Eli en tiedä mitä tekisin, mutta ensimmäisenä juolahti mieleen että pistän afterdawniin ketjun. Ongelmana on se, kun yritän mennä pelaamaan esim Call of Duty 2 (Aito on), niin tietokone menee täydellisesti jumiin, en saa sitä muuten "henkiin" paitsi käynnistämällä tietokoneen uudelleen. Ja tässä ois HjT logi teille tarkistettavaksi, että jos se vika löytyisi sieltä Logfile of HijackThis v1.99.1 Scan saved at 20:56:35, on 8.8.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\SOUNDMAN.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Xfire\xfiremusic.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\DynDNS Updater\DynDNS.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Lavalys\EVEREST Ultimate Edition\everest.exe C:\FRAPS\FRAPS.EXE C:\Program Files\WhatPulse\WhatPulse.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Logitech\Profiler\lwemon.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Program Files\mIRC\mirc.exe C:\Program Files\Xfire\xfire.exe C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE C:\Program Files\Mozilla Firefox\firefox.exe D:\Netistä\HijackThis_v1.99.1.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = ftp://ftp.saunalahti.fi/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [Xfire Music] "C:\Program Files\Xfire\xfiremusic.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DynDNS Updater] "C:\Program Files\DynDNS Updater\DynDNS.exe" O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [EVEREST AutoStart] C:\Program Files\Lavalys\EVEREST Ultimate Edition\everest.exe O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE O4 - HKCU\..\Run: [WhatPulse] C:\Program Files\WhatPulse\WhatPulse.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwemon.exe" /noui O4 - Startup: mIRC.lnk = C:\Program Files\mIRC\mirc.exe O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe O4 - Global Startup: Logitech SetPoint.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
eipä syytä tälläseen yleensä näy Avaa hijackthis merkkaa seuraavat rivi(t) ja paina fix checked, sulje muut ohjelmat siksi aikaa. R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) Tässä ohje miten merkataan: ========== Tarkista koneesi F-Securen online skannerilla Huom, skanneri toimii vain Internet Explorer selaimella * Lue sivun ohjeet huolella läpi * Klikkaa Start scanning * Mikäli saat Internet Explorer -suojausvaroituksen, klikkaa Asenna * Klikkaa Accept * Klikkaa Custom Scan * Säädä asetukset seuraavasti o "Virus Scan Option" kohdasta valitse Scan whole system o "Other Scan Option" kohdasta valitse Scan All Files o Valitse Scan whole system for rootkits o Valitse Scan whole system for spyware o Laita ruksi kohtaan Scan inside archives o Varmista että Use advanced heuristics on valittuna * Klikkaa Start * Skannaus käynnistyy kun tarvittavat tiedostot/päivitykset on ladattu * Odota kärsivällisesti * Kun sakannaus on suoritettu, klikkaa Automatic cleaning * Klikkaa Show Report * Raportti aukeaa selaimessa, kopioi teksti kokonaan * Liitä kopioitu teksti esim. muistioon tai Wordiin ja tallenna työpöydälle * Voit sulkea skannerin * Lähetä raportti viestiketjuusi ========== Loistava ohje tietokoneeen nopeuttamiseksi http://neko.1g.fi/ohje/hidastelua.html ========== Lataa Deckard's System Scanner Työpöydällesi. Huomioi: Sinulla tulee olla Järjestelmänvalvojan oikeudet ajaaksesi ohjelman. [*]Sulje kaikki avoimet ikkunat ja ohjelmat. [*]Tupla Klikkaa Dss.exe tiedostoa ajaaksesi ohjelman, seuraa ohjeita. [*]Kun Scannaus on valmis 2 textitiedostoa pitäisi avautua, Main.txt ja extra.txt [*]Näppäile Kopioi ( CTRL+A -> CTRL + C ) ja liitä ( CTRL + V ) [*]kopioi ja liitä Extra.txt & Main.txt sisältö seuraavaan vastaukseesi. myös F-securen raportti
Sain vain tosta F-secure hommelista login.. F-Secure Scanning Report Wednesday, August 08, 2007 23:01:37 - 02:16:14 Computer name: TIETOKONE Scanning type: Scan system for viruses, rootkits, spyware Target: C:\ D:\ Result: 4 malware found Tracking Cookie (spyware) * System (Disinfected) * System * System Windows (spyware) * System (Disinfected) Statistics Scanned: * Files: 255992 * System: 4364 * Not scanned: 183 Actions: * Disinfected: 2 * Renamed: 0 * Deleted: 0 * None: 2 * Submitted: 0 Files not scanned: Options Scanning engines: * F-Secure Libra: 2.4.2, 2007-08-08 * F-Secure AVP: 7.0.171, 2007-08-08 * F-Secure Orion: 1.2.37, 2007-08-08 * F-Secure Blacklight: 1.0.64 * F-Secure Draco: 1.0.35, 0260-23-12 * F-Secure Pegasus: 1.19.0, 2007-07-05 Scanning options: * Scan all files * Scan inside archives * Use Advanced heuristics Copyright © 1998-2006 Product support |Send virus sample to F-Secure F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability. Ja tosta toisesta ohjelmasta en saanu logia, vaan ennenkun se olisi lopettamassa sitä juttua, niin se tekee näin
aja tää sen tilalla 1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä: http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe http://download.bleepingcomputer.com/sUBs/ComboFix.exe 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. (C:\ComboFix.txt) Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Jos tätä logia tarkoitat, kun tää ilmesty heti ohjelman sammuttua ComboFix 07-08-09.3 - "Antti" 2007-08-09 14:21:45.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.837 [GMT 3:00] * Created a new restore point ((((((((((((((((((((((((( Files Created from 2007-07-09 to 2007-08-09 ))))))))))))))))))))))))))))))) 2007-08-09 14:21 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-09 13:06 <KANSIO> d-------- C:\GTR2 2007-08-09 03:06 <KANSIO> d-------- C:\Deckard 2007-08-08 20:46 <KANSIO> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\Xfire 2007-08-08 20:33 <KANSIO> d-------- C:\WINDOWS\system32\appmgmt 2007-08-08 19:53 <KANSIO> d-------- C:\Program Files\SCi Games 2007-08-08 15:53 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia 2007-08-08 15:45 <KANSIO> d-------- C:\Program Files\rFactor 2007-08-02 21:09 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-08-02 21:09 740,442 --a------ C:\WINDOWS\system32\divx.dll 2007-08-02 21:09 73,728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-08-02 21:09 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-08-02 21:09 630,784 --a------ C:\WINDOWS\system32\vp7vfw.dll 2007-08-02 21:09 564,224 --a------ C:\WINDOWS\system32\x264vfw.dll 2007-08-02 21:09 438,272 --a------ C:\WINDOWS\system32\vp6vfw.dll 2007-08-02 21:09 39,936 --a------ C:\WINDOWS\system32\huffyuv.dll 2007-08-02 21:09 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-08-02 21:09 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll 2007-08-02 21:09 217,088 --a------ C:\WINDOWS\system32\i420vfw.dll 2007-08-02 21:09 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-08-02 21:09 163,840 --a------ C:\WINDOWS\system32\unrar.dll 2007-08-02 21:09 144,384 --a------ C:\WINDOWS\system32\Iacenc.dll 2007-08-02 21:09 <KANSIO> d-------- C:\Program Files\K-Lite Codec Pack 2007-08-02 20:49 <KANSIO> d-------- C:\DOCUME~1\Antti\APPLIC~1\vlc 2007-08-02 20:46 <KANSIO> d-------- C:\Program Files\VideoLAN 2007-08-02 10:57 <KANSIO> d--h----- C:\WINDOWS\PIF 2007-08-02 10:57 <KANSIO> d-------- C:\Program Files\VentSrv 2007-08-01 14:44 <KANSIO> d-------- C:\Program Files\QuickTime 2007-08-01 14:43 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer 2007-07-31 12:05 <KANSIO> d-------- C:\Program Files\Guitar Pro 5 2007-07-30 23:21 <KANSIO> d-------- C:\Program Files\ffdshow 2007-07-29 12:08 <KANSIO> d-------- C:\WINDOWS\Downloaded Installations 2007-07-29 12:08 <KANSIO> d-------- C:\SYSTEMTOOLS 2007-07-29 12:08 <KANSIO> d-------- C:\DOCUME~1\Antti\APPLIC~1\Leadertech 2007-07-29 12:07 <KANSIO> d-------- C:\Program Files\Diskeeper Corporation 2007-07-28 23:29 225,280 --a------ C:\WINDOWS\system32\rewire.dll 2007-07-28 23:29 <KANSIO> d-------- C:\Program Files\VstPlugins 2007-07-28 23:27 <KANSIO> d-------- C:\Program Files\Image-Line 2007-07-28 15:14 <KANSIO> d-------- C:\testi 2007-07-28 15:12 <KANSIO> d-------- C:\DOCUME~1\Antti\Phone Browser 2007-07-28 15:09 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite 2007-07-28 15:07 <KANSIO> d-------- C:\DOCUME~1\Antti\APPLIC~1\Nokia 2007-07-28 15:06 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2007-07-28 15:06 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution 2007-07-28 15:06 <KANSIO> d-------- C:\Program Files\DIFX 2007-07-28 15:06 <KANSIO> d-------- C:\DOCUME~1\Antti\APPLIC~1\PC Suite 2007-07-28 15:05 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations 2007-07-27 22:35 <KANSIO> d-------- C:\Program Files\VirtualDJ 2007-07-27 22:13 23,600 --a------ C:\WINDOWS\system32\drivers\TVICHW32.SYS 2007-07-27 21:07 <KANSIO> d-------- C:\Program Files\ASUS 2007-07-27 21:03 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2007-07-27 18:57 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-07-27 18:57 22,328 --a------ C:\DOCUME~1\Antti\APPLIC~1\PnkBstrK.sys 2007-07-27 18:56 674,600 --a------ C:\WINDOWS\system32\pbsvc.exe 2007-07-27 18:56 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-07-27 18:56 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-07-27 17:24 <KANSIO> d-------- C:\Program Files\SystemRequirementsLab 2007-07-27 17:23 <KANSIO> d-------- C:\DOCUME~1\Antti\APPLIC~1\SystemRequirementsLab 2007-07-27 11:12 <KANSIO> d-------- C:\Program Files\Common Files\DirectX 2007-07-27 11:10 <KANSIO> d-------- C:\DOCUME~1\Antti\APPLIC~1\THQ 2007-07-27 10:46 <KANSIO> d-------- C:\Program Files\THQ 2007-07-26 12:57 <KANSIO> d-------- C:\Program Files\Windows Live Safety Center 2007-07-25 17:02 <KANSIO> d-------- C:\Program Files\LFS Server 2007-07-24 16:37 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2007-07-24 16:37 286,720 --------- C:\WINDOWS\Setup1.exe 2007-07-24 16:37 <KANSIO> d-------- C:\Program Files\Rcon4Cod2 2007-07-24 11:18 <KANSIO> d-------- C:\DOCUME~1\Antti\APPLIC~1\Ahead 2007-07-24 11:16 <KANSIO> d-------- C:\Program Files\Nero 2007-07-24 11:16 <KANSIO> d-------- C:\Program Files\Common Files\Ahead 2007-07-24 11:16 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero 2007-07-22 23:40 <KANSIO> d-------- C:\Program Files\CloneSpy 2007-07-22 16:19 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll 2007-07-22 16:19 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll 2007-07-22 16:03 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys 2007-07-22 16:03 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys 2007-07-22 16:03 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys 2007-07-22 16:03 <KANSIO> d-------- C:\WINDOWS\system32\Futuremark 2007-07-22 16:02 <KANSIO> d-------- C:\Program Files\Futuremark 2007-07-22 14:59 <KANSIO> d-------- C:\RivaTuner 2007-07-22 14:26 <KANSIO> d-------- C:\CoolBits 2007-07-21 23:38 <KANSIO> d-------- C:\Program Files\WS_FTP 2007-07-21 23:33 <KANSIO> d-------- C:\Program Files\WinSCP3 2007-07-21 22:28 1,877 --a------ C:\WINDOWS\mozver.dat 2007-07-18 19:39 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\NVIDIA 2007-07-18 16:21 <KANSIO> d-------- C:\DOCUME~1\Antti\APPLIC~1\Alien Skin 2007-07-18 16:09 86,016 --a------ C:\WINDOWS\unvise32.exe 2007-07-18 12:37 <KANSIO> d-------- C:\DOCUME~1\Antti\APPLIC~1\Ventrilo 2007-07-18 12:36 <KANSIO> d-------- C:\Program Files\VentriloMIX 2007-07-17 11:00 <KANSIO> d-------- C:\DOCUME~1\Antti\APPLIC~1\Media Player Classic 2007-07-16 21:41 <KANSIO> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP 2007-07-16 21:41 <KANSIO> d-------- C:\Fraps 2007-07-16 14:15 <KANSIO> d-------- C:\Program Files\uTorrent 2007-07-16 14:15 <KANSIO> d-------- C:\DOCUME~1\Antti\APPLIC~1\uTorrent 2007-07-15 12:42 12,020 --ah----- C:\WINDOWS\system32\mlfcache.dat 2007-07-14 15:24 <KANSIO> d-------- C:\Program Files\DC++ 2007-07-14 00:17 <KANSIO> d-------- C:\Downloads 2007-07-13 20:14 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Test Drive Unlimited 2007-07-13 20:13 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-07-13 20:13 <KANSIO> dr-h----- C:\DOCUME~1\Antti\APPLIC~1\SecuROM 2007-07-13 19:08 <KANSIO> d-------- C:\Xenofex 2 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-01 14:40 71212 --a------ C:\WINDOWS\system32\perfc00B.dat 2007-08-01 14:40 366822 --a------ C:\WINDOWS\system32\perfh00B.dat 2007-07-13 11:57 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2007-07-13 11:57 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2007-06-08 08:11 831048 --a------ C:\WINDOWS\system32\WudfUpdate_01005.dll 2007-05-16 18:14 85504 --a--c--- C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 18:14 510976 --a--c--- C:\WINDOWS\system32\dllcache\wab32.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Ptipbmf"="ptipbmf.dll" [2006-02-26 18:21 C:\WINDOWS\system32\ptipbmf.dll] "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40] "SoundMan"="SOUNDMAN.EXE" [2004-02-26 16:53 C:\WINDOWS\SOUNDMAN.EXE] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 01:03] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 C:\WINDOWS\KHALMNPR.Exe] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 01:22] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22] "nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="NvMCTray.dll" [2006-10-22 12:22 C:\WINDOWS\system32\nvmctray.dll] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40] "DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2005-11-22 17:38] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12] "DynDNS Updater"="C:\Program Files\DynDNS Updater\DynDNS.exe" [2006-09-17 10:32] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 13:48] "EVEREST AutoStart"="C:\Program Files\Lavalys\EVEREST Ultimate Edition\everest.exe" [2007-04-05 00:00] "Fraps"="C:\FRAPS\FRAPS.EXE" [2006-12-19 16:02] "WhatPulse"="C:\Program Files\WhatPulse\WhatPulse.exe" [2006-08-21 20:48] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2006-03-15 16:01] "Start WingMan Profiler"="C:\Program Files\Logitech\Profiler\lwemon.exe" [2006-07-05 13:17] C:\Documents and Settings\Antti\K„ynnist„-valikko\Ohjelmat\K„ynnistys\ mIRC.lnk - C:\Program Files\mIRC\mirc.exe [2006-11-23 18:45:34] Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2007-08-03 01:44:38] C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\ Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-07-13 11:57:11] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "LinkResolveIgnoreLinkInfo"=0 (0x0) "NoResolveSearch"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "LinkResolveIgnoreLinkInfo"=0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup" R0 aftx2k;aftx2k;C:\WINDOWS\system32\drivers\aftx2k.sys R0 fasttx2k;fasttx2k;C:\WINDOWS\system32\DRIVERS\fasttx2k.sys R0 Teefer;Teefer for NT;C:\WINDOWS\system32\Drivers\Teefer.sys R1 AmdK8;AMD Athlon64 Processor Driver;C:\WINDOWS\system32\DRIVERS\AmdK8.sys R1 wpsdrvnt;wpsdrvnt;\??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys R2 wg3n;SyGate for NT, wg3n;C:\WINDOWS\system32\Drivers\wg3n.sys R2 wg4n;SyGate for NT, wg4n;C:\WINDOWS\system32\Drivers\wg4n.sys R2 wg5n;SyGate for NT, wg5n;C:\WINDOWS\system32\Drivers\wg5n.sys R2 wg6n;SyGate for NT, wg6n;C:\WINDOWS\system32\Drivers\wg6n.sys R3 L8042Kbd;Logitech SetPoint Keyboard Driver;C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver;C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys R3 Wdf01000;Wdf01000;C:\WINDOWS\system32\DRIVERS\Wdf01000.sys R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys R3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys S1 ATITool;ATITool Overclocking Utility;C:\WINDOWS\system32\DRIVERS\ATITool.sys S3 WmFilter;Logitech Gaming HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys S3 WmHidLo;Logitech Gaming USB Filter Driver;C:\WINDOWS\system32\drivers\WmHidLo.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{040a34e6-3c14-11dc-a64f-0011d8b189da}] AutoRun\command- K:\setup.exe *Newly Created Service* - EVERESTDRIVER *Newly Created Service* - F-SECURE_STANDALONE_MINIFILTER ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-09 14:23:24 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xf9\x2022\xd3w\2] "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT" scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-09 14:24:06 --- E O F ---
Pysy puhtaana -> Tyhjennä järjestelmänpalautus Ohjeet Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste. Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä. -> Käytä CCleaneria -> CCleaner Lataa ja asenna CCleaner. Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti. -> Asenna SpywareBlaster -> SpywareBlaster SpywareBlaster estää haittaohjelmia asentumasta koneellesi. Ei kuluta muistia! Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas -> Asenna MVPS Hosts tiedosto -> MVPS Hosts Estää koneesi yhteyden haitallisiin sivustoihin. Opas saatavilla suomeksi! Nimimerkki Axelin opas -> Vaihda selaimesi Firefoxiin -> Firefox Firefox on nopeampi, turvallisempi ja parempi selain kuin Internet Explorer. -> Pidä järjestelmäsi ajantasalla. -> Windows Update Vieraile Windows Updatessa säännöllisesti. -> Pidä palomuuri ja virustorjunta ajantasalla Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi. ja hyvä myös escan http://koti.mbnet.fi/pattaya1/escanmwav.htm ->Pidä ohjelmistosi ajantasalla. -> Secunia Software Inspector Secunia Software Inspector tutkii sinun järjestälmäsi ja ohjelmistosi puuttuvien turvallisuuspäivityksien osalta. Tavallinen tutkinta kestää normaalisti 5-40 sekuntia, kun läpikotainen (thorough system inspection) voi kestää useita minuutteja. ->Seuraa säännöllisesti viestintäviraston tietoja uusista haavoittuvuuksista -> CERT-FI Jos tulevaisuudessa tulee haittaohjelmien kanssa ongelmia, älä epäröi laittaa Hijackthis-logia tarkistettavaksi!
