Taas mulla ongelmia koneessa!

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by kartsa173, Dec 1, 2008.

  1. kartsa173

    kartsa173 Member

    Joined:
    Nov 14, 2008
    Messages:
    26
    Likes Received:
    0
    Trophy Points:
    11
    Taitaa olla taas viruksia.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:15:49, on 1.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    D:\WINDOWS\System32\smss.exe
    D:\WINDOWS\system32\winlogon.exe
    D:\WINDOWS\system32\services.exe
    D:\WINDOWS\system32\lsass.exe
    D:\WINDOWS\system32\Ati2evxx.exe
    D:\WINDOWS\system32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\system32\Ati2evxx.exe
    D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    D:\Program Files\Alwil Software\Avast4\ashServ.exe
    D:\WINDOWS\system32\spoolsv.exe
    D:\WINDOWS\Explorer.EXE
    D:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
    D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    D:\Program Files\Skype\Phone\Skype.exe
    D:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
    D:\Program Files\Skype\Plugin Manager\skypePM.exe
    D:\Program Files\Windows Live\Messenger\usnsvc.exe
    D:\Program Files\Windows Live\Messenger\msnmsgr.exe
    D:\Program Files\Mozilla Firefox\firefox.exe
    D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - D:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
    O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - D:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe

    --
    End of file - 2383 bytes


    Onko tässä vikaa taas.
     
    kartsa173, Dec 1, 2008
    #1
  2. Hujo

    Hujo Guest

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Hujo, Dec 1, 2008
    #2
  3. kartsa173

    kartsa173 Member

    Joined:
    Nov 14, 2008
    Messages:
    26
    Likes Received:
    0
    Trophy Points:
    11

    Kiitosta kuitenki, minun ongelmat hajotti koneen.
    power oli rikki.
    laitan tietoja kuhan saan niitä haettuu.
     
    kartsa173, Dec 2, 2008
    #3
  4. kartsa173

    kartsa173 Member

    Joined:
    Nov 14, 2008
    Messages:
    26
    Likes Received:
    0
    Trophy Points:
    11
    Aivan joo, tuntuu että uuden asennuksen yhteydessä tuli hitautta lisää meinaan ei aukee netti aikä tunnu aukeevan kohta mikään että mikä täälä vetää koneen tehot kaakkoon?
    tässä ois logi uusin, eri osat koneessa.


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:08:34, on 5.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16735)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
    C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
    C:\Program Files\Common Files\Teleca Shared\Generic.exe
    C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
    O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe

    --
    End of file - 5354 bytes


    Kiitoksia
     
    kartsa173, Dec 5, 2008
    #4
  5. Hujo

    Hujo Guest

    eihän siellä ole vintoosan palomuuri päällä

    ==========

    scannaa hjt:llä merkkaa paina Fix checked

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
     
    Hujo, Dec 5, 2008
    #5
  6. kartsa173

    kartsa173 Member

    Joined:
    Nov 14, 2008
    Messages:
    26
    Likes Received:
    0
    Trophy Points:
    11
    Uusin logi

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:12:54, on 6.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16735)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Program Files\Common Files\Ahead\lib\NMIndexStoreSvr.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
    O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe

    --
    End of file - 4864 bytes
     
    kartsa173, Dec 5, 2008
    #6
  7. kartsa173

    kartsa173 Member

    Joined:
    Nov 14, 2008
    Messages:
    26
    Likes Received:
    0
    Trophy Points:
    11
    Ei oo vinukan palo päälä, sellanen sunbelt palomuuri.

    mutta tässä nää molemmat Logit


    SDFix: Version 1.240
    Run by K on la 06.12.2008 at 13:45

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\Documents and Settings\K\Ty”p”yt„\SDFix

    Checking Services :


    Restoring Default Security Values
    Restoring Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-06 13:49:36
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    IPC error: 2 Määritettyä tiedostoa ei löydy.
    scanning hidden services & system hive ...

    scanning hidden registry entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "C:\\Program Files\\ApexDC++\\ApexDC.exe"="C:\\Program Files\\ApexDC++\\ApexDC.exe:*:Enabled:ApexDC++"
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    Remaining Files :



    Files with Hidden Attributes :

    Mon 14 Apr 2008 1,695,232 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
    Sat 6 Dec 2008 857 ...HR --- "C:\Documents and Settings\K\Application Data\SecuROM\UserData\securom_v7_01.bak"

    Finished!


    sit se
    hjackthis

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:51:43, on 6.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16735)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\notepad.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
    O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe

    --
    End of file - 4921 bytes

    näin.
    kiitoksia neuvoista.
     
    kartsa173, Dec 6, 2008
    #7
  8. Hujo

    Hujo Guest

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi

     
    Hujo, Dec 6, 2008
    #8
  9. kartsa173

    kartsa173 Member

    Joined:
    Nov 14, 2008
    Messages:
    26
    Likes Received:
    0
    Trophy Points:
    11
    Malwarebytes' Anti-Malware 1.31
    Tietokantaversio: 1470
    Windows 5.1.2600 Service Pack 3

    7.12.2008 22:53:36
    mbam-log-2008-12-07 (22-53-27).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|)
    Tarkistetut kohteet: 111766
    Kulunut aika: 2 hour(s), 18 minute(s), 8 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 1

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    C:\Documents and Settings\K\BF2_Patch_1.41.exe (Trojan.FakeAlert) -> No action taken.

    Tässäpä tämä.
     
    kartsa173, Dec 7, 2008
    #9
  10. Hujo

    Hujo Guest

    1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
    Combofix1
    Combofix2

    2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, Dec 7, 2008
    #10
  11. kartsa173

    kartsa173 Member

    Joined:
    Nov 14, 2008
    Messages:
    26
    Likes Received:
    0
    Trophy Points:
    11
    Moro!

    Combofix.logi

    ComboFix 08-12-06.06 - K 2008-12-08 0:14:32.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1035.18.1695 [GMT 2:00]
    Sijainti: c:\documents and settings\K\Omat tiedostot\ComboFix.exe
    * Uusi palautuspiste luotu
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    E:\resycled
    e:\resycled\boot.com

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-11-07 to 2008-12-07 )))))))))))))))))
    .

    2008-12-07 23:37 . 2008-04-13 20:45 10,624 --a------ c:\windows\system32\drivers\gameenum.sys
    2008-12-07 23:37 . 2008-04-13 20:45 10,624 --a--c--- c:\windows\system32\dllcache\gameenum.sys
    2008-12-07 23:37 . 2001-08-17 20:19 3,712 --a------ c:\windows\system32\drivers\ctljystk.sys
    2008-12-07 23:37 . 2001-08-17 20:19 3,712 --a--c--- c:\windows\system32\dllcache\ctljystk.sys
    2008-12-07 16:59 . 2008-12-07 16:59 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
    2008-12-07 16:59 . 2008-12-07 16:59 <KANSIO> d-------- c:\documents and settings\K\Application Data\Malwarebytes
    2008-12-07 16:59 . 2008-12-07 16:59 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
    2008-12-07 16:59 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
    2008-12-07 16:59 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
    2008-12-06 13:44 . 2008-12-06 13:44 579,072 --a--c--- c:\windows\system32\dllcache\user32.dll
    2008-12-06 13:43 . 2008-12-06 13:43 <KANSIO> d-------- c:\windows\ERUNT
    2008-12-06 06:52 . 2008-12-06 06:52 <KANSIO> d-------- c:\documents and settings\K\Application Data\OpenOffice.org
    2008-12-06 03:00 . 2008-12-06 03:00 <KANSIO> d-------- c:\program files\MSXML 4.0
    2008-12-05 13:40 . 2008-12-05 13:41 <KANSIO> d-------- c:\documents and settings\K\Application Data\Teleca
    2008-12-05 13:40 . 2008-12-05 13:40 <KANSIO> d-------- c:\documents and settings\K\Application Data\Sony Ericsson
    2008-12-05 13:38 . 2008-12-05 13:38 <KANSIO> d-------- c:\documents and settings\All Users\Documents
    2008-12-05 13:37 . 2008-12-05 13:37 <KANSIO> d-------- c:\windows\Downloaded Installations
    2008-12-05 13:37 . 2008-12-05 13:37 <KANSIO> d-------- c:\program files\Sony Ericsson
    2008-12-05 13:37 . 2008-12-05 13:38 <KANSIO> d-------- c:\program files\Common Files\Teleca Shared
    2008-12-05 13:37 . 2008-12-05 13:38 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Teleca
    2008-12-05 13:37 . 2008-12-05 13:38 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Sony Ericsson
    2008-12-05 13:35 . 2008-12-05 13:35 <KANSIO> d-------- c:\documents and settings\K\Application Data\Leadertech
    2008-12-05 13:32 . 2008-12-05 13:33 <KANSIO> d-------- c:\windows\system32\URTTemp
    2008-12-05 13:31 . 2008-12-05 13:32 <KANSIO> d-------- c:\program files\QuickTime
    2008-12-05 13:31 . 2008-12-05 13:31 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Apple Computer
    2008-12-05 13:30 . 2008-12-05 13:30 54,156 --ah----- c:\windows\QTFont.qfn
    2008-12-05 13:30 . 2008-12-05 13:30 1,409 --a------ c:\windows\QTFont.for
    2008-12-05 13:28 . 2008-12-05 13:28 <KANSIO> d-------- c:\program files\OpenOffice.org 3
    2008-12-05 13:24 . 2008-12-05 13:24 <KANSIO> d-------- c:\documents and settings\K\Application Data\TeamViewer
    2008-12-05 13:23 . 2008-12-05 13:23 <KANSIO> d-------- c:\program files\TeamViewer3
    2008-12-05 13:23 . 2008-12-05 13:23 <KANSIO> d-------- c:\documents and settings\K\temp
    2008-12-05 02:52 . 2008-12-05 02:54 <KANSIO> d-------- c:\program files\RegCleaner
    2008-12-03 23:44 . 2008-12-03 23:44 <KANSIO> d-------- c:\program files\Java
    2008-12-03 23:44 . 2008-12-03 23:44 73,728 --a------ c:\windows\system32\javacpl.cpl
    2008-12-03 16:01 . 2008-12-03 16:01 <KANSIO> d-------- c:\windows\Sun
    2008-12-03 15:28 . 2008-12-03 15:28 171 --a------ c:\windows\RtlRack.ini
    2008-12-03 15:15 . 2008-12-03 15:15 <KANSIO> d-------- c:\program files\Realtek Sound Manager
    2008-12-03 15:15 . 2008-12-03 15:15 <KANSIO> d-------- c:\program files\AvRack
    2008-12-03 15:15 . 2004-05-14 17:26 14,268,928 --a------ c:\windows\system32\ALSNDMGR.CPL
    2008-12-03 15:15 . 2004-05-14 17:25 7,360,512 --a------ c:\windows\system32\RTLCPL.EXE
    2008-12-03 15:15 . 2002-11-21 15:07 765,952 --a------ c:\windows\system\crlds3d.dll
    2008-12-03 15:15 . 2004-05-14 23:24 622,172 --a------ c:\windows\system32\drivers\ALCXWDM.SYS
    2008-12-03 15:15 . 2004-02-24 11:08 400,384 --a------ c:\windows\system32\drivers\ALCXSENS.SYS
    2008-12-03 15:15 . 2004-02-27 18:14 208,896 --------- c:\windows\alcupd.exe
    2008-12-03 15:15 . 2004-02-09 15:18 155,648 --a------ c:\windows\system32\RTLCPAPI.dll
    2008-12-03 15:15 . 2002-02-05 13:54 141,016 --a------ c:\windows\system32\ALSNDMGR.WAV
    2008-12-03 15:15 . 2004-02-02 18:44 139,264 --------- c:\windows\alcrmv.exe
    2008-12-03 15:15 . 2004-05-14 15:47 67,072 --a------ c:\windows\SOUNDMAN.EXE
    2008-12-03 15:15 . 2001-07-06 00:19 164 --------- c:\windows\avrack.ini
    2008-12-03 13:43 . 2008-12-06 07:08 <KANSIO> d-------- c:\documents and settings\K\Application Data\Command & Conquer 3 Tiberium Wars
    2008-12-03 13:42 . 2008-12-03 13:42 <KANSIO> dr-h----- c:\documents and settings\K\Application Data\SecuROM
    2008-12-03 13:42 . 2008-12-03 13:42 98,304 --a------ c:\windows\system32CmdLineExt.dll
    2008-12-03 13:41 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll
    2008-12-03 13:23 . 2008-12-03 13:23 <KANSIO> d-------- c:\program files\Electronic Arts
    2008-12-03 13:09 . 2008-12-07 13:27 116 --a------ c:\windows\NeroDigital.ini
    2008-12-03 11:51 . 2008-12-03 11:52 <KANSIO> d-------- c:\program files\Windows Live Safety Center
    2008-12-03 11:44 . 2008-12-03 13:15 <KANSIO> d-------- c:\documents and settings\K\Application Data\Ahead
    2008-12-03 11:42 . 2008-12-03 11:42 <KANSIO> d-------- c:\program files\Nero
    2008-12-03 11:42 . 2008-12-03 11:42 <KANSIO> d-------- c:\program files\Common Files\Ahead
    2008-12-03 04:29 . 2008-12-03 10:58 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Messenger Plus!
    2008-12-03 04:26 . 2008-12-03 04:26 <KANSIO> d-------- c:\program files\Messenger Plus! Live
    2008-12-03 04:10 . 2008-10-31 07:09 270,888 -ra------ c:\windows\system32\drivers\SbFw.sys
    2008-12-03 04:10 . 2008-06-21 04:54 65,576 --a------ c:\windows\system32\drivers\SbFwIm.sys
    2008-12-03 04:09 . 2008-12-03 04:09 <KANSIO> d-------- c:\program files\Sunbelt Software
    2008-12-03 03:44 . 2008-12-03 03:44 <KANSIO> d-------- c:\program files\Primedius
    2008-12-03 03:44 . 2003-09-12 11:08 184,320 --a------ c:\windows\system32\Prifw.dll
    2008-12-03 03:44 . 2003-05-27 14:37 57,344 --a------ c:\windows\system32\ndisapi.dll
    2008-12-03 03:43 . 2008-12-03 03:43 <KANSIO> d-------- c:\program files\ToniArts
    2008-12-03 03:34 . 2008-04-13 20:45 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys
    2008-12-03 03:18 . 2008-12-03 03:18 <KANSIO> d-------- c:\program files\Webteh
    2008-12-03 03:04 . 2008-12-03 13:09 <KANSIO> d-------- c:\documents and settings\K\Application Data\dvdcss
    2008-12-03 03:02 . 2008-12-03 03:08 <KANSIO> d-------- c:\documents and settings\K\Application Data\vlc
    2008-12-03 02:47 . 2008-12-03 03:35 <KANSIO> d-------- c:\program files\ApexDC++
    2008-12-03 02:36 . 2008-12-03 02:36 10 --a------ c:\windows\WININIT.INI
    2008-12-03 02:30 . 2008-12-03 02:30 0 --a------ c:\windows\ativpsrm.bin
    2008-12-03 01:57 . 2008-12-03 01:57 <KANSIO> d-------- c:\documents and settings\K\Application Data\Logitech
    2008-12-03 01:56 . 2008-12-03 01:56 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Logitech
    2008-12-03 01:52 . 2008-12-03 02:36 <KANSIO> d-------- c:\program files\ATI Technologies
    2008-12-03 01:52 . 2008-12-03 01:52 <KANSIO> d-------- C:\ATI
    2008-12-03 01:46 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
    2008-12-03 01:46 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll
    2008-12-03 01:46 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
    2008-12-03 01:30 . 2008-12-03 01:30 <KANSIO> d-------- c:\program files\VideoLAN
    2008-12-03 01:17 . 2008-12-03 03:00 293 --a------ c:\windows\system\cmicnfg.ini
    2008-12-03 01:02 . 2008-04-13 21:19 146,048 --a------ c:\windows\system32\drivers\portcls.sys
    2008-12-03 01:02 . 2008-04-13 21:19 146,048 --a--c--- c:\windows\system32\dllcache\portcls.sys
    2008-12-03 01:02 . 2008-04-14 18:12 129,536 --a------ c:\windows\system32\ksproxy.ax
    2008-12-03 01:02 . 2008-04-14 18:12 129,536 --a--c--- c:\windows\system32\dllcache\ksproxy.ax
    2008-12-03 01:02 . 2008-04-13 20:45 60,160 --a------ c:\windows\system32\drivers\drmk.sys
    2008-12-03 01:02 . 2008-04-13 20:45 60,160 --a--c--- c:\windows\system32\dllcache\drmk.sys
    2008-12-03 01:02 . 2008-04-14 18:11 4,096 --a------ c:\windows\system32\ksuser.dll
    2008-12-03 01:02 . 2008-04-14 18:11 4,096 --a--c--- c:\windows\system32\dllcache\ksuser.dll
    2008-12-03 00:52 . 2001-10-05 15:59 12,160 --a------ c:\windows\system32\drivers\mouhid.sys
    2008-12-03 00:52 . 2001-10-05 15:59 12,160 --a--c--- c:\windows\system32\dllcache\mouhid.sys
    2008-12-03 00:51 . 2008-12-03 01:56 <KANSIO> d-------- c:\program files\Logitech
    2008-12-03 00:51 . 2008-12-05 13:32 <KANSIO> d--h----- c:\program files\InstallShield Installation Information
    2008-12-03 00:51 . 2008-12-03 01:56 <KANSIO> d-------- c:\program files\Common Files\Logitech
    2008-12-03 00:51 . 2008-12-03 01:53 <KANSIO> d-------- c:\program files\Common Files\InstallShield
    2008-12-03 00:51 . 2004-04-14 10:54 163,840 --a------ c:\windows\system32\WmJoyFrc.dll
    2008-12-03 00:51 . 2004-04-14 11:08 44,064 --a------ c:\windows\system32\drivers\WmXlCore.sys
    2008-12-03 00:51 . 2004-04-14 11:08 21,280 --a------ c:\windows\system32\drivers\WmFilter.sys
    2008-12-03 00:51 . 2004-04-14 11:08 10,144 --a------ c:\windows\system32\drivers\WmBEnum.sys
    2008-12-03 00:51 . 2004-04-14 11:08 5,600 --a------ c:\windows\system32\drivers\WmVirHid.sys
    2008-12-03 00:46 . 2008-12-03 11:15 <KANSIO> d-------- c:\documents and settings\K\Application Data\skypePM
    2008-12-03 00:46 . 2008-12-03 00:46 56 --ah----- c:\windows\system32\ezsidmv.dat
    2008-12-03 00:44 . 2008-12-03 00:44 <KANSIO> d-------- c:\program files\Skype
    2008-12-03 00:44 . 2008-12-03 00:44 <KANSIO> d-------- c:\program files\Common Files\Skype
    2008-12-03 00:44 . 2008-12-03 11:22 <KANSIO> d-------- c:\documents and settings\K\Application Data\Skype
    2008-12-03 00:44 . 2008-12-03 00:44 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Skype
    2008-12-03 00:39 . 2008-12-03 01:07 <KANSIO> d-------- c:\documents and settings\K\Contacts
    2008-12-03 00:38 . 2008-12-05 13:40 <KANSIO> d----c--- c:\windows\system32\DRVSTORE
    2008-12-03 00:23 . 2008-12-03 00:23 <KANSIO> d-------- c:\program files\Trend Micro
    2008-12-03 00:08 . 2008-12-03 00:08 <KANSIO> d-------- c:\program files\Alwil Software
    2008-12-03 00:08 . 2003-03-18 22:20 1,060,864 --a------ c:\windows\system32\MFC71.dll
    2008-12-03 00:08 . 2003-03-18 21:14 499,712 --a------ c:\windows\system32\MSVCP71.dll
    2008-12-03 00:08 . 2003-02-21 05:42 348,160 --a------ c:\windows\system32\MSVCR71.dll
    2008-12-03 00:07 . 2008-12-05 12:06 <KANSIO> d-------- c:\program files\Yahoo!
    2008-12-03 00:07 . 2008-12-03 00:07 <KANSIO> d-------- c:\program files\CCleaner
    2008-12-02 23:56 . 2008-12-03 00:37 <KANSIO> d--hsc--- c:\program files\Common Files\WindowsLiveInstaller
    2008-12-02 23:55 . 2008-12-03 00:37 <KANSIO> d-------- c:\program files\Windows Live
    2008-12-02 23:55 . 2008-12-03 00:36 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\WLInstaller
    2008-12-02 23:41 . 2008-04-13 20:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys
    2008-12-02 23:41 . 2008-04-13 20:45 32,128 --a--c--- c:\windows\system32\dllcache\usbccgp.sys
    2008-12-02 23:41 . 2008-04-14 18:11 21,504 --a------ c:\windows\system32\hidserv.dll
    2008-12-02 23:41 . 2008-04-14 18:11 21,504 --a--c--- c:\windows\system32\dllcache\hidserv.dll

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-12-03 01:08 --------- d-----w c:\documents and settings\K\Application Data\vlc
    2008-12-02 23:56 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
    2008-12-02 23:56 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
    2008-12-02 23:56 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
    2008-12-02 18:31 --------- d-----w c:\program files\microsoft frontpage
    2008-11-10 07:39 562,044,991 ----a-w c:\documents and settings\K\BF2_Patch_1.41.exe
    2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
    2008-10-16 12:13 202,776 ----a-w c:\windows\system32\wuweb.dll
    2008-10-16 12:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
    2008-10-16 12:12 561,688 ----a-w c:\windows\system32\wuapi.dll
    2008-10-16 12:12 323,608 ----a-w c:\windows\system32\wucltui.dll
    2008-10-16 12:09 92,696 ----a-w c:\windows\system32\cdm.dll
    2008-10-16 12:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
    2008-10-16 12:09 43,544 ----a-w c:\windows\system32\wups2.dll
    2008-10-16 12:08 34,328 ----a-w c:\windows\system32\wups.dll
    2008-09-30 14:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
    2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys
    2008-09-10 01:15 1,307,648 ------w c:\windows\system32\msxml6.dll
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-09-03 94208]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux"= ctwdm32.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "c:\\Program Files\\ApexDC++\\ApexDC.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=

    R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-05 111184]
    R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2008-12-03 270888]
    R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [2008-06-21 66600]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-12-05 20560]
    R2 SbPF.Launcher;SbPF.Launcher;"c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe" [2008-10-31 95528]
    R2 SPF4;Sunbelt Personal Firewall 4;"c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe" [2008-10-31 1365288]
    R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\sbfwim.sys [2008-12-03 65576]
    S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-12-07 38496]

    *Newly Created Service* - PROCEXP90
    .
    - - - - POISTETUT JÄMÄRIVIT - - - -

    HKLM-Run-Cmaudio - cmicnfg.cpl
    HKLM-Run-NWEReboot - (no file)


    .
    ------- Täydentävä tarkistus -------
    .
    FireFox -: Profile - c:\documents and settings\K\Application Data\Mozilla\Firefox\Profiles\boh2hd1l.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.suomi24.fi/
    FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
    FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
    FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
    FF -: plugin - c:\program files\Yahoo!\Common\npyaxmpb.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-08 00:19:36
    Windows 5.1.2600 Service Pack 3 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    --------------------- Prosesseihin ladatut DLLt ---------------------

    - - - - - - - > 'winlogon.exe'(656)
    c:\windows\system32\Ati2evxx.dll
    .
    Valmistumisajankohta: 2008-12-08 0:21:55
    ComboFix-quarantined-files.txt 2008-12-07 22:21:50

    Ennen ajoa: 84 525 789 184 tavua vapaana
    Ajon jälkeen: 84,514,320,384 tavua vapaana

    WindowsXP-KB310994-SP2-Pro-BootDisk-FIN.EXE
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    234 --- E O F --- 2008-12-06 11:33:54

    Tässäpä tätä tietoo taas.
     
    kartsa173, Dec 7, 2008
    #11
  12. Hujo

    Hujo Guest

    Vieläkös menee hanat kaakkoon
     
    Hujo, Dec 7, 2008
    #12
  13. kartsa173

    kartsa173 Member

    Joined:
    Nov 14, 2008
    Messages:
    26
    Likes Received:
    0
    Trophy Points:
    11
    Kiitosta vaan!
    Hanat pysyy hyvin alhaala, ja nettikin toimii ainakin nyt ku unelma.

    Onko jotain tiettyy aika jaksoo millo kannattas näitä puhistaa samallla lailla?





     
    kartsa173, Dec 7, 2008
    #13
  14. Hujo

    Hujo Guest

    Malwarebytes' Anti-Malware <-- tuolla on hyvä putsata jos tuntuu tukoselta. Pitää vain päivittää enen täydellistä ajoa.

    =============

    Lataa OTMoveIt
    OTMoveIt ja tallenna se työpöydällesi.

    Tuplaklikkaa OTMoveIt.exe.
    Klikkaa CleanUp!.
    Valitse Yes kun kysytään "Begin cleanup Process?".
    Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.

    HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.
     
    Hujo, Dec 7, 2008
    #14
  15. vessu

    vessu Member

    Joined:
    Apr 22, 2006
    Messages:
    27
    Likes Received:
    0
    Trophy Points:
    11
    Voisko joku jeesiä mua tän mun koneeni kanssa ku tämä on ihan jumissa , käynnistäminen kestäää tosi kauan ! ? kiiitos jo etukäteen , kyselkää s-posti osotetta että jos haluatte auttaa ?
     
    vessu, Dec 12, 2008
    #15

Share This Page