|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Firefox availee itsekseen sivuja
|
|
Junior Member
2 tuotearviota
|
2. heinäkuuta 2007 @ 08:25 |
Linkki tähän viestiin
|
No niin Firefox on alkanut availemaan itsekseen mainos yms sivuja.
Logfile of HijackThis v1.99.1
Scan saved at 12:23:21, on 2.7.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Windows\system32\isys32.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\HJT\HijackThis.exe
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [MonAppli] C:\Windows\system32\isys32.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsu...b?1183187561421
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
|
|
Auttaja
Suspended permanently
|
2. heinäkuuta 2007 @ 12:41 |
Linkki tähän viestiin
|
|
Junior Member
2 tuotearviota
|
2. heinäkuuta 2007 @ 17:32 |
Linkki tähän viestiin
|
|
Ei toi combofix tehny muuta kuin ComboFix.txt.bat tiedoston c:n juureen.
Se kysyi kyllä että anna 1 tai 2 ja alkoi jotain tekemään mutta sitten se vain katosi...
|
|
Auttaja
Suspended permanently
|
2. heinäkuuta 2007 @ 17:48 |
Linkki tähän viestiin
|
|
ComboFix.txt.bat
jees eli tuplaklikkaa sitä nii taitaa tulla sitten se tiedosto.
|
Junior Member
2 tuotearviota
|
2. heinäkuuta 2007 @ 18:35 |
Linkki tähän viestiin
|
ComboFix 07-06-18.2 - C:\ComboFix.exe
"Mika" - 2007-07-02 21:32:39 - Service Pack 2 NTFS
((((((((((((((((((((((((( Files Created from 2007-06-02 to 2007-07-02 )))))))))))))))))))))))))))))))
2007-07-02 21:52 639,224 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-07-02 21:37 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
2007-07-02 21:37 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-07-02 21:37 <DIR> d-------- C:\Program Files\ffdshow
2007-07-02 21:32 1,087,754 --a------ C:\ComboFix.exe
2007-07-02 21:27 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-07-02 16:18 <DIR> d-------- C:\DOCUME~1\Mika\APPLIC~1\WinRAR
2007-07-02 12:22 <DIR> d-------- C:\HJT
2007-07-02 12:19 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-02 08:16 <DIR> d-------- C:\Program Files\Lavasoft
2007-07-02 08:16 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-02 08:16 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-01 08:00 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-06-30 19:28 <DIR> d-------- C:\Program Files\uTorrent
2007-06-30 19:28 <DIR> d-------- C:\DOCUME~1\Mika\APPLIC~1\uTorrent
2007-06-30 19:25 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2007-06-30 19:25 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-06-30 18:17 490,272 --a------ C:\WINDOWS\system32\LVUI2.dll
2007-06-30 18:17 465,696 --a------ C:\WINDOWS\system32\LVUI2RC.dll
2007-06-30 18:17 416,544 --a------ C:\WINDOWS\system32\lvcodec2.dll
2007-06-30 18:17 41,888 --a------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2007-06-30 18:17 3,580,832 --a------ C:\WINDOWS\system32\drivers\lvuvc.sys
2007-06-30 18:17 22,560 --a------ C:\WINDOWS\system32\drivers\lvuvcflt.sys
2007-06-30 18:17 195,360 --a------ C:\WINDOWS\system32\lvci1100.dll
2007-06-30 18:17 15,558 --a------ C:\WINDOWS\system32\Repository.reg
2007-06-30 18:17 1,921,184 --a------ C:\WINDOWS\system32\drivers\lvpopflt.sys
2007-06-30 18:16 <DIR> d-------- C:\Program Files\Common Files\LogiShrd
2007-06-30 18:14 43,136 --a------ C:\WINDOWS\system32\drivers\sbp2port.sys
2007-06-30 18:14 <DIR> d--hs---- C:\RECYCLER
2007-06-30 18:09 990 --a------ C:\WINDOWS\SB0790.reg
2007-06-30 18:09 986 --a------ C:\WINDOWS\SB0792.reg
2007-06-30 18:09 98,304 --a------ C:\WINDOWS\system32\a3d.dll
2007-06-30 18:09 8,704 --a------ C:\WINDOWS\system32\drivers\Pfmodnt.sys
2007-06-30 18:09 782,336 -ra------ C:\WINDOWS\OALInst.exe
2007-06-30 18:09 73,728 --a------ C:\WINDOWS\MIDIDEF.EXE
2007-06-30 18:09 53,248 --a------ C:\WINDOWS\system32\P17CPI.dll
2007-06-30 18:09 53,248 --a------ C:\WINDOWS\resdef.exe
2007-06-30 18:09 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll
2007-06-30 18:09 21,504 --a------ C:\WINDOWS\system32\sfman32.dll
2007-06-30 18:09 197,632 --a------ C:\WINDOWS\SF32.exe
2007-06-30 18:09 162,176 --a------ C:\WINDOWS\system32\drivers\ctusfsyn.sys
2007-06-30 18:09 142,336 --a------ C:\WINDOWS\system32\drivers\ctsfm2k.sys
2007-06-30 18:09 139,264 --a------ C:\WINDOWS\system32\EAX.DLL
2007-06-30 18:09 137,728 --a------ C:\WINDOWS\system32\P17res.dll
2007-06-30 18:09 137,216 --a------ C:\WINDOWS\system32\OemSpi.dll
2007-06-30 18:09 120,832 --a------ C:\WINDOWS\system32\sfms32.dll
2007-06-30 18:09 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll
2007-06-30 18:09 114,688 --a------ C:\WINDOWS\system32\drivers\ctoss2k.sys
2007-06-30 18:09 11,264 --a------ C:\WINDOWS\InRes.DLL
2007-06-30 18:09 10,752 --a------ C:\WINDOWS\system32\SPIRun.dll
2007-06-30 18:09 1,173,504 --a------ C:\WINDOWS\system32\drivers\P17xfi.sys
2007-06-30 18:09 <DIR> d-------- C:\Program Files\Creative
2007-06-30 18:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative
2007-06-30 17:33 <DIR> d-------- C:\DOCUME~1\Mika\APPLIC~1\HP
2007-06-30 17:31 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
2007-06-30 17:30 <DIR> d-------- C:\Program Files\Common Files\HP
2007-06-30 17:29 <DIR> d-------- C:\Program Files\Hewlett-Packard
2007-06-30 17:29 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2007-06-30 17:28 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2007-06-30 17:28 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2007-06-30 17:28 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe
2007-06-30 17:28 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2007-06-30 17:28 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll
2007-06-30 17:28 306,688 --a------ C:\WINDOWS\IsUninst.exe
2007-06-30 17:28 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll
2007-06-30 17:28 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2007-06-30 17:28 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-06-30 17:25 <DIR> d-------- C:\Program Files\HP
2007-06-30 17:23 36,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-06-30 17:23 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-06-30 17:23 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-06-30 17:23 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-06-30 17:23 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-06-30 17:23 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-06-30 17:23 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-06-30 17:22 117,132 --a------ C:\WINDOWS\hpoins11.dat
2007-06-30 17:22 <DIR> d-------- C:\WINDOWS\RegisteredPackages
2007-06-30 17:22 <DIR> d-------- C:\Program Files\Winamp
2007-06-30 17:21 49,664 --a------ C:\WINDOWS\system32\drivers\HPZid412.sys
2007-06-30 17:21 21,568 --a------ C:\WINDOWS\system32\drivers\HPZius12.sys
2007-06-30 17:21 16,496 --a------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2007-06-30 17:19 98,304 --a------ C:\WINDOWS\system32\hpzjsn01.dll
2007-06-30 17:19 827,392 --a------ C:\WINDOWS\system32\hpotiop2.dll
2007-06-30 17:19 77,824 --a------ C:\WINDOWS\system32\HPZIDS01.dll
2007-06-30 17:19 659,456 --a------ C:\WINDOWS\system32\hpowiax2.dll
2007-06-30 17:19 282,624 --a------ C:\WINDOWS\system32\HPZc3212.dll
2007-06-30 17:19 254,026 --a------ C:\WINDOWS\system32\hpovst09.dll
2007-06-30 17:18 11,634 --a------ C:\WINDOWS\hpomdl11.dat
2007-06-30 17:14 <DIR> d-------- C:\DOCUME~1\Mika\Contacts
2007-06-30 17:09 <DIR> d-------- C:\Program Files\MSN Messenger
2007-06-30 17:06 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bluetooth
2007-06-30 12:44 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-06-30 12:12 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2007-06-30 12:12 8,192 --a------ C:\WINDOWS\system32\wshirda.dll
2007-06-30 12:12 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-06-30 12:12 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2007-06-30 12:12 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2007-06-30 12:12 59,648 --a------ C:\WINDOWS\system32\drivers\rfcomm.sys
2007-06-30 12:12 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2007-06-30 12:12 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-06-01 13:16:22 152,064 ----a-w C:\WINDOWS\system32\isys32.exe
2007-05-17 07:25:18 323,624 ----a-w C:\WINDOWS\system32\wiaaut.dll
2007-05-11 14:30:16 25,888 ----a-w C:\WINDOWS\system32\drivers\LVPr2Mon.sys
2007-05-11 14:29:54 2,142,752 ----a-w C:\WINDOWS\system32\drivers\LVMVdrv.sys
2007-05-11 14:27:58 2,107,808 ----a-w C:\WINDOWS\system32\drivers\Lvckap.sys
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-19 10:26:00 888,832 ----a-w C:\WINDOWS\system32\nvmobls.dll
2007-04-19 10:26:00 86,016 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-04-19 10:26:00 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-04-19 10:26:00 794,624 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-04-19 10:26:00 7,700,480 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-04-19 10:26:00 581,632 ----a-w C:\WINDOWS\system32\nvhwvid.dll
2007-04-19 10:26:00 5,644,288 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-04-19 10:26:00 5,619,712 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-04-19 10:26:00 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-04-19 10:26:00 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-04-19 10:26:00 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-04-19 10:26:00 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-04-19 10:26:00 4,543,616 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-04-19 10:26:00 35,840 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-04-19 10:26:00 35,840 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-04-19 10:26:00 311,296 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-04-19 10:26:00 3,035,136 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-04-19 10:26:00 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-04-19 10:26:00 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-04-19 10:26:00 212,992 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-04-19 10:26:00 2,924,544 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-04-19 10:26:00 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll
2007-04-19 10:26:00 159,810 ----a-w C:\WINDOWS\system32\nvsvc32.exe
2007-04-19 10:26:00 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe
2007-04-19 10:26:00 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-04-19 10:26:00 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2007-04-19 10:26:00 1,474,560 ----a-w C:\WINDOWS\system32\nview.dll
2007-04-19 10:26:00 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe
2007-04-19 10:26:00 1,236,992 ----a-w C:\WINDOWS\system32\nvwss.dll
2007-04-19 10:26:00 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll
2007-04-19 10:26:00 1,011,712 ----a-w C:\WINDOWS\system32\nvcpluir.dll
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 19:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 19:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-13 12:19:52 7,680 ----a-w C:\WINDOWS\system32\lsdelete.exe
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 04:07 C:\WINDOWS\system32\bthprops.cpl]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2006-12-05 16:22]
"F-Secure TNB"="C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" [2007-01-08 22:10]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 13:26]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 C:\WINDOWS\KHALMNPR.Exe]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41]
"P17Helper"="SPIRun.dll" [2006-07-03 12:43 C:\WINDOWS\system32\SPIRun.dll]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-05-17 10:52]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-05-17 10:53]
"MonAppli"="C:\Windows\system32\isys32.exe" [2007-06-01 16:16]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-06-30 17:13]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 15:29]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ
*Newly Created Service* - AAWSERVICE
*Newly Created Service* - AD-WATCH_CONNECT_FILTER
*Newly Created Service* - AD-WATCH_REGISTRY_FILTER
*Newly Created Service* - AVG_ANTI-SPYWARE_DRIVER
*Newly Created Service* - AVG_ANTI-SPYWARE_GUARD
*Newly Created Service* - UMWDF
**************************************************************************
catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-02 22:16:23
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
? [19100]
? [32352]
? [656]
? [716]
? [2836]
? [2388]
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
P17Helper = Rundll32 SPIRun.dll,RunDLLEntry?
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services\{00001000-0000-1000-8000-00805f9b34fb}]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services\{00001115-0000-1000-8000-00805f9b34fb}]
Completion time: 2007-07-02 22:17:41
--- E O F ---
Siinäpä se loki.
|
|
Auttaja
Suspended permanently
|
2. heinäkuuta 2007 @ 19:44 |
Linkki tähän viestiin
|
Lataa Killbox Option^Explicitiltä.
Huomaa: Jos sinulla on jo Killbox, tämä on uusi versio joka sinun tulee asentaa. Poista aikaisempi.
[*]Tallenna työpöydällesi.
[*] Tupla-klikkaa Killbox.exe ajaaksesi ohjelman.
[*] Valitse: [*]Delete on Reboot[*] sitten klikkaa All Files valintaa.
[*]Kopioi ja liitä alapuolella olevat tiedostopolut leikepöydälle mustaamalla KAIKKI ne ja painamalla CTRL + C (tai, mustaamisen jälkeen, oikea klikki hiirellä ja valitse kopioi):
C:\Windows\system32\isys32.exe
[*] Palaa Killboxiin, mene File valikkoon, ja valitse Paste from Clipboard.
[*]Klikkaa puna-valkoista Delete File valintaa. Klikkaa Yes "Delete on Reboot" pyyntöön. Klikkaa OK mihin vain PendingFileRenameOperations pyyntöön (ja anna fixaajan tietää jos jokin tälläinen tulee!).
Käynnistä koneesi itse jos se ei sitä automaattisesti tee
Jos saat tälläisen viestin: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." Kun yrität ajaa KillBoxia, klikkaa tätä ladataksesi ja ajaaksesi Missingfilessetup.exe;n. Sitten koita KillBoxia uudestaan.
=======
Ajetaanpas blacklightia.
Lataa ja tallenna Blacklight työpöydällesi;
Tupla-klikkaa fsbl.exe, hyväksy sopimus, klikkaa -> Scan, sitten -> Next
Näet listan kaikesta mitä löytyi. Työpöydällesi myös ilmestyy loki jonka nimi on fsbl.xxxxxxx.log (xxxxxxx;n tilalla on luultavimmin numeroita).
Kopioi ja liitä tämä loki seuraavaan vastaukseesi. Älä valitse "Rename" optiota vielä! Haluamme nähdä login ensin, koska hyviä tiedostoja saattaa olla mukana, kuten "wbemtest.exe".
|
Junior Member
2 tuotearviota
|
2. heinäkuuta 2007 @ 19:57 |
Linkki tähän viestiin
|
|
07/02/07 23:53:29 [Info]: BlackLight Engine 1.0.64 initialized
07/02/07 23:53:29 [Info]: OS: 5.1 build 2600 (Service Pack 2)
07/02/07 23:53:29 [Note]: 7019 4
07/02/07 23:53:29 [Note]: 7005 0
07/02/07 23:53:33 [Note]: 7006 0
07/02/07 23:53:33 [Note]: 7011 1904
07/02/07 23:53:34 [Note]: FSRAW library version 1.7.1022
Amatööristä ainakin näyttää hyvältä??? :)
|
|
Auttaja
Suspended permanently
|
2. heinäkuuta 2007 @ 20:05 |
Linkki tähän viestiin
|
Itseasia huono homma että ei löytäny mitään, ei ne popupit kai mihinkää oo hävinny
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file
O4 - HKLM\..\Run: [MonAppli] C:\Windows\system32\isys32.exe
fixaa
Tässä ohje miten merkataan:
======
Lataa Deckard's System Scanner Työpöydällesi.
Huomioi: Sinulla tulee olla Järjestelmänvalvojan oikeudet ajaaksesi ohjelman.
[*]Sulje kaikki avoimet ikkunat ja ohjelmat.
[*]Tupla Klikkaa Dss.exe tiedostoa ajaaksesi ohjelman, seuraa ohjeita.
[*]Kun Scannaus on valmis 2 textitiedostoa pitäisi avautua, Main.txt ja extra.txt
[*]Näppäile Kopioi ( CTRL+A -> CTRL + C ) ja liitä ( CTRL + V )
[*]kopioi ja liitä Extra.txt & Main.txt sisältö seuraavaan vastaukseesi.
|
Junior Member
2 tuotearviota
|
2. heinäkuuta 2007 @ 20:20 |
Linkki tähän viestiin
|
Deckard's System Scanner v20070611.50
Run by Mika on 2007-07-03 at 00:17:00
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
System Restore is disabled; attempting to re-enable...success.
-- Last 1 Restore Point(s) --
1: 2007-07-02 21:17:04 UTC - RP1 - System Checkpoint
Backed up registry hives.
Performed disk cleanup.
-- HijackThis (run as Mika.exe) ------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 0:17:27, on 3.7.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Mika\Desktop\dss.exe
C:\HJT\Mika.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsu...b?1183187561421
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
-- HijackThis Fixed Entries (C:\HJT\backups\) ----------------------------------
backup-20070703-001034-190 O4 - HKLM\..\Run: [MonAppli] C:\Windows\system32\isys32.exe
backup-20070703-001034-273 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
-- File Associations -----------------------------------------------------------
All associations okay.
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R0 BTHidMgr (Bluetooth HID Manager Service) - c:\windows\system32\drivers\bthidmgr.sys <Not Verified; IVT Corporation; BlueSoleil(c)>
R0 FSFW (F-Secure Firewall Driver) - c:\windows\system32\drivers\fsdfw.sys <Not Verified; F-Secure Corporation; F-Secure Anti-Virus Internet Shield>
R1 F-Secure HIPS - c:\program files\f-secure\hips\fshs.sys <Not Verified; F-Secure Corporation; F-Secure HIPS Driver>
R3 BlueletAudio (Bluetooth Audio Service) - c:\windows\system32\drivers\blueletaudio.sys <Not Verified; IVT Corporation; Windows (R) 2000 DDK driver>
R3 BlueletSCOAudio (Bluetooth SCO Audio Service) - c:\windows\system32\drivers\blueletscoaudio.sys <Not Verified; IVT Corporation; Windows (R) 2000 DDK driver>
R3 BT (Bluetooth PAN Network Adapter) - c:\windows\system32\drivers\btnetdrv.sys <Not Verified; IVT Corporation; BlueSoleil>
R3 Btcsrusb (Bluetooth USB For Bluetooth Service) - c:\windows\system32\drivers\btcusb.sys <Not Verified; IVT Corporation; Bluetooth USB Device Driver>
R3 BTHidEnum (Bluetooth HID Enumerator) - c:\windows\system32\drivers\vbtenum.sys
R3 F-Secure Gatekeeper - c:\program files\f-secure\anti-virus\minifilter\fsgk.sys
R3 VComm (Virtual Serial port driver) - c:\windows\system32\drivers\vcomm.sys <Not Verified; IVT Corporation; BlueSoleil>
R3 VcommMgr (Bluetooth VComm Manager Service) - c:\windows\system32\drivers\vcommmgr.sys <Not Verified; IVT Corporation; BlueSoleil>
S3 Ad-Watch Connect Filter (Ad-Watch Connect Kernel Filter) - c:\windows\system32\drivers\nsdriver.sys <Not Verified; Lavasoft AB; Ad-Watch Connections>
S4 F-Secure Filter (F-Secure File System Filter) - c:\program files\f-secure\anti-virus\win2k\fsfilter.sys
S4 F-Secure Recognizer (F-Secure File System Recognizer) - c:\program files\f-secure\anti-virus\win2k\fsrec.sys
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 aawservice (Ad-Aware 2007 Service) - "c:\program files\lavasoft\ad-aware 2007\aawservice.exe" <Not Verified; Lavasoft AB; Ad-Aware 2007 Service>
R2 BlueSoleil Hid Service - c:\program files\ivt corporation\bluesoleil\btntservice.exe
R2 F-Secure Gatekeeper Handler Starter (FSGKHS) - "c:\program files\f-secure\anti-virus\fsgk32st.exe" <Not Verified; F-Secure Corporation; F-Secure Corp. Startup service>
R2 FSMA (F-Secure Management Agent) - "c:\program files\f-secure\common\fsma32.exe" <Not Verified; F-Secure Corporation; F-Secure Management Agent>
R3 FSAUA (F-Secure Automatic Update Agent) - "c:\program files\f-secure\fsaua\program\fsaua.exe" <Not Verified; F-Secure Corporation; F-Secure Automatic Update Agent>
R3 FSDFWD (F-Secure Anti-Virus Firewall Daemon) - "c:\program files\f-secure\fwes\program\fsdfwd.exe" <Not Verified; F-Secure Corporation; F-Secure Anti-Virus Internet Shield>
R3 F-Secure Network Request Broker - "c:\program files\f-secure\common\fnrb32.exe" <Not Verified; F-Secure Corporation; F-Secure Management Agent>
-- Files created between 2007-06-03 and 2007-07-03 -----------------------------
2007-07-03 00:01:49 28672 --a------ C:\WINDOWS\system32\mcoinstall.exe <Not Verified; Aapie.Net; prjMCOInstaller>
2007-07-02 23:47:35 0 d-------- C:\!KillBox
2007-07-02 21:52:01 639224 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-07-02 21:37:40 60273 --a------ C:\WINDOWS\system32\pthreadGC2.dll <Not Verified; Open Source Software community project; >
2007-07-02 21:37:40 10752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-07-02 21:37:37 0 d-------- C:\Program Files\ffdshow
2007-07-02 21:32:23 1087754 --a------ C:\ComboFix.exe
2007-07-02 16:18:02 0 d-------- C:\Documents and Settings\Mika\Application Data\WinRAR
2007-07-02 12:22:52 0 d-------- C:\HJT
2007-07-02 12:19:54 0 d-------- C:\Documents and Settings\Mika\Application Data\Grisoft
2007-07-02 12:19:47 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-07-02 08:16:50 0 d-------- C:\Program Files\Lavasoft
2007-07-02 08:16:50 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-07-02 08:16:26 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-01 08:00:16 0 d-------- C:\Program Files\MSXML 4.0
2007-06-30 19:28:38 0 d-------- C:\Program Files\uTorrent
2007-06-30 19:28:30 0 d-------- C:\Documents and Settings\Mika\Application Data\uTorrent
2007-06-30 18:16:19 0 d-------- C:\Program Files\Common Files\LogiShrd
2007-06-30 18:09:44 73728 --a------ C:\WINDOWS\MIDIDEF.EXE <Not Verified; Creative Technology Ltd; Creative Audio Product>
2007-06-30 18:09:32 409600 --a------ C:\WINDOWS\system32\wrap_oal.dll <Not Verified; Creative Labs; Creative Labs OpenAL32>
2007-06-30 18:09:32 0 d-------- C:\Documents and Settings\All Users\Application Data\Creative
2007-06-30 18:09:31 114688 --a------ C:\WINDOWS\system32\OpenAL32.dll <Not Verified; Portions (C) Creative Labs Inc. and NVIDIA Corp.; Standard OpenAL(TM) Library>
2007-06-30 18:09:17 139264 --a------ C:\WINDOWS\system32\EAX.DLL <Not Verified; Creative Technology Ltd; EAX Unified>
2007-06-30 18:09:17 197632 --a------ C:\WINDOWS\SF32.exe <Not Verified; Creative Technology Ltd; Creative Technology Ltd>
2007-06-30 18:09:17 986 --a------ C:\WINDOWS\SB0792.reg
2007-06-30 18:09:17 990 --a------ C:\WINDOWS\SB0790.reg
2007-06-30 18:09:17 782336 -ra------ C:\WINDOWS\OALInst.exe <Not Verified; Creative Labs Inc.; OpenAL Installer>
2007-06-30 18:09:15 0 d-------- C:\Program Files\Creative
2007-06-30 17:33:10 0 d-------- C:\Documents and Settings\Mika\Application Data\HP
2007-06-30 17:31:58 0 d-------- C:\Documents and Settings\All Users\Application Data\HP
2007-06-30 17:30:59 0 d-------- C:\Program Files\Common Files\HP
2007-06-30 17:29:45 0 d-------- C:\Program Files\Hewlett-Packard
2007-06-30 17:29:29 0 d-------- C:\Program Files\Common Files\Hewlett-Packard
2007-06-30 17:28:00 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2007-06-30 17:25:56 0 d-------- C:\Program Files\HP
2007-06-30 17:22:54 0 d-------- C:\WINDOWS\RegisteredPackages
2007-06-30 17:22:19 117132 --a------ C:\WINDOWS\hpoins11.dat
2007-06-30 17:22:14 0 d-------- C:\Program Files\Winamp
2007-06-30 17:19:39 98304 --a------ C:\WINDOWS\system32\hpzjsn01.dll <Not Verified; Hewlett Packard Company; HPJZSN01 Dynamic Link Library>
2007-06-30 17:18:27 11634 --a------ C:\WINDOWS\hpomdl11.dat
2007-06-30 17:14:03 0 d-------- C:\Documents and Settings\Mika\Contacts
2007-06-30 17:09:49 0 d-------- C:\Program Files\MSN Messenger
2007-06-30 17:06:32 0 d-------- C:\Documents and Settings\All Users\Application Data\Bluetooth
2007-06-30 12:44:22 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2007-06-30 12:10:08 0 d--hs---- C:\WINDOWS\Installer
2007-06-30 12:10:07 0 d-------- C:\Program Files\Common Files\ODBC
2007-06-30 12:10:04 0 d-------- C:\Program Files\Common Files\SpeechEngines
2007-06-30 12:10:03 0 dr------- C:\Program Files
2007-06-30 12:09:36 0 d--h----- C:\Documents and Settings\Default User\Templates
2007-06-30 12:09:36 0 dr------- C:\Documents and Settings\Default User\Start Menu
2007-06-30 12:09:36 0 dr-h----- C:\Documents and Settings\Default User\SendTo
2007-06-30 12:09:36 0 d--h----- C:\Documents and Settings\Default User\Recent
2007-06-30 12:09:36 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2007-06-30 12:09:36 0 d--h----- C:\Documents and Settings\Default User\NetHood
2007-06-30 12:09:36 0 d-------- C:\Documents and Settings\Default User\My Documents
2007-06-30 12:09:36 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
2007-06-30 12:09:36 0 d-------- C:\Documents and Settings\Default User\Favorites
2007-06-30 12:09:36 0 d-------- C:\Documents and Settings\Default User\Desktop
2007-06-30 12:09:36 0 d---s---- C:\Documents and Settings\Default User\Cookies
2007-06-30 12:09:36 0 d--h----- C:\Documents and Settings\All Users\Templates
2007-06-30 12:09:36 0 dr------- C:\Documents and Settings\All Users\Start Menu
2007-06-30 12:09:36 0 d-------- C:\Documents and Settings\All Users\Favorites
2007-06-30 12:09:36 0 dr------- C:\Documents and Settings\All Users\Documents
2007-06-30 12:09:36 0 d-------- C:\Documents and Settings\All Users\Desktop
2007-06-30 12:07:44 0 d-------- C:\WINDOWS\system32\CatRoot2
2007-06-30 12:07:44 0 d-------- C:\WINDOWS\system32\CatRoot
2007-06-30 12:07:39 0 dr-h----- C:\Documents and Settings\Default User\Application Data
2007-06-30 12:07:39 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2007-06-30 12:07:39 0 dr-h----- C:\Documents and Settings\All Users\Application Data
2007-06-30 12:07:39 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
2007-06-30 12:07:13 0 d--hs---- C:\System Volume Information
2007-06-30 12:07:13 0 d-------- C:\Documents and Settings
2007-06-30 12:01:18 0 d-------- C:\WINDOWS
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\WinSxS
2007-06-30 12:01:18 0 dr------- C:\WINDOWS\Web
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\twain_32
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\wins
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\wbem
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\usmt
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\spool
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\ShellExt
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\Setup
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\ras
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\oobe
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\npp
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\mui
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\inetsrv
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\IME
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\icsxml
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\ias
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\export
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\drivers
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\drivers\etc
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\drivers\disdn
2007-06-30 12:01:18 0 dr-hs--c- C:\WINDOWS\system32\dllcache
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\dhcp
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\config
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\3com_dmi
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\3076
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\2052
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\1054
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\1042
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\1041
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\1037
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\1033
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\1031
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\1028
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system32\1025
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\system
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\security
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\Resources
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\repair
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\Provisioning
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\PeerNet
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\pchealth
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\mui
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\msapps
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\msagent
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\Media
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\java
2007-06-30 12:01:18 0 d--h----- C:\WINDOWS\inf
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\ime
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\Help
2007-06-30 12:01:18 0 dr--s---- C:\WINDOWS\Fonts
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\ehome
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\Driver Cache
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\Debug
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\Cursors
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\Connection Wizard
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\Config
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\AppPatch
2007-06-30 12:01:18 0 d-------- C:\WINDOWS\addins
2007-06-30 10:29:15 0 d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd
2007-06-30 10:28:53 0 d-------- C:\Documents and Settings\Mika\Application Data\Logitech
2007-06-30 10:27:55 0 d-------- C:\WINDOWS\system32\ReinstallBackups
2007-06-30 10:27:53 0 d------c- C:\WINDOWS\system32\DRVSTORE
2007-06-30 10:27:43 69632 --a------ C:\WINDOWS\system32\KemXML.dll <Not Verified; Logitech Inc.; Logitech SetPoint>
2007-06-30 10:27:43 110592 --a------ C:\WINDOWS\system32\KemWnd.dll <Not Verified; Logitech Inc.; Logitech SetPoint>
2007-06-30 10:27:43 135168 --a------ C:\WINDOWS\system32\KemUtil.dll <Not Verified; Logitech Inc.; Logitech SetPoint>
2007-06-30 10:27:43 163840 --a------ C:\WINDOWS\system32\kemutb.dll <Not Verified; Logitech Inc.; Logitech SetPoint>
2007-06-30 10:27:21 0 d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2007-06-30 10:27:14 0 d-------- C:\Program Files\Common Files\Logitech
2007-06-30 10:27:09 0 d-------- C:\Program Files\Logitech
2007-06-30 10:27:06 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-06-30 10:27:03 0 d-------- C:\Documents and Settings\Mika\Application Data\InstallShield
2007-06-30 10:23:13 0 d-------- C:\Program Files\IVT Corporation
2007-06-30 10:17:14 0 d-------- C:\WINDOWS\system32\PreInstall
2007-06-30 10:17:08 0 d--h----- C:\WINDOWS\$hf_mig$
2007-06-30 10:16:16 0 d-------- C:\WINDOWS\nview
2007-06-30 10:15:45 0 d-------- C:\NVIDIA
2007-06-30 10:13:41 0 d-------- C:\Documents and Settings\Mika\Application Data\Macromedia
2007-06-30 10:13:35 1156 --a------ C:\WINDOWS\mozver.dat
2007-06-30 10:13:07 0 --a------ C:\WINDOWS\nsreg.dat
2007-06-30 10:13:01 0 d-------- C:\Documents and Settings\Mika\Application Data\Mozilla
2007-06-30 10:11:20 0 d---s---- C:\Documents and Settings\Mika\UserData
2007-06-30 10:11:18 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-06-30 10:10:33 0 d-------- C:\Program Files\Marvell
2007-06-30 10:10:18 0 d-------- C:\Program Files\Common Files\InstallShield
2007-06-30 09:41:28 5824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2007-06-30 09:40:34 0 d-------- C:\Documents and Settings\Mika\Application Data\F-Secure
2007-06-30 09:35:05 29536 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys <Not Verified; F-Secure Corporation; F-Secure Anti-Virus Internet Shield>
2007-06-30 09:35:05 50240 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys <Not Verified; F-Secure Corporation; F-Secure Anti-Virus Internet Shield>
2007-06-30 09:35:04 0 d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2007-06-30 09:34:38 0 d-------- C:\Documents and Settings\All Users\Application Data\fssg
2007-06-30 09:33:59 0 d-------- C:\Program Files\F-Secure
2007-06-30 09:32:45 0 d-------- C:\Documents and Settings\Mika\Application Data\Identities
2007-06-30 09:32:29 0 d--h----- C:\Documents and Settings\Mika\Templates
2007-06-30 09:32:29 0 dr------- C:\Documents and Settings\Mika\Start Menu
2007-06-30 09:32:29 0 dr-h----- C:\Documents and Settings\Mika\SendTo
2007-06-30 09:32:29 0 dr-h----- C:\Documents and Settings\Mika\Recent
2007-06-30 09:32:29 0 d--h----- C:\Documents and Settings\Mika\PrintHood
2007-06-30 09:32:29 1048576 --ah----- C:\Documents and Settings\Mika\NTUSER.DAT
2007-06-30 09:32:29 0 d--h----- C:\Documents and Settings\Mika\NetHood
2007-06-30 09:32:29 0 dr------- C:\Documents and Settings\Mika\My Documents
2007-06-30 09:32:29 0 d--h----- C:\Documents and Settings\Mika\Local Settings
2007-06-30 09:32:29 0 dr------- C:\Documents and Settings\Mika\Favorites
2007-06-30 09:32:29 0 d-------- C:\Documents and Settings\Mika\Desktop
2007-06-30 09:32:29 0 d---s---- C:\Documents and Settings\Mika\Cookies
2007-06-30 09:32:29 0 dr-h----- C:\Documents and Settings\Mika\Application Data
2007-06-30 09:31:43 0 d-------- C:\WINDOWS\SoftwareDistribution
2007-06-30 09:31:42 0 d---s---- C:\WINDOWS\system32\Microsoft
2007-06-30 09:31:42 0 d-------- C:\WINDOWS\Prefetch
2007-06-30 09:31:41 262144 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT
2007-06-30 09:31:41 0 d--h----- C:\Documents and Settings\LocalService\Local Settings
2007-06-30 09:31:41 0 d---s---- C:\Documents and Settings\LocalService\Cookies
2007-06-30 09:31:41 0 d-------- C:\Documents and Settings\LocalService\Application Data
2007-06-30 09:31:41 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
2007-06-30 09:23:08 262144 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
2007-06-30 09:23:08 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
2007-06-30 09:23:08 0 d---s---- C:\Documents and Settings\NetworkService\Cookies
2007-06-30 09:23:08 0 d-------- C:\Documents and Settings\NetworkService\Application Data
2007-06-30 09:23:08 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
2007-06-30 09:20:11 0 d-------- C:\WINDOWS\system32\xircom
2007-06-30 09:20:11 0 d-------- C:\Program Files\microsoft frontpage
2007-06-30 09:20:01 262144 --ah----- C:\Documents and Settings\Default User\NTUSER.DAT
2007-06-30 09:19:53 0 -rahs---- C:\MSDOS.SYS
2007-06-30 09:19:53 0 -rahs---- C:\IO.SYS
2007-06-30 09:19:53 0 --a------ C:\CONFIG.SYS
2007-06-30 09:19:53 0 --a------ C:\AUTOEXEC.BAT
2007-06-30 09:19:07 0 d--hs---- C:\Documents and Settings\All Users\DRM
2007-06-30 09:19:01 0 dr------- C:\WINDOWS\Offline Web Pages
2007-06-30 09:19:01 0 d---s---- C:\WINDOWS\Downloaded Program Files
2007-06-30 09:18:52 0 d--h----- C:\Program Files\WindowsUpdate
2007-06-30 09:18:33 0 d-------- C:\WINDOWS\system32\DirectX
2007-06-30 09:17:51 0 d---s---- C:\WINDOWS\Tasks
2007-06-30 09:17:50 0 d-------- C:\Program Files\Common Files\MSSoap
2007-06-30 09:17:45 0 d-------- C:\WINDOWS\srchasst
2007-06-30 09:17:44 0 d-------- C:\WINDOWS\system32\Macromed
2007-06-30 09:17:34 0 d-------- C:\Program Files\Movie Maker
2007-06-30 09:17:23 0 d-------- C:\WINDOWS\system32\Restore
2007-06-30 09:16:50 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-06-30 09:16:39 0 d-------- C:\WINDOWS\Registration
2007-06-30 09:16:35 0 d-------- C:\Program Files\Online Services
2007-06-30 09:16:29 0 d-------- C:\Program Files\Messenger
2007-06-30 09:16:25 0 d-------- C:\Program Files\MSN Gaming Zone
2007-06-30 09:15:36 0 d-------- C:\Program Files\Windows NT
2007-06-30 09:15:32 0 d-------- C:\WINDOWS\system32\MsDtc
2007-06-30 09:15:30 0 d-------- C:\WINDOWS\system32\Com
2007-06-04 15:18:48 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys <Not Verified; Lavasoft AB; Ad-Watch Connections>
2007-06-04 15:17:02 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys <Not Verified; Lavasoft AB; Ad-Watch Registry Protection>
2007-06-04 15:14:56 6272 --a------ C:\WINDOWS\system32\drivers\AWRTPD.sys <Not Verified; Lavasoft AB; Ad-Watch Beta>
-- Find3M Report ---------------------------------------------------------------
2007-06-30 12:09:36 62 --ahs---- C:\Documents and Settings\Mika\Application Data\desktop.ini
2007-04-19 13:26:00 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2007-04-19 13:26:00 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2007-04-19 13:26:00 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2007-04-19 13:26:00 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll
2007-04-19 13:26:00 1626112 --a------ C:\WINDOWS\system32\nwiz.exe
2007-04-19 13:26:00 1474560 --a------ C:\WINDOWS\system32\nview.dll
2007-04-19 13:26:00 581632 --a------ C:\WINDOWS\system32\nvhwvid.dll
2007-04-19 13:26:00 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2007-04-19 13:26:00 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2007-04-19 13:26:00 212992 --a------ C:\WINDOWS\system32\nvapi.dll
2007-04-19 13:26:00 425984 --a------ C:\WINDOWS\system32\keystone.exe
2007-04-13 15:19:52 7680 --a------ C:\WINDOWS\system32\lsdelete.exe
-- Registry Dump ---------------------------------------------------------------
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"BluetoothAuthenticationAgent"="rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent"
"F-Secure Manager"="\"C:\\Program Files\\F-Secure\\Common\\FSM32.EXE\" /splash"
"F-Secure TNB"="\"C:\\Program Files\\F-Secure\\FSGUI\\TNBUtil.exe\" /CHECKALL /WAITFORSW"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"P17Helper"="Rundll32 SPIRun.dll,RunDLLEntry"
"LogitechCommunicationsManager"="\"C:\\Program Files\\Common Files\\LogiShrd\\LComMgr\\Communications_Helper.exe\""
"LogitechQuickCamRibbon"="\"C:\\Program Files\\Logitech\\QuickCam10\\QuickCam10.exe\" /hide"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
bthsvcs REG_MULTI_SZ BthServ\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_AVGASCLN
-- End of Deckard's System Scanner: finished at 2007-07-03 at 00:19:10 ---------
Deckard's System Scanner v20070611.50
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------
-- System Information ----------------------------------------------------------
Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English
CPU 0: AMD Athlon(tm) 64 Processor 3500+
Percentage of Memory in Use: 54%
Physical Memory (total/avail): 1023.23 MiB / 466.04 MiB
Pagefile Memory (total/avail): 2459.89 MiB / 2004.44 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1955.25 MiB
A: is Removable (No Media)
C: is Fixed (NTFS) - 24.7 GiB total, 19.57 GiB free.
D: is Fixed (NTFS) - 152.66 GiB total, 41.01 GiB free.
E: is Fixed (NTFS) - 208.18 GiB total, 122.32 GiB free.
F: is Fixed (NTFS) - 111.78 GiB total, 52.17 GiB free.
G: is CDROM (No Media)
-- Security Center -------------------------------------------------------------
AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.
FirstRunDisabled is set.
FW: F-Secure Client Security 7.00 v7.00 (F-Secure Corporation)
AV: F-Secure Client Security 7.00 v7.00 (F-Secure Corporation)
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"="C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"
-- Environment Variables -------------------------------------------------------
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Mika\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=MIKA-809EE679E9
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Mika
LOGONSERVER=\\MIKA-809EE679E9
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 47 Stepping 2, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=2f02
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Mika\LOCALS~1\Temp
TMP=C:\DOCUME~1\Mika\LOCALS~1\Temp
USERDOMAIN=MIKA-809EE679E9
USERNAME=Mika
USERPROFILE=C:\Documents and Settings\Mika
windir=C:\WINDOWS
-- User Profiles ---------------------------------------------------------------
Mika (admin)
-- Add/Remove Programs ---------------------------------------------------------
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Spyware Scanner"
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Spyware"
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Virus Client Security Installer"
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure Automatic Update Agent"
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure DAAS"
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure Diagnostics"
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure FWES"
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure GateKeeper Interface"
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure Gemini"
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure GUI"
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure Help"
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure Localization API"
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure Management Agent"
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure Pegasus Engine"
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure Policy Manager Support"
--> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure TNB"
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17E96A7F-AFE3-4171-87B1-583E376319E8}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9 /remove
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
µTorrent --> "C:\Program Files\uTorrent\uTorrent.exe" /UNINSTALL
Ad-Aware 2007 --> MsiExec.exe /X{0E6AB9FC-76C2-431B-9C06-6C1CFFFEA8EB}
AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
BlueSoleil --> MsiExec.exe /X{38F0F8B4-3786-42D6-A82C-DF1FEB010C46}
CDDRV_Installer --> MsiExec.exe /I{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}
Creative Audio Console --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17E96A7F-AFE3-4171-87B1-583E376319E8}\setup.exe" -l0x9 /remove
F-Secure Client Security - E-Mail Scanning --> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure E-mail Scanning"
F-Secure Client Security - Internet Shield --> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure Internet Shield"
F-Secure Client Security - System Control --> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure HIPS"
F-Secure Client Security - Web Traffic Scanning --> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure Protocol Scanner"
F-Secure Client Security - Virus & Spy Protection --> "C:\Program Files\F-Secure\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Virus"
ffdshow [rev 1320] [2007-06-25] --> "C:\Program Files\ffdshow\unins000.exe"
HijackThis 1.99.1 --> C:\Documents and Settings\Mika\Desktop\HijackThis.exe /uninstall
HP Customer Participation Program 7.0 --> C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Imaging Device Functions 7.0 --> C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP Photosmart Essential --> MsiExec.exe /X{6994491D-D491-48F1-AE1F-E179C1FFFC2F}
HP Photosmart, Officejet and Deskjet 7.0.A --> C:\Program Files\HP\Digital Imaging\{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}\setup\hpzscr01.exe -datfile hposcr11.dat
HP Software Update --> MsiExec.exe /X{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}
HP Solution Center 7.0 --> C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
KhalInstallWrapper --> MsiExec.exe /I{56918C0C-0D87-4CA6-92BF-4975A43AC719}
Logitech Audio Echo Cancellation Component --> MsiExec.exe /X{BEF726DD-4037-4214-8C6A-E625C02D2870}
Logitech QuickCam --> MsiExec.exe /X{EFA2BBEB-CF93-493B-904B-1B970B8DFAB6}
Logitech SetPoint --> C:\Program Files\InstallShield Installation Information\{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}\setup.exe -runfromtemp -l0x0009 -removeonly
Logitech® Camera Driver --> "C:\Program Files\Common Files\LogiShrd\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
Marvell Miniport Driver --> MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Mozilla Firefox (2.0.0.4) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MVision --> MsiExec.exe /I{35725FBC-A136-4A46-9F29-091759D9BB93}
NVIDIA Drivers --> C:\WINDOWS\system32\nvudisp.exe UninstallGUI
OCR Software by I.R.I.S 7.0 --> C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe"
Windows Live Messenger --> MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F}
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
-- End of Deckard's System Scanner: finished at 2007-07-03 at 00:19:10 ---------
Tuossapa noi tiedot, seuraavan vastauksen saat vasta aamulla... Pakko mennä nukkumaan että jaksaa herätä muksujen kanssa aamulla aikaisin... :)
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 2. heinäkuuta 2007 @ 20:23
|
|
Auttaja
Suspended permanently
|
2. heinäkuuta 2007 @ 20:26 |
Linkki tähän viestiin
|
1,Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi. Jos sinulla on jo kyseinen ohjelma siirry suoraan kohtaan 2!
[*]Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
[*]Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
2. [*]Käynnistä AVG eAnti-Spyware.
[*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
[*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
[*]Paina hetken kuluttua uudestaan "Start Update" , jos päivitykset eivät heti onnistu
[*]Jos automaattipäivitys ei jostain syystä toimi, niin tunnisteet voi ladata manuaalisesti http://www.ewido.net/en/download/updates/ -linkin takaa.
[*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
[*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
[*]Sitten "Reports" valikon alta:
[*]Laita täppi kohtaan "Automatically generate report after every scan"
[*]Ota täppi pois kohdasta"Only if threats were found"
[*]Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
[*]"Resident shield is", muuta tila active:sta inactive:ksi
[*]Sulje ohjelma, ÄLÄ skannaa vielä.
HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.
[*]Käynnistä AVG Anti-Spyware.
[*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
[*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
[*]Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
[*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
[*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
[*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
[*]Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestiketjuusi.
|
Junior Member
2 tuotearviota
|
3. heinäkuuta 2007 @ 08:09 |
Linkki tähän viestiin
|
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 11:39:40 3.7.2007
+ Scan result:
:mozilla.149:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.150:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.151:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.152:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.153:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.154:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.155:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.156:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.157:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.174:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.121:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.47:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned.
:mozilla.48:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned.
:mozilla.49:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned.
:mozilla.50:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned.
:mozilla.95:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.96:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.29:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
C:\Documents and Settings\Mika\Cookies\mika@CAI3STMV.txt -> TrackingCookie.Statistik-gallup : Cleaned.
:mozilla.38:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.133:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.134:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.135:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.137:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.138:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\41o6hju3.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
::Report end
Ei ole muuten Firefox enää aukonut ylimääräisiä sivuja!
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 3. heinäkuuta 2007 @ 08:28
|
|
Auttaja
Suspended permanently
|
3. heinäkuuta 2007 @ 10:00 |
Linkki tähän viestiin
|
|
Voitko ajaa uudestaan tuon combofixin ja laittaa sen login, katotaan häviskö nuo muutamat epämääräset prosessit?
|
Junior Member
2 tuotearviota
|
3. heinäkuuta 2007 @ 10:44 |
Linkki tähän viestiin
|
ComboFix 07-06-18.2 - C:\Documents and Settings\Mika\Desktop\ComboFix.exe
"Mika" - 2007-07-03 14:41:29 - Service Pack 2 NTFS
((((((((((((((((((((((((( Files Created from 2007-06-03 to 2007-07-03 )))))))))))))))))))))))))))))))
2007-07-03 07:44 <DIR> d-------- C:\Program Files\Alcohol Soft
2007-07-03 07:41 <DIR> d-------- C:\Program Files\Kyodai
2007-07-03 07:40 <DIR> d-------- C:\Program Files\DVDlabPro2
2007-07-03 07:39 <DIR> d-------- C:\Program Files\coverXP
2007-07-03 07:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
2007-07-03 07:36 <DIR> d-------- C:\Program Files\CyberLink
2007-07-03 07:33 <DIR> d-------- C:\Program Files\DVD Shrink
2007-07-03 07:33 <DIR> d-------- C:\Program Files\DVD Decrypter
2007-07-03 07:33 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
2007-07-03 07:29 <DIR> d-------- C:\Program Files\DVD-RB PRO
2007-07-03 07:29 <DIR> d-------- C:\Program Files\Custom Technology
2007-07-03 07:28 385,108 --a------ C:\WINDOWS\system32\csedv.dll
2007-07-03 07:28 376,832 --a------ C:\WINDOWS\system32\hlcdvc.dll
2007-07-03 07:28 32,256 --a------ C:\WINDOWS\system32\cdvccodc.dll
2007-07-03 07:28 22,528 --a------ C:\WINDOWS\system32\csthread.dll
2007-07-03 07:28 188,482 -ra------ C:\WINDOWS\system32\helixprodctrl.dll
2007-07-03 07:28 159,832 --a------ C:\WINDOWS\system32\csccdvc.dll
2007-07-03 07:28 147,456 --a------ C:\WINDOWS\system32\csccdvcx.dll
2007-07-03 07:28 1,089,625 --a------ C:\WINDOWS\system32\csedvh.dll
2007-07-03 07:28 <DIR> d-------- C:\Program Files\Common Files\Canopus Shared
2007-07-03 07:28 <DIR> d-------- C:\Program Files\Canopus
2007-07-03 07:27 <DIR> d-------- C:\Program Files\AviSynth 2.5
2007-07-03 07:27 <DIR> d-------- C:\Program Files\AutoQMatEnc
2007-07-03 07:19 <DIR> d-------- C:\Program Files\Collectorz.com
2007-07-03 00:16 <DIR> d-------- C:\Deckard
2007-07-03 00:01 28,672 --a------ C:\WINDOWS\system32\mcoinstall.exe
2007-07-02 23:47 <DIR> d-------- C:\!KillBox
2007-07-02 21:52 639,224 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-07-02 21:37 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
2007-07-02 21:37 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-07-02 21:37 <DIR> d-------- C:\Program Files\ffdshow
2007-07-02 21:32 1,087,754 --a------ C:\ComboFix.exe
2007-07-02 21:27 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-07-02 16:18 <DIR> d-------- C:\DOCUME~1\Mika\APPLIC~1\WinRAR
2007-07-02 12:22 <DIR> d-------- C:\HJT
2007-07-02 12:19 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-02 08:16 <DIR> d-------- C:\Program Files\Lavasoft
2007-07-02 08:16 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-02 08:16 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-01 08:00 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-06-30 19:28 <DIR> d-------- C:\Program Files\uTorrent
2007-06-30 19:28 <DIR> d-------- C:\DOCUME~1\Mika\APPLIC~1\uTorrent
2007-06-30 19:25 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2007-06-30 19:25 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-06-30 18:17 490,272 --a------ C:\WINDOWS\system32\LVUI2.dll
2007-06-30 18:17 465,696 --a------ C:\WINDOWS\system32\LVUI2RC.dll
2007-06-30 18:17 416,544 --a------ C:\WINDOWS\system32\lvcodec2.dll
2007-06-30 18:17 41,888 --a------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2007-06-30 18:17 3,580,832 --a------ C:\WINDOWS\system32\drivers\lvuvc.sys
2007-06-30 18:17 22,560 --a------ C:\WINDOWS\system32\drivers\lvuvcflt.sys
2007-06-30 18:17 195,360 --a------ C:\WINDOWS\system32\lvci1100.dll
2007-06-30 18:17 15,558 --a------ C:\WINDOWS\system32\Repository.reg
2007-06-30 18:17 1,921,184 --a------ C:\WINDOWS\system32\drivers\lvpopflt.sys
2007-06-30 18:16 <DIR> d-------- C:\Program Files\Common Files\LogiShrd
2007-06-30 18:14 43,136 --a------ C:\WINDOWS\system32\drivers\sbp2port.sys
2007-06-30 18:14 <DIR> d--hs---- C:\RECYCLER
2007-06-30 18:09 990 --a------ C:\WINDOWS\SB0790.reg
2007-06-30 18:09 986 --a------ C:\WINDOWS\SB0792.reg
2007-06-30 18:09 98,304 --a------ C:\WINDOWS\system32\a3d.dll
2007-06-30 18:09 8,704 --a------ C:\WINDOWS\system32\drivers\Pfmodnt.sys
2007-06-30 18:09 782,336 -ra------ C:\WINDOWS\OALInst.exe
2007-06-30 18:09 73,728 --a------ C:\WINDOWS\MIDIDEF.EXE
2007-06-30 18:09 53,248 --a------ C:\WINDOWS\system32\P17CPI.dll
2007-06-30 18:09 53,248 --a------ C:\WINDOWS\resdef.exe
2007-06-30 18:09 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll
2007-06-30 18:09 21,504 --a------ C:\WINDOWS\system32\sfman32.dll
2007-06-30 18:09 197,632 --a------ C:\WINDOWS\SF32.exe
2007-06-30 18:09 162,176 --a------ C:\WINDOWS\system32\drivers\ctusfsyn.sys
2007-06-30 18:09 142,336 --a------ C:\WINDOWS\system32\drivers\ctsfm2k.sys
2007-06-30 18:09 139,264 --a------ C:\WINDOWS\system32\EAX.DLL
2007-06-30 18:09 137,728 --a------ C:\WINDOWS\system32\P17res.dll
2007-06-30 18:09 137,216 --a------ C:\WINDOWS\system32\OemSpi.dll
2007-06-30 18:09 120,832 --a------ C:\WINDOWS\system32\sfms32.dll
2007-06-30 18:09 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll
2007-06-30 18:09 114,688 --a------ C:\WINDOWS\system32\drivers\ctoss2k.sys
2007-06-30 18:09 11,264 --a------ C:\WINDOWS\InRes.DLL
2007-06-30 18:09 10,752 --a------ C:\WINDOWS\system32\SPIRun.dll
2007-06-30 18:09 1,173,504 --a------ C:\WINDOWS\system32\drivers\P17xfi.sys
2007-06-30 18:09 <DIR> d-------- C:\Program Files\Creative
2007-06-30 18:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative
2007-06-30 17:33 <DIR> d-------- C:\DOCUME~1\Mika\APPLIC~1\HP
2007-06-30 17:31 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
2007-06-30 17:30 <DIR> d-------- C:\Program Files\Common Files\HP
2007-06-30 17:29 <DIR> d-------- C:\Program Files\Hewlett-Packard
2007-06-30 17:29 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2007-06-30 17:28 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2007-06-30 17:28 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2007-06-30 17:28 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe
2007-06-30 17:28 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2007-06-30 17:28 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll
2007-06-30 17:28 306,688 --a------ C:\WINDOWS\IsUninst.exe
2007-06-30 17:28 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll
2007-06-30 17:28 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2007-06-30 17:28 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-06-30 17:25 <DIR> d-------- C:\Program Files\HP
2007-06-30 17:23 36,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-06-30 17:23 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-06-30 17:23 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-06-30 17:23 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-06-30 17:23 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-05-17 07:25:18 323,624 ----a-w C:\WINDOWS\system32\wiaaut.dll
2007-05-11 14:30:16 25,888 ----a-w C:\WINDOWS\system32\drivers\LVPr2Mon.sys
2007-05-11 14:29:54 2,142,752 ----a-w C:\WINDOWS\system32\drivers\LVMVdrv.sys
2007-05-11 14:27:58 2,107,808 ----a-w C:\WINDOWS\system32\drivers\Lvckap.sys
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-19 10:26:00 888,832 ----a-w C:\WINDOWS\system32\nvmobls.dll
2007-04-19 10:26:00 86,016 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-04-19 10:26:00 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-04-19 10:26:00 794,624 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-04-19 10:26:00 7,700,480 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-04-19 10:26:00 581,632 ----a-w C:\WINDOWS\system32\nvhwvid.dll
2007-04-19 10:26:00 5,644,288 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-04-19 10:26:00 5,619,712 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-04-19 10:26:00 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-04-19 10:26:00 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-04-19 10:26:00 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-04-19 10:26:00 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-04-19 10:26:00 4,543,616 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-04-19 10:26:00 35,840 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-04-19 10:26:00 35,840 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-04-19 10:26:00 311,296 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-04-19 10:26:00 3,035,136 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-04-19 10:26:00 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-04-19 10:26:00 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-04-19 10:26:00 212,992 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-04-19 10:26:00 2,924,544 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-04-19 10:26:00 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll
2007-04-19 10:26:00 159,810 ----a-w C:\WINDOWS\system32\nvsvc32.exe
2007-04-19 10:26:00 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe
2007-04-19 10:26:00 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-04-19 10:26:00 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2007-04-19 10:26:00 1,474,560 ----a-w C:\WINDOWS\system32\nview.dll
2007-04-19 10:26:00 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe
2007-04-19 10:26:00 1,236,992 ----a-w C:\WINDOWS\system32\nvwss.dll
2007-04-19 10:26:00 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll
2007-04-19 10:26:00 1,011,712 ----a-w C:\WINDOWS\system32\nvcpluir.dll
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 19:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 19:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-13 12:19:52 7,680 ----a-w C:\WINDOWS\system32\lsdelete.exe
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 04:07 C:\WINDOWS\system32\bthprops.cpl]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2006-12-05 16:22]
"F-Secure TNB"="C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" [2007-01-08 22:10]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 C:\WINDOWS\KHALMNPR.Exe]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41]
"P17Helper"="SPIRun.dll" [2006-07-03 12:43 C:\WINDOWS\system32\SPIRun.dll]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-05-17 10:52]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-05-17 10:53]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 21:01]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-06-30 17:13]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 15:29]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ
**************************************************************************
catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-03 14:42:45
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
P17Helper = Rundll32 SPIRun.dll,RunDLLEntry?
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services\{00001000-0000-1000-8000-00805f9b34fb}]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services\{00001115-0000-1000-8000-00805f9b34fb}]
Completion time: 2007-07-03 14:43:19
C:\ComboFix2.txt ... 2007-07-02 22:17
--- E O F ---
Siinäpä combofixin loki.
|
|
Auttaja
Suspended permanently
|
3. heinäkuuta 2007 @ 12:21 |
Linkki tähän viestiin
|
pakko kai se uskoo et puhasta on
Pysy puhtaana
-> Tyhjennä järjestelmänpalautus Ohjeet
Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste. Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä.
-> Käytä CCleaneria -> CCleaner
Lataa ja asenna CCleaner. Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti.
-> Asenna SpywareBlaster -> SpywareBlaster
SpywareBlaster estää haittaohjelmia asentumasta koneellesi. Ei kuluta muistia!
Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas
-> Asenna MVPS Hosts tiedosto -> MVPS Hosts
Estää koneesi yhteyden haitallisiin sivustoihin.
Opas saatavilla suomeksi! Nimimerkki Axelin opas
-> Vaihda selaimesi Firefoxiin -> Firefox
Firefox on nopeampi, turvallisempi ja parempi selain kuin Internet Explorer.
-> Pidä järjestelmäsi ajantasalla. -> Windows Update
Vieraile Windows Updatessa säännöllisesti.
-> Pidä palomuuri ja virustorjunta ajantasalla
Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi.
ja hyvä myös escan http://koti.mbnet.fi/pattaya1/escanmwav.htm
->Pidä ohjelmistosi ajantasalla. -> Secunia Software Inspector
Secunia Software Inspector tutkii sinun järjestälmäsi ja ohjelmistosi puuttuvien turvallisuuspäivityksien osalta. Tavallinen tutkinta kestää normaalisti 5-40 sekuntia, kun läpikotainen (thorough system inspection) voi kestää useita minuutteja.
->Seuraa säännöllisesti viestintäviraston tietoja uusista haavoittuvuuksista -> CERT-FI
-> Rekistöröidy. -> Virustorjunta.net
Virustorjunta.net on suomalainen haittaohjelmien poistoon keskittyvä sivusto joka kykenee auttamaan sinua mitä erilaisimmissa ongelmissa. Lisäksi siellä on suomen ainut HjT-koulu. Koulussa syvennytään HjT-ohjelman tuottaman informaation analysoimiseen sekä analysoinnin jälkeiseen tietokoneen puhdistamiseen.
Jos tulevaisuudessa tulee haittaohjelmien kanssa ongelmia, älä epäröi laittaa HijackThis-logia tarkistettavaksi!
|
|
Mainos
|
|
|
Junior Member
2 tuotearviota
|
3. heinäkuuta 2007 @ 19:32 |
Linkki tähän viestiin
|
|
Kiitoksia hirmuisen paljon avustasi!!! Hienoa että on ihmisiä olemassa, jotka jaksavat auttaa! :D
|
|
