viiruksia ja troijalaisia pääsi koneelle

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by AitiKoira, Sep 16, 2008.

  1. AitiKoira

    AitiKoira Member

    Joined:
    May 10, 2007
    Messages:
    15
    Likes Received:
    0
    Trophy Points:
    11
    lataamani codec-päkin mukana koneelle tuli kaiken maailman juttuja, mm. avasivat mainos popuppeja jne. scannailtuani asioita avg:llä, A2 malvarella ja ad-awarella löysin jotain la poistin ne. silti kone on vielä hidas joten tässä lista tarkastettavaksi. kiitos kovasti!!

    lisäksi uusi lataamani google chrome pistää tehtävien hallinnassa näkyviin useita chrome.exe:jä. onko tämä normallia??

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:40:02, on 16.9.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\a-squared Anti-Malware\a2service.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Microsoft IntelliType Pro\itype.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Program Files\VentriloMIX\Ventrilo 2.1.4.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Program Files\AVG\AVG8\avgscanx.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\WinRAR\WinRAR.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/fi/index.php?rvs=hompag&d=79919278
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: {a53b3965-52a3-45c8-f294-cb1c346f93f3} - {3f39f643-c1bc-492f-8c54-3a255693b35a} - C:\WINDOWS\system32\mupect.dll
    O2 - BHO: (no name) - {644D9331-F010-4A1A-99B1-6D2F04622803} - (no file)
    O2 - BHO: QXK Olive - {7287293E-B0BE-4A31-B52B-EA15F57679E3} - C:\WINDOWS\vmgspntbnrp.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {842C53C2-9959-4A21-BB67-D98A1457DA37} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
    O3 - Toolbar: fqbewlna - {94E952A4-FAE1-40E5-BBE1-8199D8CF7FD0} - (no file)
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
    O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} (Windows Live SkyDrive Upload Tool) - https://secure.shared.live.com/Pa6vGqB728AxD-ckvrPc0A/etc/Microsoft.Live.Folders.RichUpload.cab
    O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.12) - http://www.yougamers.com/systeminfo/MSC3.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{41539730-8FE8-4EC8-988C-3B739F9BB5B7}: NameServer = 192.168.1.1,192.168.2.1
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: avgrsstx.dll mupect.dll
    O20 - Winlogon Notify: ssqPgFvU - ssqPgFvU.dll (file missing)
    O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 7831 bytes
     
    AitiKoira, Sep 16, 2008
    #1
  2. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/fi/index.php?rvs=hompag&d=79919278
    O2 - BHO: (no name) - {644D9331-F010-4A1A-99B1-6D2F04622803} - (no file)
    O2 - BHO: (no name) - {842C53C2-9959-4A21-BB67-D98A1457DA37} - (no file)
    O3 - Toolbar: fqbewlna - {94E952A4-FAE1-40E5-BBE1-8199D8CF7FD0} - (no file)
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O20 - Winlogon Notify: ssqPgFvU - ssqPgFvU.dll (file missing)

    ==================

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    ================

    Jos koneella on Malwarebytes' Anti-Malware ennestään suorita ensin päivitys aja sen jälkeen.

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.

    ==================

    Lataa Tästä Ccleaner
    CCleaner v2.05.555- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
    Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
    Asennuksen jälkeen aukaise CCleaner.
    Valitse vasemmalta pystyrivistä Options.
    Valitse viereisestä pystyrivistä Settings.
    Language kohtaan valitse Suomi.

    Puhdistaja
    Valitse vasemmalta pystyrivistä Puhdistaja.
    Paina alhaalta Tutki.
    Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
    Kun tutkiminen on valmis, paina Aja CCleaner.
    Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.

    Rekisterin virheiden korjaus
    Valitse vasemmalta pystyrivistä Rekisteri.
    Paina alhaalta Etsi rekisterin virheitä.
    Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
    Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
    Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
    Saat vielä varmistus kysymyksen, paina Ok.
    Kun virheet on korjattu, paina Sulje.
    Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
     
    Hujo, Sep 16, 2008
    #2
  3. AitiKoira

    AitiKoira Member

    Joined:
    May 10, 2007
    Messages:
    15
    Likes Received:
    0
    Trophy Points:
    11
    hjt:n fix checkin tein ja malwarebutesin latasin ja scannailin ja ccleanerilla pyyhin ( käytin muuten uusinta versiota CCleanerista, 2.11.363. ei kai haittaa )

    tässä malwarebytesin loki:

    Malwarebytes' Anti-Malware 1.28
    Tietokantaversio: 1163
    Windows 5.1.2600 Service Pack 2

    17.9.2008 17:05:55
    mbam-log-2008-09-17 (17-05-55).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|F:\|)
    Tarkistetut kohteet: 188548
    Kulunut aika: 51 minute(s), 9 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 1
    Saastuneita rekisteriavaimia: 18
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 2
    Saastuneita hakemistoja: 1
    Saastuneita tiedostoja: 25

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    C:\WINDOWS\system32\mupect.dll (Trojan.Vundo) -> Delete on reboot.

    Saastuneita rekisteriavaimia:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3f39f643-c1bc-492f-8c54-3a255693b35a} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{3f39f643-c1bc-492f-8c54-3a255693b35a} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{d15d736d-0f85-43f0-b9b7-440281a2f463} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{3dd3c2ae-50f9-4606-a1c6-6866616dba1e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{971eed72-60a4-4c07-9c6c-8b7485b0f860} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{7287293e-b0be-4a31-b52b-ea15f57679e3} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7287293e-b0be-4a31-b52b-ea15f57679e3} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\fqbewlna.bldx (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\fqbewlna.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Malware.Trace) -> Data: c:\windows\system32\ -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Malware.Trace) -> Data: system32\ -> Quarantined and deleted successfully.

    Saastuneita hakemistoja:
    C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.

    Saastuneita tiedostoja:
    C:\WINDOWS\system32\mupect.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\System Volume Information\_restore{BA514DD7-E19A-42EC-982A-D9EC932578E9}\RP307\A0061392.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{BA514DD7-E19A-42EC-982A-D9EC932578E9}\RP307\A0061393.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\gpmrxisy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\casino1.ico (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\casino2.ico (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\casino3.ico (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\tdssadw.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\tdssl.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\tdssmain.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\drivers\tdssserv.sys (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\dtseqrxk.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\mgxfebsq.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\mqgldfvo.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\vmgspntbnrp.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

     
    AitiKoira, Sep 17, 2008
    #3
  4. AitiKoira

    AitiKoira Member

    Joined:
    May 10, 2007
    Messages:
    15
    Likes Received:
    0
    Trophy Points:
    11
    combofix linkki kenkkuili, mutta nyt se toimi ja tässä on loki:

    ComboFix 08-09-16.05 - ÄitiKoira 2008-09-17 17:15:39.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1572 [GMT 3:00]
    Sijainti: C:\Lataus loota lol\ComboFix.exe
    * Uusi palautuspiste luotu
    * Resident AV is active


    VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\emnf.exe
    C:\WINDOWS\system32\jthtkyub.ini
    C:\WINDOWS\system32\kevinuip.ini
    C:\WINDOWS\system32\mlUvCJjl.ini
    C:\WINDOWS\system32\mlUvCJjl.ini2
    C:\WINDOWS\system32\tdsspopup.dll
    C:\WINDOWS\system32\tdsspopup1.url
    C:\WINDOWS\system32\tdsspopup2.url
    C:\WINDOWS\system32\tdsspopup3.url
    C:\WINDOWS\system32\windows_update.exe

    .
    ((((((((((((((((((((((((((((((((((((((( Ajurit/Palvelut )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_TDSSSERV
    -------\Service_TDSSserv


    ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-08-17 to 2008-09-17 )))))))))))))))))
    .

    2008-09-17 16:01 . 2008-09-17 16:01 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-17 16:01 . 2008-09-17 16:01 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
    2008-09-17 16:01 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-09-17 16:01 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-09-14 18:17 . 2008-09-14 18:17 <KANSIO> d-------- C:\Program Files\K-Lite Codec Pack417
    2008-09-10 23:12 . 2008-09-10 23:25 <KANSIO> d-------- C:\Program Files\mIRC
    2008-09-10 20:39 . 2004-09-14 16:07 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
    2008-09-10 20:39 . 2004-09-14 16:07 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
    2008-09-10 20:38 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
    2008-09-10 20:38 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
    2008-08-28 00:03 . 2008-08-28 00:03 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll
    2008-08-27 21:00 . 2008-08-30 18:59 <KANSIO> d-------- C:\WINDOWS\system32\Adobe
    2008-08-27 20:04 . 2008-08-27 20:06 <KANSIO> d-------- C:\WINDOWS\.jagex_cache_32
    2008-08-25 21:09 . 2008-08-25 21:09 <KANSIO> d-------- C:\WINDOWS\system32\drivers\SAMSUNG
    2008-08-25 21:09 . 2007-03-01 00:33 172,032 --a------ C:\WINDOWS\system32\SECSNMP.dll
    2008-08-25 21:09 . 2006-08-17 23:46 151,552 --a------ C:\WINDOWS\system32\scx530ci.exe
    2008-08-25 21:09 . 2006-08-17 23:46 57,344 --a------ C:\WINDOWS\system32\scx530ci.dll
    2008-08-25 21:09 . 2006-08-17 23:46 22,663 --a------ C:\WINDOWS\system32\scx530lk.dll
    2008-08-25 21:09 . 2006-08-16 19:59 11,502 --------- C:\WINDOWS\Dr. Printer Icon.ico
    2008-08-25 21:09 . 2006-08-17 23:46 488 --a------ C:\WINDOWS\system32\scx530lk.smt
    2008-08-25 20:47 . 2008-08-25 20:47 <KANSIO> d-------- C:\WINDOWS\Samsung
    2008-08-25 20:47 . 2008-08-25 21:09 <KANSIO> d-------- C:\Program Files\Samsung
    2008-08-25 20:47 . 2007-02-02 03:44 41,984 --------- C:\WINDOWS\system32\drivers\DgivEcp.sys
    2008-08-19 21:01 . 2008-08-19 21:01 <KANSIO> d-------- C:\Program Files\GameSpy
    2008-08-19 21:00 . 2008-08-19 21:00 <KANSIO> d-------- C:\WINDOWS\system32\URTTEMP
    2008-08-19 20:58 . 2008-08-19 20:58 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
    2008-08-17 14:04 . 2008-08-17 14:04 <KANSIO> d-------- C:\Program Files\DAEMON Tools Toolbar
    2008-08-17 14:03 . 2008-08-21 07:11 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-14 15:16 --------- d-----w C:\Program Files\K-Lite Codec Pack
    2008-09-11 18:55 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
    2008-09-11 15:53 --------- d-----w C:\Program Files\DivX
    2008-09-11 12:32 --------- d-----w C:\Program Files\Xfire
    2008-09-10 13:30 --------- d-----w C:\Program Files\Steam
    2008-09-08 14:13 --------- d-----w C:\Program Files\SpeedFan
    2008-08-30 08:15 97,928 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys
    2008-08-25 17:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-08-20 15:48 --------- d-----w C:\Program Files\Microsoft Games
    2008-08-19 20:02 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-08-19 17:59 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-08-19 17:52 --------- d-----w C:\Program Files\Electronic Arts
    2008-08-07 08:51 --------- d-----w C:\Program Files\Opera
    2008-08-07 08:42 --------- d-----w C:\Program Files\PAFPoker
    2008-08-07 08:01 --------- d-----w C:\Program Files\PalickSoft
    2008-08-02 09:22 --------- d-----w C:\Program Files\MP3Gain
    2008-07-29 17:07 --------- d-----w C:\Program Files\Diablo II
    2008-07-28 14:29 --------- d-----w C:\Program Files\Java
    2008-07-27 23:06 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
    2008-07-21 09:31 --------- d-----w C:\Program Files\Microsoft SDKs
    2008-07-19 11:08 --------- d-----w C:\Program Files\Lavasoft
    2008-07-19 11:08 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2007-12-04 12:56 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\ezsid.dat
    .

    (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-06-12 700416]
    "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088]
    "IntelliPoint"="c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
    "itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 988584]
    "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-30 1235736]
    "CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016]
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-14 C:\WINDOWS\system32\bthprops.cpl]
    "RTHDCPL"="RTHDCPL.EXE" [2007-03-21 C:\WINDOWS\RTHDCPL.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=avgrsstx.dll mupect.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.XFR1"= xfcodec.dll
    "msacm.l3fhg"= mp3fhg.acm
    "msacm.divxa32"= divxa32.acm
    "VIDC.X264"= x264vfw.dll
    "VIDC.HFYU"= huffyuv.dll
    "vidc.i263"= i263_32.drv
    "VIDC.YV12"= yv12vfw.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
    "C:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
    "C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"=
    "C:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "C:\\Program Files\\Xfire\\xfire.exe"=
    "C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=
    "C:\\WINDOWS\\system32\\mmc.exe"=
    "C:\\Program Files\\Steam\\steamapps\\4rs0\\source sdk base\\hl2.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"=
    "C:\\WINDOWS\\system32\\dplaysvr.exe"=
    "F:\\Battlefield 2\\BF2.exe"=
    "C:\\Program Files\\mIRC\\mirc.exe"=
    "C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"=

    R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-30 97928]
    R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-30 875288]
    R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-30 231704]
    R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-04 76040]
    R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 38656]
    S2 SSPORT;SSPORT;C:\WINDOWS\system32\Drivers\SSPORT.sys [ ]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f308c26-b6c5-11dc-b84c-001bfc8e9c58}]
    \Shell\AutoRun\command - G:\SETUP.EXE

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f308c27-b6c5-11dc-b84c-001bfc8e9c58}]
    \Shell\AutoRun\command - H:\Setup.exe
    .
    'Ajoitetut teht„v„t'-kansion sis„lt”
    .
    - - - - POISTETUT JŽMŽRIVIT - - - -

    ShellExecuteHooks-{644D9331-F010-4A1A-99B1-6D2F04622803} - (no file)


    .
    ------- T„ydent„v„ tarkistus -------
    .
    FireFox -: Profile - C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\Mozilla\Firefox\Profiles\yb7jo285.default\
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-17 17:25:13
    Windows 5.1.2600 Service Pack 2 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja k„ynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    ------------------------ Muut prosessit ------------------------
    .
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\AVG\AVG8\avgrsx.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
    C:\ComboFix\pv.cfexe
    .
    **************************************************************************
    .
    Valmistumisajankohta: 2008-09-17 17:29:52 - kone k„ynnistettiin uudelleen
    ComboFix-quarantined-files.txt 2008-09-17 14:29:49

    Pre-Run: 20,558,704,640 tavua vapaana
    Post-Run: 20,618,579,968 tavua vapaana

    187 --- E O F --- 2008-09-10 14:26:43
     
    AitiKoira, Sep 17, 2008
    #4
  5. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, Sep 17, 2008
    #5
  6. AitiKoira

    AitiKoira Member

    Joined:
    May 10, 2007
    Messages:
    15
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:41:34, on 17.9.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files\Microsoft IntelliType Pro\itype.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Program Files\AVG\AVG8\avgtray.exe
    C:\Program Files\VentriloMIX\Ventrilo 2.1.4.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
    O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} (Windows Live SkyDrive Upload Tool) - https://secure.shared.live.com/Pa6vGqB728AxD-ckvrPc0A/etc/Microsoft.Live.Folders.RichUpload.cab
    O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.12) - http://www.yougamers.com/systeminfo/MSC3.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{41539730-8FE8-4EC8-988C-3B739F9BB5B7}: NameServer = 192.168.1.1,192.168.2.1
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: avgrsstx.dll mupect.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 7006 bytes

     
    AitiKoira, Sep 17, 2008
    #6
  7. Hujo

    Hujo Guest

    ajas tuo combofix uudelleen
     
    Hujo, Sep 17, 2008
    #7
  8. AitiKoira

    AitiKoira Member

    Joined:
    May 10, 2007
    Messages:
    15
    Likes Received:
    0
    Trophy Points:
    11
    ComboFix 08-09-16.05 - ÄitiKoira 2008-09-17 20:21:32.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1376 [GMT 3:00]
    Sijainti: C:\Lataus loota lol\ComboFix.exe
    * Resident AV is active


    VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !!
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-08-17 to 2008-09-17 )))))))))))))))))
    .

    2008-09-17 17:29 . <KANSIO> C:\Documents and Settings\-itiKoira.ATKONE
    2008-09-17 16:01 . 2008-09-17 16:01 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-17 16:01 . 2008-09-17 16:01 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
    2008-09-17 16:01 . 2008-09-17 16:01 <KANSIO> d-------- C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\Malwarebytes
    2008-09-17 16:01 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-09-17 16:01 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-09-14 18:17 . 2008-09-14 18:17 <KANSIO> d-------- C:\Program Files\K-Lite Codec Pack417
    2008-09-10 23:12 . 2008-09-10 23:25 <KANSIO> d-------- C:\Program Files\mIRC
    2008-09-10 23:12 . 2008-09-10 23:27 <KANSIO> d-------- C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\mIRC
    2008-09-10 20:39 . 2004-09-14 16:07 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
    2008-09-10 20:39 . 2004-09-14 16:07 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
    2008-09-10 20:38 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
    2008-09-10 20:38 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
    2008-08-28 00:03 . 2008-08-28 00:03 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll
    2008-08-27 21:00 . 2008-08-30 18:59 <KANSIO> d-------- C:\WINDOWS\system32\Adobe
    2008-08-27 20:04 . 2008-08-27 20:06 <KANSIO> d-------- C:\WINDOWS\.jagex_cache_32
    2008-08-27 20:04 . 2008-08-27 20:29 24 --a------ C:\Documents and Settings\ÄitiKoira.ATKONE\jagex_runescape_preferences.dat
    2008-08-27 20:04 . 2008-08-27 20:29 24 --a------ C:\Documents and Settings\ÄitiKoira.ATKONE\jagex_runescape_preferences.dat
    2008-08-25 21:09 . 2008-08-25 21:09 <KANSIO> d-------- C:\WINDOWS\system32\drivers\SAMSUNG
    2008-08-25 21:09 . 2007-03-01 00:33 172,032 --a------ C:\WINDOWS\system32\SECSNMP.dll
    2008-08-25 21:09 . 2006-08-17 23:46 151,552 --a------ C:\WINDOWS\system32\scx530ci.exe
    2008-08-25 21:09 . 2006-08-17 23:46 57,344 --a------ C:\WINDOWS\system32\scx530ci.dll
    2008-08-25 21:09 . 2006-08-17 23:46 22,663 --a------ C:\WINDOWS\system32\scx530lk.dll
    2008-08-25 21:09 . 2006-08-16 19:59 11,502 --------- C:\WINDOWS\Dr. Printer Icon.ico
    2008-08-25 21:09 . 2006-08-17 23:46 488 --a------ C:\WINDOWS\system32\scx530lk.smt
    2008-08-25 20:47 . 2008-08-25 20:47 <KANSIO> d-------- C:\WINDOWS\Samsung
    2008-08-25 20:47 . 2008-08-25 21:09 <KANSIO> d-------- C:\Program Files\Samsung
    2008-08-25 20:47 . 2007-02-02 03:44 41,984 --------- C:\WINDOWS\system32\drivers\DgivEcp.sys
    2008-08-20 22:04 . 2008-08-20 22:05 <KANSIO> d-------- C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\teamspeak2
    2008-08-19 21:01 . 2008-08-19 21:01 <KANSIO> d-------- C:\Program Files\GameSpy
    2008-08-19 21:00 . 2008-08-19 21:00 <KANSIO> d-------- C:\WINDOWS\system32\URTTEMP
    2008-08-19 20:59 . 2008-08-19 20:59 22,328 --a------ C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\PnkBstrK.sys
    2008-08-19 20:58 . 2008-08-19 20:58 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
    2008-08-17 14:04 . 2008-08-17 14:04 <KANSIO> d-------- C:\Program Files\DAEMON Tools Toolbar
    2008-08-17 14:03 . 2008-08-21 07:11 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-17 15:33 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
    2008-09-16 20:05 --------- d-----w C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\Hamachi
    2008-09-16 17:09 --------- d-----w C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\uTorrent
    2008-09-14 15:16 --------- d-----w C:\Program Files\K-Lite Codec Pack
    2008-09-14 15:13 --------- d-----w C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\DivX
    2008-09-11 15:53 --------- d-----w C:\Program Files\DivX
    2008-09-11 15:02 --------- d-----w C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\Xfire
    2008-09-11 12:32 --------- d-----w C:\Program Files\Xfire
    2008-09-10 13:30 --------- d-----w C:\Program Files\Steam
    2008-09-08 14:13 --------- d-----w C:\Program Files\SpeedFan
    2008-08-30 08:15 97,928 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys
    2008-08-25 17:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-08-20 15:48 --------- d-----w C:\Program Files\Microsoft Games
    2008-08-19 20:02 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-08-19 17:59 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-08-19 17:58 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
    2008-08-19 17:58 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    2008-08-19 17:52 --------- d-----w C:\Program Files\Electronic Arts
    2008-08-07 08:51 --------- d-----w C:\Program Files\Opera
    2008-08-07 08:42 --------- d-----w C:\Program Files\PAFPoker
    2008-08-07 08:01 --------- d-----w C:\Program Files\PalickSoft
    2008-08-02 09:22 --------- d-----w C:\Program Files\MP3Gain
    2008-07-29 17:07 --------- d-----w C:\Program Files\Diablo II
    2008-07-29 16:30 152,920 ----a-w C:\WINDOWS\system32\vghd.scr
    2008-07-28 14:29 --------- d-----w C:\Program Files\Java
    2008-07-27 23:06 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
    2008-07-27 23:06 --------- d-----w C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\DAEMON Tools
    2008-07-25 08:36 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
    2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
    2008-07-23 16:48 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
    2008-07-23 16:48 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
    2008-07-23 16:46 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
    2008-07-21 09:31 --------- d-----w C:\Program Files\Microsoft SDKs
    2008-07-19 11:08 --------- d-----w C:\Program Files\Lavasoft
    2008-07-19 11:08 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
    2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
    2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
    2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
    2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
    2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
    2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2008-07-18 19:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
    2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
    2008-07-16 18:51 2,041,363 ----a-w C:\WINDOWS\system32\x264vfw.dll
    2008-07-13 13:46 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
    2008-07-13 13:46 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
    2008-07-13 13:46 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
    2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
    2008-07-04 06:33 10,520 ----a-w C:\WINDOWS\system32\avgrsstx.dll
    2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
    2008-06-24 15:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
    2008-06-23 15:40 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-06-20 17:41 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
    2007-12-04 12:56 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\ezsid.dat
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-06-12 700416]
    "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088]
    "IntelliPoint"="c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
    "itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 988584]
    "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-30 1235736]
    "CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016]
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-14 C:\WINDOWS\system32\bthprops.cpl]
    "RTHDCPL"="RTHDCPL.EXE" [2007-03-21 C:\WINDOWS\RTHDCPL.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=avgrsstx.dll mupect.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.XFR1"= xfcodec.dll
    "msacm.l3fhg"= mp3fhg.acm
    "msacm.divxa32"= divxa32.acm
    "VIDC.X264"= x264vfw.dll
    "VIDC.HFYU"= huffyuv.dll
    "vidc.i263"= i263_32.drv
    "VIDC.YV12"= yv12vfw.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
    "C:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
    "C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"=
    "C:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "C:\\Program Files\\Xfire\\xfire.exe"=
    "C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=
    "C:\\WINDOWS\\system32\\mmc.exe"=
    "C:\\Program Files\\Steam\\steamapps\\4rs0\\source sdk base\\hl2.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"=
    "C:\\WINDOWS\\system32\\dplaysvr.exe"=
    "F:\\Battlefield 2\\BF2.exe"=
    "C:\\Program Files\\mIRC\\mirc.exe"=
    "C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"=

    R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-30 97928]
    R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-30 875288]
    R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-30 231704]
    R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-04 76040]
    S2 SSPORT;SSPORT;C:\WINDOWS\system32\Drivers\SSPORT.sys [ ]
    S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 38656]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f308c26-b6c5-11dc-b84c-001bfc8e9c58}]
    \Shell\AutoRun\command - G:\SETUP.EXE

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f308c27-b6c5-11dc-b84c-001bfc8e9c58}]
    \Shell\AutoRun\command - H:\Setup.exe
    .
    'Ajoitetut tehtävät'-kansion sisältö
    .
    .
    ------- Täydentävä tarkistus -------
    .
    FireFox -: Profile - C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\Mozilla\Firefox\Profiles\yb7jo285.default\
    FF -: plugin - C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Update\1.2.131.11\npGoogleOneClick5.dll
    FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
    FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-17 20:22:45
    Windows 5.1.2600 Service Pack 2 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    Valmistumisajankohta: 2008-09-17 20:24:11
    ComboFix-quarantined-files.txt 2008-09-17 17:23:19
    ComboFix2.txt 2008-09-17 14:29:54

    Pre-Run: 24,743,645,184 tavua vapaana
    Post-Run: 24,729,563,136 tavua vapaana

    195 --- E O F --- 2008-09-10 14:26:43
     
    AitiKoira, Sep 17, 2008
    #8
  9. Hujo

    Hujo Guest

    Eli poista toi google chrome lataus vaikka sen omalla poistolla
     
    Last edited by a moderator: Sep 17, 2008
    Hujo, Sep 17, 2008
    #9
  10. AitiKoira

    AitiKoira Member

    Joined:
    May 10, 2007
    Messages:
    15
    Likes Received:
    0
    Trophy Points:
    11
    tässä uusi hjt loki google chromen poiston jälkeen:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:07:31, on 17.9.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files\Microsoft IntelliType Pro\itype.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Program Files\AVG\AVG8\avgtray.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\AVG\AVG8\avgrsx.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
    O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} (Windows Live SkyDrive Upload Tool) - https://secure.shared.live.com/Pa6vGqB728AxD-ckvrPc0A/etc/Microsoft.Live.Folders.RichUpload.cab
    O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.12) - http://www.yougamers.com/systeminfo/MSC3.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{41539730-8FE8-4EC8-988C-3B739F9BB5B7}: NameServer = 192.168.1.1,192.168.2.1
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: avgrsstx.dll mupect.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 5798 bytes
     
    AitiKoira, Sep 17, 2008
    #10
  11. Hujo

    Hujo Guest

    Poista vielä tuokin
    Running processes:

    C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe


    aja päälle vielä Ccleaner
     
    Hujo, Sep 17, 2008
    #11

Share This Page