Virusvaroituksia ja messengerin itse kirjoitteleva virus HIJACKTHIS loki

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by uskis, Dec 2, 2008.

  1. uskis

    uskis Regular member

    Joined:
    Sep 11, 2005
    Messages:
    130
    Likes Received:
    1
    Trophy Points:
    28
    Emäntä menettää pian hermonsa tämän koneen kanssa, hidastelee ja takkuilee kaikessa. Löytyykö mitään virusta tms?


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 22:16:53, on 2.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    J:\WINDOWS\System32\smss.exe
    J:\WINDOWS\system32\winlogon.exe
    J:\WINDOWS\system32\services.exe
    J:\WINDOWS\system32\lsass.exe
    J:\WINDOWS\system32\Ati2evxx.exe
    J:\WINDOWS\system32\svchost.exe
    J:\WINDOWS\System32\svchost.exe
    J:\WINDOWS\system32\svchost.exe
    J:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    J:\WINDOWS\system32\Ati2evxx.exe
    J:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    J:\Program Files\Alwil Software\Avast4\ashServ.exe
    J:\WINDOWS\system32\spoolsv.exe
    J:\Program Files\Bonjour\mDNSResponder.exe
    J:\WINDOWS\system32\cisvc.exe
    J:\WINDOWS\Explorer.EXE
    J:\Program Files\COMODO\Firewall\cmdagent.exe
    J:\Program Files\Java\jre6\bin\jqs.exe
    J:\Program Files\Raxco\PerfectDisk\PDAgent.exe
    J:\Program Files\CyberLink\Shared Files\RichVideo.exe
    J:\WINDOWS\system32\svchost.exe
    J:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    J:\WINDOWS\RTHDCPL.EXE
    J:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    J:\Program Files\Java\jre6\bin\jusched.exe
    J:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    J:\Program Files\COMODO\Firewall\cfp.exe
    J:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    J:\Program Files\Raxco\PerfectDisk\PDEngine.exe
    J:\WINDOWS\system32\ctfmon.exe
    J:\Program Files\Skype\Phone\Skype.exe
    J:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    J:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Windows\wkssvr.exe
    J:\Program Files\OpenOffice.org 3\program\soffice.exe
    J:\Program Files\OpenOffice.org 3\program\soffice.bin
    J:\WINDOWS\System32\svchost.exe
    J:\Program Files\Skype\Plugin Manager\skypePM.exe
    J:\Program Files\Windows Live\Messenger\usnsvc.exe
    J:\WINDOWS\system32\cidaemon.exe
    J:\Program Files\Opera\opera.exe
    J:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - J:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - J:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - J:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - J:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - J:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - J:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - J:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [avast!] J:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [PinnacleDriverCheck] J:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
    O4 - HKLM\..\Run: [StartCCC] J:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "J:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "J:\Program Files\COMODO\Firewall\cfp.exe" -h
    O4 - HKLM\..\Run: [hpsjbmgr] J:\SCANJET\PrecisionScanLT\hpsjbmgr.exe
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "J:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe"
    O4 - HKLM\..\Run: [COMODO Internet Security] "J:\Program Files\COMODO\Firewall\cfp.exe" -h
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "J:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [MSN] C:\Windows\wkssvr.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Skype] "J:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [MsnMsgr] "J:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [LaunchList] J:\Program Files\Pinnacle\Studio 11\LaunchList2.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] J:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKCU\..\Run: [Livestation] J:\Program Files\Livestation\AppStart.exe -nosplash -systemstartup
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: OpenOffice.org 3.0.lnk = J:\Program Files\OpenOffice.org 3\program\quickstart.exe
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - J:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - J:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - J:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - J:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - J:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.extrafilm.fi/ImageUploader5.cab
    O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://ra.ruukki.com/dana-cached/setup/JuniperSetupSP1.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - J:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: J:\WINDOWS\system32\guard32.dll
    O20 - Winlogon Notify: !SASWinLogon - J:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - J:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Unknown owner - J:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - J:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - J:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - J:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - J:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - J:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - J:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - J:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - J:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - J:\Program Files\COMODO\Firewall\cmdagent.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - J:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - J:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - J:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - J:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: PCLEPCI - Pinnacle Systems GmbH - J:\WINDOWS\system32\drivers\pclepci.sys
    O23 - Service: PDAgent - Raxco Software, Inc. - J:\Program Files\Raxco\PerfectDisk\PDAgent.exe
    O23 - Service: PDEngine - Raxco Software, Inc. - J:\Program Files\Raxco\PerfectDisk\PDEngine.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - J:\Program Files\CyberLink\Shared Files\RichVideo.exe

    --
    End of file - 8940 bytes
     
    uskis, Dec 2, 2008
    #1
  2. Hujo

    Hujo Guest

    Jos koneella on Malwarebytes' Anti-Malware ennestään suorita ensin päivitys aja sen jälkeen.

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi

    =============

    1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
    Combofix1
    Combofix2

    2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    ===============

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

    ================

    scannaa hjt:llä merkkaa paina Fix checked


    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "J:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "J:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "J:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

    ==============

    poista lisää poista sovelutuksesta

    SUPERAntiSpyware

    Poista kansio vikasiedossa

    J:\Program Files\SUPERAntiSpyware
     
    Hujo, Dec 2, 2008
    #2
  3. uskis

    uskis Regular member

    Joined:
    Sep 11, 2005
    Messages:
    130
    Likes Received:
    1
    Trophy Points:
    28
    Tässä tulee lokit, on sitte muutama rivi tekstiä, heh.


    Malwarebytes' Anti-Malware 1.30
    Tietokantaversio: 1454
    Windows 5.1.2600 Service Pack 3

    3.12.2008 20:28:18
    mbam-log-2008-12-03 (20-28-17).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|F:\|J:\|)
    Tarkistetut kohteet: 265519
    Kulunut aika: 1 hour(s), 48 minute(s), 4 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 1
    Saastuneita rekisteriarvoja: 1
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 3

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSN (Backdoor.Bot) -> Quarantined and deleted successfully.

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    F:\System Volume Information\_restore{8BF42CF8-C8FD-4415-BD3B-0F9856D29416}\RP469\A0151422.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    F:\System Volume Information\_restore{8BF42CF8-C8FD-4415-BD3B-0F9856D29416}\RP469\A0151425.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\WINDOWS\wkssvr.exe (Backdoor.Bot) -> Delete on reboot.

    ComboFix 08-12-02.02 - Käyttäjänimi 2008-12-03 20:45:34.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.364 [GMT 2:00]
    Sijainti: j:\documents and settings\Käyttäjänimi\Desktop\ComboFix.exe
    * Uusi palautuspiste luotu
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-11-03 to 2008-12-03 )))))))))))))))))
    .

    2008-12-03 20:28 . 2008-12-03 20:28 61,440 --a------ j:\windows\system32\drivers\qzdsigwp.sys
    2008-12-03 18:38 . 2008-12-03 18:38 <DIR> d-------- j:\program files\Malwarebytes' Anti-Malware
    2008-12-03 18:38 . 2008-12-03 18:38 <DIR> d-------- j:\documents and settings\Käyttäjänimi\Application Data\Malwarebytes
    2008-12-03 18:38 . 2008-12-03 18:38 <DIR> d-------- j:\documents and settings\All Users\Application Data\Malwarebytes
    2008-12-03 18:38 . 2008-10-22 16:10 38,496 --a------ j:\windows\system32\drivers\mbamswissarmy.sys
    2008-12-03 18:38 . 2008-10-22 16:10 15,504 --a------ j:\windows\system32\drivers\mbam.sys
    2008-12-02 23:00 . 2008-12-02 23:00 <DIR> d-------- j:\program files\Defraggler
    2008-12-02 22:16 . 2008-12-02 22:16 <DIR> d-------- j:\program files\Trend Micro
    2008-11-16 10:17 . 2008-11-16 10:17 <DIR> d-------- j:\documents and settings\Käyttäjänimi\Application Data\OpenOffice.org
    2008-11-16 10:15 . 2008-11-16 10:15 <DIR> d-------- j:\program files\OpenOffice.org 3
    2008-11-16 10:06 . 2008-11-16 10:05 410,976 --a------ j:\windows\system32\deploytk.dll
    2008-11-12 11:47 . 2008-10-24 13:21 455,296 -----c--- j:\windows\system32\dllcache\mrxsmb.sys
    2008-11-12 11:46 . 2008-09-04 19:15 1,106,944 -----c--- j:\windows\system32\dllcache\msxml3.dll

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-12-03 18:46 --------- d-----w j:\documents and settings\Käyttäjänimi\Application Data\Skype
    2008-12-03 18:31 --------- d-----w j:\documents and settings\Käyttäjänimi\Application Data\skypePM
    2008-12-03 18:28 --------- d-----w j:\documents and settings\Käyttäjänimi\Application Data\uTorrent
    2008-12-03 18:23 --------- d-----w j:\program files\PowerArchiver
    2008-12-03 17:06 --------- d-----w j:\program files\Java
    2008-12-03 17:03 --------- d-----w j:\program files\SUPERAntiSpyware
    2008-12-03 17:03 --------- d-----w j:\program files\Common Files\Wise Installation Wizard
    2008-12-03 17:03 --------- d-----w j:\documents and settings\Käyttäjänimi\Application Data\SUPERAntiSpyware.com
    2008-12-02 20:58 --------- d-----w j:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2008-12-02 20:52 --------- d-----w j:\program files\Yahoo!
    2008-11-30 11:47 --------- d-----w j:\program files\Spybot - Search & Destroy
    2008-11-27 21:15 --------- d-----w j:\documents and settings\Käyttäjänimi\Application Data\Juniper Networks
    2008-11-16 08:14 --------- d-----w j:\program files\OpenOffice.org 2.4
    2008-11-13 21:14 --------- d-----w j:\documents and settings\Käyttäjänimi\Application Data\OpenOffice.org2
    2008-11-08 13:59 --------- d-----w j:\program files\Paint.NET
    2008-11-02 11:12 99,856 ----a-w j:\windows\system32\drivers\cmdguard.sys
    2008-11-02 11:12 31,504 ----a-w j:\windows\system32\drivers\cmdhlp.sys
    2008-11-02 11:12 143,096 ----a-w j:\windows\system32\guard32.dll
    2008-10-24 11:21 455,296 ----a-w j:\windows\system32\drivers\mrxsmb.sys
    2008-10-21 13:11 --------- d-----w j:\program files\Microsoft Silverlight
    2008-10-19 08:38 --------- d-----w j:\program files\DScaler
    2008-10-16 12:13 202,776 ----a-w j:\windows\system32\wuweb.dll
    2008-10-16 12:13 1,809,944 ----a-w j:\windows\system32\wuaueng.dll
    2008-10-16 12:12 561,688 ----a-w j:\windows\system32\wuapi.dll
    2008-10-16 12:12 323,608 ----a-w j:\windows\system32\wucltui.dll
    2008-10-16 12:09 92,696 ----a-w j:\windows\system32\cdm.dll
    2008-10-16 12:09 51,224 ----a-w j:\windows\system32\wuauclt.exe
    2008-10-16 12:09 43,544 ----a-w j:\windows\system32\wups2.dll
    2008-10-16 12:08 34,328 ----a-w j:\windows\system32\wups.dll
    2008-10-16 12:06 268,648 ----a-w j:\windows\system32\mucltui.dll
    2008-10-16 12:06 208,744 ----a-w j:\windows\system32\muweb.dll
    2008-10-11 18:42 --------- d-----w j:\program files\Opera
    2008-10-06 17:34 --------- d-----w j:\program files\EResultsLite
    2008-10-04 15:25 --------- d-----w j:\documents and settings\Käyttäjänimi\Application Data\GRETECH
    2008-10-04 15:25 --------- d-----w j:\documents and settings\All Users\Application Data\GRETECH
    2008-10-04 15:24 --------- d-----w j:\program files\GRETECH
    2008-09-30 14:43 1,286,152 ----a-w j:\windows\system32\msxml4.dll
    2008-09-15 12:12 1,846,400 ----a-w j:\windows\system32\win32k.sys
    2008-09-10 01:14 1,307,648 ----a-w j:\windows\system32\msxml6.dll
    2008-09-04 17:15 1,106,944 ----a-w j:\windows\system32\msxml3.dll
    2008-04-01 20:19 32 ----a-w j:\documents and settings\All Users\Application Data\ezsid.dat
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="j:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "Skype"="j:\program files\Skype\Phone\Skype.exe" [2008-07-23 21738792]
    "MsnMsgr"="j:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
    "LaunchList"="j:\program files\Pinnacle\Studio 11\LaunchList2.exe" [2007-03-21 145496]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "avast!"="j:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-12 81000]
    "PinnacleDriverCheck"="j:\windows\system32\PSDrvCheck.exe" [2003-12-04 406016]
    "StartCCC"="j:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
    "COMODO Firewall Pro"="j:\program files\COMODO\Firewall\cfp.exe" [2008-11-02 1797880]
    "Adobe Photo Downloader"="j:\program files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe" [2008-04-01 61440]
    "COMODO Internet Security"="j:\program files\COMODO\Firewall\cfp.exe" [2008-11-02 1797880]
    "Adobe Reader Speed Launcher"="j:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
    "SunJavaUpdateSched"="j:\program files\Java\jre6\bin\jusched.exe" [2008-11-16 136600]
    "SkyTel"="SkyTel.EXE" [2006-05-16 j:\windows\SkyTel.exe]
    "RTHDCPL"="RTHDCPL.EXE" [2006-06-28 j:\windows\RTHDCPL.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="j:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

    j:\documents and settings\Käyttäjänimi\Start Menu\Programs\Startup\
    OpenOffice.org 3.0.lnk - j:\program files\OpenOffice.org 3\program\quickstart.exe [2008-10-04 393216]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"= j:\windows\system32\guard32.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.wmv3"= j:\progra~1\COMBIN~1\Filters\wmv9vcm.dll
    "VIDC.MJPG"= Pvmjpg30.dll
    "VIDC.PIM1"= pclepim1.dll
    "vidc.asv2"= asusasv2.dll
    "VIDC.MJPX"= PICVideo MJPEG Codec
    "msacm.divxa32"= msaud32_divx.acm

    [HKLM\~\startupfolder\J:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=j:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=j:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\J:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
    path=j:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
    backup=j:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

    [HKLM\~\startupfolder\J:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
    path=j:\documents and settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
    backup=j:\windows\pss\AutoCAD Startup Accelerator.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
    --a------ 2005-11-09 00:00 128920 j:\program files\DAEMON Tools\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
    --a------ 2006-12-05 21:55 54832 j:\program files\CyberLink\PowerDVD\Language\Language.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
    --a------ 2006-06-05 16:06 188416 j:\program files\PowerISO\PWRISOVM.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    --------- 2006-12-06 17:37 69216 j:\program files\CyberLink\PowerDVD\PDVDServ.exe

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "j:\\Program Files\\uTorrent\\utorrent.exe"=
    "j:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"=
    "j:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
    "j:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
    "j:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"=
    "j:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "j:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "j:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "j:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "j:\\Program Files\\Skype\\Phone\\Skype.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "1723:TCP"= 1723:TCP:mad:xpsp2res.dll,-22015
    "1701:UDP"= 1701:UDP:mad:xpsp2res.dll,-22016
    "500:UDP"= 500:UDP:mad:xpsp2res.dll,-22017

    R1 aswSP;avast! Self Protection;j:\windows\system32\drivers\aswSP.sys [2008-04-23 110160]
    R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;j:\windows\system32\DRIVERS\cmdguard.sys [2008-05-11 99856]
    R1 cmdHlp;COMODO Firewall Pro Helper Driver;j:\windows\system32\DRIVERS\cmdhlp.sys [2008-05-11 31504]
    R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\j:\program files\CyberLink\PowerDVD\000.fcl [2007-05-19 21:46:05 13560]
    R2 aswFsBlk;aswFsBlk;j:\windows\system32\DRIVERS\aswFsBlk.sys [2008-04-23 20560]
    R3 ttBudget2;TechnoTrend BDA/DVB (BDA);j:\windows\system32\Drivers\ttBudget2.sys [2007-12-21 254464]
    S3 Cap7146_DVB;TechnoTrend BDA/DVB Capture;j:\windows\system32\Drivers\TTCap46n.sys [2007-12-19 81024]
    S3 PTDVB;TechnoTrend BDA/DVB Tuner;j:\windows\system32\Drivers\TTFEDVBn.sys [2007-12-19 253952]
    S3 TFBULK;Topfield USB client driver;j:\windows\system32\drivers\TfBulk.sys [2008-03-18 41996]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\L]
    \Shell\AutoRun\command - L:\AutoPlay.exe -auto

    *Newly Created Service* - PROCEXP90
    .
    'Ajoitetut tehtävät'-kansion sisältö

    2008-10-28 j:\windows\Tasks\AppleSoftwareUpdate.job
    - j:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
    .
    - - - - POISTETUT JÄMÄRIVIT - - - -

    MSConfigStartUp-AdVantage - j:\program files\AdVantage\AdVantage.exe
    MSConfigStartUp-flaw mapi - j:\docume~1\MARKOT~1\APPLIC~1\GREATU~1\Info Vga.exe
    MSConfigStartUp-QuickTime Task - j:\program files\QuickTime\qttask.exe
    MSConfigStartUp-Steam - j:\program files\steam\steam.exe
    MSConfigStartUp-swg - j:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    MSConfigStartUp-updateMgr - j:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe


    .
    ------- Täydentävä tarkistus -------
    .
    FireFox -: Profile - j:\documents and settings\Käyttäjänimi\Application Data\Mozilla\Firefox\Profiles\9jjvwx8k.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://fi.msn.com/
    FF -: plugin - j:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
    FF -: plugin - j:\program files\Java\jre6\bin\new_plugin\npjp2.dll
    FF -: plugin - j:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30716.0.dll
    FF -: plugin - j:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
    FF -: plugin - j:\program files\Mozilla Firefox\plugins\npdeploytk.dll
    FF -: plugin - j:\program files\Opera\program\plugins\nppl3260.dll
    FF -: plugin - j:\program files\Opera\program\plugins\nprpjplug.dll
    FF -: plugin - j:\program files\Yahoo!\Common\npyaxmpb.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-03 20:47:17
    Windows 5.1.2600 Service Pack 3 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
    "ImagePath"="\??\j:\program files\CyberLink\PowerDVD\000.fcl"
    .
    --------------------- Prosesseihin ladatut DLLt ---------------------

    - - - - - - - > 'winlogon.exe'(868)
    j:\windows\system32\guard32.dll
    j:\windows\system32\Ati2evxx.dll

    - - - - - - - > 'lsass.exe'(928)
    j:\windows\system32\guard32.dll
    .
    Valmistumisajankohta: 2008-12-03 20:48:07
    ComboFix-quarantined-files.txt 2008-12-03 18:48:03

    Ennen ajoa: 210 323 709 952 bytes free
    Ajon jälkeen: 210,312,499,200 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-FIN.EXE
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    j:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    204 --- E O F --- 2008-11-12 10:42:24



    SDFix: Version 1.240
    Run by Käyttäjänimi on ke 03.12.2008 at 20:59

    Microsoft Windows XP [Version 5.1.2600]
    Running From: J:\Documents and Settings\Käyttäjänimi\Desktop\SDFix\SDFix

    Checking Services :


    Restoring Default Security Values
    Restoring Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-03 21:08:35
    Windows 5.1.2600 Service Pack 3 NTFS

    detected NTDLL code modification:
    ZwClose

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s0"=dword:fedb9d3a
    "s1"=dword:a0709564
    "s2"=dword:7744058f
    "h0"=dword:00000001

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="J:\Program Files\DAEMON Tools\"
    "h0"=dword:00000000
    "khjeh"=hex:40,89,91,1e,89,75,28,73,8a,23,de,e4,52,b9,fc,70,f0,66,10,30,0a,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,ec,54,49,91,0d,c1,bb,01,dc,ef,a1,23,b0,32,fe,14,22,..
    "khjeh"=hex:6d,b1,e9,9e,98,a6,a9,6f,65,3c,ad,97,24,ea,9d,23,a7,74,2b,db,08,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:0d,a3,7a,64,09,41,19,6a,8b,f1,6f,e1,c5,f2,0d,51,29,57,a4,ce,c2,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="J:\Program Files\DAEMON Tools\"
    "h0"=dword:00000000
    "khjeh"=hex:40,89,91,1e,89,75,28,73,8a,23,de,e4,52,b9,fc,70,f0,66,10,30,0a,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,ec,54,49,91,0d,c1,bb,01,dc,ef,a1,23,b0,32,fe,14,22,..
    "khjeh"=hex:6d,b1,e9,9e,98,a6,a9,6f,65,3c,ad,97,24,ea,9d,23,a7,74,2b,db,08,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:0d,a3,7a,64,09,41,19,6a,8b,f1,6f,e1,c5,f2,0d,51,29,57,a4,ce,c2,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="J:\Program Files\DAEMON Tools\"
    "h0"=dword:00000000
    "khjeh"=hex:40,89,91,1e,89,75,28,73,8a,23,de,e4,52,b9,fc,70,f0,66,10,30,0a,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,ec,54,49,91,0d,c1,bb,01,dc,ef,a1,23,b0,32,fe,14,22,..
    "khjeh"=hex:6d,b1,e9,9e,98,a6,a9,6f,65,3c,ad,97,24,ea,9d,23,a7,74,2b,db,08,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:0d,a3,7a,64,09,41,19,6a,8b,f1,6f,e1,c5,f2,0d,51,29,57,a4,ce,c2,..

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
    "TracesProcessed"=dword:00000178
    "TracesSuccessful"=dword:00000004

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "J:\\Program Files\\uTorrent\\utorrent.exe"="J:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:æTorrent"
    "J:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"="J:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe:*:Enabled:Render Manager"
    "J:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"="J:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe:*:Enabled:Studio"
    "J:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"="J:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe:*:Enabled:pMSRegisterFile"
    "J:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"="J:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe:*:Enabled:umi"
    "J:\\Program Files\\VideoLAN\\VLC\\vlc.exe"="J:\\Program Files\\VideoLAN\\VLC\\vlc.exe:*:Enabled:VLC media player"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "J:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="J:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "J:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="J:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "J:\\Program Files\\Bonjour\\mDNSResponder.exe"="J:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
    "J:\\Program Files\\Skype\\Phone\\Skype.exe"="J:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "J:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="J:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "J:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="J:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "J:\\PROGRAM FILES\\LIVESTATION\\1.0.77.3\\LIVESTATION.EXE"="J:\\Program Files\\Livestation\\1.0.77.3\\Livestation.exe"

    Remaining Files :



    Files with Hidden Attributes :

    Mon 26 Nov 2007 6,219,320 A..H. --- "J:\Program Files\Picasa2\setup.exe"
    Wed 22 Oct 2008 949,072 A.SHR --- "J:\Program Files\Spybot - Search & Destroy\advcheck.dll"
    Mon 15 Sep 2008 1,562,960 A.SHR --- "J:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
    Thu 14 Aug 2008 1,429,840 A.SHR --- "J:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
    Wed 30 Jul 2008 4,891,984 A.SHR --- "J:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
    Tue 16 Sep 2008 1,833,296 A.SHR --- "J:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
    Wed 22 Oct 2008 962,896 A.SHR --- "J:\Program Files\Spybot - Search & Destroy\Tools.dll"
    Thu 30 Oct 2008 4,348 ..SH. --- "J:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Tue 27 Nov 2007 0 A.SH. --- "J:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
    Sun 26 Oct 2008 1,131,560 A..H. --- "J:\WINDOWS\SoftwareDistribution\Download\d8d19e7b16e1dafba6906abfdd61b4f9\BIT13E.tmp"

    Finished!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:14:16, on 3.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    J:\WINDOWS\System32\smss.exe
    J:\WINDOWS\system32\winlogon.exe
    J:\WINDOWS\system32\services.exe
    J:\WINDOWS\system32\lsass.exe
    J:\WINDOWS\system32\Ati2evxx.exe
    J:\WINDOWS\system32\svchost.exe
    J:\WINDOWS\System32\svchost.exe
    J:\WINDOWS\system32\svchost.exe
    J:\WINDOWS\system32\Ati2evxx.exe
    J:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    J:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    J:\Program Files\Alwil Software\Avast4\ashServ.exe
    J:\WINDOWS\system32\spoolsv.exe
    J:\Program Files\Bonjour\mDNSResponder.exe
    J:\Program Files\COMODO\Firewall\cmdagent.exe
    J:\Program Files\Java\jre6\bin\jqs.exe
    J:\Program Files\Raxco\PerfectDisk\PDAgent.exe
    J:\Program Files\CyberLink\Shared Files\RichVideo.exe
    J:\WINDOWS\system32\svchost.exe
    J:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    J:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    J:\Program Files\Raxco\PerfectDisk\PDEngine.exe
    J:\WINDOWS\Explorer.EXE
    J:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    J:\WINDOWS\RTHDCPL.EXE
    J:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    J:\Program Files\COMODO\Firewall\cfp.exe
    J:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe
    J:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    J:\Program Files\Java\jre6\bin\jusched.exe
    J:\WINDOWS\system32\ctfmon.exe
    J:\WINDOWS\System32\svchost.exe
    J:\Program Files\Skype\Phone\Skype.exe
    J:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    J:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    J:\Program Files\OpenOffice.org 3\program\soffice.exe
    J:\Program Files\OpenOffice.org 3\program\soffice.bin
    J:\Program Files\Windows Live\Messenger\usnsvc.exe
    J:\Program Files\Skype\Plugin Manager\skypePM.exe
    J:\Program Files\Opera\opera.exe
    J:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - J:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - J:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - J:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - J:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - J:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - J:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - J:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [avast!] J:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [PinnacleDriverCheck] J:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
    O4 - HKLM\..\Run: [StartCCC] J:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "J:\Program Files\COMODO\Firewall\cfp.exe" -h
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "J:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe"
    O4 - HKLM\..\Run: [COMODO Internet Security] "J:\Program Files\COMODO\Firewall\cfp.exe" -h
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "J:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "J:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Skype] "J:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [MsnMsgr] "J:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [LaunchList] J:\Program Files\Pinnacle\Studio 11\LaunchList2.exe
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: OpenOffice.org 3.0.lnk = J:\Program Files\OpenOffice.org 3\program\quickstart.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre6\bin\jp2iexp.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre6\bin\jp2iexp.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - J:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - J:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - J:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - J:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - J:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - J:\Program Files\Yahoo!\Common\yinsthelper.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - J:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: J:\WINDOWS\system32\guard32.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - J:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Unknown owner - J:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - J:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - J:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - J:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - J:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - J:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - J:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - J:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - J:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - J:\Program Files\COMODO\Firewall\cmdagent.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - J:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - J:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - J:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - J:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: PCLEPCI - Pinnacle Systems GmbH - J:\WINDOWS\system32\drivers\pclepci.sys
    O23 - Service: PDAgent - Raxco Software, Inc. - J:\Program Files\Raxco\PerfectDisk\PDAgent.exe
    O23 - Service: PDEngine - Raxco Software, Inc. - J:\Program Files\Raxco\PerfectDisk\PDEngine.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - J:\Program Files\CyberLink\Shared Files\RichVideo.exe

    --
    End of file - 8797 bytes
     
    uskis, Dec 3, 2008
    #3
  4. Hujo

    Hujo Guest

    Lataa OTMoveIt
    OTMoveIt ja tallenna se työpöydällesi.

    Tuplaklikkaa OTMoveIt.exe.
    Klikkaa CleanUp!.
    Valitse Yes kun kysytään "Begin cleanup Process?".
    Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.

    HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.

    ============

    Lataa Tästä Ccleaner
    CCleaner v 2.14.750.- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
    Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
    Asennuksen jälkeen aukaise CCleaneri.
    Valitse vasemmalta pystyrivistä Options.
    Valitse viereisestä pystyrivistä Settings.
    Language kohtaan valitse Suomi.

    Puhdistaja
    Valitse vasemmalta pystyrivistä Puhdistaja.
    Paina alhaalta Tutki.
    Nyt CCleaneri tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
    Kun tutkiminen on valmis, paina Aja CCleaner.
    Nyt CCleaneri poistaa löydetyt tempit, cookiessit jne.

    Rekisterin virheiden korjaus
    Valitse vasemmalta pystyrivistä Rekisteri.
    Paina alhaalta Etsi rekisterin virheitä.
    Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
    Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
    Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
    Saat vielä varmistus kysymyksen, paina Ok.
    Kun virheet on korjattu, paina Sulje.
    Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
     
    Hujo, Dec 3, 2008
    #4
  5. uskis

    uskis Regular member

    Joined:
    Sep 11, 2005
    Messages:
    130
    Likes Received:
    1
    Trophy Points:
    28
    Saiko selvää mitä pöpöjä kone sisälsi? Mitä ne kaikki ohjelmat tekivät ja etsivät jotka latailin ja joita käytin ohjeiden mukaan?

    Jos toimenpiteet oli siinä niin todella paljon kiitoksia ja rauhallista mukavaa joulun odotusta.
     
    uskis, Dec 4, 2008
    #5

Share This Page