Tietokone ja netti on hidas. Suoritin 100%

tietoturva keskus ei ole käytössä en tiedä miksi ja windows update ei toimi.
tässä olis logi.




Logfile of HijackThis v1.99.1
Scan saved at 20:07:46, on 8.4.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [drvsyskit] C:\WINDOWS\system32\drivers\hldrrr.exe
O4 - HKCU\..\Run: [german.exe] C:\WINDOWS\system32\wintems.exe
O4 - HKCU\..\Run: [PowerBar] "C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1207325697859
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1207389527718
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Unknown owner - C:\Norman\Npm\bin\ELOGSVC.EXE (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

 

Kopioi / liitä seuraava teksti alapuolella tyhjään muistioFiluun
Varmista että tiedoston tyyppi on ”all Files” ja tallenna se Poisto.bat. nimisenä
työpöydällesi.

@echo off
sc stop eLoggerSvc6
sc delete eLoggerSvc6

Tupla-klikkaa Poisto.bat. filua työpöydälläsi , ikkuna avautuu ja Sulkeutuu tämä on normaalia.

==================

Poista kansio vikasiedossa

C:\Norman

==================

Lataa RustBFix by ejvindh http://www.uploads.ejvindh.net/rustbfix.exe
ja tallenna se työpöydällesi.

Tuplaklikkaa tiedostoa rustbfix.exe. Jos löytyy Rustock.b-infektio, sinua pyydetään pian käynnistämään kone uudelleen. Uudelleenkäynnistyminen saattaa kestää hetken ja joudut ehkä käynnistämään koneen vielä toisenkin kerran. Kaikki tämä tapahtuu automaattisesti. Uudelleenkäynnistyksen jälkeen kaksi lokitiedostoa avautuu (%root%\avenger.txt & %root%\rustbfix\pelog.txt).

Kopioi ja liitä nämä kaksi lokitiedostoa seuraavaan vastaukseesi uuden HijackThis lokin kera.

============

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

 

************************* Rustock.b-fix v. 1.01 -- By ejvindh *************************
ti 08.04.2008 21:28:43,10

No Rustock.b-rootkits found

******************************* End of Logfile ********************************'



HJT


Logfile of HijackThis v1.99.1
Scan saved at 21:30:35, on 8.4.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [drvsyskit] C:\WINDOWS\system32\drivers\hldrrr.exe
O4 - HKCU\..\Run: [german.exe] C:\WINDOWS\system32\wintems.exe
O4 - HKCU\..\Run: [PowerBar] "C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1207325697859
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1207389527718
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

 

scannaa hjt:llä merkkaa paina Fix checked

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKCU\..\Run: [drvsyskit] C:\WINDOWS\system32\drivers\hldrrr.exe
O4 - HKCU\..\Run: [german.exe] C:\WINDOWS\system32\wintems.exe

==========

sitten sdfix

 

En pässyt vikasietotilaan. rämppäsin f8 ja sitten vallkasin vikasietotila sitten se latas jotain ja sammu, sitten ruutuun tuli fujitsu siemens odottelin en painanut mitään.
Tuli taas se sama ruutu otin uudestaan vikasietotila ja sama kävi.
Poistanko ton kansion normaalissatillassa ja käytönkö ton ohjelman?

 

poista normaalissa tilassa.
sdfix ei sitten onnistu kun ei pääse vikasietotilaan.

=============

aja tuokin sitten normaalissa tilassa.

Ohje AVG:n Anti-Spyware 7.5:n käyttöön
Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.

Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

Lataa AVG:n Anti-Spyware 7.5:n
ja tallenna ohjelma työpöydällesi.
o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
o Käynnistä AVG:n Anti-Spyware.
o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".

o Sitten "Reports" valikon alta:
o Laita täppi kohtaan "Automatically generate report after every scan"
o Ota täppi pois kohdasta"Only if threats were found"

o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
o "Resident shield is", muuta tila active:sta inactive:ksi
o Sulje ohjelma, ÄLÄ skannaa vielä.

Käynnistä koneesi vikasietotilaan,
sammuta ja käynnistä
käynnistyksen yhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina enter ja enter

Toisissa koneissa paukutetaan F8:sin sijasta F5:tä

HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"

o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.

 

Tarkistan tolla huomenna, päivitän ja laitan asetukset valmiiksi.

 

AVG ei antanut reporttia löyty:
1 troijan
87 Trackingcookieta.

 

kun avaat avg anti-spyware 7.5:n pitäs löytyä reports kohdasta

 

siellä lukee ''no reports available''

 

scannataas tuolla sitten

Escan
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg

scannaa

jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl+A.
Kopioi rivit komennolla Ctrl+C.
Liitä rivit komennolla Ctrl+V.

Laita virus log tänne.

 

File C:\WINDOWS\system32\mdelk.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\wintems.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\2TTSGU4K\b64_1[1].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\2TTSGU4K\b64_1[2].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\2TTSGU4K\b64_3[1].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\2TTSGU4K\b64_3[2].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\2TTSGU4K\b64_3[3].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\DGENSL8L\b64_1[1].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\DGENSL8L\b64_1[2].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\DGENSL8L\b64_3[1].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\DGENSL8L\b64_3[2].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\DGENSL8L\b64_3[3].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\OTY1W5YG\b64_1[1].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\OTY1W5YG\b64_1[2].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\OTY1W5YG\b64_3[1].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\OTY1W5YG\b64_3[2].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\OTY1W5YG\b64_3[3].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\OTY1W5YG\b64_3[4].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\XG68A5Q3\b64_1[1].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\XG68A5Q3\b64_1[2].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\XG68A5Q3\b64_3[1].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\XG68A5Q3\b64_3[2].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\XG68A5Q3\b64_3[3].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\XG68A5Q3\b64_3[4].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\XG68A5Q3\b64_3[5].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP100\A0015015.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP100\A0015016.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP101\A0015028.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP101\A0015029.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP102\A0015041.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP102\A0015042.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP103\A0015057.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP103\A0015070.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP104\A0015207.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP104\A0015278.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP104\A0015279.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013452.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013463.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013464.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013465.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013466.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013467.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013487.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013489.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013508.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013509.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013526.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013527.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013528.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013529.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013543.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013544.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013545.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013546.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013547.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013561.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013695.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP94\A0013705.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP95\A0013709.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP95\A0013740.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP95\A0013741.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP95\A0013742.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP95\A0013743.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP95\A0013744.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP95\A0013752.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP96\A0013789.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP97\A0013791.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP97\A0013793.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP98\A0013812.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP98\A0013824.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP98\A0013827.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP98\A0013828.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP98\A0013850.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP98\A0013856.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP98\A0013857.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP99\A0013980.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP99\A0014920.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP99\A0014924.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP99\A0014925.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\14853031.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\31343406.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\31398421.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\36906.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\47063359.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\47088421.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\552859.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\55921.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\58906.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\61953.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\62312.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\62375.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\62516890.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\62610937.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\78192343.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\78260953.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\78796.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\79375.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\81968.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\84703.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\91906.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\95744359.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\95759265.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\downld\97312.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\hldrrr.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\mdelk.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.

 

1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

 

AVASTI KATOSI KUN AJOIN tämän ohjelman tuolta ala palkista.


ComboFix 08-04-08.10 - Omistaja 2008-04-09 17:15:09.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.686 [GMT 3:00]
Running from: C:\Documents and Settings\Omistaja\Työpöytä\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\ban_list.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_srosa


((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-03-09 to 2008-04-09 )))))))))))))))))
.

2008-04-09 16:50 . 2008-04-09 16:50 0 --a------ C:\23990098.$$$
2008-04-09 15:40 . 2008-04-09 15:56 <KANSIO> d-------- C:\Downloads
2008-04-09 15:40 . 2008-04-09 15:55 <KANSIO> d-------- C:\Bases
2008-04-09 15:38 . 2008-04-09 15:56 <KANSIO> d-------- C:\Kaspersky
2008-04-09 15:33 . 2008-04-09 15:33 35,371 --a------ C:\Juomani.JPG
2008-04-09 15:24 . 2008-04-09 15:38 20,952,576 --a------ C:\mwav.exe
2008-04-08 22:02 . 2008-04-08 22:02 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Grisoft
2008-04-08 22:02 . 2008-04-08 22:02 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-08 22:02 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-08 21:28 . 2008-04-08 21:28 <KANSIO> d-------- C:\Rustbfix
2008-04-08 20:51 . 2008-04-09 15:56 116 --a------ C:\WINDOWS\NeroDigital.ini
2008-04-08 17:24 . 2008-04-08 17:24 <KANSIO> d-------- C:\hijackthis_v2.0.2
2008-04-08 17:16 . 2008-04-08 21:44 <KANSIO> d-------- C:\HJT
2008-04-08 17:10 . 2008-04-08 17:11 499,568 --a------ C:\hijackthis_v2.0.2.zip
2008-04-08 15:24 . 2008-04-08 15:24 <KANSIO> d-------- C:\WINDOWS\.jagex_cache_32
2008-04-08 15:22 . 2008-04-08 15:22 <KANSIO> dr------- C:\Documents and Settings\Tero\Omat tiedostot
2008-04-08 15:21 . 2008-04-04 20:23 <KANSIO> d--h----- C:\Documents and Settings\Tero\Verkkoymp„rist”
2008-04-08 15:21 . 2008-04-08 20:17 <KANSIO> d-------- C:\Documents and Settings\Tero\Ty”p”yt„
2008-04-08 15:21 . 2008-04-04 20:23 <KANSIO> d--h----- C:\Documents and Settings\Tero\Tulostinymp„rist”
2008-04-08 15:21 . 2008-04-08 15:22 <KANSIO> dr------- C:\Documents and Settings\Tero\Suosikit
2008-04-08 15:21 . 2008-04-04 17:27 <KANSIO> d--h----- C:\Documents and Settings\Tero\Mallit
2008-04-08 15:21 . 2008-04-04 20:23 <KANSIO> dr------- C:\Documents and Settings\Tero\K„ynnist„-valikko
2008-04-07 19:57 . 2008-04-08 15:13 <KANSIO> d-------- C:\WINDOWS\system32\Adobe
2008-04-07 19:40 . 2008-04-07 19:40 <KANSIO> d-------- C:\WINDOWS\Sun
2008-04-06 21:32 . 2008-04-06 21:32 135 --a------ C:\WINDOWS\ODBC.INI
2008-04-06 21:25 . 2008-03-29 20:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-06 21:25 . 2008-03-29 20:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-04-06 20:58 . 2008-04-06 20:58 <KANSIO> d-------- C:\Program Files\Alwil Software
2008-04-06 19:28 . 2008-04-06 19:28 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\InstallShield
2008-04-06 17:08 . 2008-04-09 16:47 <KANSIO> d-------- C:\WINDOWS\system32\drivers\downld
2008-04-05 23:29 . 2008-04-05 23:29 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-04-05 22:30 . 2008-04-05 22:30 <KANSIO> d-------- C:\Program Files\Lavalys
2008-04-05 21:37 . 2008-04-06 19:28 <KANSIO> d-------- C:\Program Files\SpeedFan
2008-04-05 21:37 . 2008-04-05 21:37 45 --a------ C:\WINDOWS\system32\initdebug.nfo
2008-04-05 19:01 . 2008-04-06 19:28 <KANSIO> d-------- C:\Program Files\CursorXP
2008-04-05 18:30 . 2008-04-05 18:30 <KANSIO> d-------- C:\Program Files\MSXML 6.0
2008-04-05 18:24 . 2003-07-01 00:00 46,080 --a------ C:\WINDOWS\system32\escimgd.dll
2008-04-05 18:24 . 2003-08-06 00:00 29,184 --a------ C:\WINDOWS\system32\escwiadn.dll
2008-04-05 18:24 . 2003-07-01 00:00 22,528 --a------ C:\WINDOWS\system32\esccmd.dll
2008-04-05 18:24 . 2008-04-05 18:24 25 --a------ C:\WINDOWS\CDE RX420.ini
2008-04-05 16:09 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-04-05 16:09 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-04-05 15:24 . 2008-04-05 18:27 <KANSIO> d-------- C:\Program Files\EPSON
2008-04-05 15:24 . 2008-04-05 15:24 <KANSIO> d-------- C:\EPSON
2008-04-05 15:24 . 2004-05-21 05:04 79,622 --------- C:\WINDOWS\system32\E_FLM9CE.DLL
2008-04-05 15:24 . 2003-05-21 02:27 64,000 --a------ C:\WINDOWS\system32\E_FBCB9CE.DLL
2008-04-05 15:24 . 2000-06-07 01:01 34,304 --a------ C:\WINDOWS\system32\E_FBCH9CE.DLL
2008-04-05 15:24 . 2003-04-10 08:40 31,744 --a------ C:\WINDOWS\system32\E_DCINST.DLL
2008-04-05 14:49 . 2008-04-05 14:49 <KANSIO> d-------- C:\Temp
2008-04-05 14:48 . 2008-04-09 17:18 <KANSIO> d-------- C:\Program Files\lg_fwupdate
2008-04-05 14:48 . 1998-06-24 00:00 115,016 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-04-05 14:48 . 1998-07-22 00:00 102,912 --a------ C:\WINDOWS\system32\Vb6stkit.dll
2008-04-05 14:48 . 1998-07-22 00:00 102,160 --a------ C:\WINDOWS\system32\VB6KO.DLL
2008-04-05 14:48 . 2006-02-17 14:19 16,384 --a------ C:\WINDOWS\system32\lgfwunis.exe
2008-04-05 14:48 . 2008-04-09 17:18 289 --a------ C:\WINDOWS\lgfwup.ini
2008-04-05 14:47 . 2008-04-05 14:47 <KANSIO> d-------- C:\Program Files\CyberLink DVD Solution
2008-04-05 14:47 . 2004-10-01 15:00 40,960 --a------ C:\Program Files\Uninstall_CDS.exe
2008-04-05 14:44 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-04-05 14:44 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-04-05 13:45 . 2008-04-05 13:45 <KANSIO> d-------- C:\Program Files\Microsoft Silverlight
2008-04-05 13:43 . 2008-04-05 13:43 <KANSIO> d-------- C:\Program Files\MSBuild
2008-04-05 13:42 . 2008-04-05 23:18 <KANSIO> d-------- C:\WINDOWS\system32\XPSViewer
2008-04-05 13:42 . 2008-04-05 13:42 <KANSIO> d-------- C:\Program Files\Reference Assemblies
2008-04-05 13:41 . 2008-04-05 13:41 <KANSIO> d-------- C:\Program Files\Windows Media Connect 2
2008-04-05 13:41 . 2008-04-05 13:41 <KANSIO> d-------- C:\d22690575149d8da0a0d99
2008-04-05 13:41 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-04-05 13:40 . 2008-04-05 13:40 <KANSIO> d-------- C:\WINDOWS\system32\LogFiles
2008-04-05 13:40 . 2008-04-05 13:40 <KANSIO> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-04-05 12:57 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-04-05 03:04 . 2008-04-05 03:10 <KANSIO> d-------- C:\i386
2008-04-04 22:14 . 2008-04-04 22:14 <KANSIO> d-------- C:\Program Files\RealMedia
2008-04-04 22:14 . 2008-04-04 22:14 <KANSIO> d-------- C:\Program Files\OpenSource Flash Video Splitter
2008-04-04 22:14 . 2008-04-05 12:46 <KANSIO> d-------- C:\Program Files\CD Audio Reader Filter
2008-04-04 22:11 . 2008-04-04 22:11 <KANSIO> d-------- C:\Program Files\SHOUTcast Source
2008-04-04 22:10 . 2008-04-05 12:46 <KANSIO> d-------- C:\Program Files\DSP-worx
2008-04-04 22:07 . 2008-04-05 12:47 <KANSIO> d-------- C:\Program Files\DirectVobSub
2008-04-04 21:44 . 2008-04-05 12:47 <KANSIO> d-------- C:\Program Files\eMule
2008-04-04 21:43 . 2008-04-07 19:58 1,289 --a------ C:\WINDOWS\mozver.dat
2008-04-04 21:29 . 2008-04-04 21:29 189,690 --a------ C:\A-Patch141rc1b1_WLM.zip
2008-04-04 21:28 . 2008-04-09 16:55 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Tracing
2008-04-04 21:25 . 2008-04-08 21:47 <KANSIO> d-------- C:\Pelit ja ohjelmia
2008-04-04 21:25 . 2008-04-07 19:23 <KANSIO> d-------- C:\Kesken er„iset
2008-04-04 21:23 . 2008-04-08 14:55 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\uTorrent
2008-04-04 21:23 . 2008-04-04 21:23 177,152 --a------ C:\utorrent.exe
2008-04-04 21:05 . 2008-04-04 21:05 <KANSIO> d-------- C:\Program Files\IZArc
2008-04-04 21:03 . 2008-04-04 21:08 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Contacts
2008-04-04 21:03 . 2008-04-04 21:05 3,723,454 --a------ C:\IZArc_Setup.exe
2008-04-04 21:02 . 2008-04-04 21:02 <KANSIO> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-04-04 21:01 . 2008-04-04 21:01 193,951 --a------ C:\A-Patch140rc1b9_WLM.zip
2008-04-04 19:16 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-04-04 19:16 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-04-04 19:16 . 2007-07-30 19:18 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-04-04 19:16 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-04-04 19:16 . 2007-07-30 19:18 20,824 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-04-04 19:09 . 2008-04-04 19:09 <KANSIO> d-------- C:\Program Files\Common Files\Ahead
2008-04-04 19:09 . 2008-04-04 19:09 <KANSIO> d-------- C:\Program Files\Ahead
2008-04-04 19:09 . 2004-07-26 17:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2008-04-04 19:09 . 2004-07-26 17:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2008-04-04 19:09 . 2004-07-26 17:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2008-04-04 19:09 . 2004-07-26 17:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-08 16:59 --------- d-----w C:\Program Files\Java
2008-04-06 18:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-04 18:27 --------- d-----w C:\Program Files\Windows Live
2008-04-04 18:02 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-04-04 17:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-04-04 17:23 9,388 ----a-w C:\WINDOWS\system32\drivers\iaStor.PNF
2008-04-04 17:23 7,280 ----a-w C:\WINDOWS\system32\drivers\viamraid.PNF
2008-04-04 17:23 63,240 ----a-w C:\WINDOWS\system32\drivers\Si3112r.PNF
2008-04-04 17:23 6,984 ----a-w C:\WINDOWS\system32\drivers\SiSRaid.PNF
2008-04-04 17:23 20,152 ----a-w C:\WINDOWS\system32\drivers\INFCACHE.1
2008-04-04 17:23 12,432 ----a-w C:\WINDOWS\system32\drivers\adpu320.PNF
2008-04-04 17:23 12,228 ----a-w C:\WINDOWS\system32\drivers\nvraid.PNF
2008-04-04 17:23 10,828 ----a-w C:\WINDOWS\system32\drivers\iaAHCI.PNF
2008-04-04 15:23 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-04-04 14:32 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-04 14:31 --------- d-----w C:\Program Files\Common Files\Java
2008-03-29 17:35 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2008-03-29 17:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2008-03-29 17:27 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2008-03-29 17:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
.

(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-04-04 21:32 3739672]
"PowerBar"="C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" [2004-04-21 10:26 86016]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 19:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-08-03 07:12 577536 C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-20 22:58 7581696]
"nwiz"="nwiz.exe" [2006-07-20 22:58 1519616 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"LGODDFU"="C:\Program Files\lg_fwupdate\fwupdate.exe" [2008-04-05 14:49 249856]
"EPSON Stylus Photo RX420 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.exe" [2004-04-09 03:00 98304]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\utorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 20:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 20:35]
S1 TDI_RD;Firewall Engine Type-R;C:\WINDOWS\system32\drivers\tdi_rd.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3b9afdc7-0405-11dd-964a-001a929682ed}]
\Shell\AutoRun\command - J:\nideiect.com
\Shell\explore\Command - J:\nideiect.com
\Shell\open\Command - J:\nideiect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{858139ad-0260-11dd-9630-001a929682ed}]
\Shell\AutoRun\command - J:\nideiect.com
\Shell\explore\Command - J:\nideiect.com
\Shell\open\Command - J:\nideiect.com

.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-09 17:17:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-04-09 17:21:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-09 14:21:05
Pre-Run: 220,639,416,320 tavua vapaana
Post-Run: 220,528,717,824 tavua vapaana
.
2008-04-05 20:21:21 --- E O F ---

 

No niin

Lataa Atribunen ATF Cleaner

Ohjeet;

Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.Main:n alla valitse: Select All
Klikkaa Empty Selected valintaa.
Jos käytät FireFoxia selaimenasi Klikkaa Firefox yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Jos käytät Operaa selaimenasiKlikkaa Opera yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa taas.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)

=============

1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK

Asenna tuo avast uudelleen

 

Tehty noi tässä olis uus logi.


Logfile of HijackThis v1.99.1
Scan saved at 17:57:52, on 9.4.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PowerBar] "C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1207325697859
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1207389527718
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

 

Windows ei löytänyt palomuuria, joten windowssin oma on käytössä.
Olisiko ehdotuksia palomuuriksi?
Kannattaako AVG:en Shield olla active

 

vikasietotila toimii jälleen niin myös windows update ja tietoturvakeskus.

 

se saa olla se inactive häirittee avastin taustasuojausta

et rupesi toimimaan no sitten turauta tuolla vielä

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

 

jokin catchme tiedosto tuli myös työpöydälle.



SDFix: Version 1.167
Run by Omistaja on ke 09.04.2008 at 18:22

Microsoft Windows XP [versio 5.1.2600]
Running From: C:\DOCUME~1\Omistaja\TYPYT~1\SDFix\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1351.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-09 18:46:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...


scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 2


Remaining Services :



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"
"C:\\utorrent.exe"="C:\\utorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :


File Backups: - C:\DOCUME~1\Omistaja\TYPYT~1\SDFix\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sun 6 Apr 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 5 Apr 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

Finished!