Troijalaisia koko ajan

Elikkäs mulla käy niin, että ainaku meen omaan tietokoneeseen, niin kansioon C-> Documents And Settings -> ~ -> Local Settings -> Temp -kansioo tulee joku random-numerosarjalla varustettu tiedosto, jonka avast! ilmottaa troijalaiseks. Just ajoin ton samaisen avastin virusskannerin, ja kyllähän se jotai löysiki mut tota ongelmaa se ei poistanu.

Eli onko koneessa joku isompi mato ku koko ajan näyttäs luovan jotai troijalaisia, vai mikä? Nyt olis hyvät neuvot tarpeen et mitä tän rakkineen kans pitäs tehä...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:32:32, on 27.1.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://advnt05.com/popsend.asp?id=30657
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: (no name) - {008DB894-99ED-445D-8547-0E7C9808898D} - blank (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {E1F45899-A91A-9CC2-10BC-147A67E7DCF3} - C:\DOCUME~1\CM-PKY~1\APPLIC~1\ONCEIN~1\dalebold.exe (file missing)
O3 - Toolbar: MSN-työkalurivi - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fi\msntb.dll (file missing)
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [SysTray] C:\Program Files\paytime.exe
O4 - HKLM\..\Run: [online error load more] C:\Documents and Settings\All Users\Application Data\program live online error\online drive.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [BSplayer_WhenUSave_Installer] C:\Program Files\BSplayer_WhenUSave_Installer\BSplayer_WhenUSave_Installer.exe
O4 - HKLM\..\Run: [hyvjzud] c:\windows\system32\hyvjzud.exe hyvjzud
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -s
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SansaDispatch] C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [Instant Access] rundll32.exe EGACCESS4_1059.dll,InstantAccess
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra 'Tools' menuitem: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01BE5BD7-B2DD-48B3-A759-59265A91E787} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1064_XP.cab
O16 - DPF: {04CCFF26-7D52-4E42-BF6A-F8ECE0896EB7} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1071_XP.cab
O16 - DPF: {07C9CFC7-DE33-4A0C-9FFB-CDFBA843B157} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1063_XP.cab
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {0DA910BC-6919-489E-B584-D9A4AAC7B8DE} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1068_ASPIV4_XP.cab
O16 - DPF: {1604DF98-D1A5-44FE-844A-98D6FD0518D0} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1060_XP.cab
O16 - DPF: {17BFC8DA-B4D6-4DB9-AA40-1CD32EDA9845} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1066_ASPIV4_XP.cab
O16 - DPF: {1CD49DC9-FD88-41FA-B892-47E037267D45} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1059_XP.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
O16 - DPF: {26D73573-F1B3-48C9-A989-E6CE071957A1} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1057_XP.cab
O16 - DPF: {3616F4B5-F6AD-4E67-966A-C218673648A0} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1070_ASPIV4_XP.cab
O16 - DPF: {3DAD912E-D2B9-4323-B7C9-7F2C5CC0C57B} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1070_XP.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {54579C3D-A58D-4623-B5B5-465552BDA45B} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1072_ASPIV4_XP.cab
O16 - DPF: {78F584DF-BBF5-4296-839C-31DE60914DBC} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1071_ASPIV4_XP.cab
O16 - DPF: {81B9C506-46D3-4667-9018-3D6575CBC046} (VacPro.finland_ver10) - http://66.194.38.28/dialer/finland_ver10.CAB
O16 - DPF: {87C1805D-C5AE-4455-AB39-E245BB516136} - http://scripts.dlv4.com/binaries/egaccess4/egaccess4_1059_XP.cab
O16 - DPF: {8D8BAF56-B581-4B90-A549-C4AC6B03F1BB} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1074_XP.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab?fgiocv=1
O16 - DPF: {95460ABD-946A-46FF-9F56-268718323EEE} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1068_XP.cab
O16 - DPF: {9E98E84C-79E1-49C3-82EB-798FCD552EFB} - http://advnt01.com/dialer/internazionale_ver4.CAB
O16 - DPF: {A1C392A2-B274-46DB-89BE-1FBD476B9C93} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1065_XP.cab
O16 - DPF: {AF7410C1-FBA3-415E-800A-4110CED40536} - http://scripts.dlv4.com/binaries/egaccess4/egaccess4_1060_XP.cab
O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/sysinetsvc32_EN_XP.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BA749BC1-143E-430D-B1DA-1D2AF67A3658} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1069_XP.cab
O16 - DPF: {BFC9677B-8006-4336-9D49-2C797AEFCB9E} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1058_XP.cab
O16 - DPF: {C2481ED1-9896-4D49-AE90-69858DFDE446} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1073_XP.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E114CD5B-17CE-4807-890E-7B1EDF9F2E5E} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1066_XP.cab
O16 - DPF: {E24E8472-89B7-479F-8AD8-BBD7206A6A02} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1067_XP.cab
O16 - DPF: {E7AE1661-EBEB-492B-AE0D-860DF24174C6} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1064_ASPIV4_XP.cab
O16 - DPF: {EC4AFBF3-4540-4306-AF10-4CAC509EA16B} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1074_ASPIV4_XP.cab
O16 - DPF: {EF4DCD99-D26B-44A4-BA77-CFDCC97E7291} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1062_XP.cab
O16 - DPF: {EFB23983-5803-4914-ADA3-C0EA2CFBDC37} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1072_XP.cab
O16 - DPF: {F72BC3F0-6C20-4793-9DDA-258589D8A907} - http://akamai.downloadv3.com/binaries/IA/netslv32_EN_XP.cab
O16 - DPF: {FA605711-8E72-46B2-AE49-BED11B2E729D} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1063_ASPIV4_XP.cab
O16 - DPF: {FA83E942-B796-46DE-9155-1632ECC5473B} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1061_XP.cab
O18 - Filter hijack: text/html - {6F176D77-7072-404C-9F2B-8A7F2109AFB6} - blank
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O21 - SSODL: E404Helper - {16c6fd91-2910-4ae5-93b4-92278480d8af} - e404d.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - Unknown owner - C:\WINDOWS\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - Unknown owner - C:\WINDOWS\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - Unknown owner - C:\WINDOWS\system32\lktsrv.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - Unknown owner - C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NILM License Manager - Macrovision Corporation - C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - Unknown owner - C:\WINDOWS\system32\nisvcloc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Windows Media Playerin verkkojakamispalvelu (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

--
End of file - 14979 bytes

Tossa vielä toi hjt-logi mikä ainaki omaan silmään näyttäs aika järkyttävältä...

 

loki -->Tänne

 

unoha

 

smitti ei auta ku koneessa on loppi ja paljon muuta kökköä
yritetään saada puhtaaks

Tee uusi hjt-scannaus Do a System scan only
Sulje kaikki muut ikkunat ja selaimen.Merkkaa nämä rivit ja paina Fix checked

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://advnt05.com/popsend.asp?id=30657
O2 - BHO: (no name) - {008DB894-99ED-445D-8547-0E7C9808898D} - blank (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {E1F45899-A91A-9CC2-10BC-147A67E7DCF3} - C:\DOCUME~1\CM-PKY~1\APPLIC~1\ONCEIN~1\dalebold.exe (file missing)
O4 - HKLM\..\Run: [SysTray] C:\Program Files\paytime.exe
O4 - HKLM\..\Run: [online error load more] C:\Documents and Settings\All Users\Application Data\program live online error\online drive.exe
O4 - HKLM\..\Run: [BSplayer_WhenUSave_Installer] C:\Program Files\BSplayer_WhenUSave_Installer\BSplayer_WhenUSave_Installer.exe
O4 - HKLM\..\Run: [hyvjzud] c:\windows\system32\hyvjzud.exe hyvjzud
O4 - HKCU\..\Run: [Instant Access] rundll32.exe EGACCESS4_1059.dll,InstantAccess
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe"
O16 - DPF: {01BE5BD7-B2DD-48B3-A759-59265A91E787} - http://akamai.downloadv3.com/binaries/EG...ESS_1064_XP.cab
O16 - DPF: {04CCFF26-7D52-4E42-BF6A-F8ECE0896EB7} - http://scripts.downloadv3.com/binaries/E...ESS_1071_XP.cab
O16 - DPF: {07C9CFC7-DE33-4A0C-9FFB-CDFBA843B157} - http://akamai.downloadv3.com/binaries/EG...ESS_1063_XP.cab
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {0DA910BC-6919-489E-B584-D9A4AAC7B8DE} - http://scripts.downloadv3.com/binaries/E...8_ASPIV4_XP.cab
O16 - DPF: {1604DF98-D1A5-44FE-844A-98D6FD0518D0} - http://akamai.downloadv3.com/binaries/EG...ESS_1060_XP.cab
O16 - DPF: {17BFC8DA-B4D6-4DB9-AA40-1CD32EDA9845} - http://scripts.downloadv3.com/binaries/E...6_ASPIV4_XP.cab
O16 - DPF: {1CD49DC9-FD88-41FA-B892-47E037267D45} - http://akamai.downloadv3.com/binaries/EG...ESS_1059_XP.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/fun...tup1.0.0.15.cab
O16 - DPF: {26D73573-F1B3-48C9-A989-E6CE071957A1} - http://akamai.downloadv3.com/binaries/EG...ESS_1057_XP.cab
O16 - DPF: {3616F4B5-F6AD-4E67-966A-C218673648A0} - http://scripts.downloadv3.com/binaries/E...0_ASPIV4_XP.cab
O16 - DPF: {3DAD912E-D2B9-4323-B7C9-7F2C5CC0C57B} - http://scripts.downloadv3.com/binaries/E...ESS_1070_XP.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {54579C3D-A58D-4623-B5B5-465552BDA45B} - http://scripts.downloadv3.com/binaries/E...2_ASPIV4_XP.cab
O16 - DPF: {78F584DF-BBF5-4296-839C-31DE60914DBC} - http://scripts.downloadv3.com/binaries/E...1_ASPIV4_XP.cab
O16 - DPF: {81B9C506-46D3-4667-9018-3D6575CBC046} (VacPro.finland_ver10) - http://66.194.38.28/dialer/finland_ver10.CAB
O16 - DPF: {87C1805D-C5AE-4455-AB39-E245BB516136} - http://scripts.dlv4.com/binaries/egaccess4/egaccess4_1059_XP.cab
O16 - DPF: {8D8BAF56-B581-4B90-A549-C4AC6B03F1BB} - http://scripts.downloadv3.com/binaries/E...ESS_1074_XP.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab?fgiocv=1
O16 - DPF: {95460ABD-946A-46FF-9F56-268718323EEE} - http://scripts.downloadv3.com/binaries/E...ESS_1068_XP.cab
O16 - DPF: {9E98E84C-79E1-49C3-82EB-798FCD552EFB} - http://advnt01.com/dialer/internazionale_ver4.CAB
O16 - DPF: {A1C392A2-B274-46DB-89BE-1FBD476B9C93} - http://scripts.downloadv3.com/binaries/E...ESS_1065_XP.cab
O16 - DPF: {AF7410C1-FBA3-415E-800A-4110CED40536} - http://scripts.dlv4.com/binaries/egaccess4/egaccess4_1060_XP.cab
O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/sysinetsvc32_EN_XP.cab
O16 - DPF: {BA749BC1-143E-430D-B1DA-1D2AF67A3658} - http://scripts.downloadv3.com/binaries/E...ESS_1069_XP.cab
O16 - DPF: {BFC9677B-8006-4336-9D49-2C797AEFCB9E} - http://akamai.downloadv3.com/binaries/EG...ESS_1058_XP.cab
O16 - DPF: {C2481ED1-9896-4D49-AE90-69858DFDE446} - http://scripts.downloadv3.com/binaries/E...ESS_1073_XP.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {E114CD5B-17CE-4807-890E-7B1EDF9F2E5E} - http://scripts.downloadv3.com/binaries/E...ESS_1066_XP.cab
O16 - DPF: {E24E8472-89B7-479F-8AD8-BBD7206A6A02} - http://scripts.downloadv3.com/binaries/E...ESS_1067_XP.cab
O16 - DPF: {E7AE1661-EBEB-492B-AE0D-860DF24174C6} - http://akamai.downloadv3.com/binaries/EG...4_ASPIV4_XP.cab
O16 - DPF: {EC4AFBF3-4540-4306-AF10-4CAC509EA16B} - http://scripts.downloadv3.com/binaries/E...4_ASPIV4_XP.cab
O16 - DPF: {EF4DCD99-D26B-44A4-BA77-CFDCC97E7291} - http://akamai.downloadv3.com/binaries/EG...ESS_1062_XP.cab
O16 - DPF: {EFB23983-5803-4914-ADA3-C0EA2CFBDC37} - http://scripts.downloadv3.com/binaries/E...ESS_1072_XP.cab
O16 - DPF: {F72BC3F0-6C20-4793-9DDA-258589D8A907} - http://akamai.downloadv3.com/binaries/IA/netslv32_EN_XP.cab
O16 - DPF: {FA605711-8E72-46B2-AE49-BED11B2E729D} - http://akamai.downloadv3.com/binaries/EG...3_ASPIV4_XP.cab
O16 - DPF: {FA83E942-B796-46DE-9155-1632ECC5473B} - http://akamai.downloadv3.com/binaries/EG...ESS_1061_XP.cab
O18 - Filter hijack: text/html - {6F176D77-7072-404C-9F2B-8A7F2109AFB6} - blank




1. Lataa combofix.exe työpöydällesi mistä tahansa alla olevasta linkistä:
Linkki 1
Linkki 2
Linkki 3

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. (C:\ComboFix.txt) Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.


Lataa NoLop työpöydällesi yhdestä seuraavista linkeistä...
Linkki 1
Linkki 2
Linkki 3
Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen
Tuplaklikkaa NoLop.exe ajaaksesi sen

Klikkaa nappulaa "Search and Destroy"
<<Tietokoneesi skannataan saastuneiden tiedostojen osalta>>
Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK
Klikkaa "REBOOT"-painiketta.
NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera.
-- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataa mscomctl.ocx ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan.

Lähetä combon loki ja NoLop-loki ja uusi hjt-loki

 

Aaah kiitoksia neuvoista, nyt hävisi ainaki tietokonetta pitkään vaivannu ongelma, nimittäin sellanen että joka kansios missä oli kuvia, niin nämä kuvat avautui todella hitaasti ja usein koko kone veti aiva jööttiin. Lisäksi ton hjt-login bytessit putos puolella Mutta tässä tulee nää logit vielä, laitan tähän samaan ku tähän nämä vastaukset on muutenki tullu.

E: Ja vielä sellanenki ongelma häipy, et ennen en oo päässy ollenkaa windowsin palomuuria säätämään koska aina tullu ilmotus: "Windowsin palomuuria ei voi avata tuntemattoman ongelman vuoksi" tai jotain tollasta Mutta nyt seki on häipyny, jess! Kiitosta vaan

Hjt-logi

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:34:12, on 2.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Winamp\winamp.exe
C:\Program Files\Last.fm\LastFM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\SNDVOL32.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: MSN-työkalurivi - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fi\msntb.dll (file missing)
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -s
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SansaDispatch] C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra 'Tools' menuitem: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O21 - SSODL: E404Helper - {16c6fd91-2910-4ae5-93b4-92278480d8af} - e404d.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - Unknown owner - C:\WINDOWS\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - Unknown owner - C:\WINDOWS\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - Unknown owner - C:\WINDOWS\system32\lktsrv.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - Unknown owner - C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NILM License Manager - Macrovision Corporation - C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - Unknown owner - C:\WINDOWS\system32\nisvcloc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Windows Media Playerin verkkojakamispalvelu (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

--
End of file - 7760 bytes

ComboFix-logi

ComboFix 08-02.02.5 - Juhis 2008-02-02 11:48:25.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.397 [GMT 2:00]
Running from: C:\Documents and Settings\Juhis\Työpöytä\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
The following files were disabled during the run:
C:\WINDOWS\system32\guard32.dll

ADS - svchost.exe: deleted 88 bytes in 2 streams.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\sys.txt
C:\WINDOWS\Fonts\acrsecB.fon
C:\WINDOWS\Fonts\acrsecI.fon
C:\WINDOWS\system32\backgrd.jpg
C:\WINDOWS\system32\hyvjzud.dat
C:\WINDOWS\system32\hyvjzud.exe . . . . poisto epäonnistui
C:\WINDOWS\system32\hyvjzud_nav.dat
C:\WINDOWS\system32\hyvjzud_navps.dat
C:\WINDOWS\system32\hyvjzud_navup.dat
C:\WINDOWS\system32\msegcompid.dll
C:\WINDOWS\Temp\1221688289.exe
C:\WINDOWS\Temp\1250540301.exe
C:\WINDOWS\Temp\1339324430.exe
C:\WINDOWS\Temp\1454450640.exe
C:\WINDOWS\Temp\1503596558.exe
C:\WINDOWS\Temp\1539929349.exe
C:\WINDOWS\Temp\2054633577.exe
C:\WINDOWS\Temp\27200487.exe
C:\WINDOWS\Temp\297591378.exe
C:\WINDOWS\Temp\387161835.exe
C:\WINDOWS\Temp\782698672.exe
C:\WINDOWS\tmlpcert2007
C:\WINDOWS\system32\hyvjzud.exe . . . . poisto epäonnistui

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_ICF
-------\ICF


((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-01-02 to 2008-02-02 )))))))))))))))))
.

2008-02-01 20:25 . 2008-02-01 20:25 268 --ah----- C:\sqmdata06.sqm
2008-01-31 17:40 . 2008-01-31 17:40 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Installations
2008-01-28 22:43 . 2008-01-28 22:44 <KANSIO> d-------- C:\WINDOWS\system32\NtmsData
2008-01-28 21:24 . 2008-01-28 21:51 3,486 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-16 17:05 . 2008-01-26 13:06 <KANSIO> d-------- C:\Java
2008-01-16 16:54 . 2008-01-16 16:54 <KANSIO> d-------- C:\Program Files\Sun
2008-01-15 22:30 . 2008-01-16 16:09 <KANSIO> d-------- C:\Program Files\Notepad++
2008-01-15 22:30 . 2008-01-15 22:31 <KANSIO> d-------- C:\Documents and Settings\Juhis\Application Data\Notepad++
2008-01-10 19:20 . 2008-01-16 16:40 <KANSIO> d-------- C:\Documents and Settings\Juhis\.SunDownloadManager
2008-01-08 17:32 . 2008-01-08 17:32 <KANSIO> d-------- C:\Program Files\SanDisk
2008-01-08 17:32 . 2008-01-08 17:32 <KANSIO> d-------- C:\Documents and Settings\Juhis\Application Data\InstallShield

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-01 22:45 --------- d-----w C:\Documents and Settings\Juhis\Application Data\uTorrent
2008-01-27 21:07 81,272 ----a-w C:\WINDOWS\system32\drivers\cmdGuard.sys
2008-01-27 21:07 23,672 ----a-w C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-01-20 17:54 --------- d-----w C:\Program Files\DC++
2008-01-17 15:37 --------- d-----w C:\Documents and Settings\Juhis\Application Data\AdobeUM
2008-01-16 14:52 --------- d-----w C:\Program Files\Java
2008-01-08 15:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-05 21:59 --------- d-----w C:\Documents and Settings\Juhis\Application Data\MSN6
2008-01-04 16:12 --------- d-----w C:\Program Files\Last.fm
2007-12-27 17:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\program live online error
2007-12-24 20:03 --------- d-----w C:\Program Files\Audible
2007-12-24 08:38 --------- d-----w C:\Program Files\QuickTime
2007-12-24 08:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-22 20:42 --------- d-----w C:\Program Files\Easy Video Downloader
2007-12-18 19:32 --------- d-----w C:\Program Files\MSN Messenger
2007-12-18 19:32 --------- d-----w C:\Program Files\Messenger Plus! Live
2007-12-17 16:56 --------- d-----w C:\Program Files\WAV to MP3 Encoder
2007-12-07 11:35 --------- d-----w C:\Program Files\Common Files\Apple
2007-12-07 11:18 --------- d-----w C:\Program Files\Apple Software Update
2007-12-07 11:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-02 11:30 --------- d-----w C:\Documents and Settings\Juhis\Application Data\Autodesk
2007-12-02 11:26 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2007-12-02 11:24 --------- d-----w C:\Program Files\AnswerWorks 4.0
2007-12-02 11:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2007-12-02 11:10 --------- d-----w C:\Program Files\Autodesk
2007-11-12 14:18 86 ----a-w C:\4063235.bat
2005-08-13 18:12 172,252 -c--a-w C:\Program Files\nudge.wav
2005-05-11 20:36 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
2004-01-03 22:07 42 -c--a-w C:\Program Files\Common Files\uninst.bat
2004-01-03 21:50 2,494 -c--a-w C:\Program Files\Common Files\uninst.htm
.

(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 01:12 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wizard"="" []
"EM_EXEC"="C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [ ]
"NWEReboot"="" []
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-15 01:12 110592 C:\WINDOWS\system32\bthprops.cpl]
"NAV_Update"="" []
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2006-03-18 04:24 184320]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-01-27 23:07 1481472]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-12-11 10:56 286720]
"SansaDispatch"="C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe" [2007-10-22 12:52 75584]
"WinampAgent"="C:\Winamp\winampa.exe" [2007-12-20 17:16 37376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 01:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"E404Helper"= {16c6fd91-2910-4ae5-93b4-92278480d8af} - e404d.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-09-15 01:12 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 2004-08-20 15:51 118784 C:\WINDOWS\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2005-05-11 22:12 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 2004-08-20 15:55 155648 C:\WINDOWS\System32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2004-06-16 06:03 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-06-16 06:03 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-09-17 01:07 8491008 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-12-11 10:56 286720 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2004-04-28 17:19 66048 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 22:41]
R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 22:41]
R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys [2003-07-25 14:02]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-01-27 23:07]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-01-27 23:07]
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys [2004-04-08 10:04]
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys [2003-08-20 09:44]
R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys [2006-07-27 10:00]
R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [2003-04-18 13:45]
S3 Devx;Devx;C:\WINDOWS\system32\drivers\Devx.sys [2001-09-06 14:21]
S3 MayPro;TigerGame SuperJoy Box Pro Filter Service;C:\WINDOWS\system32\Drivers\MayPro.sys [2005-09-12 22:04]
S3 VtPr;VtPr;C:\WINDOWS\system32\drivers\VtPr.sys [2001-10-10 16:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ee8897c-7f4e-11d9-a73a-806d6172696f}]
\Shell\AutoRun\command - K:\setup.exe
\Shell\directx\command - K:\DirectX\dxsetup.exe
\Shell\setup\command - K:\setup.exe

.
'Ajoitetut teht„v„t'-kansion sis„lt”
"2008-02-02 10:00:00 C:\WINDOWS\Tasks\A9AD885791060483.job"
- c:\docume~1\cm-pky~1\applic~1\funkpo~1\Real Bike Flap.exe
"2007-12-24 08:24:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-02 11:57:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\WINDOWS\system32\guard32.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
.
**************************************************************************
.
Completion time: 2008-02-02 12:03:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-02 10:03:06
.
2008-02-01 22:47:23 --- E O F ---

NoLop-logi

NoLop! Log by Skate_Punk_21

Fix running from: C:\Documents and Settings\Juhis\Työpöytä
[2.2.2008]
[12:07:00]

---Infection Files Found/Removed---
C:\WINDOWS\tasks\A9AD885791060483.job

Beginning Removal...
Rebooting...
Removing Lop's Leftover Files/Folders...
Editing Registry...
**Fix Complete!**

---Listing AppData sub directories---

C:\Documents and Settings\All Users\Application Data\Adobe
C:\Documents and Settings\All Users\Application Data\Adobe Systems
C:\Documents and Settings\All Users\Application Data\Ahead
C:\Documents and Settings\All Users\Application Data\Apple
C:\Documents and Settings\All Users\Application Data\Apple Computer
C:\Documents and Settings\All Users\Application Data\Autodesk
C:\Documents and Settings\All Users\Application Data\Comodo
C:\Documents and Settings\All Users\Application Data\Hp
C:\Documents and Settings\All Users\Application Data\Installations
C:\Documents and Settings\All Users\Application Data\Installshield
C:\Documents and Settings\All Users\Application Data\Last.fm
C:\Documents and Settings\All Users\Application Data\Mailfrontier -- EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Messenger Plus!
C:\Documents and Settings\All Users\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Msn6
C:\Documents and Settings\All Users\Application Data\National Instruments
C:\Documents and Settings\All Users\Application Data\Npf
C:\Documents and Settings\All Users\Application Data\Nvidia
C:\Documents and Settings\All Users\Application Data\Nview_profiles -- EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Program Live Online Error
C:\Documents and Settings\All Users\Application Data\Sonic
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
C:\Documents and Settings\All Users\Application Data\Worldpokertour
C:\Documents and Settings\Cm-pääkäyttäjä\Application Data\Onceinsidecorn -- EMPTY Directory
C:\Documents and Settings\Default User\Application Data\Identities
C:\Documents and Settings\Default User\Application Data\Intervideo
C:\Documents and Settings\Default User\Application Data\Microsoft
C:\Documents and Settings\Juhis\Application Data\Adobe
C:\Documents and Settings\Juhis\Application Data\Adobeum -- EMPTY Directory
C:\Documents and Settings\Juhis\Application Data\Ahead
C:\Documents and Settings\Juhis\Application Data\Apple Computer
C:\Documents and Settings\Juhis\Application Data\Atari
C:\Documents and Settings\Juhis\Application Data\Autodesk
C:\Documents and Settings\Juhis\Application Data\Bsplayer
C:\Documents and Settings\Juhis\Application Data\Bsplayer Pro
C:\Documents and Settings\Juhis\Application Data\Comodo
C:\Documents and Settings\Juhis\Application Data\Divx
C:\Documents and Settings\Juhis\Application Data\Fretsonfire
C:\Documents and Settings\Juhis\Application Data\Help -- EMPTY Directory
C:\Documents and Settings\Juhis\Application Data\Hp
C:\Documents and Settings\Juhis\Application Data\Hyperionics
C:\Documents and Settings\Juhis\Application Data\Identities
C:\Documents and Settings\Juhis\Application Data\Installshield
C:\Documents and Settings\Juhis\Application Data\Intervideo
C:\Documents and Settings\Juhis\Application Data\Jasc Software Inc
C:\Documents and Settings\Juhis\Application Data\Lavasoft
C:\Documents and Settings\Juhis\Application Data\Limewire
C:\Documents and Settings\Juhis\Application Data\Macromedia
C:\Documents and Settings\Juhis\Application Data\Microsoft
C:\Documents and Settings\Juhis\Application Data\Mozilla
C:\Documents and Settings\Juhis\Application Data\Msn6
C:\Documents and Settings\Juhis\Application Data\National Instruments
C:\Documents and Settings\Juhis\Application Data\Nch Swift Sound
C:\Documents and Settings\Juhis\Application Data\Notepad++
C:\Documents and Settings\Juhis\Application Data\Screenshot Sender
C:\Documents and Settings\Juhis\Application Data\Securom
C:\Documents and Settings\Juhis\Application Data\Sun
C:\Documents and Settings\Juhis\Application Data\Talkback
C:\Documents and Settings\Juhis\Application Data\Template
C:\Documents and Settings\Juhis\Application Data\Utorrent
C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Identities
C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Intervideo
C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Microsoft
C:\Documents and Settings\Localservice\Application Data\Macromedia
C:\Documents and Settings\Localservice\Application Data\Microsoft
C:\Documents and Settings\Networkservice\Application Data\Microsoft
C:\Documents and Settings\Vieras\Application Data\Identities
C:\Documents and Settings\Vieras\Application Data\Intervideo
C:\Documents and Settings\Vieras\Application Data\Macromedia
C:\Documents and Settings\Vieras\Application Data\Microsoft
C:\Documents and Settings\Vieras\Application Data\Mozilla
C:\Documents and Settings\Äitee Ja Isä\Application Data\Adobe
C:\Documents and Settings\Äitee Ja Isä\Application Data\Comodo
C:\Documents and Settings\Äitee Ja Isä\Application Data\Identities
C:\Documents and Settings\Äitee Ja Isä\Application Data\Intervideo
C:\Documents and Settings\Äitee Ja Isä\Application Data\Macromedia
C:\Documents and Settings\Äitee Ja Isä\Application Data\Microsoft
C:\Documents and Settings\Äitee Ja Isä\Application Data\Mozilla
C:\Documents and Settings\Äitee Ja Isä\Application Data\Sun
C:\Documents and Settings\Äitee Ja Isä\Application Data\Template

Kiitoksia vielä kerran

 

Puh puh... Äläs lähe viel. Parin tiedoston poisto epäonnistu ja toi tulee aikaa nopee takas ellet hoida sitä nyt kunnolla pois. Ootappa viel lisä ohjeistusta

 

Joo toi hyvjzud.exe ainaki vissii jäi vielä jotain kummittelemaan, poistin sen kyllä vissiin tolla smitfraudilla niin ettei se käynnisty enää tietokoneen käynnistyksen yhteydes... Mutta pitää odottaa vielä neuvoja

 

Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

Tallenna nimellä CFScript (itse asiassa combofix tunnistaa tuon vaikka tiedostopääte ei olisi
edes .txt).

Sitten raahaa CFScript ComboFix.exeen kuten alla.



Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.

 

Jep tein nyt ton, toivottavasti se ei häiriintyny ku bootin jälkeen tietty meni palomuuri takas päälle ja se rupes kiusaamaan tota combofixiä enneku ehin ottaa sen pois päältä.

Logi:

ComboFix 08-02.02.5 - Juhis 2008-02-02 14:47:08.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.376 [GMT 2:00]
Running from: C:\Documents and Settings\Juhis\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Juhis\Työpöytä\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\Program Files\paytime.exe
c:\secure32.html
C:\WINDOWS\system32\hyvjzud.exe
C:\winstall.exe
.
The following files were disabled during the run:
C:\WINDOWS\system32\guard32.dll


(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Program Live Online Error
C:\Documents and Settings\All Users\Application Data\Program Live Online Error\CastManagerPop
C:\Documents and Settings\All Users\Application Data\Program Live Online Error\PingFaceDale
C:\Documents and Settings\All Users\Application Data\Program Live Online Error\Scr Axis Bend
C:\Documents and Settings\Cm-pääkäyttäjä\Application Data\Onceinsidecorn
C:\WINDOWS\system32\hyvjzud.exe . . . . poisto epäonnistui

.
((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-01-02 to 2008-02-02 )))))))))))))))))
.

2008-02-02 14:47 . 2008-02-02 14:47 6,736 --a------ C:\WINDOWS\system32\drivers\PROCEXP90.SYS
2008-02-02 12:11 . 2008-02-02 12:13 <KANSIO> d-------- C:\NoLopBackups
2008-02-02 12:03 . <KANSIO> C:\Documents and Settings\-itee ja isõ\Local Settings
2008-02-02 12:03 . <KANSIO> C:\Documents and Settings\-itee ja isõ\Local Settings
2008-02-01 20:25 . 2008-02-01 20:25 268 --ah----- C:\sqmdata06.sqm
2008-01-31 17:40 . 2008-01-31 17:40 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Installations
2008-01-28 22:43 . 2008-01-28 22:44 <KANSIO> d-------- C:\WINDOWS\system32\NtmsData
2008-01-28 21:24 . 2008-01-28 21:51 3,486 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-16 17:05 . 2008-01-26 13:06 <KANSIO> d-------- C:\Java
2008-01-16 16:54 . 2008-01-16 16:54 <KANSIO> d-------- C:\Program Files\Sun
2008-01-15 22:30 . 2008-01-16 16:09 <KANSIO> d-------- C:\Program Files\Notepad++
2008-01-15 22:30 . 2008-01-15 22:31 <KANSIO> d-------- C:\Documents and Settings\Juhis\Application Data\Notepad++
2008-01-10 19:20 . 2008-01-16 16:40 <KANSIO> d-------- C:\Documents and Settings\Juhis\.SunDownloadManager
2008-01-08 17:32 . 2008-01-08 17:32 <KANSIO> d-------- C:\Program Files\SanDisk
2008-01-08 17:32 . 2008-01-08 17:32 <KANSIO> d-------- C:\Documents and Settings\Juhis\Application Data\InstallShield

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-01 22:45 --------- d-----w C:\Documents and Settings\Juhis\Application Data\uTorrent
2008-01-27 21:07 81,272 ----a-w C:\WINDOWS\system32\drivers\cmdGuard.sys
2008-01-27 21:07 23,672 ----a-w C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-01-20 17:54 --------- d-----w C:\Program Files\DC++
2008-01-17 15:37 --------- d-----w C:\Documents and Settings\Juhis\Application Data\AdobeUM
2008-01-16 14:52 --------- d-----w C:\Program Files\Java
2008-01-08 15:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-05 21:59 --------- d-----w C:\Documents and Settings\Juhis\Application Data\MSN6
2008-01-04 16:12 --------- d-----w C:\Program Files\Last.fm
2007-12-24 20:03 --------- d-----w C:\Program Files\Audible
2007-12-24 08:38 --------- d-----w C:\Program Files\QuickTime
2007-12-24 08:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-22 20:42 --------- d-----w C:\Program Files\Easy Video Downloader
2007-12-18 19:32 --------- d-----w C:\Program Files\MSN Messenger
2007-12-18 19:32 --------- d-----w C:\Program Files\Messenger Plus! Live
2007-12-17 16:56 --------- d-----w C:\Program Files\WAV to MP3 Encoder
2007-12-07 11:35 --------- d-----w C:\Program Files\Common Files\Apple
2007-12-07 11:18 --------- d-----w C:\Program Files\Apple Software Update
2007-12-07 11:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-02 11:30 --------- d-----w C:\Documents and Settings\Juhis\Application Data\Autodesk
2007-12-02 11:26 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2007-12-02 11:24 --------- d-----w C:\Program Files\AnswerWorks 4.0
2007-12-02 11:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2007-12-02 11:10 --------- d-----w C:\Program Files\Autodesk
2007-11-12 14:18 86 ----a-w C:\4063235.bat
2005-08-13 18:12 172,252 -c--a-w C:\Program Files\nudge.wav
2005-05-11 20:36 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
2004-01-03 22:07 42 -c--a-w C:\Program Files\Common Files\uninst.bat
2004-01-03 21:50 2,494 -c--a-w C:\Program Files\Common Files\uninst.htm
.

(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 01:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wizard"="" []
"EM_EXEC"="C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [ ]
"NWEReboot"="" []
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-15 01:12 110592 C:\WINDOWS\system32\bthprops.cpl]
"NAV_Update"="" []
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2006-03-18 04:24 184320]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-01-27 23:07 1481472]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-12-11 10:56 286720]
"SansaDispatch"="C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe" [2007-10-22 12:52 75584]
"WinampAgent"="C:\Winamp\winampa.exe" [2007-12-20 17:16 37376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 01:12 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-09-15 01:12 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 2004-08-20 15:51 118784 C:\WINDOWS\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2005-05-11 22:12 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 2004-08-20 15:55 155648 C:\WINDOWS\System32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2004-06-16 06:03 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-06-16 06:03 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-09-17 01:07 8491008 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-12-11 10:56 286720 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2004-04-28 17:19 66048 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 22:41]
R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 22:41]
R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys [2003-07-25 14:02]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-01-27 23:07]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-01-27 23:07]
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys [2004-04-08 10:04]
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys [2003-08-20 09:44]
R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys [2006-07-27 10:00]
R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [2003-04-18 13:45]
S3 Devx;Devx;C:\WINDOWS\system32\drivers\Devx.sys [2001-09-06 14:21]
S3 MayPro;TigerGame SuperJoy Box Pro Filter Service;C:\WINDOWS\system32\Drivers\MayPro.sys [2005-09-12 22:04]
S3 VtPr;VtPr;C:\WINDOWS\system32\drivers\VtPr.sys [2001-10-10 16:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ee8897c-7f4e-11d9-a73a-806d6172696f}]
\Shell\AutoRun\command - K:\setup.exe
\Shell\directx\command - K:\DirectX\dxsetup.exe
\Shell\setup\command - K:\setup.exe

.
'Ajoitetut teht„v„t'-kansion sis„lt”
"2007-12-24 08:24:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-02 14:55:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\WINDOWS\system32\guard32.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
.
**************************************************************************
.
Completion time: 2008-02-02 15:01:04 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-02 13:00:58
ComboFix2.txt 2008-02-02 10:03:13
.
2008-02-02 11:31:53 --- E O F ---

 

Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

Tallenna nimellä CFScript (itse asiassa combofix tunnistaa tuon vaikka tiedostopääte ei olisi
edes .txt).

Sitten raahaa CFScript ComboFix.exeen kuten alla.



Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.

 

Tein ton kakski kertaa nyt, mut ei näyttäny tehoovan :s

Hyvjzud näyttää sitkeeltä pirulaiselta

ComboFix 08-02.02.5 - Juhis 2008-02-02 19:31:05.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.427 [GMT 2:00]
Running from: C:\Documents and Settings\Juhis\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Juhis\Työpöytä\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
The following files were disabled during the run:
C:\WINDOWS\system32\guard32.dll


(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\hyvjzud.exe . . . . poisto epäonnistui

.
((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-01-02 to 2008-02-02 )))))))))))))))))
.

2008-02-02 12:11 . 2008-02-02 12:13 <KANSIO> d-------- C:\NoLopBackups
2008-02-02 12:03 . <KANSIO> C:\Documents and Settings\-itee ja isõ\Local Settings
2008-02-02 12:03 . <KANSIO> C:\Documents and Settings\-itee ja isõ\Local Settings
2008-02-01 20:25 . 2008-02-01 20:25 268 --ah----- C:\sqmdata06.sqm
2008-01-31 17:40 . 2008-01-31 17:40 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Installations
2008-01-28 22:43 . 2008-01-28 22:44 <KANSIO> d-------- C:\WINDOWS\system32\NtmsData
2008-01-28 21:24 . 2008-01-28 21:51 3,486 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-16 17:05 . 2008-01-26 13:06 <KANSIO> d-------- C:\Java
2008-01-16 16:54 . 2008-01-16 16:54 <KANSIO> d-------- C:\Program Files\Sun
2008-01-15 22:30 . 2008-01-16 16:09 <KANSIO> d-------- C:\Program Files\Notepad++
2008-01-15 22:30 . 2008-01-15 22:31 <KANSIO> d-------- C:\Documents and Settings\Juhis\Application Data\Notepad++
2008-01-10 19:20 . 2008-01-16 16:40 <KANSIO> d-------- C:\Documents and Settings\Juhis\.SunDownloadManager
2008-01-08 17:32 . 2008-01-08 17:32 <KANSIO> d-------- C:\Program Files\SanDisk
2008-01-08 17:32 . 2008-01-08 17:32 <KANSIO> d-------- C:\Documents and Settings\Juhis\Application Data\InstallShield

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 17:13 --------- d-----w C:\Documents and Settings\Juhis\Application Data\uTorrent
2008-01-27 21:07 81,272 ----a-w C:\WINDOWS\system32\drivers\cmdGuard.sys
2008-01-27 21:07 23,672 ----a-w C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-01-20 17:54 --------- d-----w C:\Program Files\DC++
2008-01-17 15:37 --------- d-----w C:\Documents and Settings\Juhis\Application Data\AdobeUM
2008-01-16 14:52 --------- d-----w C:\Program Files\Java
2008-01-08 15:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-05 21:59 --------- d-----w C:\Documents and Settings\Juhis\Application Data\MSN6
2008-01-04 16:12 --------- d-----w C:\Program Files\Last.fm
2007-12-24 20:03 --------- d-----w C:\Program Files\Audible
2007-12-24 08:38 --------- d-----w C:\Program Files\QuickTime
2007-12-24 08:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-22 20:42 --------- d-----w C:\Program Files\Easy Video Downloader
2007-12-18 19:32 --------- d-----w C:\Program Files\MSN Messenger
2007-12-18 19:32 --------- d-----w C:\Program Files\Messenger Plus! Live
2007-12-17 16:56 --------- d-----w C:\Program Files\WAV to MP3 Encoder
2007-12-07 11:35 --------- d-----w C:\Program Files\Common Files\Apple
2007-12-07 11:18 --------- d-----w C:\Program Files\Apple Software Update
2007-12-07 11:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-02 11:30 --------- d-----w C:\Documents and Settings\Juhis\Application Data\Autodesk
2007-12-02 11:26 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2007-12-02 11:24 --------- d-----w C:\Program Files\AnswerWorks 4.0
2007-12-02 11:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2007-12-02 11:10 --------- d-----w C:\Program Files\Autodesk
2007-11-12 14:18 86 ----a-w C:\4063235.bat
2005-08-13 18:12 172,252 -c--a-w C:\Program Files\nudge.wav
2005-05-11 20:36 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
2004-01-03 22:07 42 -c--a-w C:\Program Files\Common Files\uninst.bat
2004-01-03 21:50 2,494 -c--a-w C:\Program Files\Common Files\uninst.htm
.

(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 01:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wizard"="" []
"EM_EXEC"="C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [ ]
"NWEReboot"="" []
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-15 01:12 110592 C:\WINDOWS\system32\bthprops.cpl]
"NAV_Update"="" []
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2006-03-18 04:24 184320]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-01-27 23:07 1481472]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-12-11 10:56 286720]
"SansaDispatch"="C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe" [2007-10-22 12:52 75584]
"WinampAgent"="C:\Winamp\winampa.exe" [2007-12-20 17:16 37376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 01:12 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-09-15 01:12 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 2004-08-20 15:51 118784 C:\WINDOWS\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2005-05-11 22:12 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 2004-08-20 15:55 155648 C:\WINDOWS\System32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2004-06-16 06:03 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-06-16 06:03 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-09-17 01:07 8491008 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-12-11 10:56 286720 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2004-04-28 17:19 66048 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 22:41]
R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 22:41]
R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys [2003-07-25 14:02]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-01-27 23:07]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-01-27 23:07]
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys [2004-04-08 10:04]
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys [2003-08-20 09:44]
R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys [2006-07-27 10:00]
R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [2003-04-18 13:45]
S3 Devx;Devx;C:\WINDOWS\system32\drivers\Devx.sys [2001-09-06 14:21]
S3 MayPro;TigerGame SuperJoy Box Pro Filter Service;C:\WINDOWS\system32\Drivers\MayPro.sys [2005-09-12 22:04]
S3 VtPr;VtPr;C:\WINDOWS\system32\drivers\VtPr.sys [2001-10-10 16:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ee8897c-7f4e-11d9-a73a-806d6172696f}]
\Shell\AutoRun\command - K:\setup.exe
\Shell\directx\command - K:\DirectX\dxsetup.exe
\Shell\setup\command - K:\setup.exe

.
'Ajoitetut teht„v„t'-kansion sis„lt”
"2007-12-24 08:24:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-02 19:36:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\WINDOWS\system32\guard32.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
.
**************************************************************************
.
Completion time: 2008-02-02 19:42:27 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-02 17:42:22
ComboFix2.txt 2008-02-02 17:28:28
ComboFix3.txt 2008-02-02 13:01:05
ComboFix4.txt 2008-02-02 10:03:13
.
2008-02-02 11:31:53 --- E O F ---

 

pitää miettiä jotain tolle tiedostolle mikä ei suostu poistumaan

tarkistetaan tämä vielä

Varmistu ensin, että piilotiedostot on näkyvillä.

Piilotiedostot näkyviin

Mene --> tänne

Kun sivu on latautunut, klikkaa Selaa-nappulaa ja etsi seuraava tiedosto ja paina Submit.

C:\4063235.bat

Lähetä skannin tulokset seuraavassa viestissäsi.

Jos Jotti on ruuhkainen, yritä samaa Virustotalissa: http://www.virustotal.com/flash/index_en.html

 

Tuo VirusTotal löysi jotain, mut toi jotti ei mitään...

Tässä tulokset:

Antivirus Version Last Update Result
AhnLab-V3 2008.2.3.10 2008.02.02 -
AntiVir 7.6.0.61 2008.02.01 -
Authentium 4.93.8 2008.02.01 -
Avast 4.7.1098.0 2008.02.02 -
AVG 7.5.0.516 2008.02.02 -
BitDefender 7.2 2008.02.03 -
CAT-QuickHeal 9.00 2008.02.01 -
ClamAV 0.92 2008.02.03 -
DrWeb 4.44.0.09170 2008.02.03 -
eSafe 7.0.15.0 2008.01.28 -
eTrust-Vet 31.3.5504 2008.02.01 -
Ewido 4.0 2008.02.02 -
FileAdvisor 1 2008.02.03 -
Fortinet 3.14.0.0 2008.02.02 -
F-Prot 4.4.2.54 2008.02.02 -
F-Secure 6.70.13260.0 2008.02.01 -
Ikarus T3.1.1.20 2008.02.03 -
Kaspersky 7.0.0.125 2008.02.03 -
McAfee 5221 2008.02.01 -
Microsoft 1.3204 2008.02.03 -
NOD32v2 2845 2008.02.02 -
Norman 5.80.02 2008.02.01 -
Panda 9.0.0.4 2008.02.02 -
Prevx1 V2 2008.02.03 Heuristic: Suspicious File With Bad Child Associations
Rising 20.29.22.00 2008.01.30 -
Sophos 4.26.0 2008.02.03 -
Sunbelt 2.2.907.0 2008.02.02 -
Symantec 10 2008.02.03 -
TheHacker 6.2.9.206 2008.02.02 -
VBA32 3.12.6.0 2008.02.02 -
VirusBuster 4.3.26:9 2008.02.02 -
Webwasher-Gateway 6.6.2 2008.02.03 -


Scanner results
Scan taken on 03 Feb 2008 08:19:01 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

 

jep,seoli vain prevx mikä löysi tiedosto on ok

Lataa Killbox Option^Explicitiltä.

Huomaa: Jos sinulla on jo Killbox, tämä on uusi versio joka sinun tulee asentaa. Poista aikaisempi.

Tallenna työpöydällesi.
Tupla-klikkaa Killbox.exe ajaaksesi ohjelman.
Valitse:Delete on Reboot
Sitten klikkaa All Files valintaa.
Kopioi ja liitä alapuolella olevat tiedostopolut leikepöydälle mustaamalla KAIKKI ne ja painamalla CTRL + C (tai, mustaamisen jälkeen, oikea klikki hiirellä ja valitse kopioi):

C:\WINDOWS\system32\hyvjzud.exe

Palaa Killboxiin, mene File valikkoon, ja valitse Paste from Clipboard.

Klikkaa puna-valkoista Delete File valintaa.
Klikkaa Yes "Delete on Reboot" pyyntöön.
Klikkaa OK mihin vain PendingFileRenameOperations pyyntöön (ja anna fixaajan tietää jos jokin tälläinen tulee!).
Käynnistä koneesi itse jos se ei sitä automaattisesti tee.

Jos saat tälläisen viestin: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." Kun yrität ajaa KillBoxia, klikkaa tätä ladataksesi ja ajaaksesi Missingfilessetup.exe;n. Sitten koita KillBoxia uudestaan.

 

No ajoin nyt ton killboxin ja siinä tuli tämmönen ilmoitus:

http://img148.imageshack.us/img148/2622/killboxgb4.jpg

Mistäs mä nyt sit tiän et onko toi hyvjzudi vieläki jammailees koneen syövereis?

 

kyll on sitkee

kokeillaan vikasietotilassa


Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

Tallenna nimellä CFScript (itse asiassa combofix tunnistaa tuon vaikka tiedostopääte ei olisi
edes .txt).

Käynnistä kone vikasietotilaan !!!!!

Sitten raahaa CFScript ComboFix.exeen kuten alla.



Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö + C:\!KillBox\Logs - loki tänne.

 

Toimittu ohjeiden mukaan. Eli meinaakos tää et se on nyt poissa?

ComboFix

ComboFix 08-02.02.5 - Juhis 2008-02-03 14:09:41.5 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.589 [GMT 2:00]
Running from: C:\Documents and Settings\Juhis\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Juhis\Työpöytä\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\system32\hyvjzud.exe
.
The following files were disabled during the run:
C:\WINDOWS\system32\guard32.dll


(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\hyvjzud.exe

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-03 to 2008-02-03 )))))))))))))))))
.

2008-02-02 12:11 . 2008-02-02 12:13 <KANSIO> d-------- C:\NoLopBackups
2008-02-01 20:25 . 2008-02-01 20:25 268 --ah----- C:\sqmdata06.sqm
2008-01-31 17:40 . 2008-01-31 17:40 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Installations
2008-01-28 22:43 . 2008-01-28 22:44 <KANSIO> d-------- C:\WINDOWS\system32\NtmsData
2008-01-28 21:24 . 2008-02-02 19:47 2,632 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-16 17:05 . 2008-01-26 13:06 <KANSIO> d-------- C:\Java
2008-01-16 16:54 . 2008-01-16 16:54 <KANSIO> d-------- C:\Program Files\Sun
2008-01-15 22:30 . 2008-01-16 16:09 <KANSIO> d-------- C:\Program Files\Notepad++
2008-01-15 22:30 . 2008-01-15 22:31 <KANSIO> d-------- C:\Documents and Settings\Juhis\Application Data\Notepad++
2008-01-10 19:20 . 2008-01-16 16:40 <KANSIO> d-------- C:\Documents and Settings\Juhis\.SunDownloadManager
2008-01-08 17:32 . 2008-01-08 17:32 <KANSIO> d-------- C:\Program Files\SanDisk
2008-01-08 17:32 . 2008-01-08 17:32 <KANSIO> d-------- C:\Documents and Settings\Juhis\Application Data\InstallShield

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 21:05 --------- d-----w C:\Documents and Settings\Juhis\Application Data\uTorrent
2008-02-02 09:54 2,883,584 ---ha-w C:\Documents and Settings\Äitee ja isä\NTUSER.DAT
2008-02-02 09:54 2,883,584 ---ha-w C:\Documents and Settings\Äitee ja isä\NTUSER.DAT
2008-01-28 16:19 139,008 ----a-w C:\WINDOWS\system32\guard32.dll.vir
2008-01-27 21:07 81,272 ----a-w C:\WINDOWS\system32\drivers\cmdGuard.sys
2008-01-27 21:07 23,672 ----a-w C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-01-20 17:54 --------- d-----w C:\Program Files\DC++
2008-01-17 15:37 --------- d-----w C:\Documents and Settings\Juhis\Application Data\AdobeUM
2008-01-16 14:52 --------- d-----w C:\Program Files\Java
2008-01-08 15:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-05 21:59 --------- d-----w C:\Documents and Settings\Juhis\Application Data\MSN6
2008-01-04 16:12 --------- d-----w C:\Program Files\Last.fm
2007-12-24 20:03 --------- d-----w C:\Program Files\Audible
2007-12-24 08:38 --------- d-----w C:\Program Files\QuickTime
2007-12-24 08:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-22 20:42 --------- d-----w C:\Program Files\Easy Video Downloader
2007-12-18 19:32 --------- d-----w C:\Program Files\MSN Messenger
2007-12-18 19:32 --------- d-----w C:\Program Files\Messenger Plus! Live
2007-12-17 16:56 --------- d-----w C:\Program Files\WAV to MP3 Encoder
2007-12-07 11:35 --------- d-----w C:\Program Files\Common Files\Apple
2007-12-07 11:18 --------- d-----w C:\Program Files\Apple Software Update
2007-12-07 11:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-24 14:21 14,336 ----a-w C:\WINDOWS\system32\svchost.exe
2007-11-23 13:33 286,208 ----a-w C:\WINDOWS\system32\xdaeunwut.exe
2007-11-21 13:32 302,080 ----a-w C:\WINDOWS\system32\hzvoii.exe
2007-11-19 13:31 290,304 ----a-w C:\WINDOWS\system32\nsdkebnz.exe
2007-11-15 12:33 299,008 ----a-w C:\WINDOWS\system32\opejvqs.exe
2007-11-13 11:31 286,720 ----a-w C:\WINDOWS\system32\soplvokrl.exe
2007-11-12 14:18 86 ----a-w C:\4063235.bat
2007-11-08 19:19 297,472 ----a-w C:\WINDOWS\system32\wrhegd.exe
2007-11-07 09:28 722,432 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-11-06 19:20 273,920 ----a-w C:\WINDOWS\system32\vfwzejr.exe
2007-11-04 18:56 286,208 ----a-w C:\WINDOWS\system32\fkzqbfdeqw.exe
2005-08-13 18:12 172,252 -c--a-w C:\Program Files\nudge.wav
2005-05-11 20:36 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
2004-01-03 22:07 42 -c--a-w C:\Program Files\Common Files\uninst.bat
2004-01-03 21:50 2,494 -c--a-w C:\Program Files\Common Files\uninst.htm
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 01:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wizard"="" []
"EM_EXEC"="C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [ ]
"NWEReboot"="" []
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-15 01:12 110592 C:\WINDOWS\system32\bthprops.cpl]
"NAV_Update"="" []
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2006-03-18 04:24 184320]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-01-27 23:07 1481472]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-12-11 10:56 286720]
"SansaDispatch"="C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe" [2007-10-22 12:52 75584]
"WinampAgent"="C:\Winamp\winampa.exe" [2007-12-20 17:16 37376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 01:12 15360]

C:\Documents and Settings\Žitee ja is„\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-10-06 11:22:49 106496]

C:\Documents and Settings\Juhis\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-10-06 11:22:49 106496]

C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart17.exe [2006-03-05 04:43:54 11000]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 22:23:26 282624]
HP Image Zone -pikak„ynnistys.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-11 23:49:24 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-09-15 01:12 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 2004-08-20 15:51 118784 C:\WINDOWS\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2005-05-11 22:12 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 2004-08-20 15:55 155648 C:\WINDOWS\System32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2004-06-16 06:03 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-06-16 06:03 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-09-17 01:07 8491008 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-12-11 10:56 286720 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2004-04-28 17:19 66048 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 22:41]
R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 22:41]
R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys [2003-07-25 14:02]
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys [2004-04-08 10:04]
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys [2003-08-20 09:44]
S1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-01-27 23:07]
S1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-01-27 23:07]
S2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys [2006-07-27 10:00]
S3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [2003-04-18 13:45]
S3 Devx;Devx;C:\WINDOWS\system32\drivers\Devx.sys [2001-09-06 14:21]
S3 MayPro;TigerGame SuperJoy Box Pro Filter Service;C:\WINDOWS\system32\Drivers\MayPro.sys [2005-09-12 22:04]
S3 VtPr;VtPr;C:\WINDOWS\system32\drivers\VtPr.sys [2001-10-10 16:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ee8897c-7f4e-11d9-a73a-806d6172696f}]
\Shell\AutoRun\command - K:\setup.exe
\Shell\directx\command - K:\DirectX\dxsetup.exe
\Shell\setup\command - K:\setup.exe

.
'Ajoitetut tehtävät'-kansion sisältö
"2007-12-24 08:24:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-03 14:14:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\WINDOWS\system32\guard32.dll
.
Completion time: 2008-02-03 14:16:07
ComboFix-quarantined-files.txt 2008-02-03 12:15:34
ComboFix2.txt 2008-02-02 17:42:27
ComboFix3.txt 2008-02-02 17:28:28
ComboFix4.txt 2008-02-02 13:01:05
ComboFix5.txt 2008-02-02 10:03:13
.
2008-02-02 21:06:46 --- E O F ---

KillBox

Pocket Killbox version 2.0.0.648
Running on Windows XP as Juhis(Administrator)
was started @ sunnuntai, helmikuu 03, 2008, 11:57 AM

# 1 [Delete on Reboot]
Path = C:\WINDOWS\system32\hyvjzud.exe


PendingFileRenameOperations Registry Data has been Removed by External Process! @ 12:00:04 PM
Killbox Closed(Exit) @ 12:01:01 PM
__________________________________________________

 

jep tuo lähti ja tuli 10 tilalle
siellä ilmeisesti joku rootkitin tapanen örkki


Varmistu ensin, että piilotiedostot on näkyvillä.

Piilotiedostot näkyviin

Mene --> tänne

Kun sivu on latautunut, klikkaa Selaa-nappulaa ja etsi seuraava tiedosto ja paina Submit.

C:\Program Files\nudge.wav

Lähetä skannin tulokset seuraavassa viestissäsi.

Jos Jotti on ruuhkainen, yritä samaa Virustotalissa: http://www.virustotal.com/flash/index_en.html

Lataa Atribunen ATF Cleaner

Ohjeet;

Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.
Main:n alla valitse: Select All
Klikkaa Empty Selected valintaa.

Jos käytät FireFoxia selaimenasiKlikkaa Firefox yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.

Jos käytät Operaa selaimenasi
Klikkaa Opera yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa taas.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)




Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

Tallenna nimellä CFScript (itse asiassa combofix tunnistaa tuon vaikka tiedostopääte ei olisi
edes .txt).

Sitten raahaa CFScript ComboFix.exeen kuten alla.



Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.


* Lataa Dr.Web Cureit työpöydällesi: Dr.Web

*Tupla klikkaa drweb-cureit.exe ja anna ohjelman tehdä *muistin- /koneen pikatarkistus.
(tämä on vain lyhyt tarkistus)
*Kun tarkistus on valmis, pistä ruksi kohtaan *Complete scan*.
*Klikkaa vihreää nuolta Dr.Web:in logon alta ,jotta tarkistus käynnistyy.
*Kun tarkistus on loppu. Paina *select all*-nappia. Sen jälkeen paina *move*-nappia.
*Kohteet siirtyvät karanteeniin seuraavaan %userprofile%\DoctorWeb\quarantine-hakemistoon.
*Avaa Dr.Webin työkalurivistä *file* ja paina *Save report list*
*Tallenna raportti työpöydälle.Tallenna se nimellä *DrWeb*.
*Sulje Dr.web.
*Käynnistä kone uudelleen !!Jotta valitut tiedostot poistetaan/siirretään käynnistyksen yhteydessä, karanteeniin.
*Kun olet uudelleen käynnistänyt tietokoneesesi, liitä Dr.Web-lokin, sisältö seuraavaan vastaukseesi.



Lataa ja tallenna Blacklight työpöydällesi;

Tupla-klikkaa blbeta.exe, hyväksy sopimus, klikkaa > Scan, sitten > Next

Näet listan kaikesta mitä löytyi. Työpöydällesi myös ilmestyy loki jonka nimi on fsbl.xxxxxxx.log (xxxxxxx;n tilalla on luultavimmin numeroita).

Kopioi ja liitä tämä loki seuraavaan vastaukseesi. Älä valitse "Rename" optiota vielä! Haluamme nähdä login ensin, koska hyviä tiedostoja saattaa olla mukana, kuten "wbemtest.exe".

Lähetä combon loki ja virustotalin tulos + DrWeb-loki ja Blacklight-loki

 

No voi s*atana Pistän tähän väliin sellasta infoa että tota Dr.Webbiä ja BlackLightia ei löydy dr.webbiä ei ollenkaa, tulee vaan sivun lataamisvirhe. Johtuukohan tää siitä ku just ku painoin siitä, niin alg.exe -niminen prosessi (windowsin omia, muka) yritti internet-yhteyttä... Noo blokkasin sen, koska just kattelin jollain foorumilla et ton ei pitäs yrittää internet-yhteyttä. Toi BlackLight menee kyllä f-securen sivuille mutta sitte tulee error 404 ku sen yrittää hyväksyä

E: Jaahas ja nyt ajoin ton atf cleanerin niin mozillan ulkoasu meni aika oudoksi onneks tästä näkee sentään lukea vielä

E2: Nyt ajoin combofixin, se näyttäs ainaki poistaneen noi, mut firefox näyttää edelleen kummalta, ainaki täälä afterdawnis Jotti ei löytäny mitää tälläkään kertaa.

Logi:

ComboFix 08-02.02.5 - Juhis 2008-02-03 16:44:17.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.385 [GMT 2:00]
Running from: C:\Documents and Settings\Juhis\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Juhis\Työpöytä\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\system32\fkzqbfdeqw.exe
C:\WINDOWS\system32\guard32.dll.vir
C:\WINDOWS\system32\hzvoii.exe
C:\WINDOWS\system32\nsdkebnz.exe
C:\WINDOWS\system32\opejvqs.exe
C:\WINDOWS\system32\soplvokrl.exe
C:\WINDOWS\system32\vfwzejr.exe
C:\WINDOWS\system32\wrhegd.exe
C:\WINDOWS\system32\xdaeunwut.exe
.
The following files were disabled during the run:
C:\WINDOWS\system32\guard32.dll


(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\fkzqbfdeqw.exe
C:\WINDOWS\system32\guard32.dll.vir
C:\WINDOWS\system32\hzvoii.exe
C:\WINDOWS\system32\nsdkebnz.exe
C:\WINDOWS\system32\opejvqs.exe
C:\WINDOWS\system32\soplvokrl.exe
C:\WINDOWS\system32\vfwzejr.exe
C:\WINDOWS\system32\wrhegd.exe
C:\WINDOWS\system32\xdaeunwut.exe

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-03 to 2008-02-03 )))))))))))))))))
.

2008-02-02 12:11 . 2008-02-02 12:13 <KANSIO> d-------- C:\NoLopBackups
2008-02-01 20:25 . 2008-02-01 20:25 268 --ah----- C:\sqmdata06.sqm
2008-01-31 17:40 . 2008-01-31 17:40 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Installations
2008-01-28 22:43 . 2008-01-28 22:44 <KANSIO> d-------- C:\WINDOWS\system32\NtmsData
2008-01-28 21:24 . 2008-02-02 19:47 2,632 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-16 17:05 . 2008-01-26 13:06 <KANSIO> d-------- C:\Java
2008-01-16 16:54 . 2008-01-16 16:54 <KANSIO> d-------- C:\Program Files\Sun
2008-01-15 22:30 . 2008-01-16 16:09 <KANSIO> d-------- C:\Program Files\Notepad++
2008-01-15 22:30 . 2008-01-15 22:31 <KANSIO> d-------- C:\Documents and Settings\Juhis\Application Data\Notepad++
2008-01-10 19:20 . 2008-01-16 16:40 <KANSIO> d-------- C:\Documents and Settings\Juhis\.SunDownloadManager
2008-01-08 17:32 . 2008-01-08 17:32 <KANSIO> d-------- C:\Program Files\SanDisk
2008-01-08 17:32 . 2008-01-08 17:32 <KANSIO> d-------- C:\Documents and Settings\Juhis\Application Data\InstallShield

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 21:05 --------- d-----w C:\Documents and Settings\Juhis\Application Data\uTorrent
2008-02-02 09:54 2,883,584 ---ha-w C:\Documents and Settings\Äitee ja isä\NTUSER.DAT
2008-02-02 09:54 2,883,584 ---ha-w C:\Documents and Settings\Äitee ja isä\NTUSER.DAT
2008-01-27 21:07 81,272 ----a-w C:\WINDOWS\system32\drivers\cmdGuard.sys
2008-01-27 21:07 23,672 ----a-w C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-01-20 17:54 --------- d-----w C:\Program Files\DC++
2008-01-17 15:37 --------- d-----w C:\Documents and Settings\Juhis\Application Data\AdobeUM
2008-01-16 14:52 --------- d-----w C:\Program Files\Java
2008-01-08 15:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-05 21:59 --------- d-----w C:\Documents and Settings\Juhis\Application Data\MSN6
2008-01-04 16:12 --------- d-----w C:\Program Files\Last.fm
2007-12-24 20:03 --------- d-----w C:\Program Files\Audible
2007-12-24 08:38 --------- d-----w C:\Program Files\QuickTime
2007-12-24 08:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-22 20:42 --------- d-----w C:\Program Files\Easy Video Downloader
2007-12-18 19:32 --------- d-----w C:\Program Files\MSN Messenger
2007-12-18 19:32 --------- d-----w C:\Program Files\Messenger Plus! Live
2007-12-17 16:56 --------- d-----w C:\Program Files\WAV to MP3 Encoder
2007-12-07 11:35 --------- d-----w C:\Program Files\Common Files\Apple
2007-12-07 11:18 --------- d-----w C:\Program Files\Apple Software Update
2007-12-07 11:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-12 14:18 86 ----a-w C:\4063235.bat
2005-08-13 18:12 172,252 -c--a-w C:\Program Files\nudge.wav
2005-05-11 20:36 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
2004-01-03 22:07 42 -c--a-w C:\Program Files\Common Files\uninst.bat
2004-01-03 21:50 2,494 -c--a-w C:\Program Files\Common Files\uninst.htm
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 01:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wizard"="" []
"EM_EXEC"="C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [ ]
"NWEReboot"="" []
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-15 01:12 110592 C:\WINDOWS\system32\bthprops.cpl]
"NAV_Update"="" []
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2006-03-18 04:24 184320]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-01-27 23:07 1481472]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-12-11 10:56 286720]
"SansaDispatch"="C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe" [2007-10-22 12:52 75584]
"WinampAgent"="C:\Winamp\winampa.exe" [2007-12-20 17:16 37376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 01:12 15360]

C:\Documents and Settings\Žitee ja is„\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-10-06 11:22:49 106496]

C:\Documents and Settings\Juhis\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-10-06 11:22:49 106496]

C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart17.exe [2006-03-05 04:43:54 11000]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 22:23:26 282624]
HP Image Zone -pikak„ynnistys.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-11 23:49:24 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-09-15 01:12 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 2004-08-20 15:51 118784 C:\WINDOWS\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2005-05-11 22:12 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 2004-08-20 15:55 155648 C:\WINDOWS\System32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2004-06-16 06:03 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-06-16 06:03 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-09-17 01:07 8491008 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-12-11 10:56 286720 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2004-04-28 17:19 66048 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 22:41]
R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 22:41]
R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys [2003-07-25 14:02]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-01-27 23:07]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-01-27 23:07]
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys [2004-04-08 10:04]
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys [2003-08-20 09:44]
R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys [2006-07-27 10:00]
R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [2003-04-18 13:45]
S3 Devx;Devx;C:\WINDOWS\system32\drivers\Devx.sys [2001-09-06 14:21]
S3 MayPro;TigerGame SuperJoy Box Pro Filter Service;C:\WINDOWS\system32\Drivers\MayPro.sys [2005-09-12 22:04]
S3 VtPr;VtPr;C:\WINDOWS\system32\drivers\VtPr.sys [2001-10-10 16:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ee8897c-7f4e-11d9-a73a-806d6172696f}]
\Shell\AutoRun\command - K:\setup.exe
\Shell\directx\command - K:\DirectX\dxsetup.exe
\Shell\setup\command - K:\setup.exe

.
'Ajoitetut tehtävät'-kansion sisältö
"2007-12-24 08:24:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-03 16:48:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\WINDOWS\system32\guard32.dll
.
Completion time: 2008-02-03 16:50:31
ComboFix-quarantined-files.txt 2008-02-03 14:50:07
ComboFix2.txt 2008-02-03 12:16:08
ComboFix3.txt 2008-02-02 17:42:27
ComboFix4.txt 2008-02-02 17:28:28
ComboFix5.txt 2008-02-02 13:01:05
.
2008-02-02 21:06:46 --- E O F ---

Jotti-logi

Scan taken on 03 Feb 2008 14:24:24 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

 

moi
voi olla että tuo örkki on muokannu sun hosts tiedosto,siksi et pääse lataa drweb

Lataa http://www.funkytoad.com/download/HostsXpert.zip
*Pura HostsXpert sopivaan kansioon, kuten C:\Hoster
*Aja HostsXpert.exe sen uudesta kansiosta
*Klikkaa "Make Hosts Writable?" oikeassa yläkulmassa (jos toiminnassa)
*Klikkaa "Restore Microsoft's Hosts File" ja sitten OK
*Sulje ohjelma.
Huomaa: JOS käytit mukautettuja Hosts-filuja, sinun täytyy laittaa yksikin niistä riveistä itse takaisin.

pääsetkö tämän jälkeen lataa drweb??
tuo firefoxin pitäis mennä kuntoon seuraavan käynnistyksen jälkeen