TurvaPc.com ongelma. Selain ei toimi ja kone hidastunut. HjT-logi

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by vihu, Jun 21, 2008.

  1. vihu

    vihu Member

    Joined:
    May 1, 2007
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    Otsikon mukainen ongelma. Kone siis hidastunut ja selain (firefox) ei suostu toimimaan normaalisti. Konetta olen koittanut puhdistaa jo useillakin ohjelmilla mutta sitkeässä tuntuu pöpö olevan. Mikä siis avuksi.
    Kiitoksia jo etukäteen auttajille.


    HjT-Logi:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:18:03, on 21.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\WindowBlinds\wbload.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Autodesk\Data Management Server 5\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\Rundll32.exe
    D:\program files\steam\steam.exe
    C:\Program Files\CursorXP\CursorXP.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    C:\Program Files\Autodesk\Data Management Server 5\Server\Webserver\Connectivity.EDMWS.Server.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\FSPC\fspc.exe
    C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\FSAUA\program\fsus.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\WgaTray.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
    O2 - BHO: {d4867f76-1cb8-dc7a-2b04-70cd14a617d6} - {6d716a41-dc07-40b2-a7cd-8bc167f7684d} - C:\WINDOWS\system32\gpxpycpq.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
    O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [tvjbmonitor] C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [BMfb6f8009] Rundll32.exe "C:\WINDOWS\system32\fwnmdomf.dll",s
    O4 - HKCU\..\Run: [Steam] "d:\program files\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
    O4 - Global Startup: Logitech SetPoint.lnk = ?
    O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
    O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure\FSPC\fspcmsie.dll
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
    O20 - Winlogon Notify: rqRJBTmM - rqRJBTmM.dll (file missing)
    O20 - Winlogon Notify: ssqPjghE - ssqPjghE.dll (file missing)
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Autodesk Data Management Job Dispatch - Autodesk Inc - C:\Program Files\Autodesk\Data Management Server 5\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
    O23 - Service: Autodesk EDM Server - - C:\Program Files\Autodesk\Data Management Server 5\Server\Webserver\Connectivity.EDMWS.Server.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    --
    End of file - 10117 bytes
     
    vihu, Jun 21, 2008
    #1
  2. Hujo

    Hujo Guest

    koneella kaksi vurustorjuntaa poista toinen

    avast ja f-secure

    ==========

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    =============

    Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

    Tallenna se nimellä CFScript.txt

    Sitten raahaa CFScript ComboFix.exeen kuten alla.
    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

    =======

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: {d4867f76-1cb8-dc7a-2b04-70cd14a617d6} - {6d716a41-dc07-40b2-a7cd-8bc167f7684d} - C:\WINDOWS\system32\gpxpycpq.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [BMfb6f8009] Rundll32.exe "C:\WINDOWS\system32\fwnmdomf.dll",s
    O20 - Winlogon Notify: rqRJBTmM - rqRJBTmM.dll (file missing)
    O20 - Winlogon Notify: ssqPjghE - ssqPjghE.dll (file missing)

    =========

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.


     
    Hujo, Jun 21, 2008
    #2
  3. vihu

    vihu Member

    Joined:
    May 1, 2007
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    Miltähän mahtaa nyt näyttää nuo logit.

    ComboFix logi:

    ComboFix 08-06-20.4 - Vihulainen 2008-06-21 17:06:46.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.436 [GMT 3:00]
    Running from: C:\Documents and Settings\Vihulainen\Desktop\virus\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Vihulainen\Desktop\virus\CFScript.txt
    * Created a new restore point
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\BMfb6f8009.xml
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\system32\ajyvbcxr.ini
    C:\WINDOWS\system32\egwsborl.dll
    C:\WINDOWS\system32\GNXIOqss.ini
    C:\WINDOWS\system32\gpxpycpq.dll
    C:\WINDOWS\system32\mogqmsng.ini
    C:\WINDOWS\system32\nxlptgih.dll
    C:\WINDOWS\system32\oytqmtbh.dll
    C:\WINDOWS\system32\rfutfuhf.dll
    C:\WINDOWS\system32\ssqOIXNG.dll
    C:\WINDOWS\system32\uluubglg.ini

    .
    ((((((((((((((((((((((((( Files Created from 2008-05-21 to 2008-06-21 )))))))))))))))))))))))))))))))
    .

    2008-06-21 17:22 . 2008-06-21 17:22 110,419 --a------ C:\WINDOWS\BMfb6f8009.xml
    2008-06-21 14:17 . 2008-06-21 14:17 <DIR> d-------- C:\Program Files\Trend Micro
    2008-06-20 16:56 . 2008-06-20 16:56 79,360 --a------ C:\WINDOWS\system32\glgbuulu.dll
    2008-06-20 16:53 . 2008-06-20 16:53 90,112 --a------ C:\WINDOWS\system32\fwnmdomf.dll
    2008-06-19 21:35 . 2008-06-19 21:35 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-06-19 21:35 . 2008-06-19 21:35 <DIR> d-------- C:\Documents and Settings\Vihulainen\Application Data\Malwarebytes
    2008-06-19 21:35 . 2008-06-19 21:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-19 21:35 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-06-19 21:35 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-06-19 21:34 . 2008-06-19 21:35 <DIR> d-------- C:\Program Files\CCleaner
    2008-06-19 21:33 . 2008-06-19 21:33 <DIR> d-------- C:\Program Files\Alwil Software
    2008-06-19 21:33 . 2003-03-18 23:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
    2008-06-19 19:55 . 2008-06-19 19:55 <DIR> d-------- C:\Program Files\Opera
    2008-06-15 14:58 . 2008-06-15 14:58 <DIR> d-------- C:\Program Files\Lavasoft
    2008-06-15 14:58 . 2008-06-15 15:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-06-15 14:57 . 2008-06-15 14:57 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-06-15 14:45 . 2008-06-19 16:55 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2008-06-15 14:45 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
    2008-06-15 14:45 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
    2008-06-15 14:45 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
    2008-06-15 14:45 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
    2008-06-15 14:44 . 2008-06-15 14:54 <DIR> d-------- C:\Program Files\Spyware Doctor
    2008-06-15 14:44 . 2008-06-15 14:44 <DIR> d-------- C:\Documents and Settings\Vihulainen\Application Data\PC Tools
    2008-06-14 11:27 . 2008-06-14 11:27 6,144 --a------ C:\sixomsn.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-19 16:58 --------- d-----w C:\Documents and Settings\Vihulainen\Application Data\uTorrent
    2008-06-19 16:57 --------- d-----w C:\Program Files\mIRC
    2008-06-15 09:10 --------- d-----w C:\Program Files\Dofus
    2008-06-04 18:00 --------- d-----w C:\Documents and Settings\Vihulainen\Application Data\dvdcss
    2008-05-16 22:45 --------- d-----w C:\Program Files\FlashFXP
    2008-05-16 08:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
    2008-05-12 18:05 --------- d-----w C:\Documents and Settings\Vihulainen\Application Data\OpenOffice.org2
    2008-05-12 09:04 1,901 ----a-w C:\WINDOWS\panose.bin
    2008-05-10 15:07 --------- d-----w C:\Program Files\SpeedFan
    2008-05-09 19:57 --------- d-----w C:\Program Files\Virtual Earth 3D
    2008-05-09 19:42 --------- d-----w C:\Program Files\Photosynth
    2008-05-09 19:30 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-04-29 08:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
    2008-04-29 08:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
    2008-04-29 08:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
    2008-04-12 09:37 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
    2008-04-12 09:37 110,592 ----a-w C:\WINDOWS\system32\OpenAL32.dll
    2008-03-26 08:09 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-25 07:20 219,936 ----a-w C:\WINDOWS\system32\msltus40.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Steam"="d:\program files\steam\steam.exe" [2008-03-29 16:45 1271032]
    "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 17:44 140288]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 13:03 94208 C:\WINDOWS\KHALMNPR.Exe]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 13:03 94208 C:\WINDOWS\KHALMNPR.Exe]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 12:12 90112]
    "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 17:28 790528]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
    "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.EXE" [2006-12-25 12:16 172081]
    "F-Secure TNB"="C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" [2006-12-25 12:16 724992]
    "LogonStudio"="C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [2002-09-03 19:38 987187]
    "BootSkin Startup Jobs"="C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" [2004-04-26 17:21 270336]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 11:54 282624]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 20:05 257088]
    "tvjbmonitor"="C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe" [2006-12-26 17:08 53248]
    "BMfb6f8009"="C:\WINDOWS\system32\fwnmdomf.dll" [2008-06-20 16:53 90112]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:56 15360]

    C:\Documents and Settings\Vihulainen\Start Menu\Programs\Startup\
    Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
    AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart17.exe [2006-03-23 22:16:32 11000]
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2006-11-11 23:53:17 671744]
    Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 23:07:32 81920]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
    "UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqRJBTmM]
    rqRJBTmM.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqPjghE]
    ssqPjghE.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
    C:\PROGRA~1\WI559D~1\fastload.dll 2001-12-20 23:34 24576 C:\PROGRA~1\WI559D~1\fastload.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=wbsys.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\ff_vfw.dll
    "vidc.wmv3"= C:\PROGRA~1\COMBIN~1\Filters\wmv9vcm.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    "FirewallOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\uTorrent\\utorrent.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\MSN Messenger\\livecall.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
    "C:\\Program Files\\FlashGet\\flashget.exe"=

    R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2006-12-25 12:16]
    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure\HIPS\fshs.sys [2006-12-25 12:17]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-09-01 13:32]
    R2 MSSQL$AUTODESKVAULT;MSSQL$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe" -sAUTODESKVAULT []
    R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\minifilter\fsgk.sys [2006-12-25 12:16]
    S3 MODRC;Ultima Infrared Receiver;C:\WINDOWS\system32\DRIVERS\modrc.sys [2007-02-06 12:10]
    S3 SQLAgent$AUTODESKVAULT;SQLAgent$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlagent.EXE" -i AUTODESKVAULT []
    S3 ZD1211U(3COM Corporation);3COM OfficeConnect Wireless 11g Compact USB Adapter(3COM Corporation);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2005-03-28 14:24]
    S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2006-12-25 12:16]
    S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2006-12-25 12:16]

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-06-03 08:29:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-21 17:21:56
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\explorer.exe
    -> C:\WINDOWS\system32\fwnmdomf.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\WINDOWS\system32\ati2evxx.exe
    C:\WINDOWS\system32\ati2evxx.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\WindowBlinds\wbload.exe
    C:\Program Files\Autodesk\Data Management Server 5\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
    C:\Program Files\Autodesk\Data Management Server 5\Server\Webserver\Connectivity.EDMWS.Server.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32.exe
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\FSPC\fspc.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
    C:\PROGRA~1\F-Secure\Common\FSM32.EXE
    C:\Program Files\F-Secure\FWES\program\fsdfwd.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\WgaTray.exe
    C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.exe
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    .
    **************************************************************************
    .
    Completion time: 2008-06-21 17:28:20 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-06-21 14:28:08

    Pre-Run: 4,848,656,384 bytes free
    Post-Run: 5,233,786,880 bytes free

    205 --- E O F --- 2008-05-22 07:56:00



    Malwarebytes logi:

    Malwarebytes' Anti-Malware 1.17
    Database version: 869

    5:47:22 22.6.2008
    mbam-log-6-22-2008 (05-47-22).txt

    Scan type: Full Scan (C:\|D:\|G:\|)
    Objects scanned: 179334
    Time elapsed: 1 hour(s), 1 minute(s), 38 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
    vihu, Jun 22, 2008
    #3
  4. Hujo

    Hujo Guest

    Hujo, Jun 22, 2008
    #4
  5. vihu

    vihu Member

    Joined:
    May 1, 2007
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    Ala boksiin kyllä tuli yksi rivi mutta en sitä saanut kopioitua millään. ohjelma kun sammuttaa itsensä ennen kuin sille pystyy mitään tekemään.
    Tuossa nyt kuitenkin tuo logi




    Sun Jun 22 14:54:38 2008 => **********************************************************
    Sun Jun 22 14:54:38 2008 => eScan AntiVirus Toolkit Utility.
    Sun Jun 22 14:54:38 2008 => Copyright © 2003-2004, MicroWorld Technologies Inc.
    Sun Jun 22 14:54:38 2008 =>
    Sun Jun 22 14:54:38 2008 => Support: support@mwti.net
    Sun Jun 22 14:54:38 2008 => Web: http://www.mwti.net
    Sun Jun 22 14:54:38 2008 => **********************************************************
    Sun Jun 22 14:54:38 2008 => Version 4.4.7
    Sun Jun 22 14:54:38 2008 => Log File: C:\KASPER~1\mwav.log
    Sun Jun 22 14:54:38 2008 => Latest Date of files inside MWAV: 22 Jun 2008 09:22:08.

    Sun Jun 22 14:54:38 2008 => Options Selected by User:
    Sun Jun 22 14:54:38 2008 => Memory Check: Enabled
    Sun Jun 22 14:54:38 2008 => Registry Check: Enabled
    Sun Jun 22 14:54:38 2008 => StartUp Folder Check: Enabled
    Sun Jun 22 14:54:38 2008 => System Folder Check: Enabled
    Sun Jun 22 14:54:38 2008 => System Area Check: Disabled
    Sun Jun 22 14:54:38 2008 => Services Check: Enabled
    Sun Jun 22 14:54:38 2008 => Drive Check: Disabled
    Sun Jun 22 14:54:38 2008 => All Drive Check :Enabled
    Sun Jun 22 14:54:38 2008 => Scanning Type: Scan And Clean
    Sun Jun 22 14:54:38 2008 => Folder Check: Disabled

    Sun Jun 22 14:54:38 2008 => ***** Scanning Memory Files *****
    Sun Jun 22 14:54:38 2008 => Scanning File C:\WINDOWS\system32\services.exe
    Sun Jun 22 14:54:38 2008 => Scanning File C:\WINDOWS\system32\lsass.exe
    Sun Jun 22 14:54:38 2008 => Scanning File C:\WINDOWS\system32\Ati2evxx.exe
    Sun Jun 22 14:54:38 2008 => Scanning File C:\WINDOWS\system32\svchost.exe
    Sun Jun 22 14:54:38 2008 => Scanning File C:\WINDOWS\System32\svchost.exe
    Sun Jun 22 14:54:38 2008 => Scanning File C:\WINDOWS\system32\Ati2evxx.exe
    Sun Jun 22 14:54:38 2008 => Scanning File C:\PROGRA~1\Lavasoft\Ad-Aware\AAWSER~1.EXE
    Sun Jun 22 14:54:38 2008 => Scanning File C:\WINDOWS\system32\spoolsv.exe
    Sun Jun 22 14:54:38 2008 => Scanning File C:\PROGRA~1\Autodesk\DATAMA~1\Server\Dispatch\CONNEC~1.EXE
    Sun Jun 22 14:54:38 2008 => Scanning File C:\PROGRA~1\Autodesk\DATAMA~1\Server\WEBSER~1\CONNEC~1.EXE
    Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\ANTI-V~1\fsgk32st.exe
    Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\Common\FSMA32.EXE
    Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\ANTI-V~1\FSGK32.EXE
    Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\Common\FSMB32.EXE
    Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\MICROS~4\MSSQL$~1\Binn\sqlservr.exe
    Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\Common\FCH32.EXE
    Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\ANALOG~1\SoundMAX\SMAgent.exe
    Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\WI559D~1\wbload.exe
    Sun Jun 22 14:54:39 2008 => Scanning File C:\WINDOWS\system32\svchost.exe
    Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\ANTI-V~1\fsqh.exe
    Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\Common\FAMEH32.EXE
    Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\FSPC\fspc.exe
    Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\FSAUA\program\fsaua.exe
    Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\ANTI-V~1\fssm32.exe
    Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\FWES\Program\fsdfwd.exe
    Sun Jun 22 14:54:39 2008 => Scanning File C:\WINDOWS\system32\WgaTray.exe
    Sun Jun 22 14:54:39 2008 => Scanning File C:\WINDOWS\Explorer.EXE
    Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\ANALOG~1\SoundMAX\SMax4PNP.exe
    Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\F-Secure\Common\FSM32.EXE
    Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\ATITEC~1\ATI.ACE\CLI.EXE
    Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\iTunes\ITUNES~1.EXE
    Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\MMEDIA\TVJUKE~1.0\TVJBMO~1.EXE
    Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\CursorXP\CursorXP.exe
    Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\Logitech\SetPoint\SetPoint.exe
    Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\iPod\bin\IPODSE~1.EXE
    Sun Jun 22 14:54:40 2008 => Scanning File C:\WINDOWS\System32\svchost.exe
    Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\COMMON~1\Logitech\KHALSH~1\KHALMNPR.EXE
    Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\ATITEC~1\ATI.ACE\cli.exe
    Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\ATITEC~1\ATI.ACE\cli.exe
    Sun Jun 22 14:54:40 2008 => Scanning File C:\WINDOWS\system32\wuauclt.exe
    Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\F-Secure\ANTI-V~1\fsav32.exe
    Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\F-Secure\FSGUI\fsguidll.exe
    Sun Jun 22 14:54:40 2008 => Scanning File D:\PROGRA~1\Steam\steam.exe
    Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\Winamp\winamp.exe
    Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\MOZILL~1\firefox.exe
    Sun Jun 22 14:54:41 2008 => Scanning File C:\PROGRA~1\mIRC\mirc.exe
    Sun Jun 22 14:54:41 2008 => File C:\PROGRA~1\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.621. No Action Taken.

    Sun Jun 22 14:54:41 2008 => Scanning File C:\PROGRA~1\MSNMES~1\msnmsgr.exe
    Sun Jun 22 14:54:41 2008 => Scanning File C:\PROGRA~1\MSNMES~1\usnsvc.exe
    Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\system32\notepad.exe
    Sun Jun 22 14:54:41 2008 => Scanning File C:\Kaspersky\mwavscan.com
    Sun Jun 22 14:54:41 2008 => Scanning File C:\Kaspersky\kavss.exe

    Sun Jun 22 14:54:41 2008 => ***** Scanning Registry Files *****

    Sun Jun 22 14:54:41 2008 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
    Sun Jun 22 14:54:41 2008 => *** File C:\WINDOWS\system32\SHELL32.dll having Size Restriction ***
    Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\system32\SHELL32.dll [**]
    Sun Jun 22 14:54:41 2008 => *** File C:\WINDOWS\system32\SHELL32.dll having Size Restriction ***
    Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\system32\SHELL32.dll [**]
    Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\system32\webcheck.dll
    Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\system32\stobject.dll
    Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\system32\upnpui.dll

    Sun Jun 22 14:54:41 2008 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects
    Sun Jun 22 14:54:41 2008 => {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} = C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    Sun Jun 22 14:54:41 2008 => Scanning File C:\PROGRA~1\Java\JRE16~4.0_0\bin\ssv.dll
    Sun Jun 22 14:54:41 2008 => {F156768E-81EF-470C-9057-481BA8380DBA} = C:\Program Files\FlashGet\getflash.dll
    Sun Jun 22 14:54:41 2008 => Scanning File C:\PROGRA~1\FlashGet\getflash.dll

    Sun Jun 22 14:54:41 2008 => Scanning HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\Explorer.exe
    Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\system32\userinit.exe

    Sun Jun 22 14:54:41 2008 => Scanning HKCU\Control Panel\Desktop

    Sun Jun 22 14:54:41 2008 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\KHALMNPR.EXE
    Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\KHALMNPR.EXE
    Sun Jun 22 14:54:41 2008 => Scanning File C:\PROGRA~1\ATITEC~1\ATI.ACE\CLIStart.exe
    Sun Jun 22 14:54:41 2008 => Scanning File C:\PROGRA~1\ANALOG~1\SoundMAX\SMax4PNP.exe
    Sun Jun 22 14:54:42 2008 => Scanning File C:\PROGRA~1\F-Secure\Common\FSM32.EXE
    Sun Jun 22 14:54:42 2008 => Scanning File C:\PROGRA~1\F-Secure\FSGUI\TNBUtil.exe
    Sun Jun 22 14:54:42 2008 => Scanning File C:\PROGRA~1\WINCUS~1\LOGONS~1\LOGONS~1.EXE
    Sun Jun 22 14:54:42 2008 => Scanning File C:\PROGRA~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe
    Sun Jun 22 14:54:42 2008 => Scanning File C:\WINDOWS\system32\NeroCheck.exe
    Sun Jun 22 14:54:42 2008 => Scanning File C:\PROGRA~1\iTunes\ITUNES~1.EXE
    Sun Jun 22 14:54:42 2008 => Scanning File C:\PROGRA~1\MMEDIA\TVJUKE~1.0\TVJBMO~1.EXE

    Sun Jun 22 14:54:42 2008 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

    Sun Jun 22 14:54:42 2008 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

    Sun Jun 22 14:54:42 2008 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

    Sun Jun 22 14:54:42 2008 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Sun Jun 22 14:54:42 2008 => Scanning File d:\PROGRA~1\steam\steam.exe
    Sun Jun 22 14:54:42 2008 => Scanning File C:\PROGRA~1\CursorXP\CursorXP.exe

    Sun Jun 22 14:54:42 2008 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

    Sun Jun 22 14:54:42 2008 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

    Sun Jun 22 14:54:42 2008 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

    Sun Jun 22 14:54:42 2008 => Scanning HKCR\txtfile\shell\open\command

    Sun Jun 22 14:54:42 2008 => Scanning HKCR\comfile\shell\open\command

    Sun Jun 22 14:54:42 2008 => Scanning HKCR\exefile\shell\open\command

    Sun Jun 22 14:54:42 2008 => Scanning HKCR\dllfile\shell\open\command

    Sun Jun 22 14:54:42 2008 => Scanning HKCR\batfile\shell\open\command

    Sun Jun 22 14:54:42 2008 => Scanning HKCR\piffile\shell\open\command

    Sun Jun 22 14:54:42 2008 => Scanning HKCR\scrfile\shell\open\command
    Sun Jun 22 14:54:47 2008 => **********************************************************
    Sun Jun 22 14:54:47 2008 => eScan AntiVirus Toolkit Utility.
    Sun Jun 22 14:54:47 2008 => Copyright © 2003-2004, MicroWorld Technologies Inc.
    Sun Jun 22 14:54:47 2008 => **********************************************************
    Sun Jun 22 14:54:47 2008 => Version 4.4.7
    Sun Jun 22 14:54:47 2008 => Log File: C:\KASPER~1\mwav.log
    Sun Jun 22 14:54:47 2008 => Latest Date of files inside MWAV: 22 Jun 2008 09:22:08.
    Sun Jun 22 14:54:51 2008 => AV Library Loaded...
    Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\kavss.exe
    Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\Getvlist.exe
    Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\kavss.dll
    Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\kavssdi.dll
    Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\kavssi.dll
    Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\kavvlg.dll
    Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\msvlclnt.dll
    Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\ipc.dll
    Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\main.avi
    Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\virus.avi
    Sun Jun 22 14:54:51 2008 => Virus Database Date: 2008/06/22
    Sun Jun 22 14:54:51 2008 => Virus Database Count: 880092
     
    vihu, Jun 22, 2008
    #5
  6. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, Jun 22, 2008
    #6
  7. vihu

    vihu Member

    Joined:
    May 1, 2007
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    Tuossahan tuo

    HjT logi:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:13:26, on 22.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Autodesk\Data Management Server 5\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
    C:\Program Files\Autodesk\Data Management Server 5\Server\Webserver\Connectivity.EDMWS.Server.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\WindowBlinds\wbload.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\FSPC\fspc.exe
    C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\WINDOWS\system32\WgaTray.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe
    C:\Program Files\CursorXP\CursorXP.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    D:\Program Files\Steam\steam.exe
    C:\Program Files\Winamp\winamp.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\mIRC\mirc.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
    O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [tvjbmonitor] C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe
    O4 - HKCU\..\Run: [Steam] "d:\program files\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
    O4 - Global Startup: Logitech SetPoint.lnk = ?
    O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
    O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure\FSPC\fspcmsie.dll
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Autodesk Data Management Job Dispatch - Autodesk Inc - C:\Program Files\Autodesk\Data Management Server 5\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
    O23 - Service: Autodesk EDM Server - - C:\Program Files\Autodesk\Data Management Server 5\Server\Webserver\Connectivity.EDMWS.Server.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    --
    End of file - 8779 bytes
     
    vihu, Jun 22, 2008
    #7
  8. Hujo

    Hujo Guest

    Hujo, Jun 22, 2008
    #8
  9. vihu

    vihu Member

    Joined:
    May 1, 2007
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    Kyllähä tää ny tuntuu toimiva iha kute pitääki. Taitaa olla pöpö poissa.
     
    vihu, Jun 23, 2008
    #9

Share This Page