Vistan prosessori täysillä HJT

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Brix777, Apr 19, 2008.

Page 1 of 2
  1. Brix777

    Brix777 Member

    Joined:
    Aug 30, 2007
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    16
    Edit: Isäni [arthyr] uusi kone, Hp Pavilion dv9740, meni pois käyttö kunnosta.
    Prosessori paahtaa koko ajan 50-100% vaikka mitään ohjelmaa ei ole päällä.
    Vista (koneen mukana tullut) asennettu 5 päivää sitten.

    Hjt:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:04:25, on 19.4.2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16643)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    C:\Program Files\HP\QuickPlay\QPService.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
    C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
    C:\Program Files\DigitalPersona\Bin\DpAgent.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
    C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
    C:\Program Files\Internet Explorer\ieuser.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Windows\system32\SearchFilterHost.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
    O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
    O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
    O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
    O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
    O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto (Automatic LiveUpdate Scheduler) - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
    O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    O23 - Service: LiveUpdate Notice - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
    O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 9645 bytes
     
    Last edited: Apr 20, 2008
    Brix777, Apr 19, 2008
    #1
  2. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, Apr 19, 2008
    #2
  3. arthyr

    arthyr Member

    Joined:
    Apr 20, 2008
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    Nyt tuntuu kone toimivan, ehkä se tytär onnistui. Katsotaan vieläkö huomenna suoritin on normaali, eikä puhalla jatkuvasti 55%
     
    arthyr, Apr 20, 2008
    #3
  4. Hujo

    Hujo Guest

    ajas siinä koneessa.

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
     
    Hujo, Apr 20, 2008
    #4
  5. arthyr

    arthyr Member

    Joined:
    Apr 20, 2008
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    Ongelmat palasivat ja latasin Compofixin. Tässä tulos
    ComboFix 08-04-18.3 - Arto 2008-04-20 19:23:38.1 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1035.18.1099 [GMT 3:00]
    Running from: C:\Users\Arto\Desktop\ComboFix.exe
    * Created a new restore point
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Windows\system32\KBL.LOG

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-03-20 to 2008-04-20 )))))))))))))))))
    .

    2008-04-20 19:15 . 2008-04-17 07:40 <KANSIO> d-------- C:\327882R2FWJFW
    2008-04-19 19:04 . 2008-04-19 19:04 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-04-19 16:03 . 2008-04-19 18:26 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\Lavasoft
    2008-04-18 14:37 . 2008-04-18 14:37 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\Watchtower
    2008-04-18 14:33 . 2008-04-18 14:33 <KANSIO> d-------- C:\Program Files\Watchtower
    2008-04-17 15:41 . 2008-04-17 15:41 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\ScanSoft
    2008-04-17 15:41 . 2008-04-17 15:41 <KANSIO> d-------- C:\Users\All Users\ScanSoft
    2008-04-17 15:41 . 2008-04-17 15:41 <KANSIO> d-------- C:\Users\All Users\InstallShield
    2008-04-17 15:41 . 2008-04-17 15:41 <KANSIO> d-------- C:\ProgramData\ScanSoft
    2008-04-17 15:41 . 2008-04-17 15:41 <KANSIO> d-------- C:\ProgramData\InstallShield
    2008-04-17 15:41 . 2008-04-17 15:41 <KANSIO> d-------- C:\Program Files\Common Files\ScanSoft Shared
    2008-04-17 15:41 . 2008-04-17 15:41 412 --a------ C:\WINDOWS\MAXLINK.INI
    2008-04-17 15:40 . 2008-04-17 15:40 <KANSIO> d-------- C:\Program Files\ScanSoft
    2008-04-16 16:15 . 2008-04-16 16:15 27,240 --a------ C:\Users\Arto\AppData\Roaming\nvModes.dat
    2008-04-16 15:41 . 2008-04-16 15:47 <KANSIO> d-------- C:\Program Files\ABBYY FineReader 6.0 Sprint
    2008-04-16 08:55 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\System32\msonpmon.dll
    2008-04-16 08:54 . 2008-04-16 08:54 <KANSIO> d-------- C:\Program Files\Microsoft.NET
    2008-04-16 08:51 . 2008-04-16 09:45 <KANSIO> d-------- C:\Users\All Users\Microsoft Help
    2008-04-16 08:51 . 2008-04-16 09:45 <KANSIO> d-------- C:\ProgramData\Microsoft Help
    2008-04-16 08:50 . 2008-04-16 08:50 <KANSIO> dr-h----- C:\MSOCache
    2008-04-16 08:22 . 2008-04-16 08:24 <KANSIO> d-------- C:\Program Files\Windows Live
    2008-04-16 08:22 . 2008-04-16 08:23 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-04-16 08:21 . 2008-04-16 08:21 <KANSIO> d-------- C:\Users\All Users\WLInstaller
    2008-04-16 08:21 . 2008-04-16 08:21 <KANSIO> d-------- C:\ProgramData\WLInstaller
    2008-04-15 17:07 . 2008-04-15 17:07 558,080 --a------ C:\WINDOWS\System32\oleaut32.dll
    2008-04-15 16:26 . 2008-04-15 16:26 <KANSIO> d-------- C:\Users\All Users\Google
    2008-04-14 17:50 . 2008-04-14 17:54 <KANSIO> d-------- C:\Program Files\Eurowordgiga
    2008-04-14 17:50 . 2008-04-14 17:50 339,968 --------- C:\WINDOWS\Setup1.exe
    2008-04-14 17:50 . 2008-04-14 17:50 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
    2008-04-14 17:12 . 2008-04-16 15:29 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\Canon
    2008-04-14 17:10 . 2008-04-14 17:10 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\CD-LabelPrint
    2008-04-14 17:05 . 2008-04-14 17:05 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\Template
    2008-04-14 17:05 . 2008-04-14 17:08 88 --a------ C:\Users\Arto\AppData\Roaming\wklnhst.dat
    2008-04-14 17:02 . 2008-04-14 17:02 <KANSIO> d-------- C:\Users\All Users\CanonIJPLM
    2008-04-14 17:02 . 2008-04-14 17:02 <KANSIO> d-------- C:\ProgramData\CanonIJPLM
    2008-04-14 16:55 . 2008-04-14 16:55 <KANSIO> d-------- C:\Program Files\Common Files\CANON
    2008-04-14 16:51 . 2008-04-14 16:51 <KANSIO> d--h----- C:\Users\All Users\CanonBJ
    2008-04-14 16:51 . 2008-04-14 16:51 <KANSIO> d--h----- C:\ProgramData\CanonBJ
    2008-04-14 16:50 . 2008-04-14 16:50 <KANSIO> d--h----- C:\WINDOWS\System32\CanonIJ Uninstaller Information
    2008-04-14 16:48 . 2007-04-15 23:00 215,040 --a------ C:\WINDOWS\System32\CNMLM93.DLL
    2008-04-14 16:47 . 2007-03-23 10:30 1,400,832 --a------ C:\WINDOWS\System32\CNC610C.DLL
    2008-04-14 16:47 . 2007-04-13 08:45 200,704 --a------ C:\WINDOWS\System32\CNC610L.DLL
    2008-04-14 16:47 . 2007-03-15 08:12 188,416 --a------ C:\WINDOWS\System32\CNC610O.DLL
    2008-04-14 16:47 . 2007-03-23 10:29 98,304 --a------ C:\WINDOWS\System32\CNC610I.DLL
    2008-04-14 16:46 . 2008-04-14 16:46 <KANSIO> d--h----- C:\Program Files\CanonBJ
    2008-04-14 16:44 . 2008-04-14 17:02 <KANSIO> d-------- C:\Program Files\Canon
    2008-04-14 16:40 . 2008-04-14 16:40 <KANSIO> d-------- C:\Program Files\Common Files\Adobe
    2008-04-14 15:55 . 2008-04-14 15:55 0 --a------ C:\WINDOWS\nsreg.dat
    2008-04-14 14:00 . 2008-04-14 14:00 1,060,920 --a------ C:\WINDOWS\System32\drivers\ntfs.sys
    2008-04-14 14:00 . 2008-04-14 14:00 194,560 --a------ C:\WINDOWS\System32\WebClnt.dll
    2008-04-14 14:00 . 2008-04-14 14:00 110,080 --a------ C:\WINDOWS\System32\drivers\mrxdav.sys
    2008-04-14 14:00 . 2008-04-14 14:00 41,984 --a------ C:\WINDOWS\System32\drivers\monitor.sys
    2008-04-14 13:58 . 2008-04-14 13:58 803,328 --a------ C:\WINDOWS\System32\drivers\tcpip.sys
    2008-04-14 13:57 . 2008-04-14 13:57 2,027,008 --a------ C:\WINDOWS\System32\win32k.sys
    2008-04-14 13:57 . 2008-04-14 13:57 1,327,104 --a------ C:\WINDOWS\System32\quartz.dll
    2008-04-14 13:57 . 2008-04-14 13:57 296,448 --a------ C:\WINDOWS\System32\gdi32.dll
    2008-04-14 13:57 . 2008-04-14 13:57 223,232 --a------ C:\WINDOWS\System32\WMASF.DLL
    2008-04-14 13:57 . 2008-04-14 13:57 9,728 --a------ C:\WINDOWS\System32\LAPRXY.DLL
    2008-04-14 13:57 . 2008-04-14 13:57 2,048 --a------ C:\WINDOWS\System32\asferror.dll
    2008-04-14 13:56 . 2008-04-14 13:56 4,247,552 --a------ C:\WINDOWS\System32\GameUXLegacyGDFs.dll
    2008-04-14 13:56 . 2008-04-14 13:56 1,686,528 --a------ C:\WINDOWS\System32\gameux.dll
    2008-04-14 13:56 . 2008-04-14 13:56 737,792 --a------ C:\WINDOWS\System32\inetcomm.dll
    2008-04-14 13:56 . 2008-04-14 13:56 84,480 --a------ C:\WINDOWS\System32\INETRES.dll
    2008-04-14 13:55 . 2008-04-14 13:55 11,776 --a------ C:\WINDOWS\System32\sbunattend.exe
    2008-04-14 13:54 . 2008-04-14 13:54 101,888 --a------ C:\WINDOWS\System32\drivers\mrxsmb.sys
    2008-04-14 13:54 . 2008-04-14 13:54 84,992 --a------ C:\WINDOWS\System32\drivers\srvnet.sys
    2008-04-14 13:54 . 2008-04-14 13:54 83,968 --a------ C:\WINDOWS\System32\dnsrslvr.dll
    2008-04-14 13:54 . 2008-04-14 13:54 58,368 --a------ C:\WINDOWS\System32\drivers\mrxsmb20.sys
    2008-04-14 13:54 . 2008-04-14 13:54 24,576 --a------ C:\WINDOWS\System32\dnscacheugc.exe
    2008-04-14 13:53 . 2008-04-14 13:53 788,992 --a------ C:\WINDOWS\System32\rpcrt4.dll
    2008-04-14 13:53 . 2008-04-14 13:53 130,048 --a------ C:\WINDOWS\System32\drivers\srv2.sys
    2008-04-14 13:51 . 2008-04-14 13:51 2,048 --a------ C:\WINDOWS\System32\tzres.dll
    2008-04-14 13:50 . 2008-04-14 13:50 1,244,672 --a------ C:\WINDOWS\System32\mcmde.dll
    2008-04-14 11:42 . 2008-04-14 11:42 <KANSIO> d-------- C:\Program Files\MSXML 4.0
    2008-04-14 11:39 . 2008-04-14 11:39 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\Symantec
    2008-04-14 11:37 . 2008-04-14 11:37 <KANSIO> dr------- C:\Users\Arto\Searches
    2008-04-14 11:37 . 2008-04-14 15:36 <KANSIO> dr------- C:\Users\Arto\Contacts
    2008-04-14 11:37 . 2008-04-14 11:37 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\DigitalPersona
    2008-04-14 11:36 . 2008-04-14 11:36 81 --a------ C:\WINDOWS\System32\LOG
    2008-04-14 11:36 . 2008-04-14 11:36 44 --a------ C:\WINDOWS\system\hpsysdrv.dat
    2008-04-14 11:35 . 2008-04-14 11:35 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\Hewlett-Packard
    2008-04-14 11:30 . 2008-04-16 08:54 <KANSIO> d-------- C:\Program Files\Microsoft Works
    2008-04-14 11:27 . 2008-04-14 16:40 <KANSIO> d-------- C:\Users\All Users\Adobe
    2008-04-14 11:26 . 2008-04-14 11:26 <KANSIO> d-------- C:\WINDOWS\PCHEALTH
    2008-04-14 11:25 . 2008-04-14 11:25 <KANSIO> d-------- C:\Program Files\Common Files\LightScribe
    2008-04-14 11:23 . 2008-04-14 11:23 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\Macrovision
    2008-04-14 11:23 . 2008-04-14 11:23 0 -rahs---- C:\WINDOWS\System32\drivers\103C_HP_cNB_Pavilion dv9700 Notebook PC_Y5335KV_0U_QCNF80243Q2_E459053-DH1_4A_I30DA_SQuanta_V85.26_F.2C_T080324_WV3-0_L40B_M2047_J250_7AMD_8F82_91.90_#071223_N10DE0450;168C001C_(GZ969EA#UUW)_XMOBILE_CN10_Z.MRK
    2008-04-14 11:22 . 2008-04-16 14:30 <KANSIO> dr------- C:\Users\Arto\Videos
    2008-04-14 11:22 . 2008-04-14 11:37 <KANSIO> dr------- C:\Users\Arto\Saved Games
    2008-04-14 11:22 . 2008-04-16 15:17 <KANSIO> dr------- C:\Users\Arto\Pictures
    2008-04-14 11:22 . 2008-04-14 11:37 <KANSIO> dr------- C:\Users\Arto\Music
    2008-04-14 11:22 . 2008-04-14 11:37 <KANSIO> dr------- C:\Users\Arto\Links
    2008-04-14 11:22 . 2008-04-14 15:52 <KANSIO> dr------- C:\Users\Arto\Downloads
    2008-04-14 11:22 . 2008-04-17 17:00 <KANSIO> dr------- C:\Users\Arto\Documents
    2008-04-14 11:22 . 2006-11-02 15:37 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\Media Center Programs
    2008-04-14 11:22 . 2008-04-14 11:22 <KANSIO> d--h----- C:\Users\Arto\AppData
    2008-04-14 11:22 . 2008-04-16 08:24 <KANSIO> d-------- C:\Users\Arto
    2008-04-14 11:22 . 2008-04-14 11:40 524,288 --ahs---- C:\Users\Arto\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
    2008-04-14 11:22 . 2008-04-14 11:40 524,288 --ahs---- C:\Users\Arto\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
    2008-04-14 11:22 . 2008-04-20 19:29 262,144 --ah----- C:\Users\Arto\ntuser.dat.LOG1
    2008-04-14 11:22 . 2008-04-14 11:40 65,536 --ahs---- C:\Users\Arto\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
    2008-04-14 11:22 . 2008-04-14 11:22 0 --ah----- C:\Users\Arto\ntuser.dat.LOG2
    2008-04-14 11:18 . 2008-04-14 11:18 1,712,984 --a------ C:\WINDOWS\System32\wuaueng.dll
    2008-04-14 11:18 . 2008-04-14 11:18 1,524,224 --a------ C:\WINDOWS\System32\wucltux.dll
    2008-04-14 11:18 . 2008-04-14 11:18 53,080 --a------ C:\WINDOWS\System32\wuauclt.exe
    2008-04-14 11:18 . 2008-04-14 11:18 43,352 --a------ C:\WINDOWS\System32\wups2.dll
    2008-04-14 11:16 . 2008-04-14 11:16 549,720 --a------ C:\WINDOWS\System32\wuapi.dll
    2008-04-14 11:16 . 2008-04-14 11:16 80,896 --a------ C:\WINDOWS\System32\wudriver.dll
    2008-04-14 11:16 . 2008-04-14 11:16 33,624 --a------ C:\WINDOWS\System32\wups.dll
    2008-04-14 11:15 . 2008-04-14 11:15 <KANSIO> dr------- C:\WINDOWS\System32\config\systemprofile\Contacts
    2008-04-14 11:15 . 2008-04-14 11:15 163,000 --a------ C:\WINDOWS\System32\wuwebv.dll
    2008-04-14 11:15 . 2008-04-14 11:15 31,232 --a------ C:\WINDOWS\System32\wuapp.exe

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-20 16:22 --------- d-----w C:\ProgramData\Symantec
    2008-04-17 12:41 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-04-14 11:06 --------- d-----w C:\Program Files\Windows Sidebar
    2008-04-14 11:06 --------- d-----w C:\Program Files\Windows Mail
    2008-04-14 11:06 --------- d-----w C:\Program Files\Norton Internet Security
    2008-04-14 11:06 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-04-14 10:59 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
    2008-04-14 10:59 7,680 ----a-w C:\Windows\System32\spwmp.dll
    2008-04-14 10:59 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
    2008-04-14 10:59 4,096 ----a-w C:\Windows\System32\dxmasf.dll
    2008-04-14 10:59 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
    2008-04-14 10:59 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
    2008-04-14 10:59 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
    2008-04-14 10:59 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
    2008-04-14 10:59 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
    2008-04-14 10:59 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
    2008-04-14 10:56 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
    2008-04-14 10:56 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
    2008-04-14 10:56 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
    2008-04-14 10:56 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
    2008-04-14 10:56 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
    2008-04-14 10:52 826,368 ----a-w C:\Windows\System32\wininet.dll
    2008-04-14 10:52 56,320 ----a-w C:\Windows\System32\iesetup.dll
    2008-04-14 10:52 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
    2008-04-14 10:52 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
    2008-04-14 10:39 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF
    2008-04-14 10:39 123,952 ----a-w C:\Windows\system32\drivers\SYMEVENT.SYS
    2008-04-14 10:39 10,740 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT
    2008-04-14 10:39 --------- d-----w C:\Program Files\Symantec
    2008-04-14 08:39 --------- d-----w C:\ProgramData\NVIDIA
    2008-04-14 08:25 --------- d-----w C:\Program Files\HPQ
    2008-04-14 08:25 --------- d-----w C:\Program Files\HP
    2008-04-14 08:15 --------- d-sh--w C:\ProgramData\Templates
    2008-04-14 08:15 --------- d-sh--w C:\ProgramData\Start Menu
    2008-04-14 08:15 --------- d-sh--w C:\ProgramData\Favorites
    2008-04-14 08:15 --------- d-sh--w C:\ProgramData\Documents
    2008-04-14 08:15 --------- d-sh--w C:\ProgramData\Desktop
    2008-04-14 08:15 --------- d-sh--w C:\ProgramData\Application Data
    2008-03-06 18:32 706 ----a-w C:\Windows\system32\drivers\COH_Mon.inf
    2008-03-06 18:32 23,904 ----a-w C:\Windows\system32\drivers\COH_Mon.sys
    2008-03-06 18:32 10,537 ----a-w C:\Windows\system32\drivers\coh_mon.cat
    2007-12-23 13:44 174 --sha-w C:\Program Files\desktop.ini
    .

    (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
    2007-08-25 04:51 316784 --a------ c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
    2008-04-14 13:38 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= "c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll" [2007-08-25 04:51 316784]

    [HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
    [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
    [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-04-14 13:55 1232896]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
    "LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 17:36 455968]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-19 23:05 86016]
    "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-19 23:05 8497696]
    "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-19 23:05 81920]
    "SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 11:29 102400]
    "QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-10-01 06:34 181544]
    "QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-20 01:31 202032]
    "OnScreenDisplay"="C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-05 00:54 554320]
    "UCam_Menu"="C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-17 10:13 218408]
    "DpAgent"="C:\Program Files\DigitalPersona\Bin\dpagent.exe" [2007-09-20 22:12 671744]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-12-23 16:04 1006264]
    "ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 11:01 51048]
    "HP Health Check Scheduler"="[ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [ ]
    "hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 19:47 480560]
    "WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-09 02:53 311296]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 15:00 132496]
    "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
    "CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 19:01 644696]
    "CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 19:50 1603152]
    "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
    "OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{DCF507BC-F4FE-4A10-A155-BD56F59B76C6}"= C:\Program Files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
    "{BA0BF932-6DCB-4630-977C-96C889ABA098}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
    "{E34059C3-F3A3-4392-8F01-B920F60F0D65}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
    "TCP Query User{12A00520-2979-4A68-A14B-932E53DC70D1}C:\\windows\\system32\\ftp.exe"= UDP:C:\windows\system32\ftp.exe:FTP-tiedostonsiirto-ohjelma
    "UDP Query User{B0525007-49FE-4DB9-A5AB-93FD935B93B2}C:\\windows\\system32\\ftp.exe"= TCP:C:\windows\system32\ftp.exe:FTP-tiedostonsiirto-ohjelma
    "{505FD9CF-06C2-455D-83E6-B032C16D06F2}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
    "{5DC9F40F-9EAD-4585-AE3D-2852CC063286}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{38D452A6-073C-42EE-915A-61A05A550B74}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
    "EnableFirewall"= 0 (0x0)

    R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\ipsdefs\20080415.001\IDSvix86.sys [2008-03-20 23:37]
    R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 10:20]
    R2 LiveUpdate Notice;LiveUpdate Notice;"c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon []
    R2 QPCapSvc;QuickPlay Background Capture Service (QBCS);"C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe" [2007-10-01 06:34]
    R2 QPSched;QuickPlay Task Scheduler (QTS);"C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe" [2007-10-01 06:34]
    R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2007-07-10 17:27]
    R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2007-05-31 02:40]
    R3 HpqRemHid;HP Remote Control HID Device;C:\Windows\system32\DRIVERS\HpqRemHid.sys [2007-07-11 21:30]
    R3 nvsmu;nvsmu;C:\Windows\system32\DRIVERS\nvsmu.sys [2007-02-17 00:50]
    R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-08-13 21:50]
    S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver;C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 10:30]
    S3 COH_Mon;COH_Mon;C:\Windows\system32\Drivers\COH_Mon.sys [2008-03-06 21:32]

    *Newly Created Service* - COMHOST

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
    .
    **************************************************************************

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-20 19:29:46
    Windows 6.0.6000 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 2

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\WINDOWS\System32\audiodg.exe
    C:\Program Files\DigitalPersona\Bin\DpHostW.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\WINDOWS\System32\drivers\XAudio.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
    C:\WINDOWS\System32\conime.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
    C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
    .
    **************************************************************************
    .
    Completion time: 2008-04-20 19:33:29 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-04-20 16:33:16

    Pre-Run: 191,800,832,000 tavua vapaana
    Post-Run: 191,709,306,880 tavua vapaana

    281 --- E O F --- 2008-04-18 10:50:15
     
    arthyr, Apr 20, 2008
    #5
  6. arthyr

    arthyr Member

    Joined:
    Apr 20, 2008
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    Tässä on tämä toinen tulos. Sitten kun tämä uusii taas(?) Käynkö silloin läpi jommallakummalla ohjelmalla uudelleen. Tämä on helpompi. Haittaavatko nämä Norton antiviruksen toimintaa?
    Malwarebytes' Anti-Malware 1.11
    Tietokantaversio: 662

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
    Tarkistetut kohteet: 156412
    Kulunut aika: 44 minute(s), 17 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)
     
    arthyr, Apr 20, 2008
    #6
  7. Hujo

    Hujo Guest

    vieläkös on ongelmaa.
     
    Hujo, Apr 20, 2008
    #7
  8. arthyr

    arthyr Member

    Joined:
    Apr 20, 2008
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    Kyllä nyt aamulla. Aivan sama juttu explorer.exe käyttää suoritintehosta 45-49% koko ajan. Sitten jos minä teen vielä jotain se nousee helposti sataan.
     
    arthyr, Apr 21, 2008
    #8
  9. Hujo

    Hujo Guest

    Lataa Tästä Ccleaner
    CCleaner v2.05.555- Standard Build, ÄLÄ aseenna Yahoo toolbaria!

    laita asetukset näin:
    Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

    aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
    aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi
     
    Hujo, Apr 21, 2008
    #9
  10. arthyr

    arthyr Member

    Joined:
    Apr 20, 2008
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    kokeilin sitä ccleaneria ohjeiden mukaan. Kyllä se löysi poistettavaa, mutta ei asia korjaantunut. explorer.exe paahtaa 48% ja suoritin kokoarvo 55% Siis jos itse ei tee mitään. HP-tuessa oletettiin että olisi joku ladattu ohjelma joka ei sovi Vistaan. En tiedä sellaistakaan. Olen poistanut joitain ohjelmia Euroword giga sanaston, muttei sekään tunnu auttavan. En onnistunut saamaan sitä rekisteriä tähän.
     
    arthyr, Apr 21, 2008
    #10
  11. Hujo

    Hujo Guest

    Lataa: RegSeeker.zip työpöydälle:

    Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman.
    Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen.
    Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri
    Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken).
    Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta
    klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin.
    Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet
    Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK".
    Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK".
    Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen.
     
    Hujo, Apr 21, 2008
    #11
  12. arthyr

    arthyr Member

    Joined:
    Apr 20, 2008
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    Ei ollut tästä ReqSeekeristäkään apua vaikka se kyllä löysi paljon poistettavaa. Minun varmaan pitää sitten vaan taas asentaa Windows uudelleen .
     
    arthyr, Apr 22, 2008
    #12
  13. arthyr

    arthyr Member

    Joined:
    Apr 20, 2008
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    Nyt taisin tehdä jotain tyhmää. Asensin uudelleen Winowsin, mutta 2pvän päästä vika uusiutui. Aajoin Compofix1 uudelleen, mutta hidastuneesta koneesta en ilmeisesti odottanut tarpeeksi kauan lokin valmistumista ja sitä ei tullut Tiedostoista eivät nyt kuvat näy, taustakuvat tai mitkään muutkaan kuvat. Jos menee Wn valkuvavalikoimaan siellä ne näkyvät, mutta ei omissa tiedostoissa. Mitä nyt pitäisi tehdä?
     
    arthyr, Apr 24, 2008
    #13
  14. Brix777

    Brix777 Member

    Joined:
    Aug 30, 2007
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    16
    Moi.
    Selvennykseksi siis että isi asensi koneeseen uudelleen windowsin.
    Nyt otin tämän koneen kotiini löytääkseni vian aiheuttajan.

    Edit: lisää faktaa...
    Prossutehot siis edelleen n. 50% muutta kone ei ole pahan hidas.
    Tausta ajoa?
    Niin arthrylin kuva ongema ratkesi rebootin jälkeen, omissa kuvatiedostoissa näkyy jälleen esikatselu kuvat. Ja taustakuvan vaan asensin uudelleen.


    Aluksi uusi hjt:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:37, on 2008-04-25
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16643)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    C:\Program Files\HP\QuickPlay\QPService.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
    C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
    C:\Program Files\DigitalPersona\Bin\DpAgent.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Windows\ehome\ehmsas.exe
    C:\WINDOWS\ehome\EHTray.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
    O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
    O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
    O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
    O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto (Automatic LiveUpdate Scheduler) - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    O23 - Service: LiveUpdate Notice - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
    O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 9238 bytes



    Edit: Lisätään vielä combofixin raportti jatkoksi.

    ComboFix 08-04-22.5 - Arto 2008-04-25 21:46:57.2 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1035.18.1139 [GMT 3:00]
    Running from: C:\Users\Arto\Desktop\ComboFix.exe
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- Previous Run -------
    .
    C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat
    C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat
    C:\Windows\system32\KBL.LOG

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-03-25 to 2008-04-25 )))))))))))))))))
    .

    2008-04-25 21:37 . 2008-04-25 21:37 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-04-24 22:18 . 2008-04-24 22:18 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\HP
    2008-04-24 22:18 . 2008-04-24 22:18 <KANSIO> d-------- C:\Users\All Users\HP
    2008-04-24 22:18 . 2008-04-24 22:18 <KANSIO> d-------- C:\ProgramData\HP
    2008-04-24 12:52 . 2008-04-24 12:56 <KANSIO> d-------- C:\Program Files\Eurowordgiga
    2008-04-24 12:51 . 2008-04-24 12:51 339,968 --------- C:\WINDOWS\Setup1.exe
    2008-04-24 12:51 . 2008-04-24 12:51 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
    2008-04-24 12:40 . 2008-04-24 12:46 <KANSIO> d-------- C:\Program Files\ABBYY FineReader 6.0 Sprint
    2008-04-24 11:32 . 2008-04-24 15:02 27,240 --a------ C:\Users\Arto\AppData\Roaming\nvModes.dat
    2008-04-23 14:17 . 2008-04-23 15:40 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\Canon
    2008-04-23 14:16 . 2008-04-23 14:16 <KANSIO> d-------- C:\Users\All Users\InstallShield
    2008-04-23 14:16 . 2008-04-23 14:16 <KANSIO> d-------- C:\ProgramData\InstallShield
    2008-04-23 14:15 . 2008-04-24 12:13 <KANSIO> d-------- C:\Users\All Users\ScanSoft
    2008-04-23 14:15 . 2008-04-24 12:13 <KANSIO> d-------- C:\ProgramData\ScanSoft
    2008-04-23 14:15 . 2008-04-23 14:15 <KANSIO> d-------- C:\Program Files\ScanSoft
    2008-04-23 14:09 . 2008-04-23 14:09 <KANSIO> d-------- C:\Users\All Users\CanonIJPLM
    2008-04-23 14:09 . 2008-04-23 14:09 <KANSIO> d-------- C:\ProgramData\CanonIJPLM
    2008-04-23 14:04 . 2008-04-23 14:04 <KANSIO> d-------- C:\Program Files\Common Files\CANON
    2008-04-23 14:00 . 2008-04-23 14:00 <KANSIO> d--h----- C:\Users\All Users\CanonBJ
    2008-04-23 14:00 . 2008-04-23 14:00 <KANSIO> d--h----- C:\ProgramData\CanonBJ
    2008-04-23 13:59 . 2008-04-23 13:59 <KANSIO> d--h----- C:\WINDOWS\System32\CanonIJ Uninstaller Information
    2008-04-23 13:57 . 2007-04-15 23:00 215,040 --a------ C:\WINDOWS\System32\CNMLM93.DLL
    2008-04-23 13:56 . 2007-03-23 10:30 1,400,832 --a------ C:\WINDOWS\System32\CNC610C.DLL
    2008-04-23 13:56 . 2007-04-13 08:45 200,704 --a------ C:\WINDOWS\System32\CNC610L.DLL
    2008-04-23 13:56 . 2007-03-15 08:12 188,416 --a------ C:\WINDOWS\System32\CNC610O.DLL
    2008-04-23 13:56 . 2007-03-23 10:29 98,304 --a------ C:\WINDOWS\System32\CNC610I.DLL
    2008-04-23 13:55 . 2008-04-23 13:55 <KANSIO> d--h----- C:\Program Files\CanonBJ
    2008-04-23 13:54 . 2008-04-23 14:09 <KANSIO> d-------- C:\Program Files\Canon
    2008-04-23 09:20 . 2008-04-23 09:20 0 --a------ C:\WINDOWS\nsreg.dat
    2008-04-23 09:07 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\System32\msonpmon.dll
    2008-04-23 09:06 . 2008-04-23 09:06 <KANSIO> d-------- C:\Program Files\Microsoft.NET
    2008-04-23 09:03 . 2008-04-23 09:39 <KANSIO> d-------- C:\Users\All Users\Microsoft Help
    2008-04-23 09:03 . 2008-04-23 09:39 <KANSIO> d-------- C:\ProgramData\Microsoft Help
    2008-04-23 09:03 . 2008-04-23 09:03 <KANSIO> dr-h----- C:\MSOCache
    2008-04-23 08:55 . 2008-04-23 08:55 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\Watchtower
    2008-04-23 08:51 . 2008-04-23 08:51 <KANSIO> d-------- C:\Program Files\Watchtower
    2008-04-22 18:06 . 2008-04-22 18:06 <KANSIO> d-------- C:\Users\All Users\Google
    2008-04-22 18:05 . 2008-04-22 18:06 <KANSIO> d-------- C:\Program Files\Google
    2008-04-22 17:30 . 2008-04-22 17:30 194,560 --a------ C:\WINDOWS\System32\WebClnt.dll
    2008-04-22 17:30 . 2008-04-22 17:30 110,080 --a------ C:\WINDOWS\System32\drivers\mrxdav.sys
    2008-04-22 17:28 . 2008-04-22 17:28 8,147,968 --a------ C:\WINDOWS\System32\wmploc.DLL
    2008-04-22 17:28 . 2008-04-22 17:28 1,060,920 --a------ C:\WINDOWS\System32\drivers\ntfs.sys
    2008-04-22 17:28 . 2008-04-22 17:28 356,864 --a------ C:\WINDOWS\System32\MediaMetadataHandler.dll
    2008-04-22 17:28 . 2008-04-22 17:28 41,984 --a------ C:\WINDOWS\System32\drivers\monitor.sys
    2008-04-22 17:28 . 2008-04-22 17:28 7,680 --a------ C:\WINDOWS\System32\spwmp.dll
    2008-04-22 17:28 . 2008-04-22 17:28 4,096 --a------ C:\WINDOWS\System32\msdxm.ocx
    2008-04-22 17:28 . 2008-04-22 17:28 4,096 --a------ C:\WINDOWS\System32\dxmasf.dll
    2008-04-22 17:26 . 2008-04-22 17:26 1,327,104 --a------ C:\WINDOWS\System32\quartz.dll
    2008-04-22 17:26 . 2008-04-22 17:26 803,328 --a------ C:\WINDOWS\System32\drivers\tcpip.sys
    2008-04-22 17:26 . 2008-04-22 17:26 216,632 --a------ C:\WINDOWS\System32\drivers\netio.sys
    2008-04-22 17:26 . 2008-04-22 17:26 167,424 --a------ C:\WINDOWS\System32\tcpipcfg.dll
    2008-04-22 17:26 . 2008-04-22 17:26 24,064 --a------ C:\WINDOWS\System32\netcfg.exe
    2008-04-22 17:26 . 2008-04-22 17:26 22,016 --a------ C:\WINDOWS\System32\netiougc.exe
    2008-04-22 17:23 . 2008-04-22 17:23 1,585,664 --a------ C:\WINDOWS\System32\setupapi.dll
    2008-04-22 17:21 . 2008-04-22 17:21 2,027,008 --a------ C:\WINDOWS\System32\win32k.sys
    2008-04-22 17:20 . 2008-04-22 17:20 4,247,552 --a------ C:\WINDOWS\System32\GameUXLegacyGDFs.dll
    2008-04-22 17:20 . 2008-04-22 17:20 1,686,528 --a------ C:\WINDOWS\System32\gameux.dll
    2008-04-22 17:20 . 2008-04-22 17:20 296,448 --a------ C:\WINDOWS\System32\gdi32.dll
    2008-04-22 17:20 . 2008-04-22 17:20 223,232 --a------ C:\WINDOWS\System32\WMASF.DLL
    2008-04-22 17:20 . 2008-04-22 17:20 9,728 --a------ C:\WINDOWS\System32\LAPRXY.DLL
    2008-04-22 17:20 . 2008-04-22 17:20 2,048 --a------ C:\WINDOWS\System32\asferror.dll
    2008-04-22 17:19 . 2008-04-22 17:19 737,792 --a------ C:\WINDOWS\System32\inetcomm.dll
    2008-04-22 17:19 . 2008-04-22 17:19 84,480 --a------ C:\WINDOWS\System32\INETRES.dll
    2008-04-22 17:19 . 2008-04-22 17:19 11,776 --a------ C:\WINDOWS\System32\sbunattend.exe
    2008-04-22 17:17 . 2008-04-22 17:17 130,048 --a------ C:\WINDOWS\System32\drivers\srv2.sys
    2008-04-22 17:17 . 2008-04-22 17:17 101,888 --a------ C:\WINDOWS\System32\drivers\mrxsmb.sys
    2008-04-22 17:17 . 2008-04-22 17:17 84,992 --a------ C:\WINDOWS\System32\drivers\srvnet.sys
    2008-04-22 17:17 . 2008-04-22 17:17 83,968 --a------ C:\WINDOWS\System32\dnsrslvr.dll
    2008-04-22 17:17 . 2008-04-22 17:17 58,368 --a------ C:\WINDOWS\System32\drivers\mrxsmb20.sys
    2008-04-22 17:17 . 2008-04-22 17:17 24,576 --a------ C:\WINDOWS\System32\dnscacheugc.exe
    2008-04-22 17:16 . 2008-04-22 17:16 788,992 --a------ C:\WINDOWS\System32\rpcrt4.dll
    2008-04-22 17:14 . 2008-04-22 17:14 <KANSIO> d-------- C:\Program Files\MSXML 4.0
    2008-04-22 17:12 . 2008-04-22 17:12 2,048 --a------ C:\WINDOWS\System32\tzres.dll
    2008-04-22 17:11 . 2008-04-22 17:11 1,244,672 --a------ C:\WINDOWS\System32\mcmde.dll
    2008-04-22 17:02 . 2008-04-22 17:02 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\Symantec
    2008-04-22 17:00 . 2008-04-22 17:00 <KANSIO> dr------- C:\Users\Arto\Searches
    2008-04-22 17:00 . 2008-04-22 17:00 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\DigitalPersona
    2008-04-22 16:59 . 2008-04-24 21:23 <KANSIO> dr------- C:\Users\Arto\Contacts
    2008-04-22 16:59 . 2008-04-22 16:59 81 --a------ C:\WINDOWS\System32\LOG
    2008-04-22 16:59 . 2008-04-22 16:59 44 --a------ C:\WINDOWS\system\hpsysdrv.dat
    2008-04-22 16:55 . 2008-04-22 16:55 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\Hewlett-Packard
    2008-04-22 16:51 . 2008-04-23 09:06 <KANSIO> d-------- C:\Program Files\Microsoft Works
    2008-04-22 16:49 . 2008-04-22 16:50 <KANSIO> d-------- C:\Users\All Users\Adobe
    2008-04-22 16:48 . 2008-04-22 16:49 <KANSIO> d-------- C:\Program Files\Common Files\Adobe
    2008-04-22 16:47 . 2008-04-22 16:47 <KANSIO> d-------- C:\WINDOWS\PCHEALTH
    2008-04-22 16:47 . 2008-04-22 16:47 <KANSIO> d-------- C:\Program Files\MSN Messenger
    2008-04-22 16:46 . 2008-04-22 16:47 <KANSIO> d-------- C:\Program Files\Common Files\LightScribe
    2008-04-22 16:45 . 2008-04-22 16:45 0 -rahs---- C:\WINDOWS\System32\drivers\103C_HP_cNB_Pavilion dv9700 Notebook PC_Y5335KV_0U_QCNF80243Q2_E459053-DH1_4A_I30DA_SQuanta_V85.26_F.2C_T080324_WV3-0_L40B_M2047_J250_7AMD_8F82_91.90_#071223_N10DE0450;168C001C_(GZ969EA#UUW)_XMOBILE_CN10_Z.MRK
    2008-04-22 16:44 . 2008-04-22 16:44 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\Macrovision
    2008-04-22 16:43 . 2008-04-23 15:10 <KANSIO> dr------- C:\Users\Arto\Videos
    2008-04-22 16:43 . 2008-04-22 17:00 <KANSIO> dr------- C:\Users\Arto\Saved Games
    2008-04-22 16:43 . 2008-04-23 15:34 <KANSIO> dr------- C:\Users\Arto\Pictures
    2008-04-22 16:43 . 2008-04-22 17:00 <KANSIO> dr------- C:\Users\Arto\Music
    2008-04-22 16:43 . 2008-04-22 17:00 <KANSIO> dr------- C:\Users\Arto\Links
    2008-04-22 16:43 . 2008-04-22 18:02 <KANSIO> dr------- C:\Users\Arto\Downloads
    2008-04-22 16:43 . 2008-04-24 21:38 <KANSIO> dr------- C:\Users\Arto\Documents
    2008-04-22 16:43 . 2006-11-02 15:37 <KANSIO> d-------- C:\Users\Arto\AppData\Roaming\Media Center Programs
    2008-04-22 16:43 . 2008-04-22 16:43 <KANSIO> d--h----- C:\Users\Arto\AppData
    2008-04-22 16:43 . 2008-04-23 13:59 <KANSIO> d-------- C:\Users\Arto
    2008-04-22 16:43 . 2008-04-22 17:39 524,288 --ahs---- C:\Users\Arto\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
    2008-04-22 16:43 . 2008-04-22 17:39 524,288 --ahs---- C:\Users\Arto\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
    2008-04-22 16:43 . 2008-04-25 21:49 262,144 --ah----- C:\Users\Arto\ntuser.dat.LOG1
    2008-04-22 16:43 . 2008-04-22 17:39 65,536 --ahs---- C:\Users\Arto\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
    2008-04-22 16:43 . 2008-04-22 16:43 0 --ah----- C:\Users\Arto\ntuser.dat.LOG2
    2008-04-22 16:38 . 2008-04-22 16:38 1,712,984 --a------ C:\WINDOWS\System32\wuaueng.dll
    2008-04-22 16:38 . 2008-04-22 16:38 1,524,224 --a------ C:\WINDOWS\System32\wucltux.dll
    2008-04-22 16:38 . 2008-04-22 16:38 53,080 --a------ C:\WINDOWS\System32\wuauclt.exe
    2008-04-22 16:38 . 2008-04-22 16:38 43,352 --a------ C:\WINDOWS\System32\wups2.dll
    2008-04-22 16:37 . 2008-04-22 16:37 549,720 --a------ C:\WINDOWS\System32\wuapi.dll
    2008-04-22 16:37 . 2008-04-22 16:37 80,896 --a------ C:\WINDOWS\System32\wudriver.dll
    2008-04-22 16:37 . 2008-04-22 16:37 33,624 --a------ C:\WINDOWS\System32\wups.dll
    2008-04-22 16:36 . 2008-04-22 16:36 <KANSIO> dr------- C:\WINDOWS\System32\config\systemprofile\Contacts
    2008-04-22 16:36 . 2008-04-22 16:36 163,000 --a------ C:\WINDOWS\System32\wuwebv.dll
    2008-04-22 16:36 . 2008-04-22 16:36 31,232 --a------ C:\WINDOWS\System32\wuapp.exe

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-25 18:42 --------- d-----w C:\ProgramData\Symantec
    2008-04-23 11:15 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-04-22 14:40 --------- d-----w C:\Program Files\Norton Internet Security
    2008-04-22 14:40 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-04-22 14:39 --------- d-----w C:\Program Files\Windows Sidebar
    2008-04-22 14:39 --------- d-----w C:\Program Files\Windows Mail
    2008-04-22 14:27 8,704 ----a-w C:\Windows\System32\hcrstco.dll
    2008-04-22 14:25 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF
    2008-04-22 14:25 123,952 ----a-w C:\Windows\system32\drivers\SYMEVENT.SYS
    2008-04-22 14:25 10,740 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT
    2008-04-22 14:25 --------- d-----w C:\Program Files\Symantec
    2008-04-22 14:20 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
    2008-04-22 14:20 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
    2008-04-22 14:20 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
    2008-04-22 14:20 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
    2008-04-22 14:20 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
    2008-04-22 14:15 826,368 ----a-w C:\Windows\System32\wininet.dll
    2008-04-22 14:15 56,320 ----a-w C:\Windows\System32\iesetup.dll
    2008-04-22 14:15 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
    2008-04-22 14:15 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
    2008-04-22 14:01 --------- d-----w C:\ProgramData\NVIDIA
    2008-04-22 13:47 --------- d-----w C:\Program Files\HPQ
    2008-04-22 13:46 --------- d-----w C:\Program Files\HP
    2008-04-22 13:36 --------- d-sh--w C:\ProgramData\Templates
    2008-04-22 13:36 --------- d-sh--w C:\ProgramData\Start Menu
    2008-04-22 13:36 --------- d-sh--w C:\ProgramData\Favorites
    2008-04-22 13:36 --------- d-sh--w C:\ProgramData\Documents
    2008-04-22 13:36 --------- d-sh--w C:\ProgramData\Desktop
    2008-04-22 13:36 --------- d-sh--w C:\ProgramData\Application Data
    2008-03-06 18:32 706 ----a-w C:\Windows\system32\drivers\COH_Mon.inf
    2008-03-06 18:32 23,904 ----a-w C:\Windows\system32\drivers\COH_Mon.sys
    2008-03-06 18:32 10,537 ----a-w C:\Windows\system32\drivers\coh_mon.cat
    2007-12-23 13:44 174 --sha-w C:\Program Files\desktop.ini
    .

    ((((((((((((((((((((((((((((( snapshot@2008-04-24_14.09.59.31 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-04-24 11:06:30 67,584 --s-a-w C:\Windows\bootstat.dat
    + 2008-04-25 18:27:29 67,584 --s-a-w C:\Windows\bootstat.dat
    + 2008-04-24 11:18:10 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2008-04-24 11:18:10 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2008-04-24 10:59:18 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat
    + 2008-04-25 18:27:25 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat
    - 2008-04-24 11:07:08 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
    + 2008-04-24 13:56:23 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
    + 2008-04-24 13:56:23 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
    - 2008-04-24 11:00:24 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat
    + 2008-04-25 18:47:00 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat
    - 2008-04-24 11:07:09 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
    + 2008-04-24 18:34:41 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
    + 2008-04-24 18:34:41 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
    - 2008-04-24 09:35:42 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2008-04-25 18:42:24 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2008-04-24 09:35:42 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2008-04-25 18:42:24 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2008-04-24 09:35:42 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2008-04-25 18:42:24 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2008-04-24 19:08:01 2,456 ----a-w C:\Windows\System32\networklist\icons\{1F53BF58-86F7-41F9-9640-C7945736AFB0}_24.bin
    + 2008-04-24 19:08:01 4,280 ----a-w C:\Windows\System32\networklist\icons\{1F53BF58-86F7-41F9-9640-C7945736AFB0}_32.bin
    + 2008-04-24 19:08:01 9,560 ----a-w C:\Windows\System32\networklist\icons\{1F53BF58-86F7-41F9-9640-C7945736AFB0}_48.bin
    - 2008-04-23 12:47:33 103,924 ----a-w C:\Windows\System32\perfc009.dat
    + 2008-04-24 14:00:31 103,924 ----a-w C:\Windows\System32\perfc009.dat
    - 2008-04-23 12:47:33 83,896 ----a-w C:\Windows\System32\perfc00B.dat
    + 2008-04-24 14:00:31 83,896 ----a-w C:\Windows\System32\perfc00B.dat
    - 2008-04-23 12:47:33 610,142 ----a-w C:\Windows\System32\perfh009.dat
    + 2008-04-24 14:00:31 610,142 ----a-w C:\Windows\System32\perfh009.dat
    - 2008-04-23 12:47:33 459,542 ----a-w C:\Windows\System32\perfh00B.dat
    + 2008-04-24 14:00:31 459,542 ----a-w C:\Windows\System32\perfh00B.dat
    - 2008-04-24 10:46:21 3,814 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2500855807-140450306-3488081192-1000_UserData.bin
    + 2008-04-24 11:20:29 4,460 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2500855807-140450306-3488081192-1000_UserData.bin
    - 2008-04-24 10:46:21 57,494 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    + 2008-04-24 11:20:29 58,342 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
    - 2008-04-24 10:46:17 33,320 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2008-04-24 11:20:25 33,680 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2008-04-25 13:23:51 99,416 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
    .
    -- Snapshot reset to current date --
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
    2007-08-25 04:51 316784 --a------ c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
    2008-04-22 17:23 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= "c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll" [2007-08-25 04:51 316784]

    [HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
    [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
    [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-04-22 17:19 1232896]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
    "LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 17:36 455968]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-04-22 18:06 171448]
    "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 15:35 125440]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-19 23:05 86016]
    "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-19 23:05 8497696]
    "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-19 23:05 81920]
    "SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 11:29 102400]
    "QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-10-01 06:34 181544]
    "QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-20 01:31 202032]
    "OnScreenDisplay"="C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-05 00:54 554320]
    "UCam_Menu"="C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-17 10:13 218408]
    "DpAgent"="C:\Program Files\DigitalPersona\Bin\dpagent.exe" [2007-09-20 22:12 671744]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-12-23 16:04 1006264]
    "ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 11:01 51048]
    "HP Health Check Scheduler"="[ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [ ]
    "hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 19:47 480560]
    "WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-09 02:53 311296]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 15:00 132496]
    "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
    "CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 19:01 644696]
    "CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 19:50 1603152]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.l3codecp"= l3codecp.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UacDisableNotify"=dword:00000001
    "InternetSettingsDisableNotify"=dword:00000001
    "AutoUpdateDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{DCF507BC-F4FE-4A10-A155-BD56F59B76C6}"= C:\Program Files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
    "{BA0BF932-6DCB-4630-977C-96C889ABA098}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
    "{E34059C3-F3A3-4392-8F01-B920F60F0D65}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
    "{5A97A8A4-6CC0-4213-A1D0-A70644B65BE3}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
    "{149A90DE-28C9-4464-8228-95ECF3FED449}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{D4F1C685-688E-49A3-B3D4-8242EADC064F}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
    "EnableFirewall"= 0 (0x0)

    R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\ipsdefs\20080423.001\IDSvix86.sys [2008-03-20 23:37]
    R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 10:20]
    R2 LiveUpdate Notice;LiveUpdate Notice;"c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon []
    R2 QPCapSvc;QuickPlay Background Capture Service (QBCS);"C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe" [2007-10-01 06:34]
    R2 QPSched;QuickPlay Task Scheduler (QTS);"C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe" [2007-10-01 06:34]
    R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2007-07-10 17:27]
    R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2007-05-31 02:40]
    R3 HpqRemHid;HP Remote Control HID Device;C:\Windows\system32\DRIVERS\HpqRemHid.sys [2007-07-11 21:30]
    R3 nvsmu;nvsmu;C:\Windows\system32\DRIVERS\nvsmu.sys [2007-02-17 00:50]
    R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-08-13 21:50]
    S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver;C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 10:30]
    S3 COH_Mon;COH_Mon;C:\Windows\system32\Drivers\COH_Mon.sys [2008-03-06 21:32]

    *Newly Created Service* - COMHOST

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-04-22 14:41:18 C:\Windows\Tasks\Norton Internet Security - Suorita täysi järjestelmäntarkistus - Arto.job"
    - c:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeB/TASK:
    .
    **************************************************************************

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-25 21:49:13
    Windows 6.0.6000 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    C:\Users\Arto\AppData\Local\Temp\~DF282C.tmp 32768 bytes
    C:\Users\Arto\AppData\Local\Temp\~DF2FD8.tmp

    scan completed successfully
    hidden files: 2

    **************************************************************************
    .
    Completion time: 2008-04-25 21:50:04
    ComboFix-quarantined-files.txt 2008-04-25 18:49:59

    Pre-Run: 201,845,776,384 tavua vapaana
    Post-Run: 201,841,848,320 tavua vapaana

    313 --- E O F --- 2008-04-23 11:23:52
     
    Last edited: Apr 25, 2008
    Brix777, Apr 25, 2008
    #14
  15. Hujo

    Hujo Guest

    Scannaa koneesi Kaspersky Online Scannerin

    Ohjelman käynnistyessä kysytään sallitaanko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
    " Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
    " Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
    " Klikkaa nyt asetuksia, Scan Settings
    " Tarkista asetuksista, että seuraavat ovat valittuina:
    o Scan using the following Anti-Virus database:
    + Extended (Jos valittavissa, muuten valitse Standard)
    o Scan Options:
    + Scan Archives
    + Scan Mail Bases
    " Klikkaa OK
    " Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
    " Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
    " Klikkaa nyt Save as Text-painiketta.
    " Tallenna tiedosto työpöydällesi.
    " Mikäli haluat jatkaa asian käsittelyä foorumissa niin kopioi tiedoston sisältö viestiisi.
     
    Hujo, Apr 26, 2008
    #15
  16. Brix777

    Brix777 Member

    Joined:
    Aug 30, 2007
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    16
    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Sunday, April 27, 2008 2:21:00 AM
    Operating System: Microsoft Windows Vista Home Edition, (Build 6000)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 26/04/2008
    Kaspersky Anti-Virus database records: 726288
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\
    E:\

    Scan Statistics:
    Total number of scanned objects: 114797
    Number of viruses found: 0
    Number of infected objects: 0
    Number of suspicious objects: 0
    Duration of the scan process: 01:00:02

    Infected Object Name / Virus Name / Last Action
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\NFWEVT.LOG Object is locked skipped
    C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.ilg Object is locked skipped
    C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\setup.ilg Object is locked skipped
    C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\setup.ilg Object is locked skipped
    C:\Program Files\InstallShield Installation Information\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\setup.ilg Object is locked skipped
    C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped
    C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped
    C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped
    C:\ProgramData\Symantec\Common Client\ccSubSDK\submissions.idx Object is locked skipped
    C:\ProgramData\Symantec\Common Client\settings.BAK Object is locked skipped
    C:\ProgramData\Symantec\Common Client\settings.DAT Object is locked skipped
    C:\ProgramData\Symantec\Common Client\volatile.DAT Object is locked skipped
    C:\ProgramData\Symantec\Common Client\{098CCF48-4E90-43E0-A282-55A4E748B96B}.BAK Object is locked skipped
    C:\ProgramData\Symantec\Common Client\{88C2F96E-5235-4128-B7D7-FB4A1EB4322A}.BAK Object is locked skipped
    C:\ProgramData\Symantec\Common Client\{88C2F96E-5235-4128-B7D7-FB4A1EB4322A}.DAT Object is locked skipped
    C:\ProgramData\Symantec\Common Client\{B75EFE3F-5A4F-4EE3-BBA1-1D5B60EA8FEB}.BAK Object is locked skipped
    C:\ProgramData\Symantec\Common Client\{B75EFE3F-5A4F-4EE3-BBA1-1D5B60EA8FEB}.DAT Object is locked skipped
    C:\ProgramData\Symantec\Common Client\{BC721F2F-DD66-4C4A-BCD7-8E4BF055ECFF}.BAK Object is locked skipped
    C:\ProgramData\Symantec\Common Client\{BC721F2F-DD66-4C4A-BCD7-8E4BF055ECFF}.DAT Object is locked skipped
    C:\ProgramData\Symantec\Common Client\{DC262AF8-C2EC-459F-A418-C06AEFF275C7}.BAK Object is locked skipped
    C:\ProgramData\Symantec\Common Client\{DC262AF8-C2EC-459F-A418-C06AEFF275C7}.DAT Object is locked skipped
    C:\ProgramData\Symantec\LiveUpdate\2008-04-26_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
    C:\ProgramData\Symantec\Shared\QBackup\index.qbs Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\BBConfig.log Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\BBDebug.log Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\BBDetect.log Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\BBNotify.log Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\BBRefr.log Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\BBSetCfg.log Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\BBSetDev.log Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\BBSetLoc.log Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\BBSetUsr.log Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\BBStHash.log Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\BBValid.log Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\Shl_{4D23560F-7CBE-44FC-B106-14E6FB8A1FB7}.ldb Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\Shl_{4D23560F-7CBE-44FC-B106-14E6FB8A1FB7}.sds Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\SPPolicy.log Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\SPStart.log Object is locked skipped
    C:\ProgramData\Symantec\SPBBC\SPStop.log Object is locked skipped
    C:\ProgramData\Symantec\SRTSP\SrtErEvt.log Object is locked skipped
    C:\ProgramData\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped
    C:\ProgramData\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped
    C:\ProgramData\Symantec\SRTSP\SrtScEvt.log Object is locked skipped
    C:\ProgramData\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped
    C:\ProgramData\Symantec\SRTSP\SrtViEvt.log Object is locked skipped
    C:\ProgramData\Symantec\SymNetDrv\SNDALRT.log Object is locked skipped
    C:\ProgramData\Symantec\SymNetDrv\SNDCON.log Object is locked skipped
    C:\ProgramData\Symantec\SymNetDrv\SNDDBG.log Object is locked skipped
    C:\ProgramData\Symantec\SymNetDrv\SNDFW.log Object is locked skipped
    C:\ProgramData\Symantec\SymNetDrv\SNDIDS.log Object is locked skipped
    C:\ProgramData\Symantec\SymNetDrv\SNDSYS.log Object is locked skipped
    C:\ProgramData\CyberLink\TinyDB\EPGSignal Object is locked skipped
    C:\ProgramData\CyberLink\TinyDB\Schedule Object is locked skipped
    C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\4b0cf7fa6ce0a899f7bd07564b01a60b_acbf7a3b-5874-4da3-a14d-5e2e081685c8 Object is locked skipped
    C:\ProgramData\Microsoft\User Account Pictures\Administrator.dat Object is locked skipped
    C:\QooBox\Quarantine\C\ProgramData\Microsoft\Network\Downloader\qmgr0.dat.vir Object is locked skipped
    C:\QooBox\Quarantine\C\ProgramData\Microsoft\Network\Downloader\qmgr1.dat.vir Object is locked skipped
    C:\System.sav\Logs\LPs\Insda-dk.log.txt Object is locked skipped
    C:\System.sav\Logs\LPs\Insfi-fi.log.txt Object is locked skipped
    C:\System.sav\Logs\LPs\Insnb-no.log.txt Object is locked skipped
    C:\System.sav\Logs\LPs\Inssv-se.log.txt Object is locked skipped
    C:\Users\Arto\AppData\Local\Microsoft\Feeds Cache\index.dat Object is locked skipped
    C:\Users\Arto\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat Object is locked skipped
    C:\Users\Arto\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008042620080427\index.dat Object is locked skipped
    C:\Users\Arto\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat Object is locked skipped
    C:\Users\Arto\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Users\Arto\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Users\Arto\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat Object is locked skipped
    C:\Users\Arto\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT Object is locked skipped
    C:\Users\Arto\AppData\Local\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Users\Arto\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 Object is locked skipped
    C:\Users\Arto\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 Object is locked skipped
    C:\Users\Arto\AppData\Local\Microsoft\Windows\UsrClass.dat{fceeed4b-1071-11dd-9bd9-001e68053fba}.TM.blf Object is locked skipped
    C:\Users\Arto\AppData\Local\Microsoft\Windows\UsrClass.dat{fceeed4b-1071-11dd-9bd9-001e68053fba}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped
    C:\Users\Arto\AppData\Local\Microsoft\Windows\UsrClass.dat{fceeed4b-1071-11dd-9bd9-001e68053fba}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped
    C:\Users\Arto\AppData\Local\Microsoft\Windows Defender\FileTracker\{577B2510-CD9E-4996-8937-530B855C1E7E} Object is locked skipped
    C:\Users\Arto\AppData\Local\Mozilla\Firefox\Profiles\uqnal3ox.default\Cache\_CACHE_001_ Object is locked skipped
    C:\Users\Arto\AppData\Local\Mozilla\Firefox\Profiles\uqnal3ox.default\Cache\_CACHE_002_ Object is locked skipped
    C:\Users\Arto\AppData\Local\Mozilla\Firefox\Profiles\uqnal3ox.default\Cache\_CACHE_003_ Object is locked skipped
    C:\Users\Arto\AppData\Local\Mozilla\Firefox\Profiles\uqnal3ox.default\Cache\_CACHE_MAP_ Object is locked skipped
    C:\Users\Arto\AppData\Local\Temp\ehmsas.txt Object is locked skipped
    C:\Users\Arto\AppData\Roaming\Microsoft\Windows\Cookies\index.dat Object is locked skipped
    C:\Users\Arto\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat Object is locked skipped
    C:\Users\Arto\AppData\Roaming\Mozilla\Firefox\Profiles\uqnal3ox.default\cert8.db Object is locked skipped
    C:\Users\Arto\AppData\Roaming\Mozilla\Firefox\Profiles\uqnal3ox.default\GoogleToolbarData\googlesafebrowsing.db Object is locked skipped
    C:\Users\Arto\AppData\Roaming\Mozilla\Firefox\Profiles\uqnal3ox.default\history.dat Object is locked skipped
    C:\Users\Arto\AppData\Roaming\Mozilla\Firefox\Profiles\uqnal3ox.default\key3.db Object is locked skipped
    C:\Users\Arto\AppData\Roaming\Mozilla\Firefox\Profiles\uqnal3ox.default\parent.lock Object is locked skipped
    C:\Users\Arto\AppData\Roaming\Symantec\NPMDataStore\CIMStore.xml Object is locked skipped
    C:\Users\Arto\NTUSER.DAT Object is locked skipped
    C:\Users\Arto\ntuser.dat.LOG1 Object is locked skipped
    C:\Users\Arto\ntuser.dat.LOG2 Object is locked skipped
    C:\Users\Arto\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped
    C:\Users\Arto\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped
    C:\Users\Arto\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\Debug\sam.log Object is locked skipped
    C:\WINDOWS\Logs\CBS\CBS.log Object is locked skipped
    C:\WINDOWS\Logs\DPX\setupact.log Object is locked skipped
    C:\WINDOWS\Logs\DPX\setuperr.log Object is locked skipped
    C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe.config Object is locked skipped
    C:\WINDOWS\panther\diagerr.xml Object is locked skipped
    C:\WINDOWS\panther\diagwrn.xml Object is locked skipped
    C:\WINDOWS\panther\setupact.log Object is locked skipped
    C:\WINDOWS\panther\setuperr.log Object is locked skipped
    C:\WINDOWS\panther\UnattendGC\diagerr.xml Object is locked skipped
    C:\WINDOWS\panther\UnattendGC\diagwrn.xml Object is locked skipped
    C:\WINDOWS\panther\UnattendGC\setupact.log Object is locked skipped
    C:\WINDOWS\panther\UnattendGC\setuperr.log Object is locked skipped
    C:\WINDOWS\security\database\secedit.sdb Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{F22AA149-28E2-43D9-A661-EFB351554289}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped
    C:\WINDOWS\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped
    C:\WINDOWS\System32\catroot2\edb.log Object is locked skipped
    C:\WINDOWS\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Object is locked skipped
    C:\WINDOWS\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Object is locked skipped
    C:\WINDOWS\System32\config\COMPONENTS Object is locked skipped
    C:\WINDOWS\System32\config\COMPONENTS.LOG1 Object is locked skipped
    C:\WINDOWS\System32\config\COMPONENTS.LOG2 Object is locked skipped
    C:\WINDOWS\System32\config\DEFAULT Object is locked skipped
    C:\WINDOWS\System32\config\DEFAULT.LOG1 Object is locked skipped
    C:\WINDOWS\System32\config\DEFAULT.LOG2 Object is locked skipped
    C:\WINDOWS\System32\config\SAM Object is locked skipped
    C:\WINDOWS\System32\config\SAM.LOG1 Object is locked skipped
    C:\WINDOWS\System32\config\SAM.LOG2 Object is locked skipped
    C:\WINDOWS\System32\config\SECURITY Object is locked skipped
    C:\WINDOWS\System32\config\SECURITY.LOG1 Object is locked skipped
    C:\WINDOWS\System32\config\SECURITY.LOG2 Object is locked skipped
    C:\WINDOWS\System32\config\SOFTWARE Object is locked skipped
    C:\WINDOWS\System32\config\SOFTWARE.LOG1 Object is locked skipped
    C:\WINDOWS\System32\config\SOFTWARE.LOG2 Object is locked skipped
    C:\WINDOWS\System32\config\SYSTEM Object is locked skipped
    C:\WINDOWS\System32\config\SYSTEM.LOG1 Object is locked skipped
    C:\WINDOWS\System32\config\SYSTEM.LOG2 Object is locked skipped
    C:\WINDOWS\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.0.regtrans-ms Object is locked skipped
    C:\WINDOWS\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.1.regtrans-ms Object is locked skipped
    C:\WINDOWS\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.2.regtrans-ms Object is locked skipped
    C:\WINDOWS\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.blf Object is locked skipped
    C:\WINDOWS\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TM.blf Object is locked skipped
    C:\WINDOWS\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped
    C:\WINDOWS\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped
    C:\WINDOWS\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000003.regtrans-ms Object is locked skipped
    C:\WINDOWS\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000004.regtrans-ms Object is locked skipped
    C:\WINDOWS\System32\LogFiles\Scm\SCM.EVM Object is locked skipped
    C:\WINDOWS\System32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
    C:\WINDOWS\System32\restore\MachineGuid.txt Object is locked skipped
    C:\WINDOWS\System32\spool\SpoolerETW.etl Object is locked skipped
    C:\WINDOWS\System32\sysprep\Panther\diagerr.xml Object is locked skipped
    C:\WINDOWS\System32\sysprep\Panther\diagwrn.xml Object is locked skipped
    C:\WINDOWS\System32\sysprep\Panther\setupact.log Object is locked skipped
    C:\WINDOWS\System32\sysprep\Panther\setuperr.log Object is locked skipped
    C:\WINDOWS\System32\wbem\AutoRecover\3460B7617E0429A960E481B197F238A3.mof Object is locked skipped
    C:\WINDOWS\System32\wbem\AutoRecover\E478A5DB75C9721E744C05D78DBACFD3.mof Object is locked skipped
    C:\WINDOWS\System32\wbem\Logs\WMITracing.log Object is locked skipped
    C:\WINDOWS\System32\wbem\Repository\INDEX.BTR Object is locked skipped
    C:\WINDOWS\System32\wbem\Repository\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\System32\wbem\Repository\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\System32\wbem\Repository\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Application.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\DFS Replication.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\DigitalPersona Pro.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\HardwareEvents.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Internet Explorer.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Key Management Service.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Media Center.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-CorruptedFileRecovery-Client%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-CorruptedFileRecovery-Server%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-DateTimeControlPanel%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Diagnosis-MSDT%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Diagnosis-PLA%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Networking%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-DiskDiagnostic%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-DiskDiagnosticDataCollector%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-DiskDiagnosticResolver%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Forwarding%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Help%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-International%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Kernel-WDI%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-MeetingSpace%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-MemoryDiagnostics-Results%4Debug.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-MUI%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-ParentalControls%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-RemoteAssistance%4Admin.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-RemoteAssistance%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Resource-Leak-Diagnostic%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-UAC%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Winsock-WS2HELP%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-Wired-AutoConfig%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\ODiag.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\OSession.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Security.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\Setup.evtx Object is locked skipped
    C:\WINDOWS\System32\winevt\Logs\System.evtx Object is locked skipped
    C:\WINDOWS\Tasks\SCHEDLGU.TXT Object is locked skipped
    C:\WINDOWS\Temp\JETF584.tmp Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    C:\WINDOWS\winsxs\x86_microsoft-windows-n..n_service_datastore_31bf3856ad364e35_6.0.6000.16386_none_cef7ceb03914a67f\dnary.xsd Object is locked skipped
    D:\$RECYCLE.BIN\Desktop.ini Object is locked skipped
    D:\$RECYCLE.BIN\Folder.htt Object is locked skipped
    D:\$RECYCLE.BIN\protect.chinese hong kong Object is locked skipped
    D:\$RECYCLE.BIN\protect.chinese simplified Object is locked skipped
    D:\$RECYCLE.BIN\protect.chinese traditional Object is locked skipped
    D:\$RECYCLE.BIN\protect.czech Object is locked skipped
    D:\$RECYCLE.BIN\protect.danish Object is locked skipped
    D:\$RECYCLE.BIN\protect.dutch Object is locked skipped
    D:\$RECYCLE.BIN\Protect.ed Object is locked skipped
    D:\$RECYCLE.BIN\protect.english Object is locked skipped
    D:\$RECYCLE.BIN\protect.finnish Object is locked skipped
    D:\$RECYCLE.BIN\protect.french Object is locked skipped
    D:\$RECYCLE.BIN\protect.german Object is locked skipped
    D:\$RECYCLE.BIN\protect.greek Object is locked skipped
    D:\$RECYCLE.BIN\protect.hebrew Object is locked skipped
    D:\$RECYCLE.BIN\protect.hungarian Object is locked skipped
    D:\$RECYCLE.BIN\protect.italian Object is locked skipped
    D:\$RECYCLE.BIN\protect.japanese Object is locked skipped
    D:\$RECYCLE.BIN\protect.korean Object is locked skipped
    D:\$RECYCLE.BIN\protect.norwegian Object is locked skipped
    D:\$RECYCLE.BIN\protect.polish Object is locked skipped
    D:\$RECYCLE.BIN\protect.portuguese Object is locked skipped
    D:\$RECYCLE.BIN\protect.portuguese brazilian Object is locked skipped
    D:\$RECYCLE.BIN\protect.russian Object is locked skipped
    D:\$RECYCLE.BIN\protect.spanish Object is locked skipped
    D:\$RECYCLE.BIN\protect.swedish Object is locked skipped
    D:\$RECYCLE.BIN\protect.turkish Object is locked skipped

    Scan process completed.
     
    Brix777, Apr 27, 2008
    #16
  17. Hujo

    Hujo Guest

    scannaas uusi hjt:n loki
     
    Hujo, Apr 27, 2008
    #17
  18. Brix777

    Brix777 Member

    Joined:
    Aug 30, 2007
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    16
    Tässä tämä hjt-loki
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:37, on 2008-04-25
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16643)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    C:\Program Files\HP\QuickPlay\QPService.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
    C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
    C:\Program Files\DigitalPersona\Bin\DpAgent.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Windows\ehome\ehmsas.exe
    C:\WINDOWS\ehome\EHTray.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
    O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
    O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
    O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
    O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto (Automatic LiveUpdate Scheduler) - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    O23 - Service: LiveUpdate Notice - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
    O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 9238 bytes
     
    Brix777, Apr 28, 2008
    #18
  19. Hujo

    Hujo Guest

    Lataa SmitfraudFix (c) S!Ri
    Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

    Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita ponnahtava rapport – muistion sisältö viestiketjuusi.
    Löytyy myös C:\rapport.txt

    Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
    (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
    A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
    silloin ne saattavat varoittaa käyttäjää.

    ============

    Lataa TÄSTÄ VundoFix.exe työpöydällesi.

    Tupla-klikkaa VundoFix.exe ajaaksesi sen.
    Klikkaa Scan for Vundo valintaa.
    Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
    Sinulta kysytään haluatko poistaa filut - klikkaa YES.
    Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
    Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
    Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

    Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
    Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.
     
    Hujo, Apr 28, 2008
    #19
  20. arthyr

    arthyr Member

    Joined:
    Apr 20, 2008
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    Smitraudfixin lokiin(+) tulee vain teksti "käyttö estetty"
    Vundofix ei löytänyt tartutettuja tiedsostoja
    Tässä uusi hjt
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:37, on 2008-04-25
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16643)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    C:\Program Files\HP\QuickPlay\QPService.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
    C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
    C:\Program Files\DigitalPersona\Bin\DpAgent.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Windows\ehome\ehmsas.exe
    C:\WINDOWS\ehome\EHTray.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
    O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
    O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
    O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
    O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto (Automatic LiveUpdate Scheduler) - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    O23 - Service: LiveUpdate Notice - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
    O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 9238 bytes
     
    arthyr, Apr 29, 2008
    #20
Page 1 of 2

Share This Page