Eli en tiedä mitä tekisin, mutta ensimmäisenä juolahti mieleen että pistän afterdawniin ketjun. Ongelmana on se, kun yritän mennä pelaamaan esim Call of Duty 2 (Aito on), niin tietokone menee täydellisesti jumiin, en saa sitä muuten "henkiin" paitsi käynnistämällä tietokoneen uudelleen. Ja tässä ois HjT logi teille tarkistettavaksi, että jos se vika löytyisi sieltä



Logfile of HijackThis v1.99.1
Scan saved at 20:56:35, on 8.8.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Xfire\xfiremusic.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\DynDNS Updater\DynDNS.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Lavalys\EVEREST Ultimate Edition\everest.exe
C:\FRAPS\FRAPS.EXE
C:\Program Files\WhatPulse\WhatPulse.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Logitech\Profiler\lwemon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\mIRC\mirc.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Netistä\HijackThis_v1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = ftp://ftp.saunalahti.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Xfire Music] "C:\Program Files\Xfire\xfiremusic.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DynDNS Updater] "C:\Program Files\DynDNS Updater\DynDNS.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [EVEREST AutoStart] C:\Program Files\Lavalys\EVEREST Ultimate Edition\everest.exe
O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE
O4 - HKCU\..\Run: [WhatPulse] C:\Program Files\WhatPulse\WhatPulse.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwemon.exe" /noui
O4 - Startup: mIRC.lnk = C:\Program Files\mIRC\mirc.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

eipä syytä tälläseen yleensä näy

Avaa hijackthis merkkaa seuraavat rivi(t) ja paina fix checked, sulje muut ohjelmat siksi aikaa.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


Tässä ohje miten merkataan:




==========

Tarkista koneesi F-Securen online skannerilla

Huom, skanneri toimii vain Internet Explorer selaimella

* Lue sivun ohjeet huolella läpi
* Klikkaa Start scanning
* Mikäli saat Internet Explorer -suojausvaroituksen, klikkaa Asenna
* Klikkaa Accept
* Klikkaa Custom Scan
* Säädä asetukset seuraavasti

o "Virus Scan Option" kohdasta valitse Scan whole system
o "Other Scan Option" kohdasta valitse Scan All Files
o Valitse Scan whole system for rootkits
o Valitse Scan whole system for spyware
o Laita ruksi kohtaan Scan inside archives
o Varmista että Use advanced heuristics on valittuna

* Klikkaa Start
* Skannaus käynnistyy kun tarvittavat tiedostot/päivitykset on ladattu
* Odota kärsivällisesti
* Kun sakannaus on suoritettu, klikkaa Automatic cleaning
* Klikkaa Show Report
* Raportti aukeaa selaimessa, kopioi teksti kokonaan
* Liitä kopioitu teksti esim. muistioon tai Wordiin ja tallenna työpöydälle
* Voit sulkea skannerin
* Lähetä raportti viestiketjuusi

==========


Loistava ohje tietokoneeen nopeuttamiseksi

http://neko.1g.fi/ohje/hidastelua.html


==========



Lataa Deckard's System Scanner Työpöydällesi.

Huomioi: Sinulla tulee olla Järjestelmänvalvojan oikeudet ajaaksesi ohjelman.

[*]Sulje kaikki avoimet ikkunat ja ohjelmat.
[*]Tupla Klikkaa Dss.exe tiedostoa ajaaksesi ohjelman, seuraa ohjeita.
[*]Kun Scannaus on valmis 2 textitiedostoa pitäisi avautua, Main.txt ja extra.txt
[*]Näppäile Kopioi ( CTRL+A -> CTRL + C ) ja liitä ( CTRL + V )
[*]kopioi ja liitä Extra.txt & Main.txt sisältö seuraavaan vastaukseesi.

myös F-securen raportti

Sain vain tosta F-secure hommelista login..


F-Secure

Scanning Report
Wednesday, August 08, 2007 23:01:37 - 02:16:14

Computer name: TIETOKONE
Scanning type: Scan system for viruses, rootkits, spyware
Target: C:\ D:\
Result: 4 malware found
Tracking Cookie (spyware)

* System (Disinfected)
* System
* System

Windows (spyware)

* System (Disinfected)

Statistics
Scanned:

* Files: 255992
* System: 4364
* Not scanned: 183

Actions:

* Disinfected: 2
* Renamed: 0
* Deleted: 0
* None: 2
* Submitted: 0

Files not scanned:

Options
Scanning engines:

* F-Secure Libra: 2.4.2, 2007-08-08
* F-Secure AVP: 7.0.171, 2007-08-08
* F-Secure Orion: 1.2.37, 2007-08-08
* F-Secure Blacklight: 1.0.64
* F-Secure Draco: 1.0.35, 0260-23-12
* F-Secure Pegasus: 1.19.0, 2007-07-05

Scanning options:

* Scan all files
* Scan inside archives
* Use Advanced heuristics

Copyright © 1998-2006 Product support |Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you
have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material
you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by
clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will
not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise,
by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.



Ja tosta toisesta ohjelmasta en saanu logia, vaan ennenkun se olisi lopettamassa sitä juttua, niin se tekee näin

aja tää sen tilalla

1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. (C:\ComboFix.txt) Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

Jos tätä logia tarkoitat, kun tää ilmesty heti ohjelman sammuttua

ComboFix 07-08-09.3 - "Antti" 2007-08-09 14:21:45.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.837 [GMT 3:00]
* Created a new restore point


((((((((((((((((((((((((( Files Created from 2007-07-09 to 2007-08-09 )))))))))))))))))))))))))))))))


2007-08-09 14:21 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-09 13:06 d-------- C:\GTR2
2007-08-09 03:06 d-------- C:\Deckard
2007-08-08 20:46 d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\Xfire
2007-08-08 20:33 d-------- C:\WINDOWS\system32\appmgmt
2007-08-08 19:53 d-------- C:\Program Files\SCi Games
2007-08-08 15:53 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
2007-08-08 15:45 d-------- C:\Program Files\rFactor
2007-08-02 21:09 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-08-02 21:09 740,442 --a------ C:\WINDOWS\system32\divx.dll
2007-08-02 21:09 73,728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-08-02 21:09 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-08-02 21:09 630,784 --a------ C:\WINDOWS\system32\vp7vfw.dll
2007-08-02 21:09 564,224 --a------ C:\WINDOWS\system32\x264vfw.dll
2007-08-02 21:09 438,272 --a------ C:\WINDOWS\system32\vp6vfw.dll
2007-08-02 21:09 39,936 --a------ C:\WINDOWS\system32\huffyuv.dll
2007-08-02 21:09 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-08-02 21:09 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll
2007-08-02 21:09 217,088 --a------ C:\WINDOWS\system32\i420vfw.dll
2007-08-02 21:09 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-08-02 21:09 163,840 --a------ C:\WINDOWS\system32\unrar.dll
2007-08-02 21:09 144,384 --a------ C:\WINDOWS\system32\Iacenc.dll
2007-08-02 21:09 d-------- C:\Program Files\K-Lite Codec Pack
2007-08-02 20:49 d-------- C:\DOCUME~1\Antti\APPLIC~1\vlc
2007-08-02 20:46 d-------- C:\Program Files\VideoLAN
2007-08-02 10:57 d--h----- C:\WINDOWS\PIF
2007-08-02 10:57 d-------- C:\Program Files\VentSrv
2007-08-01 14:44 d-------- C:\Program Files\QuickTime
2007-08-01 14:43 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-07-31 12:05 d-------- C:\Program Files\Guitar Pro 5
2007-07-30 23:21 d-------- C:\Program Files\ffdshow
2007-07-29 12:08 d-------- C:\WINDOWS\Downloaded Installations
2007-07-29 12:08 d-------- C:\SYSTEMTOOLS
2007-07-29 12:08 d-------- C:\DOCUME~1\Antti\APPLIC~1\Leadertech
2007-07-29 12:07 d-------- C:\Program Files\Diskeeper Corporation
2007-07-28 23:29 225,280 --a------ C:\WINDOWS\system32\rewire.dll
2007-07-28 23:29 d-------- C:\Program Files\VstPlugins
2007-07-28 23:27 d-------- C:\Program Files\Image-Line
2007-07-28 15:14 d-------- C:\testi
2007-07-28 15:12 d-------- C:\DOCUME~1\Antti\Phone Browser
2007-07-28 15:09 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
2007-07-28 15:07 d-------- C:\DOCUME~1\Antti\APPLIC~1\Nokia
2007-07-28 15:06 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2007-07-28 15:06 d-------- C:\Program Files\PC Connectivity Solution
2007-07-28 15:06 d-------- C:\Program Files\DIFX
2007-07-28 15:06 d-------- C:\DOCUME~1\Antti\APPLIC~1\PC Suite
2007-07-28 15:05 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
2007-07-27 22:35 d-------- C:\Program Files\VirtualDJ
2007-07-27 22:13 23,600 --a------ C:\WINDOWS\system32\drivers\TVICHW32.SYS
2007-07-27 21:07 d-------- C:\Program Files\ASUS
2007-07-27 21:03 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2007-07-27 18:57 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-07-27 18:57 22,328 --a------ C:\DOCUME~1\Antti\APPLIC~1\PnkBstrK.sys
2007-07-27 18:56 674,600 --a------ C:\WINDOWS\system32\pbsvc.exe
2007-07-27 18:56 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-07-27 18:56 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-07-27 17:24 d-------- C:\Program Files\SystemRequirementsLab
2007-07-27 17:23 d-------- C:\DOCUME~1\Antti\APPLIC~1\SystemRequirementsLab
2007-07-27 11:12 d-------- C:\Program Files\Common Files\DirectX
2007-07-27 11:10 d-------- C:\DOCUME~1\Antti\APPLIC~1\THQ
2007-07-27 10:46 d-------- C:\Program Files\THQ
2007-07-26 12:57 d-------- C:\Program Files\Windows Live Safety Center
2007-07-25 17:02 d-------- C:\Program Files\LFS Server
2007-07-24 16:37 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2007-07-24 16:37 286,720 --------- C:\WINDOWS\Setup1.exe
2007-07-24 16:37 d-------- C:\Program Files\Rcon4Cod2
2007-07-24 11:18 d-------- C:\DOCUME~1\Antti\APPLIC~1\Ahead
2007-07-24 11:16 d-------- C:\Program Files\Nero
2007-07-24 11:16 d-------- C:\Program Files\Common Files\Ahead
2007-07-24 11:16 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
2007-07-22 23:40 d-------- C:\Program Files\CloneSpy
2007-07-22 16:19 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2007-07-22 16:19 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2007-07-22 16:03 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2007-07-22 16:03 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2007-07-22 16:03 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2007-07-22 16:03 d-------- C:\WINDOWS\system32\Futuremark
2007-07-22 16:02 d-------- C:\Program Files\Futuremark
2007-07-22 14:59 d-------- C:\RivaTuner
2007-07-22 14:26 d-------- C:\CoolBits
2007-07-21 23:38 d-------- C:\Program Files\WS_FTP
2007-07-21 23:33 d-------- C:\Program Files\WinSCP3
2007-07-21 22:28 1,877 --a------ C:\WINDOWS\mozver.dat
2007-07-18 19:39 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\NVIDIA
2007-07-18 16:21 d-------- C:\DOCUME~1\Antti\APPLIC~1\Alien Skin
2007-07-18 16:09 86,016 --a------ C:\WINDOWS\unvise32.exe
2007-07-18 12:37 d-------- C:\DOCUME~1\Antti\APPLIC~1\Ventrilo
2007-07-18 12:36 d-------- C:\Program Files\VentriloMIX
2007-07-17 11:00 d-------- C:\DOCUME~1\Antti\APPLIC~1\Media Player Classic
2007-07-16 21:41 d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-07-16 21:41 d-------- C:\Fraps
2007-07-16 14:15 d-------- C:\Program Files\uTorrent
2007-07-16 14:15 d-------- C:\DOCUME~1\Antti\APPLIC~1\uTorrent
2007-07-15 12:42 12,020 --ah----- C:\WINDOWS\system32\mlfcache.dat
2007-07-14 15:24 d-------- C:\Program Files\DC++
2007-07-14 00:17 d-------- C:\Downloads
2007-07-13 20:14 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Test Drive Unlimited
2007-07-13 20:13 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-07-13 20:13 dr-h----- C:\DOCUME~1\Antti\APPLIC~1\SecuROM
2007-07-13 19:08 d-------- C:\Xenofex 2


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-01 14:40 71212 --a------ C:\WINDOWS\system32\perfc00B.dat
2007-08-01 14:40 366822 --a------ C:\WINDOWS\system32\perfh00B.dat
2007-07-13 11:57 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-07-13 11:57 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2007-06-08 08:11 831048 --a------ C:\WINDOWS\system32\WudfUpdate_01005.dll
2007-05-16 18:14 85504 --a--c--- C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 18:14 510976 --a--c--- C:\WINDOWS\system32\dllcache\wab32.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ptipbmf"="ptipbmf.dll" [2006-02-26 18:21 C:\WINDOWS\system32\ptipbmf.dll]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40]
"SoundMan"="SOUNDMAN.EXE" [2004-02-26 16:53 C:\WINDOWS\SOUNDMAN.EXE]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 01:03]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 C:\WINDOWS\KHALMNPR.Exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 01:22]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-10-22 12:22 C:\WINDOWS\system32\nvmctray.dll]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40]
"DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2005-11-22 17:38]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12]
"DynDNS Updater"="C:\Program Files\DynDNS Updater\DynDNS.exe" [2006-09-17 10:32]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 13:48]
"EVEREST AutoStart"="C:\Program Files\Lavalys\EVEREST Ultimate Edition\everest.exe" [2007-04-05 00:00]
"Fraps"="C:\FRAPS\FRAPS.EXE" [2006-12-19 16:02]
"WhatPulse"="C:\Program Files\WhatPulse\WhatPulse.exe" [2006-08-21 20:48]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2006-03-15 16:01]
"Start WingMan Profiler"="C:\Program Files\Logitech\Profiler\lwemon.exe" [2006-07-05 13:17]

C:\Documents and Settings\Antti\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
mIRC.lnk - C:\Program Files\mIRC\mirc.exe [2006-11-23 18:45:34]
Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2007-08-03 01:44:38]

C:\Documents and Settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-07-13 11:57:11]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoResolveSearch"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup"

R0 aftx2k;aftx2k;C:\WINDOWS\system32\drivers\aftx2k.sys
R0 fasttx2k;fasttx2k;C:\WINDOWS\system32\DRIVERS\fasttx2k.sys
R0 Teefer;Teefer for NT;C:\WINDOWS\system32\Drivers\Teefer.sys
R1 AmdK8;AMD Athlon64 Processor Driver;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
R1 wpsdrvnt;wpsdrvnt;\??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys
R2 wg3n;SyGate for NT, wg3n;C:\WINDOWS\system32\Drivers\wg3n.sys
R2 wg4n;SyGate for NT, wg4n;C:\WINDOWS\system32\Drivers\wg4n.sys
R2 wg5n;SyGate for NT, wg5n;C:\WINDOWS\system32\Drivers\wg5n.sys
R2 wg6n;SyGate for NT, wg6n;C:\WINDOWS\system32\Drivers\wg6n.sys
R3 L8042Kbd;Logitech SetPoint Keyboard Driver;C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver;C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
R3 Wdf01000;Wdf01000;C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys
R3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys
S1 ATITool;ATITool Overclocking Utility;C:\WINDOWS\system32\DRIVERS\ATITool.sys
S3 WmFilter;Logitech Gaming HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys
S3 WmHidLo;Logitech Gaming USB Filter Driver;C:\WINDOWS\system32\drivers\WmHidLo.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{040a34e6-3c14-11dc-a64f-0011d8b189da}]
AutoRun\command- K:\setup.exe

*Newly Created Service* - EVERESTDRIVER
*Newly Created Service* - F-SECURE_STANDALONE_MINIFILTER

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-09 14:23:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xf9\x2022\xd3w\2]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-09 14:24:06

--- E O F ---

Pysy puhtaana

-> Tyhjennä järjestelmänpalautus Ohjeet
Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste. Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä.

-> Käytä CCleaneria -> CCleaner
Lataa ja asenna CCleaner. Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti.

-> Asenna SpywareBlaster -> SpywareBlaster
SpywareBlaster estää haittaohjelmia asentumasta koneellesi. Ei kuluta muistia!
Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas

-> Asenna MVPS Hosts tiedosto -> MVPS Hosts
Estää koneesi yhteyden haitallisiin sivustoihin.
Opas saatavilla suomeksi! Nimimerkki Axelin opas

-> Vaihda selaimesi Firefoxiin -> Firefox
Firefox on nopeampi, turvallisempi ja parempi selain kuin Internet Explorer.

-> Pidä järjestelmäsi ajantasalla. -> Windows Update
Vieraile Windows Updatessa säännöllisesti.

-> Pidä palomuuri ja virustorjunta ajantasalla
Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi.
ja hyvä myös escan http://koti.mbnet.fi/pattaya1/escanmwav.htm

->Pidä ohjelmistosi ajantasalla. -> Secunia Software Inspector
Secunia Software Inspector tutkii sinun järjestälmäsi ja ohjelmistosi puuttuvien turvallisuuspäivityksien osalta. Tavallinen tutkinta kestää normaalisti 5-40 sekuntia, kun läpikotainen (thorough system inspection) voi kestää useita minuutteja.

->Seuraa säännöllisesti viestintäviraston tietoja uusista haavoittuvuuksista -> CERT-FI

Jos tulevaisuudessa tulee haittaohjelmien kanssa ongelmia, älä epäröi laittaa Hijackthis-logia tarkistettavaksi!

Ongelma ratkennut asentamalla AVG Anti-Spyware, ja tutkimalla sillä kone haittaohjelmista