C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Report1a089a51\Report.cab\s1265.php.xor

    Statistics
    Scanned:

    * Files: 250781
    * System: 4295
    * Not scanned: 349

    Actions:

    * Disinfected: 0
    * Renamed: 7
    * Deleted: 0
    * None: 14
    * Submitted: 7

    Files not scanned:

    * `&#65533;&#65533;IIBERFIL.SYS C:\PAGEFILE.SYS
    * C:\WINDOWS\BTHSERVSDP.DAT
    * C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-NTVDM-SYSTEM32_31BF3856AD364E35_6.0.6001.18000_NONE_FE0D791A728DD79C\BIOS1.ROM
    * C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-NTVDM-SYSTEM32_31BF3856AD364E35_6.0.6000.16386_NONE_FBD6B71E75A2C6C8\BIOS1.ROM
    * C:\WINDOWS\WINSXS\BACKUP\X86_MICROSOFT-WINDOWS-NTVDM-SYSTEM32_31BF3856AD364E35_6.0.6001.18000_NONE_FE0D791A728DD79C_BIOS1.ROM_265D2348
    * C:\WINDOWS\TEMP\_AVAST4_\WEBSHLOCK.TXT
    * C:\WINDOWS\SYSTEM32\7B296FB0-376B-497E-B012-9C450E1B7327-2P-0.C7483456-A289-439D-8115-601632D005A0
    * C:\WINDOWS\SYSTEM32\7B296FB0-376B-497E-B012-9C450E1B7327-2P-1.C7483456-A289-439D-8115-601632D005A0
    * C:\WINDOWS\SYSTEM32\BIOS1.ROM
    * C:\WINDOWS\SYSTEM32\SMI\STORE\MACHINE\SCHEMA.DAT{3D4E88EC-6A70-11DB-B1BA-D64300C9C793}.TXR.1.REGTRANS-MS
    * C:\WINDOWS\SYSTEM32\SMI\STORE\MACHINE\SCHEMA.DAT{3D4E88EC-6A70-11DB-B1BA-D64300C9C793}.TXR.2.REGTRANS-MS
    * C:\WINDOWS\SYSTEM32\SMI\STORE\MACHINE\SCHEMA.DAT{3D4E88ED-6A70-11DB-B1BA-D64300C9C793}.TMCONTAINER00000000000000000002.REGTRANS-MS
    * C:\WINDOWS\SYSTEM32\MSDTC\KTMRMTMCONTAINER00000000000000000002
    * C:\WINDOWS\SYSTEM32\DRIVERS\SPTD.SYS
    * C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS
    * C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS.LOG1
    * C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS.LOG2
    * C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
    * C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG1
    * C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG2
    * C:\WINDOWS\SYSTEM32\CONFIG\SAM
    * C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG1
    * C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG2
    * C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
    * C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG1
    * C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG2
    * C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
    * C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG1
    * C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG2
    * C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
    * C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG1
    * C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG2
    * C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\NTUSER.DAT{94DEA92B-71E3-11DB-92C0-806E6F6E6963}.TMCONTAINER00000000000000000002.REGTRANS-MS
    * C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\MICROSOFT\WINDOWS\USRCLASS.DAT{AF53CEFF-B39A-11DC-832E-000000000000}.TMCONTAINER00000000000000000002.REGTRANS-MS
    * C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\MICROSOFT\WINDOWS\USRCLASS.DAT{E1D3CDC5-B2AD-11DC-9A30-000000000000}.TMCONTAINER00000000000000000002.REGTRANS-MS
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\COMPONENTS
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\COMPONENTS.LOG1
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\DEFAULT
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\DEFAULT.LOG1
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SAM
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SAM.LOG1
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SECURITY
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SECURITY.LOG1
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SOFTWARE
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SOFTWARE.LOG1
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SYSTEM
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SYSTEM.LOG1
    * C:\WINDOWS\SYSTEM32\CATROOT2\EDB.LOG
    * C:\WINDOWS\SYSTEM32\CATROOT2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\CATDB
    * C:\WINDOWS\SYSTEM32\CATROOT2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\CATDB
    * C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\NTUSER.DAT
    * C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\NTUSER.DAT.LOG1
    * C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\NTUSER.DAT.LOG2
    * C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\NTUSER.DAT{3D4E88E5-6A70-11DB-B1BA-D64300C9C793}.TMCONTAINER00000000000000000002.REGTRANS-MS
    * C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\APPDATA\LOCAL\MICROSOFT\WINDOWS\USRCLASS.DAT{766364D0-B5F5-11DC-B3EE-000000000000}.TMCONTAINER00000000000000000002.REGTRANS-MS
    * C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\APPDATA\LOCAL\MICROSOFT\WINDOWS\USRCLASS.DAT{92BD4D20-13B1-11DD-9B38-000000000000}.TMCONTAINER0000000000000&#65533;

    Options
    Scanning engines:

    * F-Secure USS: 2.30.0
    * F-Secure Hydra: 2.8.8110, 2008-09-09
    * F-Secure AVP: 7.0.171, 2008-09-09
    * F-Secure Pegasus: 1.20.0, 2008-04-15

    Scanning options:

    * Scan all files
    * Scan inside archives
    * Use Advanced heuristics

    Copyright © 1998-2007 Product support |Send virus sample to F-Secure
    F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.

     
    uupee, Sep 9, 2008
    #16
  17. uupee

    uupee Member

    Joined:
    Mar 27, 2006
    Messages:
    73
    Likes Received:
    1
    Trophy Points:
    18
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:46:38, on 9.9.2008
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Launch Manager\LManager.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Users\Hallinta\AppData\Local\Temp\RtkBtMnt.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
    C:\Program Files\Internet Explorer\IEUser.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
    O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
    O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
    O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\alkohooli\axcmd.exe" /automount
    O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: Lähetä kuva &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Lähetä sivu &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O13 - Gopher Prefix:
    O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/fi-fi/wlscctrl2.cab
    O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs:
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\alkohooli\StarWind\StarWindServiceAE.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 8452 bytes
     
    uupee, Sep 9, 2008
    #17
  18. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Avaa Muistio ja kopioi seuraavat rivit siihen:

    Code:
    @echo off
sc stop CLTNetCnService
sc delete CLTNetCnService
    Sitten documentti tallennetaan työpöydälle nimellä Poisto.bat ja tiedostotyypiksi: All Files.
    Sitten ajetaan työpöydällä oleva Poisto.bat-tiedosto.

    Lataa CCleaner tästä

    - Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
    - Asennuksen jälkeen aukaise CCleaner.
    - Valitse vasemmalta pystyrivistä Options.
    - Valitse viereisestä pystyrivistä Settings.
    - Language kohtaan valitse Suomi.

    - Käynnistä CCleaner.
    - Valitse Valinnat.
    - Paina Lisäasetukset.
    - Ota ruksi pois kohdasta "Poista vain yli 48 tuntia vanhat tiedostot Windowsin tilapäiskansioista".

    Puhdistaja

    - Valitse vasemmalta pystyrivistä Puhdistaja.
    - Paina alhaalta Tutki.
    Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
    - Kun tutkiminen on valmis, paina Aja CCleaner.
    Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.

    Rekisterin virheiden korjaus

    - Valitse vasemmalta pystyrivistä Rekisteri.
    - Paina alhaalta Etsi rekisterin virheitä.
    - Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
    - Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
    - Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
    - Saat vielä varmistus kysymyksen, paina Ok.
    - Kun virheet on korjattu, paina Sulje.

    Nyt voit suljea CCleanerin painamalla oikealta ylhäältä punaista rastia.

    Lähetä uusi Hijackthis loki.
     
    yaht, Sep 10, 2008
    #18
  19. uupee

    uupee Member

    Joined:
    Mar 27, 2006
    Messages:
    73
    Likes Received:
    1
    Trophy Points:
    18
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:47:10, on 10.9.2008
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Launch Manager\LManager.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Users\Hallinta\AppData\Local\Temp\RtkBtMnt.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\ieuser.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
    C:\Windows\system32\conime.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
    O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
    O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
    O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\alkohooli\axcmd.exe" /automount
    O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: Lähetä kuva &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Lähetä sivu &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O13 - Gopher Prefix:
    O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/fi-fi/wlscctrl2.cab
    O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs:
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\alkohooli\StarWind\StarWindServiceAE.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 8518 bytes
     
    uupee, Sep 10, 2008
    #19
  20. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Puhtaalta näyttää :D
     
    yaht, Sep 11, 2008
    #20
Page 1 of 2

Share This Page