Virusongelma

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by kumiorava, Apr 15, 2008.

  1. kumiorava

    kumiorava Regular member

    Joined:
    Mar 26, 2005
    Messages:
    310
    Likes Received:
    0
    Trophy Points:
    26
    No niinhän siinä sittem kävi että menin painamaan sitä väärää nappulaa ja melko uusi kone sai jonkinasteisen infektion.

    MAhdollisia viruksen tai muun aiheuttamia oireita:
    1.näyttöön tulee silloin tällöin joku "security center" screen joka ohjaa sivulle, joka mainostaa jotain spywaren poisto-ohjelmia. Tämän yhteydessä tuonne oikeaan alareunaan muiden käynnissä olevien ohjelmien joukkoon tulee "varoituskolmio", jota kun painaa niin pääsee samalle sivulle kuin edellisessä.
    2.en pääse tehtävienhallintaan ctrl+alt+del yhdistelmän kautta
    3.Internet Explorerilla selaamisesta ei tule yhtään mitään kun se koko ajan heittää jollekkin ihme sivuille missä tarotaan mitä erilaisempia pc:n siivousohjelmia.

    muita ongelmia:
    1. symantec löysi infostealer.gampass viruksen, jota se ei osaa poistaa
    2. Symantec huomauttaa vähän väliä että se on torjunut jonkun troijalaisen tai muun hyökkäyksen konetta vastaan.
    3. Järjestelmän palauttaminenkaan ei onnistunut. Windows vaan ilmoitti että tapahtui joku tuntematon virhe syystä tuntematon...

    Adawarella ja AVG anti-spywarella ajoin scannit ja infektioita löytyi reippaasti päälle 100. Molemmilla ohjelmilla suoritin ohjelmien tarjoamat toimenpiteet.

    Ongelmia siis riittää ja nyt tässä viimeisin Hijackthis logi pureskeltavaksi. Jos tähän onkelmaan ratkaisu löytyisi niin olisin kyllä erityisen kiitollinen. Torstaina lähden takaisin inttiin, jossa internettiin pääseminen ongelma, jootta vähän kiire olisi asialla. Kiitoksia tuhannesti teille asianne osaaville.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:34:49, on 15.4.2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16609)
    Boot mode: Normal

    Running processes:
    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\WLANExt.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\ATK Hotkey\ASLDRSrv.exe
    C:\Program Files\ATKGFNEX\GFNEXSrv.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    C:\Windows\system32\ifxspmgt.exe
    C:\Windows\system32\ifxtcs.exe
    C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Windows\system32\IfxPsdSv.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Spyware Doctor\pctsAuxs.exe
    C:\Program Files\Spyware Doctor\pctsSvc.exe
    C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\servicing\TrustedInstaller.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
    C:\Program Files\ASUS\ASUS Live Update\ALU.exe
    C:\Program Files\ATK Hotkey\Hcontrol.exe
    C:\Program Files\ATKOSD2\ATKOSD2.exe
    C:\Program Files\Wireless Console 2\wcourier.exe
    C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
    C:\Program Files\P4G\BatteryLife.exe
    C:\Program Files\ASUS\Splendid\ACMON.exe
    C:\Windows\System32\ACEngSvr.exe
    C:\ProgramData\zqbupexg\nytyfwjc.exe
    C:\Program Files\ATK Hotkey\ATKOSD.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE
    C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ASUS\ATK Media\DMedia.exe
    C:\Program Files\P4P\P4P.exe
    C:\Program Files\ATK Hotkey\KBFiltr.exe
    C:\Windows\ASScrPro.exe
    C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
    C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Spyware Doctor\pctsTray.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Windows\System32\zcxenytg.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\Infineon\Security Platform Software\PSDrt.exe
    C:\Program Files\Infineon\Security Platform Software\SpTna.exe
    C:\Program Files\Spyware Doctor\pctsGui.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\rundll32.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wermgr.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
    O2 - BHO: (no name) - {3484EB5F-6599-411F-8169-1171991BD71C} - C:\Windows\system32\ljJyWqqp.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: DVA Storm - {D3593B96-4822-434E-82B4-A54C29FCC7F5} - C:\Windows\lgmxvpatdbr.dll
    O2 - BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll
    O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
    O3 - Toolbar: qtvglped - {41B15C1C-2C15-49E4-B6A4-C940F885290E} - C:\Windows\qtvglped.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
    O4 - HKLM\..\Run: [PowerForPhone] "C:\Program Files\P4P\P4P.exe"
    O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe
    O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe
    O4 - HKLM\..\Run: [IFXSPMGT] C:\Windows\system32\ifxspmgt.exe /NotifyLogon
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
    O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\opnNHwXP.dll,#1
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
    O4 - HKLM\..\Run: [0c9cf2bb] rundll32.exe "C:\Windows\system32\nyvgklqa.dll",b
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
    O4 - HKCU\..\Run: [jlksqzrq] C:\Windows\system32\zcxenytg.exe
    O4 - HKLM\..\Policies\Explorer\Run: [Wt6Mrq19nv] C:\ProgramData\zqbupexg\nytyfwjc.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: ASUS Security Protect Manager e-Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
    O9 - Extra 'Tools' menuitem: ASUS Security Protect Manager e-&Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O20 - AppInit_DLLs: APSHook.dll
    O21 - SSODL: pmsoarbf - {498133E0-DA6D-4629-A020-409385506FC4} - C:\Windows\pmsoarbf.dll
    O21 - SSODL: omlbpkaw - {D9D8BEFE-40A5-46E8-AC4B-B1E678D9B958} - C:\Windows\omlbpkaw.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
    O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\Windows\system32\ifxspmgt.exe
    O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\Windows\system32\ifxtcs.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Windows\system32\IfxPsdSv.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
    O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

    --
    End of file - 13584 bytes

    Käyttiksenä siis WIndows Vista Home Premium

    edit: ongelma numero 3 lisätty
     
    Last edited: Apr 15, 2008
    kumiorava, Apr 15, 2008
    #1
  2. Hujo

    Hujo Guest

    Koneesa ei ole muuta kuin pelkää ongelmaa ;)

    ===========

    Avaa Windows Defender.
    Klikkaa Tools ja General Settings.
    Selaa alas ja ota rasti pois Turn on real-time protection (recommended)-kohdasta.
    Tämän jälkeen klikkaa Save ja sulje Windows Defender.

    ===========

    Lataa TÄSTÄ VundoFix.exe työpöydällesi.

    Tupla-klikkaa VundoFix.exe ajaaksesi sen.
    Klikkaa Scan for Vundo valintaa.
    Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
    Sinulta kysytään haluatko poistaa filut - klikkaa YES.
    Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
    Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
    Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

    Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
    Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.

    ===========

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    =============

    Lataa SmitfraudFix (c) S!Ri
    Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

    Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita ponnahtava rapport – muistion sisältö viestiketjuusi.
    Löytyy myös C:\rapport.txt

    Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
    (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
    A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
    silloin ne saattavat varoittaa käyttäjää.

    =============

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.

    ===========

    Älä käyttä nyt järjestelmän palautusta ollenkaan
     
    Last edited by a moderator: Apr 15, 2008
    Hujo, Apr 15, 2008
    #2
  3. kumiorava

    kumiorava Regular member

    Joined:
    Mar 26, 2005
    Messages:
    310
    Likes Received:
    0
    Trophy Points:
    26
    Vundofix ei mitään löytänyt.

    Tuorein HJT loki:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:31:54, on 15.4.2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16609)
    Boot mode: Normal

    Running processes:
    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Windows\system32\WLANExt.exe
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\ATK Hotkey\ASLDRSrv.exe
    C:\Program Files\ATKGFNEX\GFNEXSrv.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    C:\Windows\system32\ifxspmgt.exe
    C:\Windows\system32\ifxtcs.exe
    C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Windows\system32\IfxPsdSv.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Spyware Doctor\pctsAuxs.exe
    C:\Program Files\Spyware Doctor\pctsSvc.exe
    C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
    C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
    C:\Program Files\ASUS\ASUS Live Update\ALU.exe
    C:\Program Files\ATK Hotkey\Hcontrol.exe
    C:\Program Files\ATKOSD2\ATKOSD2.exe
    C:\Program Files\Wireless Console 2\wcourier.exe
    C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
    C:\Program Files\P4G\BatteryLife.exe
    C:\Program Files\ASUS\Splendid\ACMON.exe
    C:\Windows\System32\ACEngSvr.exe
    C:\Windows\system32\conime.exe
    C:\Program Files\ATK Hotkey\ATKOSD.exe
    C:\Program Files\ATK Hotkey\KBFiltr.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE
    C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ASUS\ATK Media\DMedia.exe
    C:\Windows\ASScrPro.exe
    C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
    C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Spyware Doctor\pctsTray.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Infineon\Security Platform Software\PSDrt.exe
    C:\Program Files\Infineon\Security Platform Software\SpTna.exe
    C:\Windows\Explorer.exe
    C:\Windows\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\notepad.exe
    C:\Windows\system32\NOTEPAD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
    O4 - HKLM\..\Run: [PowerForPhone] "C:\Program Files\P4P\P4P.exe"
    O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe
    O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe
    O4 - HKLM\..\Run: [IFXSPMGT] C:\Windows\system32\ifxspmgt.exe /NotifyLogon
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: ASUS Security Protect Manager e-Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
    O9 - Extra 'Tools' menuitem: ASUS Security Protect Manager e-&Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O20 - AppInit_DLLs: APSHook.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
    O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\Windows\system32\ifxspmgt.exe
    O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\Windows\system32\ifxtcs.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Windows\system32\IfxPsdSv.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
    O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

    --
    End of file - 12286 bytes

    _________________________________________


    Combofix loki:
    ComboFix 08-04-14.2 - Taneli 2008-04-15 15:11:13.1 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1035.18.1757 [GMT 3:00]
    Running from: C:\Users\Taneli\Desktop\ComboFix.exe
    * Created a new restore point
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Program Files\akl
    C:\Program Files\akl\akl.dll
    C:\Program Files\akl\akl.exe
    C:\Program Files\akl\uninstall.exe
    C:\Program Files\akl\unsetup.exe
    C:\Program Files\p4p
    C:\Program Files\p4p\Bookmark.ini
    C:\Program Files\p4p\P4P.exe
    C:\Program Files\p4p\RING.WAV
    C:\Program Files\PC-Cleaner
    C:\Users\Taneli\Desktopblackbird.jpg
    C:\Users\Taneli\DesktopEditorFKWP1.5.exe
    C:\Users\Taneli\DesktopEditorFKWP2.0.exe
    C:\Users\Taneli\Desktopfilemanagerclient.exe
    C:\Users\Taneli\Desktopfkwp1.5.exe
    C:\Users\Taneli\Desktopfkwp2.0.exe
    C:\Users\Taneli\Desktopfwebd.exe
    C:\Users\Taneli\DesktopFWebdEditor.exe
    C:\Users\Taneli\DesktopTrojan.Win32.BlackBird.exe
    C:\Users\Taneli\Desktopvirii
    C:\Windows\a.bat
    C:\Windows\base64.tmp
    C:\Windows\bdn.com
    C:\Windows\FVProtect.exe
    C:\Windows\iTunesMusic.exe
    C:\Windows\mslagent
    C:\Windows\mslagent\2_mslagent.dll
    C:\Windows\mslagent\mslagent.exe
    C:\Windows\mslagent\uninstall.exe
    C:\Windows\mssecu.exe
    C:\Windows\system32\aokokghr.dll
    C:\Windows\system32\ljJaxYsp.dll
    C:\Windows\system32\ljJyWqqp.dll
    C:\Windows\system32\pmnNFwuV.dll
    C:\Windows\System32\pqqWyJjl.ini
    C:\Windows\System32\pqqWyJjl.ini2
    C:\Windows\System32\psYxaJjl.ini
    C:\Windows\System32\psYxaJjl.ini2
    C:\Windows\System32\rhgkokoa.ini
    C:\Windows\system32\ssqPfcca.dll
    C:\Windows\System32\VuwFNnmp.ini
    C:\Windows\System32\VuwFNnmp.ini2
    C:\Windows\system32\xxywWqOI.dll
    C:\Windows\system32akttzn.exe
    C:\Windows\system32anticipator.dll
    C:\Windows\system32awtoolb.dll
    C:\Windows\system32bdn.com
    C:\Windows\system32bsva-egihsg52.exe
    C:\Windows\system32dpcproxy.exe
    C:\Windows\system32emesx.dll
    C:\Windows\system32h@tkeysh@@k.dll
    C:\Windows\system32hoproxy.dll
    C:\Windows\system32hxiwlgpm.dat
    C:\Windows\system32hxiwlgpm.exe
    C:\Windows\system32medup012.dll
    C:\Windows\system32medup020.dll
    C:\Windows\system32msgp.exe
    C:\Windows\system32msnbho.dll
    C:\Windows\system32mssecu.exe
    C:\Windows\system32msvchost.exe
    C:\Windows\system32mtr2.exe
    C:\Windows\system32mwin32.exe
    C:\Windows\system32netode.exe
    C:\Windows\system32newsd32.exe
    C:\Windows\system32ps1.exe
    C:\Windows\system32psof1.exe
    C:\Windows\system32psoft1.exe
    C:\Windows\system32regc64.dll
    C:\Windows\system32regm64.dll
    C:\Windows\system32Rundl1.exe
    C:\Windows\system32smp
    C:\Windows\system32smp\msrc.exe
    C:\Windows\system32sncntr.exe
    C:\Windows\system32ssurf022.dll
    C:\Windows\system32ssvchost.com
    C:\Windows\system32ssvchost.exe
    C:\Windows\system32sysreq.exe
    C:\Windows\system32taack.dat
    C:\Windows\system32taack.exe
    C:\Windows\system32temp#01.exe
    C:\Windows\system32thun.dll
    C:\Windows\system32thun32.dll
    C:\Windows\system32VBIEWER.OCX
    C:\Windows\system32vbsys2.dll
    C:\Windows\system32vcatchpi.dll
    C:\Windows\system32winlogonpc.exe
    C:\Windows\system32winsystem.exe
    C:\Windows\system32WINWGPX.EXE
    C:\Windows\userconfig9x.dll
    C:\Windows\Web\def.htm
    C:\Windows\winsystem.exe
    C:\Windows\zip1.tmp
    C:\Windows\zip2.tmp
    C:\Windows\zip3.tmp
    C:\Windows\zipped.tmp

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-03-15 to 2008-04-15 )))))))))))))))))
    .

    2008-04-15 15:55 . 2008-04-15 15:55 110,592 --a------ C:\Windows\System32\jwfwnmto.exe
    2008-04-15 14:40 . 2008-04-15 14:40 <KANSIO> d-------- C:\VundoFix Backups
    2008-04-15 08:34 . 2008-04-15 08:34 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-04-15 08:22 . 2008-04-15 13:22 474 ---hs---- C:\Windows\System32\aqlkgvyn.ini
    2008-04-15 07:53 . 2008-04-15 07:53 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\PC Tools
    2008-04-15 07:53 . 2008-04-15 15:54 <KANSIO> d-a------ C:\ProgramData\TEMP
    2008-04-15 07:53 . 2008-04-15 07:55 <KANSIO> d-------- C:\Program Files\Spyware Doctor
    2008-04-15 07:53 . 2007-12-10 13:53 81,288 --a------ C:\Windows\System32\drivers\iksyssec.sys
    2008-04-15 07:53 . 2007-12-10 13:53 66,952 --a------ C:\Windows\System32\drivers\iksysflt.sys
    2008-04-15 07:53 . 2008-02-01 11:55 42,376 --a------ C:\Windows\System32\drivers\ikfilesec.sys
    2008-04-15 07:53 . 2007-12-10 13:53 29,576 --a------ C:\Windows\System32\drivers\kcom.sys
    2008-04-15 03:05 . 2008-04-15 03:06 <KANSIO> d-------- C:\ProgramData\Lavasoft
    2008-04-15 03:05 . 2008-04-15 03:05 <KANSIO> d-------- C:\Program Files\Lavasoft
    2008-04-15 03:04 . 2008-04-15 03:04 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-04-15 02:52 . 2008-04-15 02:52 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Grisoft
    2008-04-15 02:52 . 2008-04-15 02:52 <KANSIO> d-------- C:\ProgramData\Grisoft
    2008-04-15 02:52 . 2007-05-30 15:10 10,872 --a------ C:\Windows\System32\drivers\AvgAsCln.sys
    2008-04-14 20:39 . 2008-04-15 08:13 354 ---hs---- C:\Windows\System32\adknoxcj.ini
    2008-04-14 20:24 . 2008-04-14 20:24 <KANSIO> d-------- C:\ProgramData\zqbupexg
    2008-04-14 20:24 . 2008-04-14 19:49 290,816 --a------ C:\Windows\lgmxvpatdbr.dll
    2008-04-14 20:24 . 2008-04-14 19:49 217,088 --a------ C:\Windows\omlbpkaw.dll
    2008-04-14 20:24 . 2008-04-14 19:49 172,032 --a------ C:\Windows\pmsoarbf.dll
    2008-04-14 20:24 . 2008-04-14 19:49 151,552 --a------ C:\Windows\qtvglped.dll
    2008-04-14 20:24 . 2008-04-14 19:49 94,208 --a------ C:\Windows\npqtsrak.exe
    2008-04-14 20:24 . 2008-04-14 20:24 90,112 --a------ C:\Windows\System32\zcxenytg.exe
    2008-04-14 20:24 . 2008-04-14 19:49 81,920 --a------ C:\Windows\rtqmekwg.exe
    2008-04-12 18:19 . 2008-04-12 19:42 <KANSIO> d-------- C:\Program Files\Windows Live
    2008-04-12 18:19 . 2008-04-12 19:42 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-04-12 18:18 . 2008-04-12 18:18 <KANSIO> d-------- C:\ProgramData\WLInstaller
    2008-04-11 13:15 . 2008-04-11 13:15 249,856 --------- C:\Windows\Setup1.exe
    2008-04-11 13:15 . 2008-04-11 13:15 73,216 --a------ C:\Windows\ST6UNST.EXE
    2008-04-11 09:00 . 2008-04-11 09:00 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\ASUS Security Protect Manager
    2008-04-10 21:31 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Searches
    2008-04-10 21:31 . 2008-04-10 21:31 <KANSIO> d-------- C:\Users\Riikka\AppData\Roaming\Infineon
    2008-04-10 21:30 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Contacts
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Videos
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Saved Games
    2008-04-10 21:29 . 2008-03-17 14:02 <KANSIO> d-------- C:\Users\Riikka\Roaming
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Pictures
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Music
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Links
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Downloads
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Documents
    2008-04-10 21:29 . 2006-11-02 15:37 <KANSIO> d-------- C:\Users\Riikka\AppData\Roaming\Media Center Programs
    2008-04-10 21:29 . 2008-04-10 21:31 <KANSIO> d--h----- C:\Users\Riikka\AppData
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> d-------- C:\Users\Riikka
    2008-04-08 19:28 . 2008-04-08 19:28 <KANSIO> d-------- C:\Program Files\EA Games
    2008-04-07 21:58 . 2008-04-08 19:48 <KANSIO> d-------- C:\Program Files\RegCleaner
    2008-04-07 18:13 . 2008-04-07 18:13 <KANSIO> d-------- C:\Program Files\ASUS Security Center
    2008-04-06 23:54 . 2008-04-06 23:54 <KANSIO> d-------- C:\Program Files\SINOSUN
    2008-04-06 23:54 . 2006-06-16 18:13 42,579 --a------ C:\Windows\System32\drivers\PrivateDisk.sys
    2008-04-06 22:11 . 2008-04-06 22:11 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
    2008-04-06 20:26 . 2008-04-06 20:26 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Ahead
    2008-04-06 17:18 . 2008-04-10 19:34 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\dvdcss
    2008-04-06 13:07 . 2008-04-06 13:07 <KANSIO> d-------- C:\ProgramData\LightScribe
    2008-04-06 11:37 . 2008-04-06 11:37 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\DAEMON Tools
    2008-04-06 11:37 . 2008-04-06 11:37 717,296 --a------ C:\Windows\System32\drivers\sptd.sys
    2008-04-06 08:11 . 2008-04-06 08:11 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\BSplayer Pro
    2008-04-06 08:11 . 2008-04-06 08:20 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\BSplayer
    2008-04-06 08:11 . 2008-04-06 08:11 <KANSIO> d-------- C:\Program Files\Webteh
    2008-04-06 03:06 . 2008-04-06 03:06 194,560 --a------ C:\Windows\System32\WebClnt.dll
    2008-04-06 03:06 . 2008-04-06 03:06 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
    2008-04-06 03:04 . 2008-04-06 03:04 <KANSIO> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2008-04-06 03:04 . 2008-04-06 03:04 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
    2008-04-06 03:04 . 2008-04-06 03:04 41,984 --a------ C:\Windows\System32\drivers\monitor.sys
    2008-04-05 17:22 . 2008-04-14 19:32 89,214 --a------ C:\Users\Taneli\AppData\Roaming\nvModes.dat
    2008-04-05 15:56 . 2008-04-05 15:56 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Miranda
    2008-04-05 15:56 . 2008-04-05 15:56 <KANSIO> d-------- C:\Program Files\Miranda IM
    2008-04-05 15:28 . 2008-04-05 15:35 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Mp3tag
    2008-04-05 15:28 . 2008-04-05 15:28 <KANSIO> d-------- C:\Program Files\Mp3tag
    2008-04-05 14:39 . 2008-04-14 17:58 49 --a------ C:\Windows\NeroDigital.ini
    2008-04-05 14:02 . 2008-04-05 14:02 <KANSIO> d-------- C:\Program Files\Nokia
    2008-04-05 14:01 . 2008-04-15 08:01 <KANSIO> d-------- C:\Program Files\Common Files\LightScribe
    2008-04-05 13:59 . 2008-04-05 13:59 <KANSIO> d-------- C:\ProgramData\Nero
    2008-04-05 13:59 . 2008-04-05 13:59 <KANSIO> d-------- C:\Program Files\Nero
    2008-04-05 13:59 . 2008-04-05 14:00 <KANSIO> d-------- C:\Program Files\Common Files\Ahead
    2008-04-05 13:38 . 2008-04-05 13:38 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Thunderbird
    2008-04-05 13:38 . 2008-04-05 13:38 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Talkback
    2008-04-05 13:38 . 2008-04-05 13:38 <KANSIO> d-------- C:\Program Files\Mozilla Thunderbird
    2008-04-05 13:37 . 2008-04-05 13:37 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\vlc
    2008-04-05 13:00 . 2008-04-14 20:16 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\uTorrent
    2008-04-05 13:00 . 2008-04-05 13:00 <KANSIO> d-------- C:\Program Files\uTorrent
    2008-04-05 12:17 . 2008-04-05 12:17 <KANSIO> d-------- C:\Program Files\Common Files\SWF Studio
    2008-04-05 12:17 . 2000-05-22 11:58 647,872 --------- C:\Windows\System32\Mscomct2.ocx
    2008-04-05 12:17 . 1999-10-11 04:00 41,984 --------- C:\Windows\Ctregrun.exe
    2008-04-05 12:16 . 1999-06-25 10:55 149,504 --a------ C:\Windows\UNWISE.EXE
    2008-04-05 12:11 . 2008-04-05 23:18 <KANSIO> d-------- C:\Program Files\Creative
    2008-04-05 12:09 . 2008-04-05 12:09 16 --a------ C:\Windows\System32\coh.cache
    2008-04-05 12:07 . 2008-04-11 09:20 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\foobar2000
    2008-04-05 12:04 . 2008-04-05 12:04 <KANSIO> d-------- C:\Program Files\VideoLAN
    2008-04-05 12:03 . 2008-04-05 12:03 <KANSIO> d-------- C:\Program Files\foobar2000
    2008-04-05 11:57 . 2008-04-05 11:57 0 --a------ C:\Windows\nsreg.dat
    2008-04-05 11:56 . 2008-04-05 11:56 1,712,984 --a------ C:\Windows\System32\wuaueng.dll
    2008-04-05 11:56 . 2008-04-05 11:56 1,524,224 --a------ C:\Windows\System32\wucltux.dll
    2008-04-05 11:56 . 2008-04-05 11:56 53,080 --a------ C:\Windows\System32\wuauclt.exe
    2008-04-05 11:56 . 2008-04-05 11:56 43,352 --a------ C:\Windows\System32\wups2.dll
    2008-04-05 11:55 . 2008-04-05 11:55 549,720 --a------ C:\Windows\System32\wuapi.dll
    2008-04-05 11:55 . 2008-04-05 11:55 163,000 --a------ C:\Windows\System32\wuwebv.dll
    2008-04-05 11:55 . 2008-04-05 11:55 80,896 --a------ C:\Windows\System32\wudriver.dll
    2008-04-05 11:55 . 2008-04-05 11:55 33,624 --a------ C:\Windows\System32\wups.dll

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-06 00:16 --------- d-----w C:\Program Files\Windows Sidebar
    2008-04-06 00:16 --------- d-----w C:\Program Files\Windows Mail
    2008-04-06 00:03 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
    2008-04-06 00:01 824,832 ----a-w C:\Windows\System32\wininet.dll
    2008-04-06 00:01 56,320 ----a-w C:\Windows\System32\iesetup.dll
    2008-04-06 00:01 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
    2008-04-06 00:01 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
    2008-04-05 10:37 --------- d-----w C:\Users\Taneli\AppData\Roaming\vlc
    2008-03-17 10:47 319,456 ----a-w C:\Windows\DIFxAPI.dll
    2008-03-17 10:17 174 --sha-w C:\Program Files\desktop.ini
    2008-03-17 10:13 --------- d-----w C:\Program Files\Windows Defender
    2008-03-17 10:13 --------- d-----w C:\Program Files\Windows Calendar
    2008-03-17 09:15 88,576 ----a-w C:\Windows\System32\avifil32.dll
    2008-03-17 09:14 8,192 ----a-w C:\Windows\System32\riched32.dll
    2008-03-17 08:56 160,872 ----a-w C:\Windows\System32\halmacpi.dll
    2008-03-17 08:56 134,760 ----a-w C:\Windows\System32\halacpi.dll
    .

    (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D3593B96-4822-434E-82B4-A54C29FCC7F5}]
    2008-04-14 19:49 290816 --a------ C:\Windows\lgmxvpatdbr.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{41B15C1C-2C15-49E4-B6A4-C940F885290E}"= "C:\Windows\qtvglped.dll" [2008-04-14 19:49 151552]

    [HKEY_CLASSES_ROOT\clsid\{41b15c1c-2c15-49e4-b6a4-c940f885290e}]
    [HKEY_CLASSES_ROOT\qtvglped.1]
    [HKEY_CLASSES_ROOT\TypeLib\{ECF15ED5-D379-484F-9B33-356630682F1C}]
    [HKEY_CLASSES_ROOT\qtvglped]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 15:35 125440]
    "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 15:36 201728]
    "LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-06-20 12:49 451872]
    "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 12:39 486856]
    "jlksqzrq"="C:\Windows\system32\zcxenytg.exe" [2008-04-14 20:24 90112]
    "vjyfunip"="C:\Windows\system32\jwfwnmto.exe" [2008-04-15 15:55 110592]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-03-17 12:01 1006264]
    "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-05 13:17 86016]
    "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-05 13:17 8534560]
    "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-05 13:17 81920]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 00:58 115816]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-08-27 08:10 4702208 C:\Windows\RtHDVCpl.exe]
    "Skytel"="Skytel.exe" [2007-08-03 08:22 1826816 C:\Windows\SkyTel.exe]
    "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-10-24 05:02 178712]
    "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-24 20:31 630784]
    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-03 00:24 857648]
    "ATKMEDIA"="C:\Program Files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 18:27 61440]
    "PowerForPhone"="C:\Program Files\P4P\P4P.exe" [ ]
    "ASUS Camera ScreenSaver"="C:\Windows\ASScrProlog.exe" [2008-03-17 14:22 37232]
    "ASUS Screen Saver Protector"="C:\Windows\ASScrPro.exe" [2008-03-17 14:23 33136]
    "IFXSPMGT"="C:\Windows\system32\ifxspmgt.exe" [2007-02-26 06:29 677408]
    "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
    "SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [2007-06-01 10:06 1629744]
    "InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe" [2007-06-01 10:05 1057328]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
    "CognizanceTS"="C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll" [2003-12-22 05:12 17920]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]
    "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-02-01 11:55 1103240]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
    "Wt6Mrq19nv"= C:\ProgramData\zqbupexg\nytyfwjc.exe

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{C14E6230-757D-4246-81CE-B34E2940C722}"= C:\Windows\system32\xxywWqOI.dll [ ]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    "pmsoarbf"= {498133E0-DA6D-4629-A020-409385506FC4} - C:\Windows\pmsoarbf.dll [2008-04-14 19:49 172032]
    "omlbpkaw"= {D9D8BEFE-40A5-46E8-AC4B-B1E678D9B958} - C:\Windows\omlbpkaw.dll [2008-04-14 19:49 217088]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UacDisableNotify"=dword:00000001
    "InternetSettingsDisableNotify"=dword:00000001
    "AutoUpdateDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{B7C18FE5-8C7C-467A-8019-84A12062E95F}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "{26D0F558-1907-4B86-9B37-E20FF300460E}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{987FA836-853D-47C1-96E7-E8B2538FBEB4}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{F678EA31-D085-4070-A22B-E4116D035E22}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{78A5D15E-56E2-4A94-B1C2-32DF9B7760EA}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{7F576416-BF94-4EDA-B8F2-56A0C02C4824}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
    "EnableFirewall"= 0 (0x0)

    R0 lullaby;lullaby;C:\Windows\system32\DRIVERS\lullaby.sys [2007-09-27 01:03]
    R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080407.003\IDSvix86.sys [2008-03-12 08:30]
    R1 ItSDisk;ItSDisk;C:\Windows\system32\Drivers\ItSDisk.sys [2006-05-17 01:14]
    R1 PersonalSecureDrive;PersonalSecureDrive;C:\Windows\system32\drivers\psd.sys [2007-01-23 15:07]
    R2 ASBroker;Logon Session Broker;C:\Windows\System32\svchost.exe [2006-11-02 12:45]
    R2 ASChannel;Local Communication Channel;C:\Windows\System32\svchost.exe [2006-11-02 12:45]
    R2 HFGService;Handsfree Headset Service;C:\Windows\system32\svchost.exe [2006-11-02 12:45]
    R2 PrivateDiskDriver;Private Encrypted Virtual Disk Driver;C:\Windows\system32\drivers\PrivateDisk.sys [2006-06-16 18:13]
    R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;C:\Windows\system32\DRIVERS\l160x86.sys [2007-10-31 14:55]
    R3 DCamUSBET;USB2.0 1.3M UVC WebCam;C:\Windows\system32\DRIVERS\etDevice.sys [2007-09-06 11:43]
    R3 FiltUSBET;ET USB Device Lower Filter;C:\Windows\system32\DRIVERS\etFilter.sys [2007-10-15 10:39]
    R3 ScanUSBET;ET USB Still Image Capture Device;C:\Windows\system32\DRIVERS\etScan.sys [2007-09-06 18:45]
    R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-01-09 17:31]
    S3 BthAudioHF;BthAudioHF-palvelu;C:\Windows\system32\DRIVERS\BthAudioHF.sys [2008-03-17 13:53]
    S3 bthav;Bluetooth-AV-profiili;C:\Windows\system32\drivers\bthav.sys [2008-03-17 13:53]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bthsvcs REG_MULTI_SZ BthServ
    GPSvcGroup REG_MULTI_SZ GPSvc
    bthaudiosvc REG_MULTI_SZ HFGService
    Cognizance REG_MULTI_SZ ASBroker ASChannel

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94bb1e85-040c-11dd-ad8c-000ea6f33381}]
    \shell\AutoRun\command - F:\autorun.exe

    *Newly Created Service* - COMHOST

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
    .
    'Ajoitetut teht„v„t'-kansion sis„lt”
    "2008-04-14 17:28:20 C:\Windows\Tasks\Norton Internet Security - Run Full System Scan - Taneli.job"
    - C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeB/TASK:
    "2008-04-15 09:00:05 C:\Windows\Tasks\Security Platform Backup Schedule.job"
    - C:\Program Files\Infineon\Security Platform Software\SpBackupWz.exe
    .
    **************************************************************************

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-15 15:55:17
    Windows 6.0.6000 NTFS

    detected NTDLL code modification:
    ZwClose

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Windows\System32\audiodg.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Windows\System32\wlanext.exe
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\ATK Hotkey\ASLDRSrv.exe
    C:\Program Files\ATKGFNEX\GFNEXSrv.exe
    C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMON.EXE
    C:\Windows\System32\IFXTCS.exe
    C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Windows\System32\IfxPsdSv.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Spyware Doctor\pctsAuxs.exe
    C:\Program Files\Spyware Doctor\pctsSvc.exe
    C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
    C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\asghost.exe
    C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
    C:\Program Files\ASUS\ASUS Live Update\ALU.exe
    C:\Program Files\ATK Hotkey\HControl.exe
    C:\Program Files\ATKOSD2\ATKOSD2.exe
    C:\Program Files\Wireless Console 2\wcourier.exe
    C:\Program Files\ASUS\ASUS CopyProtect\ASPG.exe
    C:\Program Files\P4G\BatteryLife.exe
    C:\Program Files\ASUS\Splendid\ACMON.exe
    C:\Windows\System32\ACEngSvr.exe
    C:\Windows\System32\conime.exe
    C:\Program Files\ATK Hotkey\ATKOSD.exe
    C:\Program Files\ATK Hotkey\KBFiltr.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\System32\regsvr32.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Infineon\Security Platform Software\PSDrt.exe
    C:\Program Files\Infineon\Security Platform Software\SpTNA.exe
    C:\Windows\System32\wbem\WMIADAP.exe
    C:\Windows\System32\dllhost.exe
    .
    **************************************************************************
    .
    Completion time: 2008-04-15 15:58:24 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-04-15 12:58:16

    Pre-Run: 81,377,071,104 tavua vapaana
    Post-Run: 80,503,406,592 tavua vapaana
    .
    2008-04-15 09:46:27 --- E O F ---


    ______________________________________________________

    SmitFraudFix loki:
    SmitFraudFix v2.314

    Scan done at 16:01:23,13, ti 15.04.2008
    Run from C:\Users\Taneli\Desktop\SmitfraudFix
    OS: Microsoft Windows [versio 6.0.6000] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Windows\system32\WLANExt.exe
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\ATK Hotkey\ASLDRSrv.exe
    C:\Program Files\ATKGFNEX\GFNEXSrv.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    C:\Windows\system32\ifxspmgt.exe
    C:\Windows\system32\ifxtcs.exe
    C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Windows\system32\IfxPsdSv.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Spyware Doctor\pctsAuxs.exe
    C:\Program Files\Spyware Doctor\pctsSvc.exe
    C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
    C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
    C:\Program Files\ASUS\ASUS Live Update\ALU.exe
    C:\Program Files\ATK Hotkey\Hcontrol.exe
    C:\Program Files\ATKOSD2\ATKOSD2.exe
    C:\Program Files\Wireless Console 2\wcourier.exe
    C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
    C:\Program Files\P4G\BatteryLife.exe
    C:\Program Files\ASUS\Splendid\ACMON.exe
    C:\Windows\System32\ACEngSvr.exe
    C:\Windows\system32\conime.exe
    C:\Program Files\ATK Hotkey\ATKOSD.exe
    C:\Program Files\ATK Hotkey\KBFiltr.exe
    C:\Windows\system32\CF12924.exe
    C:\ProgramData\zqbupexg\nytyfwjc.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE
    C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ASUS\ATK Media\DMedia.exe
    C:\Windows\ASScrPro.exe
    C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
    C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Spyware Doctor\pctsTray.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\jwfwnmto.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Infineon\Security Platform Software\PSDrt.exe
    C:\Program Files\Infineon\Security Platform Software\SpTna.exe
    \\?\C:\Windows\system32\wbem\WMIADAP.EXE
    C:\Windows\Explorer.exe
    C:\Windows\system32\notepad.exe
    C:\ComboFix\handle.cfexe
    C:\ComboFix\sed.cfexe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\cmd.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Taneli


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Taneli\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Taneli\FAVORI~1


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, following keys are not inevitably infected!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, following keys are not inevitably infected!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri
    +--------------------------------------------------+
    [!] Suspicious: lgmxvpatdbr.dll
    BHO: DVA Storm - {D3593B96-4822-434E-82B4-A54C29FCC7F5}
    TypeLib: {23034122-FC83-4D09-9452-9840B6545ABF}
    Interface: {3C40E9CB-6EE3-4D48-8D73-1BDBF05A9683}
    Interface: {FD74A196-BE7F-4A94-BA77-B75DDD098CB6}

    [!] Suspicious: qtvglped.dll
    Toolbar: qtvglped - {41B15C1C-2C15-49E4-B6A4-C940F885290E}
    TypeLib: {ECF15ED5-D379-484F-9B33-356630682F1C}
    Interface: {ABBE25B1-BE73-4744-B520-B1C73711C88C}
    Classe: qtvglped.bekb
    Classe: qtvglped.ToolBar.1

    [!] Suspicious: pmsoarbf.dll
    SSODL: pmsoarbf - {498133E0-DA6D-4629-A020-409385506FC4}

    [!] Suspicious: omlbpkaw.dll
    SSODL: omlbpkaw - {D9D8BEFE-40A5-46E8-AC4B-B1E678D9B958}


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"="APSHook.dll"


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Userinit"="C:\\Windows\\system32\\userinit.exe,"
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Rustock



    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Atheros L1 Gigabit Ethernet 10/100/1000Base-T Controller
    DNS Server Search Order: 212.146.0.10
    DNS Server Search Order: 212.146.30.200
    DNS Server Search Order: 212.146.30.201

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{DB97BCE6-88AD-4E22-A361-DA3CE7240CE0}: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{DB97BCE6-88AD-4E22-A361-DA3CE7240CE0}: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{DB97BCE6-88AD-4E22-A361-DA3CE7240CE0}: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End



    _____________________________________________

    Malwarebyte's anti-malware loki:
    Malwarebytes' Anti-Malware 1.11
    Tietokantaversio: 631

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
    Tarkistetut kohteet: 138325
    Kulunut aika: 24 minute(s), 2 second(s)

    Saastuneita muistiprosesseja: 2
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 24
    Saastuneita rekisteriarvoja: 7
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 12

    Saastuneita muistiprosesseja:
    C:\Windows\System32\jwfwnmto.exe (Trojan.FakeAlert) -> Unloaded process successfully.
    C:\ProgramData\zqbupexg\nytyfwjc.exe (Trojan.FakeAlert) -> Unloaded process successfully.

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    HKEY_CLASSES_ROOT\CLSID\{c14e6230-757d-4246-81ce-b34e2940c722} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{abbe25b1-be73-4744-b520-b1c73711c88c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{ecf15ed5-d379-484f-9b33-356630682f1c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{3c40e9cb-6ee3-4d48-8d73-1bdbf05a9683} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{fd74a196-be7f-4a94-ba77-b75ddd098cb6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{23034122-fc83-4d09-9452-9840b6545abf} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{d3593b96-4822-434e-82b4-a54c29fcc7f5} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d3593b96-4822-434e-82b4-a54c29fcc7f5} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\qtvglped.bekb (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{41b15c1c-2c15-49e4-b6a4-c940f885290e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\qtvglped.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{6b56c13c-90bf-44f1-ac8c-e8f7015d92a5} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{d9d8befe-40a5-46e8-ac4b-b1e678d9b958} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{1e11d7be-3dc2-49e9-be69-a24c4f9fc5e5} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{498133e0-da6d-4629-a020-409385506fc4} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jlksqzrq (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjyfunip (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Wt6Mrq19nv (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{c14e6230-757d-4246-81ce-b34e2940c722} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{41b15c1c-2c15-49e4-b6a4-c940f885290e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\omlbpkaw (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\pmsoarbf (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    C:\Windows\System32\zcxenytg.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Windows\System32\jwfwnmto.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\ProgramData\zqbupexg\nytyfwjc.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Windows\lgmxvpatdbr.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Windows\qtvglped.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\Windows\System32\ssqPfcca.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\Windows\System32\xxywWqOI.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\Windows\Web\def.htm.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Windows\npqtsrak.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Windows\omlbpkaw.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Windows\pmsoarbf.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Windows\rtqmekwg.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.



     
    kumiorava, Apr 15, 2008
    #3
  4. Hujo

    Hujo Guest

    ajas uudestaan tuo smitfraudfix sillä optio 1
     
    Hujo, Apr 15, 2008
    #4
  5. kumiorava

    kumiorava Regular member

    Joined:
    Mar 26, 2005
    Messages:
    310
    Likes Received:
    0
    Trophy Points:
    26
    Tässäpä uusi smitfraudfix loki:

    SmitFraudFix v2.314

    Scan done at 18:32:35,35, ti 15.04.2008
    Run from C:\Users\Taneli\Desktop\SmitfraudFix
    OS: Microsoft Windows [versio 6.0.6000] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Windows\system32\WLANExt.exe
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\ATK Hotkey\ASLDRSrv.exe
    C:\Program Files\ATKGFNEX\GFNEXSrv.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    C:\Windows\system32\ifxspmgt.exe
    C:\Windows\system32\ifxtcs.exe
    C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Windows\system32\IfxPsdSv.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Spyware Doctor\pctsAuxs.exe
    C:\Program Files\Spyware Doctor\pctsSvc.exe
    C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
    C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
    C:\Program Files\ASUS\ASUS Live Update\ALU.exe
    C:\Program Files\ATK Hotkey\Hcontrol.exe
    C:\Program Files\ATKOSD2\ATKOSD2.exe
    C:\Program Files\Wireless Console 2\wcourier.exe
    C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
    C:\Program Files\P4G\BatteryLife.exe
    C:\Program Files\ASUS\Splendid\ACMON.exe
    C:\Windows\System32\ACEngSvr.exe
    C:\Windows\system32\conime.exe
    C:\Program Files\ATK Hotkey\ATKOSD.exe
    C:\Program Files\ATK Hotkey\KBFiltr.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE
    C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ASUS\ATK Media\DMedia.exe
    C:\Windows\ASScrPro.exe
    C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
    C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Spyware Doctor\pctsTray.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Infineon\Security Platform Software\PSDrt.exe
    C:\Program Files\Infineon\Security Platform Software\SpTna.exe
    C:\Windows\Explorer.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    \\?\C:\Windows\system32\wbem\WMIADAP.EXE
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\cmd.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Taneli


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Taneli\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Taneli\FAVORI~1


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, following keys are not inevitably infected!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, following keys are not inevitably infected!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"="APSHook.dll"


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Userinit"="C:\\Windows\\system32\\userinit.exe,"
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Rustock



    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Atheros L1 Gigabit Ethernet 10/100/1000Base-T Controller
    DNS Server Search Order: 212.146.0.10
    DNS Server Search Order: 212.146.30.200
    DNS Server Search Order: 212.146.30.201

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{DB97BCE6-88AD-4E22-A361-DA3CE7240CE0}: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{DB97BCE6-88AD-4E22-A361-DA3CE7240CE0}: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{DB97BCE6-88AD-4E22-A361-DA3CE7240CE0}: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End

     
    kumiorava, Apr 15, 2008
    #5
  6. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, Apr 15, 2008
    #6
  7. kumiorava

    kumiorava Regular member

    Joined:
    Mar 26, 2005
    Messages:
    310
    Likes Received:
    0
    Trophy Points:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:10:00, on 15.4.2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16609)
    Boot mode: Normal

    Running processes:
    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Windows\system32\WLANExt.exe
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\ATK Hotkey\ASLDRSrv.exe
    C:\Program Files\ATKGFNEX\GFNEXSrv.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    C:\Windows\system32\ifxspmgt.exe
    C:\Windows\system32\ifxtcs.exe
    C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Windows\system32\IfxPsdSv.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Spyware Doctor\pctsAuxs.exe
    C:\Program Files\Spyware Doctor\pctsSvc.exe
    C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
    C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
    C:\Program Files\ASUS\ASUS Live Update\ALU.exe
    C:\Program Files\ATK Hotkey\Hcontrol.exe
    C:\Program Files\ATKOSD2\ATKOSD2.exe
    C:\Program Files\Wireless Console 2\wcourier.exe
    C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
    C:\Program Files\P4G\BatteryLife.exe
    C:\Program Files\ASUS\Splendid\ACMON.exe
    C:\Windows\System32\ACEngSvr.exe
    C:\Windows\system32\conime.exe
    C:\Program Files\ATK Hotkey\ATKOSD.exe
    C:\Program Files\ATK Hotkey\KBFiltr.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE
    C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ASUS\ATK Media\DMedia.exe
    C:\Windows\ASScrPro.exe
    C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
    C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Spyware Doctor\pctsTray.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Infineon\Security Platform Software\PSDrt.exe
    C:\Program Files\Infineon\Security Platform Software\SpTna.exe
    C:\Windows\Explorer.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Spyware Doctor\pctsGui.exe
    C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\Mozilla Firefox\firefox.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
    O4 - HKLM\..\Run: [PowerForPhone] "C:\Program Files\P4P\P4P.exe"
    O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe
    O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe
    O4 - HKLM\..\Run: [IFXSPMGT] C:\Windows\system32\ifxspmgt.exe /NotifyLogon
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: ASUS Security Protect Manager e-Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
    O9 - Extra 'Tools' menuitem: ASUS Security Protect Manager e-&Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O20 - AppInit_DLLs: APSHook.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
    O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\Windows\system32\ifxspmgt.exe
    O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\Windows\system32\ifxtcs.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Windows\system32\IfxPsdSv.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
    O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

    --
    End of file - 12396 bytes
     
    kumiorava, Apr 15, 2008
    #7
  8. Hujo

    Hujo Guest

    Loki ok kuinkas kone jakselee.
     
    Hujo, Apr 15, 2008
    #8
  9. kumiorava

    kumiorava Regular member

    Joined:
    Mar 26, 2005
    Messages:
    310
    Likes Received:
    0
    Trophy Points:
    26
    paljon paremmin jo! Mm. tehtävienhallinta on jo palannut eikä mainoksia enää tule. Vaikuttaa siltä että saatiin pahimmat sonnat pois koneelta. Kiitoksia paljon! Mihin minä oikein joutuisin ilman afterdawnia...

    AInoastaan tuo spyware doctor vielä löytää jotain sontaa mutta niiden riskitaso on "alhainen". Poistaa niitä ei voi kun tuo on joku kokeiluversio tms. KYllä siellä joukossa näyttää peräti joku troijalainenkin olevan. Saisikohan nämä jollain konstilla vielä pois kun ei niistä kyllä hyötyäkään koneen toiminnalle ole.
     
    Last edited: Apr 15, 2008
    kumiorava, Apr 15, 2008
    #9
  10. Hujo

    Hujo Guest

    ajas tuo combofix uudelleen
     
    Last edited by a moderator: Apr 15, 2008
    Hujo, Apr 15, 2008
    #10
  11. kumiorava

    kumiorava Regular member

    Joined:
    Mar 26, 2005
    Messages:
    310
    Likes Received:
    0
    Trophy Points:
    26
    sen tein... tässä uusin loki. pistän tuon spyware doctorin scannailemaan ja katson mitä tulee...

    ComboFix 08-04-14.2 - Taneli 2008-04-15 21:35:19.2 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1035.18.1610 [GMT 3:00]
    Running from: C:\Users\Taneli\Desktop\ComboFix.exe
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-03-15 to 2008-04-15 )))))))))))))))))
    .

    2008-04-15 16:04 . 2008-04-15 16:04 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Malwarebytes
    2008-04-15 16:04 . 2008-04-15 16:04 <KANSIO> d-------- C:\ProgramData\Malwarebytes
    2008-04-15 16:04 . 2008-04-15 16:04 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-04-15 16:01 . 2008-04-15 18:32 5,176 --a------ C:\Windows\System32\tmp.reg
    2008-04-15 16:00 . 2007-09-06 00:22 289,144 --a------ C:\Windows\System32\VCCLSID.exe
    2008-04-15 16:00 . 2006-04-27 17:49 288,417 --a------ C:\Windows\System32\SrchSTS.exe
    2008-04-15 16:00 . 2008-04-14 19:28 86,528 --a------ C:\Windows\System32\VACFix.exe
    2008-04-15 16:00 . 2008-04-12 13:49 82,432 --a------ C:\Windows\System32\IEDFix.exe
    2008-04-15 16:00 . 2003-06-05 21:13 53,248 --a------ C:\Windows\System32\Process.exe
    2008-04-15 16:00 . 2004-07-31 18:50 51,200 --a------ C:\Windows\System32\dumphive.exe
    2008-04-15 16:00 . 2007-10-04 00:36 25,600 --a------ C:\Windows\System32\WS2Fix.exe
    2008-04-15 14:40 . 2008-04-15 14:40 <KANSIO> d-------- C:\VundoFix Backups
    2008-04-15 08:34 . 2008-04-15 08:34 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-04-15 08:22 . 2008-04-15 13:22 474 ---hs---- C:\Windows\System32\aqlkgvyn.ini
    2008-04-15 07:53 . 2008-04-15 07:53 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\PC Tools
    2008-04-15 07:53 . 2008-04-15 21:19 <KANSIO> d-a------ C:\ProgramData\TEMP
    2008-04-15 07:53 . 2008-04-15 07:55 <KANSIO> d-------- C:\Program Files\Spyware Doctor
    2008-04-15 07:53 . 2007-12-10 13:53 81,288 --a------ C:\Windows\System32\drivers\iksyssec.sys
    2008-04-15 07:53 . 2007-12-10 13:53 66,952 --a------ C:\Windows\System32\drivers\iksysflt.sys
    2008-04-15 07:53 . 2008-02-01 11:55 42,376 --a------ C:\Windows\System32\drivers\ikfilesec.sys
    2008-04-15 07:53 . 2007-12-10 13:53 29,576 --a------ C:\Windows\System32\drivers\kcom.sys
    2008-04-15 03:05 . 2008-04-15 03:06 <KANSIO> d-------- C:\ProgramData\Lavasoft
    2008-04-15 03:05 . 2008-04-15 03:05 <KANSIO> d-------- C:\Program Files\Lavasoft
    2008-04-15 03:04 . 2008-04-15 03:04 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-04-15 02:52 . 2008-04-15 02:52 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Grisoft
    2008-04-15 02:52 . 2008-04-15 02:52 <KANSIO> d-------- C:\ProgramData\Grisoft
    2008-04-15 02:52 . 2007-05-30 15:10 10,872 --a------ C:\Windows\System32\drivers\AvgAsCln.sys
    2008-04-14 20:39 . 2008-04-15 08:13 354 ---hs---- C:\Windows\System32\adknoxcj.ini
    2008-04-14 20:24 . 2008-04-15 16:30 <KANSIO> d-------- C:\ProgramData\zqbupexg
    2008-04-12 18:19 . 2008-04-12 19:42 <KANSIO> d-------- C:\Program Files\Windows Live
    2008-04-12 18:19 . 2008-04-12 19:42 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-04-12 18:18 . 2008-04-12 18:18 <KANSIO> d-------- C:\ProgramData\WLInstaller
    2008-04-11 13:15 . 2008-04-11 13:15 249,856 --------- C:\Windows\Setup1.exe
    2008-04-11 13:15 . 2008-04-11 13:15 73,216 --a------ C:\Windows\ST6UNST.EXE
    2008-04-11 09:00 . 2008-04-11 09:00 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\ASUS Security Protect Manager
    2008-04-10 21:31 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Searches
    2008-04-10 21:31 . 2008-04-10 21:31 <KANSIO> d-------- C:\Users\Riikka\AppData\Roaming\Infineon
    2008-04-10 21:30 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Contacts
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Videos
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Saved Games
    2008-04-10 21:29 . 2008-03-17 14:02 <KANSIO> d-------- C:\Users\Riikka\Roaming
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Pictures
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Music
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Links
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Downloads
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Documents
    2008-04-10 21:29 . 2006-11-02 15:37 <KANSIO> d-------- C:\Users\Riikka\AppData\Roaming\Media Center Programs
    2008-04-10 21:29 . 2008-04-10 21:31 <KANSIO> d--h----- C:\Users\Riikka\AppData
    2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> d-------- C:\Users\Riikka
    2008-04-08 19:28 . 2008-04-08 19:28 <KANSIO> d-------- C:\Program Files\EA Games
    2008-04-07 21:58 . 2008-04-08 19:48 <KANSIO> d-------- C:\Program Files\RegCleaner
    2008-04-07 18:13 . 2008-04-07 18:13 <KANSIO> d-------- C:\Program Files\ASUS Security Center
    2008-04-06 23:54 . 2008-04-06 23:54 <KANSIO> d-------- C:\Program Files\SINOSUN
    2008-04-06 23:54 . 2006-06-16 18:13 42,579 --a------ C:\Windows\System32\drivers\PrivateDisk.sys
    2008-04-06 22:11 . 2008-04-06 22:11 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
    2008-04-06 20:26 . 2008-04-06 20:26 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Ahead
    2008-04-06 17:18 . 2008-04-10 19:34 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\dvdcss
    2008-04-06 13:07 . 2008-04-06 13:07 <KANSIO> d-------- C:\ProgramData\LightScribe
    2008-04-06 11:37 . 2008-04-06 11:37 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\DAEMON Tools
    2008-04-06 11:37 . 2008-04-06 11:37 717,296 --a------ C:\Windows\System32\drivers\sptd.sys
    2008-04-06 08:11 . 2008-04-06 08:11 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\BSplayer Pro
    2008-04-06 08:11 . 2008-04-06 08:20 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\BSplayer
    2008-04-06 08:11 . 2008-04-06 08:11 <KANSIO> d-------- C:\Program Files\Webteh
    2008-04-06 03:06 . 2008-04-06 03:06 194,560 --a------ C:\Windows\System32\WebClnt.dll
    2008-04-06 03:06 . 2008-04-06 03:06 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
    2008-04-06 03:04 . 2008-04-06 03:04 <KANSIO> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2008-04-06 03:04 . 2008-04-06 03:04 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
    2008-04-06 03:04 . 2008-04-06 03:04 41,984 --a------ C:\Windows\System32\drivers\monitor.sys
    2008-04-05 17:22 . 2008-04-14 19:32 89,214 --a------ C:\Users\Taneli\AppData\Roaming\nvModes.dat
    2008-04-05 15:56 . 2008-04-05 15:56 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Miranda
    2008-04-05 15:56 . 2008-04-05 15:56 <KANSIO> d-------- C:\Program Files\Miranda IM
    2008-04-05 15:28 . 2008-04-05 15:35 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Mp3tag
    2008-04-05 15:28 . 2008-04-05 15:28 <KANSIO> d-------- C:\Program Files\Mp3tag
    2008-04-05 14:39 . 2008-04-14 17:58 49 --a------ C:\Windows\NeroDigital.ini
    2008-04-05 14:02 . 2008-04-05 14:02 <KANSIO> d-------- C:\Program Files\Nokia
    2008-04-05 14:01 . 2008-04-15 08:01 <KANSIO> d-------- C:\Program Files\Common Files\LightScribe
    2008-04-05 13:59 . 2008-04-05 13:59 <KANSIO> d-------- C:\ProgramData\Nero
    2008-04-05 13:59 . 2008-04-05 13:59 <KANSIO> d-------- C:\Program Files\Nero
    2008-04-05 13:59 . 2008-04-05 14:00 <KANSIO> d-------- C:\Program Files\Common Files\Ahead
    2008-04-05 13:38 . 2008-04-05 13:38 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Thunderbird
    2008-04-05 13:38 . 2008-04-05 13:38 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Talkback
    2008-04-05 13:38 . 2008-04-05 13:38 <KANSIO> d-------- C:\Program Files\Mozilla Thunderbird
    2008-04-05 13:37 . 2008-04-05 13:37 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\vlc
    2008-04-05 13:00 . 2008-04-14 20:16 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\uTorrent
    2008-04-05 13:00 . 2008-04-05 13:00 <KANSIO> d-------- C:\Program Files\uTorrent
    2008-04-05 12:17 . 2008-04-05 12:17 <KANSIO> d-------- C:\Program Files\Common Files\SWF Studio
    2008-04-05 12:17 . 2000-05-22 11:58 647,872 --------- C:\Windows\System32\Mscomct2.ocx
    2008-04-05 12:17 . 1999-10-11 04:00 41,984 --------- C:\Windows\Ctregrun.exe
    2008-04-05 12:16 . 1999-06-25 10:55 149,504 --a------ C:\Windows\UNWISE.EXE
    2008-04-05 12:11 . 2008-04-05 23:18 <KANSIO> d-------- C:\Program Files\Creative
    2008-04-05 12:09 . 2008-04-05 12:09 16 --a------ C:\Windows\System32\coh.cache
    2008-04-05 12:07 . 2008-04-11 09:20 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\foobar2000
    2008-04-05 12:04 . 2008-04-05 12:04 <KANSIO> d-------- C:\Program Files\VideoLAN
    2008-04-05 12:03 . 2008-04-05 12:03 <KANSIO> d-------- C:\Program Files\foobar2000
    2008-04-05 11:57 . 2008-04-05 11:57 0 --a------ C:\Windows\nsreg.dat
    2008-04-05 11:56 . 2008-04-05 11:56 1,712,984 --a------ C:\Windows\System32\wuaueng.dll
    2008-04-05 11:56 . 2008-04-05 11:56 1,524,224 --a------ C:\Windows\System32\wucltux.dll
    2008-04-05 11:56 . 2008-04-05 11:56 53,080 --a------ C:\Windows\System32\wuauclt.exe
    2008-04-05 11:56 . 2008-04-05 11:56 43,352 --a------ C:\Windows\System32\wups2.dll
    2008-04-05 11:55 . 2008-04-05 11:55 549,720 --a------ C:\Windows\System32\wuapi.dll

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-06 00:16 --------- d-----w C:\Program Files\Windows Sidebar
    2008-04-06 00:16 --------- d-----w C:\Program Files\Windows Mail
    2008-04-06 00:03 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
    2008-04-06 00:01 824,832 ----a-w C:\Windows\System32\wininet.dll
    2008-04-06 00:01 56,320 ----a-w C:\Windows\System32\iesetup.dll
    2008-04-06 00:01 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
    2008-04-06 00:01 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
    2008-04-05 10:37 --------- d-----w C:\Users\Taneli\AppData\Roaming\vlc
    2008-03-17 10:47 319,456 ----a-w C:\Windows\DIFxAPI.dll
    2008-03-17 10:17 174 --sha-w C:\Program Files\desktop.ini
    2008-03-17 10:13 --------- d-----w C:\Program Files\Windows Defender
    2008-03-17 10:13 --------- d-----w C:\Program Files\Windows Calendar
    2008-03-17 09:15 88,576 ----a-w C:\Windows\System32\avifil32.dll
    2008-03-17 09:14 8,192 ----a-w C:\Windows\System32\riched32.dll
    2008-03-17 08:56 160,872 ----a-w C:\Windows\System32\halmacpi.dll
    2008-03-17 08:56 134,760 ----a-w C:\Windows\System32\halacpi.dll
    .

    ((((((((((((((((((((((((((((( snapshot@2008-04-15_15.57.30.54 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-04-15 12:54:28 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
    + 2008-04-15 12:55:46 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
    + 2008-04-15 12:55:46 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
    - 2008-04-15 12:54:04 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2008-04-15 17:34:54 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2008-04-15 12:54:04 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2008-04-15 17:34:54 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2008-04-15 12:54:04 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2008-04-15 17:34:54 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2008-04-15 11:42:25 103,924 ----a-w C:\Windows\System32\perfc009.dat
    + 2008-04-15 15:53:04 103,924 ----a-w C:\Windows\System32\perfc009.dat
    - 2008-04-15 11:42:25 83,896 ----a-w C:\Windows\System32\perfc00B.dat
    + 2008-04-15 15:53:04 83,896 ----a-w C:\Windows\System32\perfc00B.dat
    - 2008-04-15 11:42:25 79,320 ----a-w C:\Windows\System32\perfc014.dat
    + 2008-04-15 15:53:04 79,320 ----a-w C:\Windows\System32\perfc014.dat
    - 2008-04-15 11:42:26 81,394 ----a-w C:\Windows\System32\perfc01D.dat
    + 2008-04-15 15:53:04 81,394 ----a-w C:\Windows\System32\perfc01D.dat
    - 2008-04-15 11:42:25 610,142 ----a-w C:\Windows\System32\perfh009.dat
    + 2008-04-15 15:53:04 610,142 ----a-w C:\Windows\System32\perfh009.dat
    - 2008-04-15 11:42:25 459,542 ----a-w C:\Windows\System32\perfh00B.dat
    + 2008-04-15 15:53:04 459,542 ----a-w C:\Windows\System32\perfh00B.dat
    - 2008-04-15 11:42:26 468,364 ----a-w C:\Windows\System32\perfh014.dat
    + 2008-04-15 15:53:04 468,364 ----a-w C:\Windows\System32\perfh014.dat
    - 2008-04-15 11:42:26 463,874 ----a-w C:\Windows\System32\perfh01D.dat
    + 2008-04-15 15:53:04 463,874 ----a-w C:\Windows\System32\perfh01D.dat
    - 2008-04-15 11:38:06 5,388 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2799988849-141376510-2707820881-1000_UserData.bin
    + 2008-04-15 12:56:04 5,638 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2799988849-141376510-2707820881-1000_UserData.bin
    - 2008-04-15 11:38:05 82,106 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    + 2008-04-15 12:56:03 82,444 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 15:35 125440]
    "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 15:36 201728]
    "LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-06-20 12:49 451872]
    "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 12:39 486856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-03-17 12:01 1006264]
    "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-05 13:17 86016]
    "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-05 13:17 8534560]
    "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-05 13:17 81920]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 00:58 115816]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-08-27 08:10 4702208 C:\Windows\RtHDVCpl.exe]
    "Skytel"="Skytel.exe" [2007-08-03 08:22 1826816 C:\Windows\SkyTel.exe]
    "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-10-24 05:02 178712]
    "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-24 20:31 630784]
    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-03 00:24 857648]
    "ATKMEDIA"="C:\Program Files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 18:27 61440]
    "PowerForPhone"="C:\Program Files\P4P\P4P.exe" [ ]
    "ASUS Camera ScreenSaver"="C:\Windows\ASScrProlog.exe" [2008-03-17 14:22 37232]
    "ASUS Screen Saver Protector"="C:\Windows\ASScrPro.exe" [2008-03-17 14:23 33136]
    "IFXSPMGT"="C:\Windows\system32\ifxspmgt.exe" [2007-02-26 06:29 677408]
    "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
    "SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [2007-06-01 10:06 1629744]
    "InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe" [2007-06-01 10:05 1057328]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
    "CognizanceTS"="C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll" [2003-12-22 05:12 17920]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]
    "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-02-01 11:55 1103240]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UacDisableNotify"=dword:00000001
    "InternetSettingsDisableNotify"=dword:00000001
    "AutoUpdateDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{B7C18FE5-8C7C-467A-8019-84A12062E95F}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "{26D0F558-1907-4B86-9B37-E20FF300460E}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{987FA836-853D-47C1-96E7-E8B2538FBEB4}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{F678EA31-D085-4070-A22B-E4116D035E22}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{78A5D15E-56E2-4A94-B1C2-32DF9B7760EA}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{7F576416-BF94-4EDA-B8F2-56A0C02C4824}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
    "EnableFirewall"= 0 (0x0)

    R0 lullaby;lullaby;C:\Windows\system32\DRIVERS\lullaby.sys [2007-09-27 01:03]
    R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080407.003\IDSvix86.sys [2008-03-12 08:30]
    R1 ItSDisk;ItSDisk;C:\Windows\system32\Drivers\ItSDisk.sys [2006-05-17 01:14]
    R1 PersonalSecureDrive;PersonalSecureDrive;C:\Windows\system32\drivers\psd.sys [2007-01-23 15:07]
    R2 ASBroker;Logon Session Broker;C:\Windows\System32\svchost.exe [2006-11-02 12:45]
    R2 ASChannel;Local Communication Channel;C:\Windows\System32\svchost.exe [2006-11-02 12:45]
    R2 HFGService;Handsfree Headset Service;C:\Windows\system32\svchost.exe [2006-11-02 12:45]
    R2 PrivateDiskDriver;Private Encrypted Virtual Disk Driver;C:\Windows\system32\drivers\PrivateDisk.sys [2006-06-16 18:13]
    R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;C:\Windows\system32\DRIVERS\l160x86.sys [2007-10-31 14:55]
    R3 DCamUSBET;USB2.0 1.3M UVC WebCam;C:\Windows\system32\DRIVERS\etDevice.sys [2007-09-06 11:43]
    R3 FiltUSBET;ET USB Device Lower Filter;C:\Windows\system32\DRIVERS\etFilter.sys [2007-10-15 10:39]
    R3 ScanUSBET;ET USB Still Image Capture Device;C:\Windows\system32\DRIVERS\etScan.sys [2007-09-06 18:45]
    R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-01-09 17:31]
    S3 BthAudioHF;BthAudioHF-palvelu;C:\Windows\system32\DRIVERS\BthAudioHF.sys [2008-03-17 13:53]
    S3 bthav;Bluetooth-AV-profiili;C:\Windows\system32\drivers\bthav.sys [2008-03-17 13:53]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bthsvcs REG_MULTI_SZ BthServ
    GPSvcGroup REG_MULTI_SZ GPSvc
    bthaudiosvc REG_MULTI_SZ HFGService
    Cognizance REG_MULTI_SZ ASBroker ASChannel

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94bb1e85-040c-11dd-ad8c-000ea6f33381}]
    \shell\AutoRun\command - F:\autorun.exe

    *Newly Created Service* - COMHOST

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-04-14 17:28:20 C:\Windows\Tasks\Norton Internet Security - Run Full System Scan - Taneli.job"
    - C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeB/TASK:
    "2008-04-15 09:00:05 C:\Windows\Tasks\Security Platform Backup Schedule.job"
    - C:\Program Files\Infineon\Security Platform Software\SpBackupWz.exe
    .
    **************************************************************************

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-15 21:54:15
    Windows 6.0.6000 NTFS

    detected NTDLL code modification:
    ZwClose

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-04-15 21:55:34
    ComboFix-quarantined-files.txt 2008-04-15 18:55:26
    ComboFix2.txt 2008-04-15 12:58:26

    Pre-Run: 79,756,898,304 tavua vapaana
    Post-Run: 79,515,619,328 tavua vapaana
    .
    2008-04-15 09:46:27 --- E O F ---

    EDIT: vielä näyttää jonkun verran sontaa löytyvän
     
    Last edited: Apr 15, 2008
    kumiorava, Apr 15, 2008
    #11
  12. Hujo

    Hujo Guest

    Päivitä AVG Anti-Spyware 7.5 ja aja vikasiedossa.
     
    Hujo, Apr 15, 2008
    #12
  13. kumiorava

    kumiorava Regular member

    Joined:
    Mar 26, 2005
    Messages:
    310
    Likes Received:
    0
    Trophy Points:
    26
    Juu kyllä se AVG jotain tracking cookieta löysi ja poisti, mutta ei spyware doctorin löytämiä troijalaisia. Spyware doctor näyttää pikaskannauksen jälkeenkin vielä 6 uhkaa ja 40 tartuntaa... Mikään muu ohjelma mitä olen kokeilut ei tunnu näitä löytävän.
     
    kumiorava, Apr 16, 2008
    #13
  14. Hujo

    Hujo Guest

    Lataa Atribunen ATF Cleaner

    Ohjeet;

    Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.Main:n alla valitse: Select All
    Klikkaa Empty Selected valintaa.
    Jos käytät FireFoxia selaimenasi Klikkaa Firefox yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
    Jos käytät Operaa selaimenasiKlikkaa Opera yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa taas.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
    Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
    Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)
     
    Hujo, Apr 16, 2008
    #14
  15. kumiorava

    kumiorava Regular member

    Joined:
    Mar 26, 2005
    Messages:
    310
    Likes Received:
    0
    Trophy Points:
    26
    Juu suoritin tuon ATF:n. Tilanne ei sittenkään vielä näytä korjaantuneen... Noita troijalaisia tuppaa tulemaan uusia jatkuvalla syötöllä. Esim. Trojan.Virtumonde ja Trojan.Downloader.Conhook. Vaikka onnistuisi aina kyseiset poistamaan, tulee niitä sitten aina uusia.

    Yksi ongelma myös minkä tuossa huomasin niin symantecin phishing filter on maissa eikä suostu enää menemään päälle.

    Toinen ongelma joka iski eilen illalla on että jostain syystä kumpikaan selain ei oikein tahdo toimia. Aloitussivulle ne menee, mutta ei sitten millekkään muulle... Mahtaakohan ongelma olla pöpöissä vai onko verkossa vikaa. Nyt työskentelen kotikoneella, joka saman modeemin kautta verkossa että verkon kyllä luulisi toimivan ainakin osittain :)

    Internet explorerissa tuntu (sillon kun selaimet vielä toimi) olevan suurempiakin ongelmia. Kokoajan heitteli jollekkin sivustoille missä tarjottiin taas jotain ohjelmistoja spywaren poistamiseen.

    EDIT: myös windowsin päivityksen kanssa tuntuu olevan ongelmia. Päivitykset on valmiina mutta kun sulkee koneen asentaakseen päivitykset, tulee ruutuun teksti ettei saa sammuttaa konetta koska asentaa päivityksiä jne jne. Tätä kestää varmaan n. ½ tuntia jonka jälkeen kone sammuu, mutta kun koneen käynnistää taas niin päivitykset eivät ole asentuneet.

    EDIT 2:konetta käynnistettäessä tulee seuraava virheilmoitus:
    Virhe ladattaessa C:\Windows\system32\awtsPihI.dll
    Määritettyä osaa ei löydy

    Seuraavan kerran pääsen koneellani verkkoon todennäköisesti vasta viikon päästä perjantaina. Saapuneet viestit voin lukea puhelimella, mutta en tod. näk. voi ainakaan mitään ohjelmia ladata tms. Kone on kyllä mukana, että jos tulee korjausehdotuksia niin pääsen kyllä testaamaan.
     
    Last edited: Apr 17, 2008
    kumiorava, Apr 17, 2008
    #15

Share This Page