Niin ilmeisesti jonkulaatusta virusta koneessa. Internet explorer ja mozilla ohjautuvat väärille sivuille, ja useat sivut eivät avaudu ollenkaan. Opera toimii täysin normaalisti ja sillä kirjoittelen tätäkin. Olen scannannut koneeni Avira antivir:llä, Windows Defenderillä ja Ad-awarella. Ongelma ei kuitenkaan ole poistunut lukuisten virusten poistojen myötä. HiJackThis loki: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:52:13, on 26.2.2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Microsoft Hardware\Keyboard\type32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Nokia\Nokia PC Suite 7\PcSync2.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\bgsvcgen.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Luidia\eBeam Device Service\eBeamDeviceServiceUI.exe C:\Program Files\Nexon\MapleStory\npkcmsvc.exe C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\WINDOWS\explorer.exe C:\Program Files\Opera\opera.exe C:\HiJackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing) O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing) O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.22\RivaTuner.exe" /S O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PcSync2.exe" /NoDialog O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by113fd.bay113.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1220656567007 O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1220656519148 O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {E4F500BF-C1A3-11D6-9697-0090961B771E} (VCR.Scan) - http://www.viruschaser.com/Kor/vc4w_ocx/Vcrscan.CAB O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: eBeam Device Service - Luidia, Inc. - C:\Program Files\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: Ethernet Packet Service (npacketservice) - Nokia - C:\WINDOWS\system32\npacketsvc.exe O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - C:\Program Files\Nexon\MapleStory\npkcmsvc.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe -- End of file - 10833 bytes
scannaa hjt:llä merkkaa paina Fix checked R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing) O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PcSync2.exe" /NoDialog =========== sammuta käynnistä ========== Lataa Malwarebytes' Anti-Malware työpöydällesi. 1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. 2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish. 3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. 4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan. 5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset. 6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected. 7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt 8. Lähetä lokin sisältö seuraavassa viestissäsi
Toimenpiteet tehty. Malwarebytes':n loki: Malwarebytes' Anti-Malware 1.34 Tietokantaversio: 1809 Windows 5.1.2600 Service Pack 3 27.2.2009 20:22:52 mbam-log-2009-02-27 (20-22-52).txt Tarkistustyyppi: Täysi tarkistus (C:\|) Tarkistetut kohteet: 277114 Kulunut aika: 3 hour(s), 43 minute(s), 6 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 6 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 1 Saastuneita tiedostoja: 11 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\malware scanner_is1 (Rogue.MalwareScanner) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Malware Scanner (Rogue.MalwareScanner) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\seneka (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\seneka (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seneka (Trojan.Agent) -> Quarantined and deleted successfully. Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: C:\WINDOWS\system32\drivers\downld (Trojan.Agent) -> Quarantined and deleted successfully. Saastuneita tiedostoja: C:\System Volume Information\_restore{09D58A35-DDE3-4DB9-8630-2AFC35CBEA05}\RP1335\A0351408.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{09D58A35-DDE3-4DB9-8630-2AFC35CBEA05}\RP1335\A0351409.dll (Rootkit.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\senekapvmiwwkx.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\senekawrbwwcmw.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\seneka.sys (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\senekawgoxtetq.sys (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\senekawpsvvsjt.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\senekaxvcwruhb.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\UACeomuwkmo.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\UACpeycspbi.log (Trojan.Agent) -> Quarantined and deleted successfully. ----------------------------------------------------------------------- Lisäys: Vaikuttaa siltä, että kaikki epänormaalit ongelmat ovat jo poistuneet.
aja 1.Lataa Combofix.exe työpöydällesi yhdestä linkistä: Combofix1 Combofix2 Älä asenna palautus consolia 2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. ============ Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi. Käynnistä koneesi vikasietotilaan: sammuta ja käynnistä käynnistyksen yhteydessä hakkaa F8 nappia valitse nuolinäppäimellä vikasietotila paina enter ja enter valitse käyttäjätilisi paina kyllä Jossakin koneissa hakataan F8:sin sijasta F5:tä " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix. " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman. " Paina Y käynnistääksesi skriptin. " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot". " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen. " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta. " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished". " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle. " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
HiJackThis log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:02:32, on 28.2.2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\bgsvcgen.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Luidia\eBeam Device Service\eBeamDeviceServiceUI.exe C:\Program Files\Nexon\MapleStory\npkcmsvc.exe C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\Microsoft Hardware\Keyboard\type32.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\SUPERAntiSpyware\e9f7d249-e6af-42cd-a76a-95c45d5a7f1d.exe C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\WINDOWS\system32\SearchProtocolHost.exe C:\Program Files\HiJackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\e9f7d249-e6af-42cd-a76a-95c45d5a7f1d.exe O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by113fd.bay113.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1220656567007 O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1220656519148 O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {E4F500BF-C1A3-11D6-9697-0090961B771E} (VCR.Scan) - http://www.viruschaser.com/Kor/vc4w_ocx/Vcrscan.CAB O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: eBeam Device Service - Luidia, Inc. - C:\Program Files\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: Ethernet Packet Service (npacketservice) - Nokia - C:\WINDOWS\system32\npacketsvc.exe O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - C:\Program Files\Nexon\MapleStory\npkcmsvc.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe -- End of file - 9986 bytes ------------------------------------------------------------------------- Combofix log: ComboFix 09-02-27.02 - Wilen 2009-02-28 14:48:39.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.2047.1457 [GMT 2:00] Sijainti: c:\documents and settings\Wilen\Työpöytä\ComboFix.exe AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) * Uusi palautuspiste luotu VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !! . (((((((((((((((((((((((((((((((((((((( Muut poistot )))))))))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Wilen\Application Data\hidires c:\windows\exefld c:\windows\system32\drivers\npf.sys c:\windows\system32\packet.dll c:\windows\system32\pthreadVC.dll c:\windows\system32\tmp.reg c:\windows\system32\wanpacket.dll c:\windows\system32\wpcap.dll . ((((((((((((((((((((((((((((((((((((((( Ajurit/Palvelut ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ILVMONEYDRIVER53 -------\Legacy_NPF -------\Service_IlvMoneyDRIVER53 -------\Service_m_hook -------\Service_NPF ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-28 to 2009-02-28 ))))))))))))))))) . 2009-02-27 23:23 . 2009-01-09 21:19 1,089,883 -----c--- c:\windows\system32\dllcache\ntprint.cat 2009-02-27 23:02 . 2009-02-27 23:02 1,374 --a------ c:\windows\imsins.BAK 2009-02-27 22:56 . 2009-02-27 22:56 <KANSIO> d-------- C:\ac86c0f9e91a403e65d90d9fcd 2009-02-27 16:36 . 2009-02-27 16:36 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-02-27 16:36 . 2009-02-27 16:36 <KANSIO> d-------- c:\documents and settings\Wilen\Application Data\Malwarebytes 2009-02-27 16:36 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-27 16:36 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2009-02-27 00:29 . 2009-02-27 00:29 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-02-27 00:28 . 2009-02-27 00:28 22,600 --a------ c:\windows\system32\AAWService_2009_02_27_00_28_18.dmp 2009-02-27 00:17 . 2009-02-27 00:29 <KANSIO> d-------- c:\program files\SUPERAntiSpyware 2009-02-27 00:17 . 2009-02-27 00:17 <KANSIO> d-------- c:\documents and settings\Wilen\Application Data\SUPERAntiSpyware.com 2009-02-26 23:37 . 2005-08-27 02:38 1,435,272 --a------ c:\windows\system32\Flash.ocx 2009-02-26 23:37 . 2002-03-04 12:27 1,140,472 --a------ c:\windows\system32\IGUltraGrid20.ocx 2009-02-26 23:37 . 2003-11-19 13:59 512,688 --a------ c:\windows\system32\XceedCry.dll 2009-02-26 23:37 . 2004-05-11 09:56 423,784 --a------ c:\windows\system32\XceedBkp.dll 2009-02-26 23:37 . 2004-02-05 20:53 389,120 --a------ c:\windows\system32\ACTSKN43.OCX 2009-02-26 23:37 . 2001-07-28 12:50 265,753 --a------ c:\windows\system32\AS-Exp2.ocx 2009-02-26 23:37 . 2004-01-09 10:54 188,416 --a------ c:\windows\system32\actsplash.ocx 2009-02-26 23:37 . 2001-03-28 22:02 89,088 --a------ c:\windows\system32\ProgressBar4.ocx 2009-02-26 23:37 . 2001-04-20 01:28 28,672 --a------ c:\windows\system32\systray.ocx 2009-02-26 23:37 . 1999-01-26 19:36 11,012 --a------ c:\windows\system32\threadapi.tlb 2009-02-26 23:37 . 2006-05-31 15:38 10,752 --a------ c:\windows\system32\md5.dll 2009-02-26 22:05 . 2009-02-26 22:07 <KANSIO> d-------- c:\documents and settings\Wilen\.housecall6.6 2009-02-26 22:02 . 2009-02-26 22:02 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-02-26 21:58 . 2009-02-26 21:58 <KANSIO> d-------- c:\windows\BDOSCAN8 2009-02-26 21:13 . 2009-02-26 21:13 22,173 --a------ c:\windows\system32\AAWService_2009_02_26_21_13_49.dmp 2009-02-26 07:37 . 2009-02-26 07:37 22,600 --a------ c:\windows\system32\AAWService_2009_02_26_07_37_31.dmp 2009-02-25 23:58 . 2009-02-25 23:42 15,688 --a------ c:\windows\system32\lsdelete.exe 2009-02-25 23:43 . 2009-02-25 23:42 64,160 --a------ c:\windows\system32\drivers\Lbd.sys 2009-02-25 23:38 . 2009-02-25 23:38 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2009-02-25 23:38 . 2009-02-25 23:38 <KANSIO> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-02-25 21:10 . 2009-02-25 21:12 794,408 --a------ c:\windows\system32\pbsvc.exe 2009-02-25 21:10 . 2009-02-25 21:12 139,152 --a------ c:\documents and settings\Wilen\Application Data\PnkBstrK.sys 2009-02-21 14:33 . 2009-02-21 14:33 <KANSIO> d-------- c:\program files\THQ 2009-02-20 12:41 . 2009-02-20 12:41 <KANSIO> d-------- c:\documents and settings\Wilen\Application Data\OpenOffice.org 2009-02-20 12:36 . 2009-02-20 12:40 <KANSIO> d-------- c:\program files\OpenOffice.org 3 2009-02-09 13:18 . 2009-02-09 13:18 1,253,376 --a------ c:\windows\system32\NvPVEnc.ax 2009-02-09 13:18 . 2009-02-09 13:18 401,408 --a------ c:\windows\system32\nvcuvid.dll 2009-02-08 04:44 . 2009-02-08 04:44 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf 2009-02-08 04:44 . 2009-02-08 04:44 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf 2009-02-08 04:42 . 2008-03-21 13:57 14,640 --------- c:\windows\system32\spmsgXP_2k3.dll . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-27 19:17 --------- d-----w c:\program files\CCleaner 2009-02-27 13:34 --------- d-----w c:\program files\iPod 2009-02-27 13:09 --------- d-----w c:\program files\NCH Swift Sound 2009-02-27 13:09 --------- d-----w c:\documents and settings\Wilen\Application Data\NCH Swift Sound 2009-02-27 12:17 --------- d-----w c:\program files\Winamp 2009-02-27 01:11 --------- d-----w c:\program files\Microsoft Silverlight 2009-02-26 22:17 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-02-26 20:40 --------- d-----w c:\program files\Google 2009-02-26 19:50 --------- d-----w c:\program files\Java 2009-02-25 21:39 --------- d-----w c:\program files\Lavasoft 2009-02-25 21:39 --------- d-----w c:\documents and settings\Wilen\Application Data\Lavasoft 2009-02-25 19:12 139,152 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2009-02-25 18:59 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-25 16:13 --------- d-----w c:\program files\AGEIA Technologies 2009-02-21 18:27 --------- d-----w c:\documents and settings\Wilen\Application Data\PC Suite 2009-02-20 14:03 --------- d-----w c:\program files\eMule 2009-02-20 10:32 --------- d-----w c:\documents and settings\Wilen\Application Data\OpenOffice.org2 2009-02-14 21:54 34 ----a-w c:\documents and settings\Wilen\jagex_runescape_preferences.dat 2009-02-10 19:34 --------- d-----w c:\program files\Nexon 2009-02-09 11:18 6,307,328 ----a-w c:\windows\system32\drivers\nv4_mini.sys 2009-02-07 01:40 --------- d-----w c:\program files\QuickTime 2009-02-02 20:22 --------- d-----w c:\program files\Emulators 2009-02-01 15:44 --------- d-----w c:\documents and settings\Wilen\Application Data\GameHouse 2009-01-23 12:19 --------- d-----w c:\documents and settings\Wilen\Application Data\yoclient 2009-01-21 21:40 --------- d-----w c:\program files\Common Files\Symbian 2009-01-17 22:33 --------- d-----w c:\program files\Common Files\PCSuite 2009-01-17 22:33 --------- d-----w c:\program files\Common Files\Nokia 2009-01-17 22:32 --------- d-----w c:\program files\PC Connectivity Solution 2009-01-17 22:31 --------- d-----w c:\program files\Nokia 2009-01-17 22:30 --------- d-----w c:\documents and settings\All Users\Application Data\Installations 2009-01-07 17:36 --------- d-----w c:\documents and settings\Wilen\Application Data\gtk-2.0 2009-01-05 13:09 --------- d-----w c:\program files\NVIDIA nTune Performance Application 2009-01-05 09:52 --------- d-----w c:\program files\Bonjour 2009-01-05 09:51 --------- d-----w c:\program files\iTunes 2009-01-05 09:51 --------- d-----w c:\program files\Common Files\Apple 2009-01-05 09:51 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2009-01-05 09:25 --------- d-----w c:\program files\Safari 2008-01-13 11:59 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat 2007-07-15 08:47 110 ----a-w c:\documents and settings\All Users\Application Data\MostFunGameId.bin 2008-05-27 20:26 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Sivuhistoria\History.IE5\MSHist012008052720080528\index.dat . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\e9f7d249-e6af-42cd-a76a-95c45d5a7f1d.exe" [2009-02-17 1830128] "OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2006-05-16 57344] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13680640] "NeroCheck"="c:\windows\System32\\NeroCheck.exe" [2001-07-09 155648] "InCD"="c:\program files\Ahead\InCD\InCD.exe" [2005-07-08 1397760] "OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2006-05-16 40960] "IntelliType"="c:\program files\Microsoft Hardware\Keyboard\type32.exe" [2002-03-22 94208] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 266497] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-09 86016] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-25 509784] "RTHDCPL"="RTHDCPL.EXE" [2006-04-04 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "EnableProfileQuota"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.MJPG"= pvmjpg21.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\eMule\\emule.exe"= "c:\\Pelit\\NHL 07\\nhl2007pal.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Pelit\\Age of empires II\\empires2.exe"= "c:\\Pelit\\Age of Empires\\EMPIRES.EXE"= "c:\\Program Files\\NEXON\\MapleStory\\Patcher.exe"= "c:\\Pelit\\Battlefield 1942\\BF1942.exe"= "c:\\Pelit\\Need for Speed Most Wanted\\speed.exe"= "c:\\Pelit\\Age of Empires\\EMPIRESX.EXE"= "c:\\Pelit\\Soldat\\Soldat.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\MostFun\\Bin\\MostFun.exe"= "c:\\Program Files\\NEXON\\MapleStory\\MapleStory.exe"= "c:\\Program Files\\DC++\\DCPlusPlus.exe"= "c:\\Pelit\\Turbo Sliders\\sliders.exe"= "c:\\Pelit\\LF2\\lf2.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\CCleaner\\CCleaner.exe"= "c:\\Pelit\\RollerCoaster Tycoon\\rct.exe"= "c:\\Pelit\\Mechwarrior Mercenaries\\MW4Mercs.exe"= "c:\\Program Files\\Opera\\Opera.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Pelit\\Flatout 2\\FlatOut2.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Pelit\\Roller Coaster Tycoon 2\\rct2.exe"= "c:\\Pelit\\Battlefield 2 Demo\\BF2.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "56362:TCP"= 56362:TCPando Media Booster "56362:UDP"= 56362:UDPando Media Booster R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-02-25 64160] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-02-17 8944] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-02-17 55024] R2 eBeam Device Service;eBeam Device Service;c:\program files\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe [2008-01-10 180224] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096] R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-02-17 7408] S3 ALSysIO;ALSysIO;\??\c:\docume~1\Wilen\LOCALS~1\Temp\ALSysIO.sys --> c:\docume~1\Wilen\LOCALS~1\Temp\ALSysIO.sys [?] S3 MzBot.sys;MzBot.sys;c:\windows\system32\MzBot.sys [2007-04-01 3584] S3 npacketdriver;Ethernet Packet Driver;c:\windows\system32\drivers\npacket.sys [2009-01-21 18249] S3 npacketservice;Ethernet Packet Service;c:\windows\system32\npacketsvc.exe [2009-01-21 61440] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8736ddc-990c-11dc-90ff-0016176dbbb7}] \Shell\AutoRun\command - D:\setupSNK.exe . 'Ajoitetut tehtävät'-kansion sisältö 2009-02-25 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-25 23:42] 2009-01-12 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-02-28 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20] . - - - - POISTETUT JÄMÄRIVIT - - - - HKCU-Run-PowerBar - (no file) HKU-Default-Run-Nokia.PCSync - c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe . ------- Täydentävä tarkistus ------- . uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local IE: Lähetä &Bluetooth-laitteeseen... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm DPF: {E4F500BF-C1A3-11D6-9697-0090961B771E} - hxxp://www.viruschaser.com/Kor/vc4w_ocx/Vcrscan.CAB FF - ProfilePath - c:\documents and settings\Wilen\Application Data\Mozilla\Firefox\Profiles\2ko5yqht.default\ FF - prefs.js: browser.startup.homepage - www.google.fi FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fi-fi&FORM=MICPFI&q= FF - component: c:\documents and settings\Wilen\Application Data\Mozilla\Firefox\Profiles\2ko5yqht.default\extensions\fi@dictionaries.addons.mozilla.org\platform\WINNT_x86-msvc\components\mozvoikko.dll FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-28 14:57:22 Windows 5.1.2600 Service Pack 3 NTFS tarkistaa piilotettuja prosesseja ... tarkistaa piilotettuja käynnistysarvoja ... tarkistaa piilotettuja tiedostoja ... tarkistus on valmis piilotetut tiedostot: 0 ************************************************************************** . --------------------- LUKITUT REKISTERIAVAIMET --------------------- [HKEY_USERS\S-1-5-21-2000478354-484061587-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ÿcÓw*] "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\PUBPLACE.HTT" . --------------------- Prosesseihin ladatut DLLt --------------------- - - - - - - - > 'winlogon.exe'(1008) c:\program files\SUPERAntiSpyware\SASWINLO.dll . ------------------------ Muut prosessit ------------------------ . c:\program files\Ahead\InCD\InCDsrv.exe c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\windows\system32\bgsvcgen.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Luidia\eBeam Device Service\eBeamDeviceServiceUI.exe c:\program files\Nexon\MapleStory\npkcmsvc.exe c:\program files\NVIDIA Corporation\nTune\nTuneService.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\PnkBstrA.exe c:\windows\system32\searchindexer.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\system32\rundll32.exe c:\windows\system32\wscntfy.exe c:\program files\PC Connectivity Solution\ServiceLayer.exe c:\program files\PC Connectivity Solution\Transports\NclBCBTSrv.exe c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE . ************************************************************************** . Valmistumisajankohta: 2009-02-28 15:15:59 - kone käynnistettiin uudelleen ComboFix-quarantined-files.txt 2009-02-28 13:15:56 Ennen ajoa: 34 327 601 152 tavua vapaana Ajon jälkeen: 34,321,776,640 tavua vapaana Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4 277 --- E O F --- 2009-02-27 18:10:30 ---------------------------------------------------------------------------- SDFix log: SDFix: Version 1.240 Run by Wilen on la 28.02.2009 at 15:27 Microsoft Windows XP [versio 5.1.2600] Running From: C:\Documents and Settings\Wilen\Työpöytä\SDFix\SDFix Checking Services : Restoring Default Security Values Restoring Default Hosts File Rebooting Checking Files : No Trojan Files Found Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-28 15:48:11 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s0"=dword:23d91d22 "s1"=dword:bb9daab4 "s2"=dword:648c0eef "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:c2,93,fb,92,ee,c1,a6,a1,6d,3f,59,fa,1c,9e,4b,3a,6d,3d,01,08,8c,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,8c,65,5a,90,ed,6d,de,dc,bc,f9,fe,d1,90,f3,5d,90,82,.. "khjeh"=hex:2a,3d,9a,c1,94,d9,bf,f0,db,57,6c,dc,98,d6,45,88,c4,f6,a4,b8,74,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:32,7a,28,6a,db,48,04,71,6b,6a,b2,96,d6,ce,14,ba,16,5a,13,f4,51,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:e3,db,51,37,e0,33,cb,ce,d2,4e,25,f2,cc,b1,e9,11,00,c1,12,ae,d0,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:fa,4c,cf,3f,f0,c4,a2,59,3c,f2,0e,76,8a,2e,87,61,c5,ed,9b,9e,f2,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43] "khjeh"=hex:e3,db,51,37,e0,33,cb,ce,d2,4e,25,f2,cc,b1,e9,11,00,c1,12,ae,d0,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:32,34,1f,38,0d,b5,54,8b,96,87,da,ad,e6,8d,5c,5b,6b,f2,ff,b9,df,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,8c,65,5a,90,ed,6d,de,dc,bc,f9,fe,d1,90,f3,5d,90,82,.. "khjeh"=hex:2a,3d,9a,c1,94,d9,bf,f0,db,57,6c,dc,98,d6,45,88,c4,f6,a4,b8,74,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:87,6e,4d,85,f1,32,23,28,e3,1e,16,08,1a,de,0d,c9,93,90,4f,a1,47,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:c2,93,fb,92,ee,c1,a6,a1,6d,3f,59,fa,1c,9e,4b,3a,6d,3d,01,08,8c,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,8c,65,5a,90,ed,6d,de,dc,bc,f9,fe,d1,90,f3,5d,90,82,.. "khjeh"=hex:2a,3d,9a,c1,94,d9,bf,f0,db,57,6c,dc,98,d6,45,88,c4,f6,a4,b8,74,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:4c,b8,90,bf,e9,08,e0,b3,d1,23,7c,50,e5,92,57,ef,6c,90,c5,25,bd,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:65,c8,25,06,d0,7e,e2,41,ac,bd,ee,6f,10,d5,fb,cd,e9,c8,07,8e,d8,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:45,2b,4a,9d,9c,6d,59,27,86,f9,96,20,ec,88,c1,a2,83,67,29,05,fa,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43] "khjeh"=hex:e3,db,51,37,e0,33,cb,ce,d2,4e,25,f2,cc,b1,e9,11,00,c1,12,ae,d0,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:c2,93,fb,92,ee,c1,a6,a1,6d,3f,59,fa,1c,9e,4b,3a,6d,3d,01,08,8c,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,8c,65,5a,90,ed,6d,de,dc,bc,f9,fe,d1,90,f3,5d,90,82,.. "khjeh"=hex:2a,3d,9a,c1,94,d9,bf,f0,db,57,6c,dc,98,d6,45,88,c4,f6,a4,b8,74,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:32,7a,28,6a,db,48,04,71,6b,6a,b2,96,d6,ce,14,ba,16,5a,13,f4,51,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:e3,db,51,37,e0,33,cb,ce,d2,4e,25,f2,cc,b1,e9,11,00,c1,12,ae,d0,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:fa,4c,cf,3f,f0,c4,a2,59,3c,f2,0e,76,8a,2e,87,61,c5,ed,9b,9e,f2,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43] "khjeh"=hex:e3,db,51,37,e0,33,cb,ce,d2,4e,25,f2,cc,b1,e9,11,00,c1,12,ae,d0,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" "C:\\Pelit\\NHL 07\\nhl2007pal.exe"="C:\\Pelit\\NHL 07\\nhl2007pal.exe:*:Enabled:nhl2007pal" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000" "C:\\Pelit\\Age of empires II\\empires2.exe"="C:\\Pelit\\Age of empires II\\empires2.exe:*:Enabled:Age of Empires II" "C:\\Pelit\\Age of Empires\\EMPIRES.EXE"="C:\\Pelit\\Age of Empires\\EMPIRES.EXE:*isabled:Age of Empires" "C:\\Program Files\\NEXON\\MapleStory\\Patcher.exe"="C:\\Program Files\\NEXON\\MapleStory\\Patcher.exe:*:Enabledatcher MFC ?? ????" "C:\\Pelit\\Battlefield 1942\\BF1942.exe"="C:\\Pelit\\Battlefield 1942\\BF1942.exe:*:Enabled:BF1942" "C:\\Pelit\\Need for Speed Most Wanted\\speed.exe"="C:\\Pelit\\Need for Speed Most Wanted\\speed.exe:*:Enabled:speed" "C:\\Pelit\\Age of Empires\\EMPIRESX.EXE"="C:\\Pelit\\Age of Empires\\EMPIRESX.EXE:*:Enabled:Age of Empires, the Rise of Rome" "C:\\Pelit\\Soldat\\Soldat.exe"="C:\\Pelit\\Soldat\\Soldat.exe:*:Enabled:Soldat" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*isabled:Firefox" "C:\\Program Files\\MostFun\\Bin\\MostFun.exe"="C:\\Program Files\\MostFun\\Bin\\MostFun.exe:*:Enabled:MostFun" "C:\\Program Files\\NEXON\\MapleStory\\MapleStory.exe"="C:\\Program Files\\NEXON\\MapleStory\\MapleStory.exe:*:Enabled:MapleStory" "C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:EnabledC++" "C:\\Pelit\\Turbo Sliders\\sliders.exe"="C:\\Pelit\\Turbo Sliders\\sliders.exe:*:Enabled:sliders" "C:\\Pelit\\LF2\\lf2.exe"="C:\\Pelit\\LF2\\lf2.exe:*:Enabled:lf2" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath " "C:\\Program Files\\CCleaner\\CCleaner.exe"="C:\\Program Files\\CCleaner\\CCleaner.exe:*:Enabled:CCleaner" "C:\\Pelit\\RollerCoaster Tycoon\\rct.exe"="C:\\Pelit\\RollerCoaster Tycoon\\rct.exe:*:Enabled:rct" "C:\\Pelit\\Mechwarrior Mercenaries\\MW4Mercs.exe"="C:\\Pelit\\Mechwarrior Mercenaries\\MW4Mercs.exe:*:Enabled:MechWarrior IV" "C:\\Program Files\\Opera\\Opera.exe"="C:\\Program Files\\Opera\\Opera.exe:*isabled:Opera Internet Browser" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" "C:\\Pelit\\Flatout 2\\FlatOut2.exe"="C:\\Pelit\\Flatout 2\\FlatOut2.exe:*isabled:FlatOut2" "C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE:*:Enabled:SAgent4" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Pelit\\Roller Coaster Tycoon 2\\rct2.exe"="C:\\Pelit\\Roller Coaster Tycoon 2\\rct2.exe:*:Enabled:rct2" "C:\\Pelit\\Battlefield 2 Demo\\BF2.exe"="C:\\Pelit\\Battlefield 2 Demo\\BF2.exe:*:Enabled:Battlefield 2" "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:EnablednkBstrA" "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:EnablednkBstrB" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" Remaining Files : Files with Hidden Attributes : Sat 20 Jan 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sat 9 Jun 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp" Finished!
Joo kylhän sillä jo pärjää ============ Kirjoita suorita luukkuun ComboFix /u Klikkaa ok ========== Lataa OTMoveIt OTMoveIt ja tallenna se työpöydällesi. Tuplaklikkaa OTMoveIt.exe. Klikkaa CleanUp!. Valitse Yes kun kysytään "Begin cleanup Process?". Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse. HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.
