Virus koneella, tässä hjt logi.

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by jUDESii, Jun 9, 2008.

  1. jUDESii

    jUDESii Regular member

    Joined:
    May 31, 2008
    Messages:
    164
    Likes Received:
    0
    Trophy Points:
    26
    Eli virus tullut mesen kautta, mutta kerennyt jo levitä ja mesevirus kyllä poistettu. Vielä valittelee parista tai yhdestä muusta viruksesta. Virustorjunnassa kehotettiin combofix ajamaan, eli tässä nyt ComboFix log, sekä HJT-log (ajettu combofixin jälkeen).

    HJT LOG:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 00:08, on 2008-06-05
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\ATKKBService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\program files\steam\steam.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\AVG\AVG8\avgrsx.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?5c2d5a97a091453e8db44cba91fe7d67
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?5c2d5a97a091453e8db44cba91fe7d67
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
    O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
    O23 - Service: AVG Anti-Spyware Guard - Unknown owner - C:\Documents and Settings\Janne\Työpöytä\AVG Anti-Spyware 7.5\guard.exe (file missing)
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
    O23 - Service: Messengerin jaettavien kansioiden USN Journal -lokin lukupalvelu (usnjsvc) - Unknown owner - C:\Program Files\MSN Messenger\usnsvc.exe (file missing)

    --
    End of file - 7147 bytes

    ------------------------------------------------------------------------------------------------------------------------------------------------------------


    ComboFix LOG:

    ComboFix 08-06-03.4 - Janne 2008-06-04 23:53:41.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1477 [GMT 3:00]
    Running from: C:\Documents and Settings\Janne\Työpöytä\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\BM83f71a07.xml
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\system32\bjinhalk.dll
    C:\WINDOWS\system32\bycjdfps.ini
    C:\WINDOWS\system32\ckqersea.dll
    C:\WINDOWS\system32\cpsynfrk.ini
    C:\WINDOWS\system32\ctkgkjtg.dll
    C:\WINDOWS\system32\ddcBULfE.dll
    C:\WINDOWS\system32\dnlcfbun.dll
    C:\WINDOWS\system32\evrjtjgw.dll
    C:\WINDOWS\system32\foixntsa.dll
    C:\WINDOWS\system32\geBtRkiF.dll
    C:\WINDOWS\system32\geiihyjc.dll
    C:\WINDOWS\system32\hcnrltcd.ini
    C:\WINDOWS\system32\iifefCRL.dll
    C:\WINDOWS\system32\khfFWppo.dll
    C:\WINDOWS\system32\KTCLknmp.ini
    C:\WINDOWS\system32\levosgqk.dll
    C:\WINDOWS\system32\lwloisew.ini
    C:\WINDOWS\system32\mcrh.tmp
    C:\WINDOWS\system32\minebphi.ini
    C:\WINDOWS\system32\nlcqghrq.ini
    C:\WINDOWS\system32\orpnleed.dll
    C:\WINDOWS\system32\pcbjbsox.dll
    C:\WINDOWS\system32\pmnkLCTK.dll
    C:\WINDOWS\system32\qmjqupyp.dll
    C:\WINDOWS\system32\qsokyjqs.ini
    C:\WINDOWS\system32\rkocqpxc.dll
    C:\WINDOWS\system32\rnhlohbh.ini
    C:\WINDOWS\system32\rrursuom.ini
    C:\WINDOWS\system32\sgaeluqe.dll
    C:\WINDOWS\system32\slrrovfa.dll
    C:\WINDOWS\system32\tohmkkme.dll
    C:\WINDOWS\system32\tuvUKawU.dll
    C:\WINDOWS\system32\tuvVolmL.dll
    C:\WINDOWS\system32\varnnxxl.dll
    C:\WINDOWS\system32\vdsrvxyk.ini
    C:\WINDOWS\system32\vgjmjofg.dll
    C:\WINDOWS\system32\vtkpnixu.dll
    C:\WINDOWS\system32\wvUkHApm.dll
    C:\WINDOWS\system32\xbhcsufg.ini
    C:\WINDOWS\system32\xwiedehs.dll
    C:\WINDOWS\system32\yayvWoNh.dll

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-05-04 to 2008-06-04 )))))))))))))))))
    .

    2008-06-02 19:48 . 2008-06-02 19:48 2,560 --a------ C:\WINDOWS\system32\vngievbk.exe
    2008-06-02 11:13 . 2008-06-02 11:36 <KANSIO> d--h----- C:\WINDOWS\$AVG8.VAULT$
    2008-06-01 22:00 . 2008-06-01 22:00 <KANSIO> d-------- C:\Documents and Settings\Janne\Application Data\Grisoft
    2008-06-01 21:59 . 2008-06-02 12:03 <KANSIO> d-------- C:\Program Files\AVG Anti-Spyware 7.5
    2008-06-01 21:59 . 2008-06-01 21:59 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-06-01 21:59 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-06-01 19:43 . 2008-06-02 12:14 345 --ahs---- C:\WINDOWS\system32\qAdLRqru.ini
    2008-06-01 19:25 . 2008-06-01 19:25 <KANSIO> d-------- C:\WINDOWS\system32\drivers\Avg
    2008-06-01 19:25 . 2008-06-01 19:25 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
    2008-06-01 19:25 . 2008-06-01 19:25 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
    2008-06-01 19:25 . 2008-06-01 19:25 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
    2008-06-01 19:24 . 2008-06-01 19:24 <KANSIO> d-------- C:\Program Files\AVG
    2008-06-01 19:24 . 2008-06-01 19:24 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\avg8
    2008-06-01 15:43 . 2008-06-01 15:47 345 --ahs---- C:\WINDOWS\system32\GPoqYcdd.ini
    2008-06-01 13:59 . 2008-06-01 14:22 345 --ahs---- C:\WINDOWS\system32\StEfOUvw.ini
    2008-06-01 00:59 . 2008-06-01 00:59 <KANSIO> d-------- C:\Documents and Settings\J„rjestelm„nvalvoja
    2008-05-31 23:38 . 2008-05-31 23:38 <KANSIO> d-------- C:\Program Files\Avast!
    2008-05-31 23:21 . 2008-05-31 23:21 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-05-31 15:37 . 2008-05-31 15:37 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-05-31 14:16 . 2008-06-01 13:17 345 --ahs---- C:\WINDOWS\system32\IOqtsBeg.ini
    2008-05-29 21:43 . 2008-05-29 21:43 86,340 -r-hs---- C:\WINDOWS\winudspm.exe
    2008-05-18 17:51 . 2008-05-18 17:51 624,416 --a------ C:\Documents and Settings\hamachi.exe
    2008-05-18 17:51 . 2008-05-18 17:51 149,800 --a------ C:\Documents and Settings\uninstall.exe
    2008-05-18 17:51 . 2008-05-18 17:51 43,420 --a------ C:\Documents and Settings\hamachi.lng
    2008-05-18 17:51 . 2008-05-18 17:51 3,744 --a------ C:\Documents and Settings\hamachi.ttf
    2008-05-18 17:51 . 2008-05-18 17:51 1,322 --a------ C:\Documents and Settings\uninstall.lng
    2008-05-18 17:51 . 2008-05-18 17:51 264 --a------ C:\Documents and Settings\hamachi.key
    2008-05-12 22:06 . 2008-05-12 22:06 <KANSIO> d-------- C:\Program Files\SmartFTP Client 3.0 Setup Files
    2008-05-07 16:44 . 2008-05-12 22:06 <KANSIO> d-------- C:\Program Files\SmartFTP Client
    2008-05-07 16:44 . 2008-05-07 16:44 <KANSIO> d-------- C:\Documents and Settings\Janne\Application Data\SmartFTP

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-04 21:00 --------- d-----w C:\Program Files\Steam
    2008-06-04 20:52 --------- d-----w C:\Program Files\mIRC
    2008-06-04 20:52 --------- d-----w C:\Documents and Settings\Janne\Application Data\uTorrent
    2008-06-03 14:27 --------- d-----w C:\Program Files\mIRC2
    2008-06-02 10:15 --------- d-----w C:\Program Files\MSN Messenger
    2008-06-01 10:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-06-01 10:46 --------- d-----w C:\Program Files\GameFace Messenger
    2008-06-01 10:46 --------- d-----w C:\Program Files\ASUS
    2008-05-19 20:07 --------- d-----w C:\Documents and Settings\Janne\Application Data\Hamachi
    2008-05-03 19:38 --------- d-----w C:\Program Files\uTorrent
    2008-04-16 13:24 --------- d-----w C:\Documents and Settings\Janne\Application Data\LimeWire
    2008-03-26 05:33 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
    2008-03-26 05:33 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
    2008-03-26 05:33 22,328 ----a-w C:\Documents and Settings\Janne\Application Data\PnkBstrK.sys
    2008-03-26 05:33 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2007-11-20 15:52 290 ----a-w C:\Documents and Settings\Hamachi\uninstall.dat
    2007-11-20 15:50 622,880 ----a-w C:\Documents and Settings\Hamachi\hamachi.exe
    2007-11-20 15:50 29,760 ----a-w C:\Documents and Settings\Hamachi\nicmgr.exe
    2007-11-20 15:50 149,288 ----a-w C:\Documents and Settings\Hamachi\uninstall.exe
    .

    (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
    "Steam"="c:\program files\steam\steam.exe" [2008-03-28 09:23 1271032]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40 2577632]
    "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-15 15:59 262401]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 04:10 49263]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
    "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-01 19:24 1177368]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
    "Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [2005-12-13 15:13 1976544]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
    antiwpa.dll 2005-09-18 03:32 5376 C:\WINDOWS\system32\antiwpa.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.asv2"= asusasv2.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Adobe Reader Speed Launch.lnk]
    backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Logitech SetPoint.lnk]
    backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\80c4299b]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS SmartDoctor]
    --a------ 2006-02-21 23:23 1073152 C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiTrayTools]
    --a------ 2006-04-17 08:24 505344 C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM83f71a07]
    C:\WINDOWS\system32\foixntsa.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comrade.exe]
    --a------ 2007-06-29 16:03 36864 C:\Program Files\GameSpy\Comrade\Comrade.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
    --a------ 2007-08-16 14:24 167368 C:\Program Files\DAEMON Tools\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GameFace Messenger]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Services]
    --a------ 2006-02-04 04:18 253952 C:\WINDOWS\WinVNC.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
    --a------ 2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Update]


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Update Machine]


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --------- 2004-10-13 19:24 1694208 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    --a------ 2007-12-05 02:41 8523776 C:\WINDOWS\system32\NvCpl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
    --a------ 2004-12-06 13:06 532480 C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
    --a------ 2007-12-05 02:41 81920 C:\WINDOWS\system32\NvMcTray.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]
    --a------ 2004-12-20 18:12 131072 C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    --a------ 2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services]
    --a------ 2006-02-13 19:33 214648 C:\Program Files\Octoshape Streaming Services\Janne\OctoshapeClient.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerStrip]
    --a------ 2004-02-08 02:00 617984 c:\program files\powerstrip\pstrip.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon]
    --a------ 2007-10-30 21:05 2650112 C:\Program Files\RivaTuner v2.06\RivaTuner.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
    --a------ 2004-11-15 13:20 77824 C:\WINDOWS\SOUNDMAN.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
    -ra------ 2006-12-18 16:34 868352 C:\Program Files\Analog Devices\Core\smax4pnp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spyware Doctor]
    --a------ 2005-12-13 15:13 1976544 C:\Program Files\Spyware Doctor\swdoctor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Start WingMan Profiler]
    --a------ 2005-04-18 11:16 73728 C:\Program Files\Logitech\Profiler\lwemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearchWHSE]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
    --a------ 2006-10-25 08:37 35328 C:\Program Files\Winamp\winampa.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows svchost]


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows UDP Control]
    -r-hs---- 2008-05-29 21:43 86340 C:\WINDOWS\winudspm.exe

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\mIRC\\mirc.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\WINDOWS\\WinVNC.exe"=
    "C:\\Program Files\\Steam\\SteamApps\\dujez\\counter-strike\\hl.exe"=
    "C:\\Program Files\\Octoshape Streaming Services\\Janne\\OctoshapeClient.exe"=
    "C:\\Documents and Settings\\Hamachi\\hamachi.exe"=
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\uTorrent\\utorrent.exe"=
    "C:\\Documents and Settings\\hamachi.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Steam\\steam.exe"=
    "C:\\Program Files\\Sierra\\Half Life\\hl.exe"=
    "C:\\Program Files\\Steam\\SteamApps\\jermuz\\counter-strike\\hl.exe"=
    "C:\\Program Files\\mIRC2\\mirc.exe"=
    "E:\\Omat\\LimeWire\\LimeWire.exe"=
    "C:\\Program Files\\Steam\\SteamApps\\cool@jippii.fi\\counter-strike source\\hl2.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
    "E:\\Omat\\The All-Seeing Eye\\eye.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "18036:TCP"= 18036:TCP:BitComet 18036 TCP
    "18036:UDP"= 18036:UDP:BitComet 18036 UDP

    R0 AmdAcpi;AmdAcpi Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\AmdAcpi.sys [2006-09-05 17:04]
    R1 atitray;atitray;C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [2006-03-01 00:55]
    R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-01 19:25]
    R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-08-07 16:17]
    R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-01 19:24]
    R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-01 19:24]
    R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-01 19:25]
    R2 PStrip;PStrip;C:\WINDOWS\system32\drivers\PStrip.sys [2001-07-24 03:31]
    R3 AmdTools;AMD Special Tools Driver;C:\WINDOWS\system32\DRIVERS\AmdTools.sys [2006-08-24 16:37]
    S0 NVStrap;NVStrap;C:\WINDOWS\system32\drivers\NVStrap.sys [2007-10-30 21:05]
    S1 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb32.sys [2005-10-20 17:25]
    S3 avgntdd;avgntdd;C:\PROGRAM FILES\AVPERSONAL\AVGNTDD.SYS []
    S3 GPU-Z;GPU-Z;C:\DOCUME~1\Janne\LOCALS~1\Temp\GPU-Z.sys []
    S3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys []

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{adc6f37a-f717-11da-996e-806d6172696f}]
    \Shell\AutoRun\command - D:\ASUSACPI.exe

    .
    'Ajoitetut teht„v„t'-kansion sis„lt”
    "2008-06-04 20:36:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
     
    jUDESii, Jun 9, 2008
    #1
  2. Hujo

    Hujo Guest

    aja combofix uudelleen

    ==========

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
     
    Hujo, Jun 9, 2008
    #2
  3. jUDESii

    jUDESii Regular member

    Joined:
    May 31, 2008
    Messages:
    164
    Likes Received:
    0
    Trophy Points:
    26
    Tehty. Tässä logit:

    Uusi ComboFix LOG:


    ComboFix 08-06-03.4 - Janne 2008-06-09 18:19:32.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1522 [GMT 3:00]
    Running from: C:\Documents and Settings\Janne\Työpöytä\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- Previous Run -------
    .
    C:\WINDOWS\BM83f71a07.xml
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\system32\bjinhalk.dll
    C:\WINDOWS\system32\bycjdfps.ini
    C:\WINDOWS\system32\ckqersea.dll
    C:\WINDOWS\system32\cpsynfrk.ini
    C:\WINDOWS\system32\ctkgkjtg.dll
    C:\WINDOWS\system32\ddcBULfE.dll
    C:\WINDOWS\system32\dnlcfbun.dll
    C:\WINDOWS\system32\evrjtjgw.dll
    C:\WINDOWS\system32\foixntsa.dll
    C:\WINDOWS\system32\geBtRkiF.dll
    C:\WINDOWS\system32\geiihyjc.dll
    C:\WINDOWS\system32\hcnrltcd.ini
    C:\WINDOWS\system32\iifefCRL.dll
    C:\WINDOWS\system32\khfFWppo.dll
    C:\WINDOWS\system32\KTCLknmp.ini
    C:\WINDOWS\system32\levosgqk.dll
    C:\WINDOWS\system32\lwloisew.ini
    C:\WINDOWS\system32\mcrh.tmp
    C:\WINDOWS\system32\minebphi.ini
    C:\WINDOWS\system32\nlcqghrq.ini
    C:\WINDOWS\system32\orpnleed.dll
    C:\WINDOWS\system32\pcbjbsox.dll
    C:\WINDOWS\system32\pmnkLCTK.dll
    C:\WINDOWS\system32\qmjqupyp.dll
    C:\WINDOWS\system32\qsokyjqs.ini
    C:\WINDOWS\system32\rkocqpxc.dll
    C:\WINDOWS\system32\rnhlohbh.ini
    C:\WINDOWS\system32\rrursuom.ini
    C:\WINDOWS\system32\sgaeluqe.dll
    C:\WINDOWS\system32\slrrovfa.dll
    C:\WINDOWS\system32\tohmkkme.dll
    C:\WINDOWS\system32\tuvUKawU.dll
    C:\WINDOWS\system32\tuvVolmL.dll
    C:\WINDOWS\system32\varnnxxl.dll
    C:\WINDOWS\system32\vdsrvxyk.ini
    C:\WINDOWS\system32\vgjmjofg.dll
    C:\WINDOWS\system32\vtkpnixu.dll
    C:\WINDOWS\system32\wvUkHApm.dll
    C:\WINDOWS\system32\xbhcsufg.ini
    C:\WINDOWS\system32\xwiedehs.dll
    C:\WINDOWS\system32\yayvWoNh.dll

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-09 to 2008-06-09 )))))))))))))))))
    .

    2008-06-09 18:18 . 2008-06-09 18:18 <KANSIO> d-------- C:\Documents and Settings\Janne\Application Data\Malwarebytes
    2008-06-09 18:18 . 2008-06-09 18:18 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-09 18:18 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-06-09 18:18 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-06-09 15:17 . 2008-06-09 18:17 <KANSIO> d-------- C:\Program Files\mIRC
    2008-06-02 19:48 . 2008-06-02 19:48 2,560 --a------ C:\WINDOWS\system32\vngievbk.exe
    2008-06-02 11:13 . 2008-06-02 11:36 <KANSIO> d--h----- C:\WINDOWS\$AVG8.VAULT$
    2008-06-01 22:00 . 2008-06-01 22:00 <KANSIO> d-------- C:\Documents and Settings\Janne\Application Data\Grisoft
    2008-06-01 21:59 . 2008-06-02 12:03 <KANSIO> d-------- C:\Program Files\AVG Anti-Spyware 7.5
    2008-06-01 21:59 . 2008-06-01 21:59 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-06-01 21:59 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-06-01 19:43 . 2008-06-02 12:14 345 --ahs---- C:\WINDOWS\system32\qAdLRqru.ini
    2008-06-01 19:25 . 2008-06-01 19:25 <KANSIO> d-------- C:\WINDOWS\system32\drivers\Avg
    2008-06-01 19:25 . 2008-06-01 19:25 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
    2008-06-01 19:25 . 2008-06-01 19:25 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
    2008-06-01 19:25 . 2008-06-01 19:25 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
    2008-06-01 19:24 . 2008-06-01 19:24 <KANSIO> d-------- C:\Program Files\AVG
    2008-06-01 19:24 . 2008-06-01 19:24 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\avg8
    2008-06-01 15:43 . 2008-06-01 15:47 345 --ahs---- C:\WINDOWS\system32\GPoqYcdd.ini
    2008-06-01 13:59 . 2008-06-01 14:22 345 --ahs---- C:\WINDOWS\system32\StEfOUvw.ini
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
    2008-06-01 00:59 . 2006-06-08 18:28 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
    2008-06-01 00:59 . 2006-06-08 18:28 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
    2008-06-01 00:59 . 2008-06-01 00:59 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja
    2008-05-31 23:38 . 2008-05-31 23:38 <KANSIO> d-------- C:\Program Files\Avast!
    2008-05-31 23:21 . 2008-05-31 23:21 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-05-31 15:37 . 2008-05-31 15:37 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-05-31 14:16 . 2008-06-01 13:17 345 --ahs---- C:\WINDOWS\system32\IOqtsBeg.ini
    2008-05-29 21:43 . 2008-05-29 21:43 86,340 -r-hs---- C:\WINDOWS\winudspm.exe
    2008-05-18 17:51 . 2008-05-18 17:51 624,416 --a------ C:\Documents and Settings\hamachi.exe
    2008-05-18 17:51 . 2008-05-18 17:51 149,800 --a------ C:\Documents and Settings\uninstall.exe
    2008-05-18 17:51 . 2008-05-18 17:51 43,420 --a------ C:\Documents and Settings\hamachi.lng
    2008-05-18 17:51 . 2008-05-18 17:51 3,744 --a------ C:\Documents and Settings\hamachi.ttf
    2008-05-18 17:51 . 2008-05-18 17:51 1,322 --a------ C:\Documents and Settings\uninstall.lng
    2008-05-18 17:51 . 2008-05-18 17:51 264 --a------ C:\Documents and Settings\hamachi.key
    2008-05-12 22:06 . 2008-05-12 22:06 <KANSIO> d-------- C:\Program Files\SmartFTP Client 3.0 Setup Files

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-09 10:53 --------- d-----w C:\Program Files\Steam
    2008-06-04 22:16 --------- d-----w C:\Documents and Settings\Janne\Application Data\uTorrent
    2008-06-03 14:27 --------- d-----w C:\Program Files\mIRC2
    2008-06-02 10:15 --------- d-----w C:\Program Files\MSN Messenger
    2008-06-01 10:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-06-01 10:46 --------- d-----w C:\Program Files\GameFace Messenger
    2008-06-01 10:46 --------- d-----w C:\Program Files\ASUS
    2008-05-19 20:07 --------- d-----w C:\Documents and Settings\Janne\Application Data\Hamachi
    2008-05-12 19:06 --------- d-----w C:\Program Files\SmartFTP Client
    2008-05-07 13:44 --------- d-----w C:\Documents and Settings\Janne\Application Data\SmartFTP
    2008-05-03 19:38 --------- d-----w C:\Program Files\uTorrent
    2008-04-16 13:24 --------- d-----w C:\Documents and Settings\Janne\Application Data\LimeWire
    2008-03-26 05:33 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
    2008-03-26 05:33 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
    2008-03-26 05:33 22,328 ----a-w C:\Documents and Settings\Janne\Application Data\PnkBstrK.sys
    2008-03-26 05:33 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2007-11-20 15:52 290 ----a-w C:\Documents and Settings\Hamachi\uninstall.dat
    2007-11-20 15:50 622,880 ----a-w C:\Documents and Settings\Hamachi\hamachi.exe
    2007-11-20 15:50 29,760 ----a-w C:\Documents and Settings\Hamachi\nicmgr.exe
    2007-11-20 15:50 149,288 ----a-w C:\Documents and Settings\Hamachi\uninstall.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-06-05_ 0.04.04.18 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-06-04 20:59:57 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-09 09:17:15 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
    "Steam"="c:\program files\steam\steam.exe" [2008-03-28 09:23 1271032]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40 2577632]
    "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-15 15:59 262401]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 04:10 49263]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
    "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-01 19:24 1177368]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
    "Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [2005-12-13 15:13 1976544]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
    antiwpa.dll 2005-09-18 03:32 5376 C:\WINDOWS\system32\antiwpa.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.asv2"= asusasv2.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Adobe Reader Speed Launch.lnk]
    backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Logitech SetPoint.lnk]
    backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\80c4299b]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS SmartDoctor]
    --a------ 2006-02-21 23:23 1073152 C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiTrayTools]
    --a------ 2006-04-17 08:24 505344 C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM83f71a07]
    C:\WINDOWS\system32\foixntsa.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comrade.exe]
    --a------ 2007-06-29 16:03 36864 C:\Program Files\GameSpy\Comrade\Comrade.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
    --a------ 2007-08-16 14:24 167368 C:\Program Files\DAEMON Tools\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GameFace Messenger]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Services]
    --a------ 2006-02-04 04:18 253952 C:\WINDOWS\WinVNC.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
    --a------ 2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Update]


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Update Machine]


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --------- 2004-10-13 19:24 1694208 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    --a------ 2007-12-05 02:41 8523776 C:\WINDOWS\system32\NvCpl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
    --a------ 2004-12-06 13:06 532480 C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
    --a------ 2007-12-05 02:41 81920 C:\WINDOWS\system32\NvMcTray.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]
    --a------ 2004-12-20 18:12 131072 C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    --a------ 2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services]
    --a------ 2006-02-13 19:33 214648 C:\Program Files\Octoshape Streaming Services\Janne\OctoshapeClient.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerStrip]
    --a------ 2004-02-08 02:00 617984 c:\program files\powerstrip\pstrip.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon]
    --a------ 2007-10-30 21:05 2650112 C:\Program Files\RivaTuner v2.06\RivaTuner.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
    --a------ 2004-11-15 13:20 77824 C:\WINDOWS\SOUNDMAN.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
    -ra------ 2006-12-18 16:34 868352 C:\Program Files\Analog Devices\Core\smax4pnp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spyware Doctor]
    --a------ 2005-12-13 15:13 1976544 C:\Program Files\Spyware Doctor\swdoctor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Start WingMan Profiler]
    --a------ 2005-04-18 11:16 73728 C:\Program Files\Logitech\Profiler\lwemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearchWHSE]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
    --a------ 2006-10-25 08:37 35328 C:\Program Files\Winamp\winampa.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows svchost]


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows UDP Control]
    -r-hs---- 2008-05-29 21:43 86340 C:\WINDOWS\winudspm.exe

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\mIRC\\mirc.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\WINDOWS\\WinVNC.exe"=
    "C:\\Program Files\\Steam\\SteamApps\\dujez\\counter-strike\\hl.exe"=
    "C:\\Program Files\\Octoshape Streaming Services\\Janne\\OctoshapeClient.exe"=
    "C:\\Documents and Settings\\Hamachi\\hamachi.exe"=
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\uTorrent\\utorrent.exe"=
    "C:\\Documents and Settings\\hamachi.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Steam\\steam.exe"=
    "C:\\Program Files\\Sierra\\Half Life\\hl.exe"=
    "C:\\Program Files\\Steam\\SteamApps\\jermuz\\counter-strike\\hl.exe"=
    "C:\\Program Files\\mIRC2\\mirc.exe"=
    "E:\\Omat\\LimeWire\\LimeWire.exe"=
    "C:\\Program Files\\Steam\\SteamApps\\cool@jippii.fi\\counter-strike source\\hl2.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
    "E:\\Omat\\The All-Seeing Eye\\eye.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "18036:TCP"= 18036:TCP:BitComet 18036 TCP
    "18036:UDP"= 18036:UDP:BitComet 18036 UDP

    R0 AmdAcpi;AmdAcpi Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\AmdAcpi.sys [2006-09-05 17:04]
    R1 atitray;atitray;C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [2006-03-01 00:55]
    R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-01 19:25]
    R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-08-07 16:17]
    R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-01 19:24]
    R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-01 19:24]
    R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-01 19:25]
    R2 PStrip;PStrip;C:\WINDOWS\system32\drivers\PStrip.sys [2001-07-24 03:31]
    R3 AmdTools;AMD Special Tools Driver;C:\WINDOWS\system32\DRIVERS\AmdTools.sys [2006-08-24 16:37]
    S0 NVStrap;NVStrap;C:\WINDOWS\system32\drivers\NVStrap.sys [2007-10-30 21:05]
    S1 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb32.sys [2005-10-20 17:25]
    S3 avgntdd;avgntdd;C:\PROGRAM FILES\AVPERSONAL\AVGNTDD.SYS []
    S3 GPU-Z;GPU-Z;C:\DOCUME~1\Janne\LOCALS~1\Temp\GPU-Z.sys []
    S3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys []

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{adc6f37a-f717-11da-996e-806d6172696f}]
    \Shell\AutoRun\command - D:\ASUSACPI.exe

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-06-09 14:36:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-09 18:21:25
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\vsdatant]
    "ImagePath"=""
    .
    Completion time: 2008-06-09 18:22:32
    ComboFix-quarantined-files.txt 2008-06-09 15:22:16

    Pre-Run: 26,504,245,248 tavua vapaana
    Post-Run: 26,512,101,376 tavua vapaana

    282 --- E O F --- 2008-05-16 04:53:54

    =============================================================================================================================================================


    Ja tässä Malwarebytesin logi:


    Malwarebytes' Anti-Malware 1.15
    Tietokantaversio: 842

    19:10:08 9.6.2008
    mbam-log-6-9-2008 (19-10-08).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|E:\|)
    Tarkistetut kohteet: 122464
    Kulunut aika: 41 minute(s), 53 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 1
    Saastuneita rekisteriavaimia: 4
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 32

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    C:\WINDOWS\system32\antiwpa.dll (Malware.Tool) -> Unloaded module successfully.

    Saastuneita rekisteriavaimia:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\antiwpa (Malware.Tool) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    C:\Program Files\mIRC\mirc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\ddcBULfE.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\geBtRkiF.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\iifefCRL.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\khfFWppo.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\pmnkLCTK.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\tuvUKawU.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\tuvVolmL.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\wvUkHApm.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\yayvWoNh.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP470\A0106217.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP473\A0107701.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP473\A0107732.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP473\A0107800.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP474\A0107812.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP474\A0116952.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP476\A0117274.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP476\A0118367.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP476\A0118368.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP477\A0119469.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP477\A0119473.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP477\A0119475.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP477\A0119476.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP477\A0119480.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP477\A0119486.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP477\A0119487.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP477\A0119491.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP477\A0119493.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{0716243C-5BD6-4F5B-91F9-C6AA55651396}\RP480\A0121815.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\WINDOWS\winudspm.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\antiwpa.dll (Malware.Tool) -> Delete on reboot.
    C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

     
    jUDESii, Jun 9, 2008
    #3
  4. Hujo

    Hujo Guest

    Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

    Tallenna se nimellä CFScript.txt

    Sitten raahaa CFScript ComboFix.exeen kuten alla.
    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

    =======

    sitten sulla on siellä koneella kaksi virus ohjelmaa
    avg8 ja antivir kumpi käytössä
    Avast! tuostakin jäänne.
     
    Last edited by a moderator: Jun 9, 2008
    Hujo, Jun 9, 2008
    #4
  5. jUDESii

    jUDESii Regular member

    Joined:
    May 31, 2008
    Messages:
    164
    Likes Received:
    0
    Trophy Points:
    26
    Tein kuten sanoit ja tässä nyt se uusi ComboFix logi:

    ComboFix 08-06-03.4 - Janne 2008-06-09 19:40:50.3 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1581 [GMT 3:00]
    Running from: C:\Documents and Settings\Janne\Työpöytä\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Janne\Työpöytä\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\WINDOWS\winudspm.exe
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-09 to 2008-06-09 )))))))))))))))))
    .

    2008-06-09 18:18 . 2008-06-09 18:18 <KANSIO> d-------- C:\Documents and Settings\Janne\Application Data\Malwarebytes
    2008-06-09 18:18 . 2008-06-09 18:18 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-09 18:18 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-06-09 18:18 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-06-09 15:17 . 2008-06-09 19:34 <KANSIO> d-------- C:\Program Files\mIRC
    2008-06-02 19:48 . 2008-06-02 19:48 2,560 --a------ C:\WINDOWS\system32\vngievbk.exe
    2008-06-02 11:13 . 2008-06-02 11:36 <KANSIO> d--h----- C:\WINDOWS\$AVG8.VAULT$
    2008-06-01 22:00 . 2008-06-01 22:00 <KANSIO> d-------- C:\Documents and Settings\Janne\Application Data\Grisoft
    2008-06-01 21:59 . 2008-06-02 12:03 <KANSIO> d-------- C:\Program Files\AVG Anti-Spyware 7.5
    2008-06-01 21:59 . 2008-06-01 21:59 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-06-01 21:59 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-06-01 19:43 . 2008-06-02 12:14 345 --ahs---- C:\WINDOWS\system32\qAdLRqru.ini
    2008-06-01 19:25 . 2008-06-01 19:25 <KANSIO> d-------- C:\WINDOWS\system32\drivers\Avg
    2008-06-01 19:25 . 2008-06-01 19:25 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
    2008-06-01 19:25 . 2008-06-01 19:25 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
    2008-06-01 19:25 . 2008-06-01 19:25 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
    2008-06-01 19:24 . 2008-06-01 19:24 <KANSIO> d-------- C:\Program Files\AVG
    2008-06-01 19:24 . 2008-06-01 19:24 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\avg8
    2008-06-01 15:43 . 2008-06-01 15:47 345 --ahs---- C:\WINDOWS\system32\GPoqYcdd.ini
    2008-06-01 13:59 . 2008-06-01 14:22 345 --ahs---- C:\WINDOWS\system32\StEfOUvw.ini
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
    2008-06-01 00:59 . 2006-06-08 18:28 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
    2008-06-01 00:59 . 2006-06-08 18:28 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
    2008-06-01 00:59 . 2008-06-01 00:59 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja
    2008-05-31 23:38 . 2008-05-31 23:38 <KANSIO> d-------- C:\Program Files\Avast!
    2008-05-31 23:21 . 2008-05-31 23:21 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-05-31 15:37 . 2008-05-31 15:37 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-05-31 14:16 . 2008-06-01 13:17 345 --ahs---- C:\WINDOWS\system32\IOqtsBeg.ini
    2008-05-18 17:51 . 2008-05-18 17:51 624,416 --a------ C:\Documents and Settings\hamachi.exe
    2008-05-18 17:51 . 2008-05-18 17:51 149,800 --a------ C:\Documents and Settings\uninstall.exe
    2008-05-18 17:51 . 2008-05-18 17:51 43,420 --a------ C:\Documents and Settings\hamachi.lng
    2008-05-18 17:51 . 2008-05-18 17:51 3,744 --a------ C:\Documents and Settings\hamachi.ttf
    2008-05-18 17:51 . 2008-05-18 17:51 1,322 --a------ C:\Documents and Settings\uninstall.lng
    2008-05-18 17:51 . 2008-05-18 17:51 264 --a------ C:\Documents and Settings\hamachi.key
    2008-05-12 22:06 . 2008-05-12 22:06 <KANSIO> d-------- C:\Program Files\SmartFTP Client 3.0 Setup Files

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-09 16:14 --------- d-----w C:\Program Files\Steam
    2008-06-04 22:16 --------- d-----w C:\Documents and Settings\Janne\Application Data\uTorrent
    2008-06-03 14:27 --------- d-----w C:\Program Files\mIRC2
    2008-06-02 10:15 --------- d-----w C:\Program Files\MSN Messenger
    2008-06-01 10:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-06-01 10:46 --------- d-----w C:\Program Files\GameFace Messenger
    2008-06-01 10:46 --------- d-----w C:\Program Files\ASUS
    2008-05-19 20:07 --------- d-----w C:\Documents and Settings\Janne\Application Data\Hamachi
    2008-05-12 19:06 --------- d-----w C:\Program Files\SmartFTP Client
    2008-05-07 13:44 --------- d-----w C:\Documents and Settings\Janne\Application Data\SmartFTP
    2008-05-03 19:38 --------- d-----w C:\Program Files\uTorrent
    2008-04-16 13:24 --------- d-----w C:\Documents and Settings\Janne\Application Data\LimeWire
    2008-03-26 05:33 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
    2008-03-26 05:33 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
    2008-03-26 05:33 22,328 ----a-w C:\Documents and Settings\Janne\Application Data\PnkBstrK.sys
    2008-03-26 05:33 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2007-11-20 15:52 290 ----a-w C:\Documents and Settings\Hamachi\uninstall.dat
    2007-11-20 15:50 622,880 ----a-w C:\Documents and Settings\Hamachi\hamachi.exe
    2007-11-20 15:50 29,760 ----a-w C:\Documents and Settings\Hamachi\nicmgr.exe
    2007-11-20 15:50 149,288 ----a-w C:\Documents and Settings\Hamachi\uninstall.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-06-05_ 0.04.04.18 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-06-04 20:59:57 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-09 16:12:15 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
    "Steam"="c:\program files\steam\steam.exe" [2008-03-28 09:23 1271032]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40 2577632]
    "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-15 15:59 262401]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 04:10 49263]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
    "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-01 19:24 1177368]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
    "Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [2005-12-13 15:13 1976544]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.asv2"= asusasv2.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Adobe Reader Speed Launch.lnk]
    backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Logitech SetPoint.lnk]
    backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\80c4299b]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS SmartDoctor]
    --a------ 2006-02-21 23:23 1073152 C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiTrayTools]
    --a------ 2006-04-17 08:24 505344 C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM83f71a07]
    C:\WINDOWS\system32\foixntsa.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comrade.exe]
    --a------ 2007-06-29 16:03 36864 C:\Program Files\GameSpy\Comrade\Comrade.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
    --a------ 2007-08-16 14:24 167368 C:\Program Files\DAEMON Tools\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GameFace Messenger]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Services]
    --a------ 2006-02-04 04:18 253952 C:\WINDOWS\WinVNC.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
    --a------ 2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Update]


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Update Machine]


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --------- 2004-10-13 19:24 1694208 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    --a------ 2007-12-05 02:41 8523776 C:\WINDOWS\system32\NvCpl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
    --a------ 2004-12-06 13:06 532480 C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
    --a------ 2007-12-05 02:41 81920 C:\WINDOWS\system32\NvMcTray.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]
    --a------ 2004-12-20 18:12 131072 C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    --a------ 2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services]
    --a------ 2006-02-13 19:33 214648 C:\Program Files\Octoshape Streaming Services\Janne\OctoshapeClient.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerStrip]
    --a------ 2004-02-08 02:00 617984 c:\program files\powerstrip\pstrip.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon]
    --a------ 2007-10-30 21:05 2650112 C:\Program Files\RivaTuner v2.06\RivaTuner.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
    --a------ 2004-11-15 13:20 77824 C:\WINDOWS\SOUNDMAN.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
    -ra------ 2006-12-18 16:34 868352 C:\Program Files\Analog Devices\Core\smax4pnp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spyware Doctor]
    --a------ 2005-12-13 15:13 1976544 C:\Program Files\Spyware Doctor\swdoctor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Start WingMan Profiler]
    --a------ 2005-04-18 11:16 73728 C:\Program Files\Logitech\Profiler\lwemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearchWHSE]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
    --a------ 2006-10-25 08:37 35328 C:\Program Files\Winamp\winampa.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows svchost]


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows UDP Control]


    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\mIRC\\mirc.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\WINDOWS\\WinVNC.exe"=
    "C:\\Program Files\\Steam\\SteamApps\\dujez\\counter-strike\\hl.exe"=
    "C:\\Program Files\\Octoshape Streaming Services\\Janne\\OctoshapeClient.exe"=
    "C:\\Documents and Settings\\Hamachi\\hamachi.exe"=
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\uTorrent\\utorrent.exe"=
    "C:\\Documents and Settings\\hamachi.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Steam\\steam.exe"=
    "C:\\Program Files\\Sierra\\Half Life\\hl.exe"=
    "C:\\Program Files\\Steam\\SteamApps\\jermuz\\counter-strike\\hl.exe"=
    "C:\\Program Files\\mIRC2\\mirc.exe"=
    "E:\\Omat\\LimeWire\\LimeWire.exe"=
    "C:\\Program Files\\Steam\\SteamApps\\cool@jippii.fi\\counter-strike source\\hl2.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
    "E:\\Omat\\The All-Seeing Eye\\eye.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "18036:TCP"= 18036:TCP:BitComet 18036 TCP
    "18036:UDP"= 18036:UDP:BitComet 18036 UDP

    R0 AmdAcpi;AmdAcpi Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\AmdAcpi.sys [2006-09-05 17:04]
    R1 atitray;atitray;C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [2006-03-01 00:55]
    R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-01 19:25]
    R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-08-07 16:17]
    R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-01 19:24]
    R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-01 19:24]
    R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-01 19:25]
    R2 PStrip;PStrip;C:\WINDOWS\system32\drivers\PStrip.sys [2001-07-24 03:31]
    R3 AmdTools;AMD Special Tools Driver;C:\WINDOWS\system32\DRIVERS\AmdTools.sys [2006-08-24 16:37]
    S0 NVStrap;NVStrap;C:\WINDOWS\system32\drivers\NVStrap.sys [2007-10-30 21:05]
    S1 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb32.sys [2005-10-20 17:25]
    S3 avgntdd;avgntdd;C:\PROGRAM FILES\AVPERSONAL\AVGNTDD.SYS []
    S3 GPU-Z;GPU-Z;C:\DOCUME~1\Janne\LOCALS~1\Temp\GPU-Z.sys []
    S3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys []

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{adc6f37a-f717-11da-996e-806d6172696f}]
    \Shell\AutoRun\command - D:\ASUSACPI.exe

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-06-09 16:36:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-09 19:42:22
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\vsdatant]
    "ImagePath"=""
    .
    Completion time: 2008-06-09 19:43:30
    ComboFix-quarantined-files.txt 2008-06-09 16:43:16
    ComboFix2.txt 2008-06-09 15:22:33

    Pre-Run: 29,758,959,616 tavua vapaana
    Post-Run: 29,765,754,880 tavua vapaana

    234 --- E O F --- 2008-05-16 04:53:54


    Ja AntiVir on käytössä, mut jos koitan sammuttaa tota AVG:tä, vinee että:
    "AVGTray is the main component of AVG. By closing it you will no longer be able to manage and monitor all other components. Do you really want to close AVGTray application?"

    Avastikin asennettu vissii joskus muttei ole päällä/käytössä.
     
    jUDESii, Jun 9, 2008
    #5
  6. Hujo

    Hujo Guest

    1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
    2. Valitse ominaisuudet
    3. Valitse järjestelmän palauttaminen välilehti
    4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
    5. Paina Käytä
    6. Paina ok
    7. Sammuta ja käynnistä
    8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
    9. Käytä ja OK

    ===========

    scannaa uusi combofix ja uudestaan Malwarebytes' Anti-Malware ajo
     
    Hujo, Jun 9, 2008
    #6
  7. jUDESii

    jUDESii Regular member

    Joined:
    May 31, 2008
    Messages:
    164
    Likes Received:
    0
    Trophy Points:
    26
    Noniin eli jälleen on tehty kuten sanoit ja scannattu combofixi:llä sekä Malwarebytes' Anti-Malware:lla, tässä logit:

    ComboFix:

    ComboFix 08-06-03.4 - Janne 2008-06-09 20:21:47.4 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1528 [GMT 3:00]
    Running from: C:\Documents and Settings\Janne\Työpöytä\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-09 to 2008-06-09 )))))))))))))))))
    .

    2008-06-09 18:18 . 2008-06-09 18:18 <KANSIO> d-------- C:\Documents and Settings\Janne\Application Data\Malwarebytes
    2008-06-09 18:18 . 2008-06-09 18:18 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-09 18:18 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-06-09 18:18 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-06-09 15:17 . 2008-06-09 20:16 <KANSIO> d-------- C:\Program Files\mIRC
    2008-06-02 19:48 . 2008-06-02 19:48 2,560 --a------ C:\WINDOWS\system32\vngievbk.exe
    2008-06-02 11:13 . 2008-06-02 11:36 <KANSIO> d--h----- C:\WINDOWS\$AVG8.VAULT$
    2008-06-01 22:00 . 2008-06-01 22:00 <KANSIO> d-------- C:\Documents and Settings\Janne\Application Data\Grisoft
    2008-06-01 21:59 . 2008-06-02 12:03 <KANSIO> d-------- C:\Program Files\AVG Anti-Spyware 7.5
    2008-06-01 21:59 . 2008-06-01 21:59 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-06-01 21:59 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-06-01 19:43 . 2008-06-02 12:14 345 --ahs---- C:\WINDOWS\system32\qAdLRqru.ini
    2008-06-01 19:25 . 2008-06-01 19:25 <KANSIO> d-------- C:\WINDOWS\system32\drivers\Avg
    2008-06-01 19:25 . 2008-06-01 19:25 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
    2008-06-01 19:25 . 2008-06-01 19:25 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
    2008-06-01 19:25 . 2008-06-01 19:25 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
    2008-06-01 19:24 . 2008-06-01 19:24 <KANSIO> d-------- C:\Program Files\AVG
    2008-06-01 19:24 . 2008-06-01 19:24 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\avg8
    2008-06-01 15:43 . 2008-06-01 15:47 345 --ahs---- C:\WINDOWS\system32\GPoqYcdd.ini
    2008-06-01 13:59 . 2008-06-01 14:22 345 --ahs---- C:\WINDOWS\system32\StEfOUvw.ini
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
    2008-06-01 00:59 . 2006-06-08 18:28 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
    2008-06-01 00:59 . 2006-06-08 18:28 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
    2008-06-01 00:59 . 2006-06-08 21:23 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
    2008-06-01 00:59 . 2008-06-01 00:59 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja
    2008-05-31 23:38 . 2008-05-31 23:38 <KANSIO> d-------- C:\Program Files\Avast!
    2008-05-31 23:21 . 2008-05-31 23:21 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-05-31 15:37 . 2008-05-31 15:37 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-05-31 14:16 . 2008-06-01 13:17 345 --ahs---- C:\WINDOWS\system32\IOqtsBeg.ini
    2008-05-18 17:51 . 2008-05-18 17:51 624,416 --a------ C:\Documents and Settings\hamachi.exe
    2008-05-18 17:51 . 2008-05-18 17:51 149,800 --a------ C:\Documents and Settings\uninstall.exe
    2008-05-18 17:51 . 2008-05-18 17:51 43,420 --a------ C:\Documents and Settings\hamachi.lng
    2008-05-18 17:51 . 2008-05-18 17:51 3,744 --a------ C:\Documents and Settings\hamachi.ttf
    2008-05-18 17:51 . 2008-05-18 17:51 1,322 --a------ C:\Documents and Settings\uninstall.lng
    2008-05-18 17:51 . 2008-05-18 17:51 264 --a------ C:\Documents and Settings\hamachi.key
    2008-05-12 22:06 . 2008-05-12 22:06 <KANSIO> d-------- C:\Program Files\SmartFTP Client 3.0 Setup Files

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-09 17:18 --------- d-----w C:\Program Files\Steam
    2008-06-09 16:52 --------- d-----w C:\Program Files\mIRC2
    2008-06-04 22:16 --------- d-----w C:\Documents and Settings\Janne\Application Data\uTorrent
    2008-06-02 10:15 --------- d-----w C:\Program Files\MSN Messenger
    2008-06-01 10:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-06-01 10:46 --------- d-----w C:\Program Files\GameFace Messenger
    2008-06-01 10:46 --------- d-----w C:\Program Files\ASUS
    2008-05-19 20:07 --------- d-----w C:\Documents and Settings\Janne\Application Data\Hamachi
    2008-05-12 19:06 --------- d-----w C:\Program Files\SmartFTP Client
    2008-05-07 13:44 --------- d-----w C:\Documents and Settings\Janne\Application Data\SmartFTP
    2008-05-03 19:38 --------- d-----w C:\Program Files\uTorrent
    2008-04-16 13:24 --------- d-----w C:\Documents and Settings\Janne\Application Data\LimeWire
    2008-03-26 05:33 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
    2008-03-26 05:33 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
    2008-03-26 05:33 22,328 ----a-w C:\Documents and Settings\Janne\Application Data\PnkBstrK.sys
    2008-03-26 05:33 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2007-11-20 15:52 290 ----a-w C:\Documents and Settings\Hamachi\uninstall.dat
    2007-11-20 15:50 622,880 ----a-w C:\Documents and Settings\Hamachi\hamachi.exe
    2007-11-20 15:50 29,760 ----a-w C:\Documents and Settings\Hamachi\nicmgr.exe
    2007-11-20 15:50 149,288 ----a-w C:\Documents and Settings\Hamachi\uninstall.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-06-05_ 0.04.04.18 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-06-04 20:59:57 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-09 17:18:19 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
    "Steam"="c:\program files\steam\steam.exe" [2008-03-28 09:23 1271032]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40 2577632]
    "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-15 15:59 262401]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 04:10 49263]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
    "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-01 19:24 1177368]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
    "Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [2005-12-13 15:13 1976544]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.asv2"= asusasv2.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Adobe Reader Speed Launch.lnk]
    backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Logitech SetPoint.lnk]
    backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\80c4299b]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS SmartDoctor]
    --a------ 2006-02-21 23:23 1073152 C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiTrayTools]
    --a------ 2006-04-17 08:24 505344 C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM83f71a07]
    C:\WINDOWS\system32\foixntsa.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comrade.exe]
    --a------ 2007-06-29 16:03 36864 C:\Program Files\GameSpy\Comrade\Comrade.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
    --a------ 2007-08-16 14:24 167368 C:\Program Files\DAEMON Tools\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GameFace Messenger]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Services]
    --a------ 2006-02-04 04:18 253952 C:\WINDOWS\WinVNC.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
    --a------ 2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Update]


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Update Machine]


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --------- 2004-10-13 19:24 1694208 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    --a------ 2007-12-05 02:41 8523776 C:\WINDOWS\system32\NvCpl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
    --a------ 2004-12-06 13:06 532480 C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
    --a------ 2007-12-05 02:41 81920 C:\WINDOWS\system32\NvMcTray.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]
    --a------ 2004-12-20 18:12 131072 C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    --a------ 2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services]
    --a------ 2006-02-13 19:33 214648 C:\Program Files\Octoshape Streaming Services\Janne\OctoshapeClient.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerStrip]
    --a------ 2004-02-08 02:00 617984 c:\program files\powerstrip\pstrip.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon]
    --a------ 2007-10-30 21:05 2650112 C:\Program Files\RivaTuner v2.06\RivaTuner.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
    --a------ 2004-11-15 13:20 77824 C:\WINDOWS\SOUNDMAN.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
    -ra------ 2006-12-18 16:34 868352 C:\Program Files\Analog Devices\Core\smax4pnp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spyware Doctor]
    --a------ 2005-12-13 15:13 1976544 C:\Program Files\Spyware Doctor\swdoctor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Start WingMan Profiler]
    --a------ 2005-04-18 11:16 73728 C:\Program Files\Logitech\Profiler\lwemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearchWHSE]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
    --a------ 2006-10-25 08:37 35328 C:\Program Files\Winamp\winampa.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows svchost]


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows UDP Control]


    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\mIRC\\mirc.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\WINDOWS\\WinVNC.exe"=
    "C:\\Program Files\\Steam\\SteamApps\\dujez\\counter-strike\\hl.exe"=
    "C:\\Program Files\\Octoshape Streaming Services\\Janne\\OctoshapeClient.exe"=
    "C:\\Documents and Settings\\Hamachi\\hamachi.exe"=
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\uTorrent\\utorrent.exe"=
    "C:\\Documents and Settings\\hamachi.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Steam\\steam.exe"=
    "C:\\Program Files\\Sierra\\Half Life\\hl.exe"=
    "C:\\Program Files\\Steam\\SteamApps\\jermuz\\counter-strike\\hl.exe"=
    "C:\\Program Files\\mIRC2\\mirc.exe"=
    "E:\\Omat\\LimeWire\\LimeWire.exe"=
    "C:\\Program Files\\Steam\\SteamApps\\cool@jippii.fi\\counter-strike source\\hl2.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
    "E:\\Omat\\The All-Seeing Eye\\eye.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "18036:TCP"= 18036:TCP:BitComet 18036 TCP
    "18036:UDP"= 18036:UDP:BitComet 18036 UDP

    R0 AmdAcpi;AmdAcpi Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\AmdAcpi.sys [2006-09-05 17:04]
    R1 atitray;atitray;C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [2006-03-01 00:55]
    R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-01 19:25]
    R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-08-07 16:17]
    R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-01 19:24]
    R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-01 19:24]
    R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-01 19:25]
    R2 PStrip;PStrip;C:\WINDOWS\system32\drivers\PStrip.sys [2001-07-24 03:31]
    R3 AmdTools;AMD Special Tools Driver;C:\WINDOWS\system32\DRIVERS\AmdTools.sys [2006-08-24 16:37]
    S0 NVStrap;NVStrap;C:\WINDOWS\system32\drivers\NVStrap.sys [2007-10-30 21:05]
    S1 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb32.sys [2005-10-20 17:25]
    S3 avgntdd;avgntdd;C:\PROGRAM FILES\AVPERSONAL\AVGNTDD.SYS []
    S3 GPU-Z;GPU-Z;C:\DOCUME~1\Janne\LOCALS~1\Temp\GPU-Z.sys []
    S3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys []

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{adc6f37a-f717-11da-996e-806d6172696f}]
    \Shell\AutoRun\command - D:\ASUSACPI.exe

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-06-09 16:36:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-09 20:23:42
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    C:\WINDOWS\TEMP\2f756195-7fe1-4a8e-ba00-c0fd395779cf.tmp

    scan completed successfully
    hidden files: 1

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\vsdatant]
    "ImagePath"=""
    .
    Completion time: 2008-06-09 20:24:54
    ComboFix-quarantined-files.txt 2008-06-09 17:24:35
    ComboFix2.txt 2008-06-09 16:43:31
    ComboFix3.txt 2008-06-09 15:22:33

    Pre-Run: 32,983,277,568 tavua vapaana
    Post-Run: 32,967,847,936 tavua vapaana

    232 --- E O F --- 2008-05-16 04:53:54


    ===================================================================================================================================

    Malwarebytes' Anti-Malware

    Malwarebytes' Anti-Malware 1.15
    Tietokantaversio: 842

    21:02:27 9.6.2008
    mbam-log-6-9-2008 (21-02-27).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|E:\|)
    Tarkistetut kohteet: 107714
    Kulunut aika: 35 minute(s), 1 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 1

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    C:\Program Files\mIRC\mirc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
     
    jUDESii, Jun 9, 2008
    #7
  8. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, Jun 9, 2008
    #8
  9. jUDESii

    jUDESii Regular member

    Joined:
    May 31, 2008
    Messages:
    164
    Likes Received:
    0
    Trophy Points:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:49:13, on 9.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\program files\steam\steam.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\ATKKBService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Globe Software\StatBar\StatBar.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?5c2d5a97a091453e8db44cba91fe7d67
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?5c2d5a97a091453e8db44cba91fe7d67
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
    O23 - Service: AVG Anti-Spyware Guard - Unknown owner - C:\Documents and Settings\Janne\Työpöytä\AVG Anti-Spyware 7.5\guard.exe (file missing)
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
    O23 - Service: Messengerin jaettavien kansioiden USN Journal -lokin lukupalvelu (usnjsvc) - Unknown owner - C:\Program Files\MSN Messenger\usnsvc.exe (file missing)

    --
    End of file - 7200 bytes
     
    jUDESii, Jun 9, 2008
    #9
  10. Hujo

    Hujo Guest

    sulla on siellä avg8 ja antivir koneella toisesta pitää luopua :)
     
    Hujo, Jun 9, 2008
    #10
  11. jUDESii

    jUDESii Regular member

    Joined:
    May 31, 2008
    Messages:
    164
    Likes Received:
    0
    Trophy Points:
    26
    Joo no pelkään että jotai käy jos poistan ton AVG, ku se valitti tosta minkä pastesin, jos yrittää sulkee. Mut voiko vaan poistaa "Lisää/Poista sovellus" -kohdasta iha normisti, niin ettei käy mitään?

    Ja mahtaskoha sul olla vastausta miks toi Malwarebytesi vines mirc.exe:stä.. Ei siinä mitää vikaa pitäs olla eikä ennen oo vinenny mikää ohjelma siitä. Tosin noi virukset System Volume Information:ssa johti mIRC:iin, ja häiritsi kaikkii urleja mitä avasin mircin kautta. (aukes IE:llä ja sekos täysin).
     
    jUDESii, Jun 9, 2008
    #11
  12. Hujo

    Hujo Guest

    juu poista avg ja poista sen kansio vikasiedossa

    nii noi työstökaslut tuppaa noinkin tehdä
    mutta pakkohan niitä on käyttää
     
    Hujo, Jun 9, 2008
    #12
  13. jUDESii

    jUDESii Regular member

    Joined:
    May 31, 2008
    Messages:
    164
    Likes Received:
    0
    Trophy Points:
    26
    Jooh.. Siitä lähti AVG poies.. Kiitoksii neuvoista, eli nyt ei pitäs enää olla viruksia, mitä ny ite sain noista logeista selvää?
     
    jUDESii, Jun 9, 2008
    #13
  14. Hujo

    Hujo Guest

    ei munkaan silmään osu
     
    Hujo, Jun 9, 2008
    #14
  15. jUDESii

    jUDESii Regular member

    Joined:
    May 31, 2008
    Messages:
    164
    Likes Received:
    0
    Trophy Points:
    26
    Juu, hyvä. Kiitoksii viel kerran avusta :D
     
    jUDESii, Jun 9, 2008
    #15
  16. jUDESii

    jUDESii Regular member

    Joined:
    May 31, 2008
    Messages:
    164
    Likes Received:
    0
    Trophy Points:
    26
    Morjesta taas. Pääs tossa taas jostai syystä C:\System Volume Information kansioon taas samantyyppinen virus tunkeutumaan mitä saatiin eilen poistettua toistakymmentä, eli ajankos nyt taas vaan Malwarebytesillä, vai? Ja jos jota logeja tarviit?
     
    jUDESii, Jun 10, 2008
    #16
  17. jUDESii

    jUDESii Regular member

    Joined:
    May 31, 2008
    Messages:
    164
    Likes Received:
    0
    Trophy Points:
    26
    Eli...? :D
     
    jUDESii, Jun 10, 2008
    #17
  18. Hujo

    Hujo Guest

    Malwarebytesillä tuolla vaan
     
    Hujo, Jun 10, 2008
    #18
  19. jUDESii

    jUDESii Regular member

    Joined:
    May 31, 2008
    Messages:
    164
    Likes Received:
    0
    Trophy Points:
    26
    Jooh, eli skannasin Malwarebytesillä ja löys yhen windowsin kansiosta, mut ei mitää sieltä C:\System Volume Information:sta. AntiVir vaan kokoaja varottaa että siellä jotai, samanlaisia mitä oli pari päivääki sit. Eli jos sais jotain neuvoja miten sais ne pois sieltä, tässä nyt vaik HJT-logi jos sillä teet jotain.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:07:53, on 11.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\ATKKBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Globe Software\StatBar\StatBar.exe
    C:\Program Files\mIRC\mirc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Steam\Steam.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?5c2d5a97a091453e8db44cba91fe7d67
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?5c2d5a97a091453e8db44cba91fe7d67
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - blank (file missing)
    O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
    O23 - Service: AVG Anti-Spyware Guard - Unknown owner - C:\Documents and Settings\Janne\Työpöytä\AVG Anti-Spyware 7.5\guard.exe (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
    O23 - Service: Messengerin jaettavien kansioiden USN Journal -lokin lukupalvelu (usnjsvc) - Unknown owner - C:\Program Files\MSN Messenger\usnsvc.exe (file missing)

    --
    End of file - 6804 bytes
     
    jUDESii, Jun 11, 2008
    #19
  20. jUDESii

    jUDESii Regular member

    Joined:
    May 31, 2008
    Messages:
    164
    Likes Received:
    0
    Trophy Points:
    26
    Sano vaan jos tarviit jotain muitaki lokeja
     
    jUDESii, Jun 11, 2008
    #20

Share This Page