AfterDawn.com Mainosta sivuillamme
User Käyttäjä Salasana  
  Puuttuuko tunnus? Liity jäseneksi nyt!.
Salasana hukassa? Klikkaa tästä. 		 
  Etusivu   Uutiset   Oppaat   Ohjelmat   Sanasto   Laitevertailu   Profiilit   Keskustelu  
 Yksityisviestit     Luo uusi yksityisviesti     Kaikki uudet viestit     Ilman vastauksia olevat viestiketjut     Hae viestejä
torstai 13.11.2025 / 01:48
Hae keskustelualueilta:        In English   Suomeksi   På svenska
afterdawn.com > keskustelu > yleistä keskustelua tietokoneista > virukset ja haittaohjelmat - hijackthis -logit > virusongelma
Näytä aiheet
 
Keskustelualueet
Keskustelualueet
Virusongelma
  Siirry:
 
Kirjoittaja Viesti
kumiorava
Member
_ 		15. huhtikuuta 2008 @ 08:47 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
No niinhän siinä sittem kävi että menin painamaan sitä väärää nappulaa ja melko uusi kone sai jonkinasteisen infektion.

MAhdollisia viruksen tai muun aiheuttamia oireita:
1.näyttöön tulee silloin tällöin joku "security center" screen joka ohjaa sivulle, joka mainostaa jotain spywaren poisto-ohjelmia. Tämän yhteydessä tuonne oikeaan alareunaan muiden käynnissä olevien ohjelmien joukkoon tulee "varoituskolmio", jota kun painaa niin pääsee samalle sivulle kuin edellisessä.
2.en pääse tehtävienhallintaan ctrl+alt+del yhdistelmän kautta
3.Internet Explorerilla selaamisesta ei tule yhtään mitään kun se koko ajan heittää jollekkin ihme sivuille missä tarotaan mitä erilaisempia pc:n siivousohjelmia.

muita ongelmia:
1. symantec löysi infostealer.gampass viruksen, jota se ei osaa poistaa
2. Symantec huomauttaa vähän väliä että se on torjunut jonkun troijalaisen tai muun hyökkäyksen konetta vastaan.
3. Järjestelmän palauttaminenkaan ei onnistunut. Windows vaan ilmoitti että tapahtui joku tuntematon virhe syystä tuntematon...

Adawarella ja AVG anti-spywarella ajoin scannit ja infektioita löytyi reippaasti päälle 100. Molemmilla ohjelmilla suoritin ohjelmien tarjoamat toimenpiteet.

Ongelmia siis riittää ja nyt tässä viimeisin Hijackthis logi pureskeltavaksi. Jos tähän onkelmaan ratkaisu löytyisi niin olisin kyllä erityisen kiitollinen. Torstaina lähden takaisin inttiin, jossa internettiin pääseminen ongelma, jootta vähän kiire olisi asialla. Kiitoksia tuhannesti teille asianne osaaville.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:34:49, on 15.4.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\WLANExt.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Windows\system32\ifxspmgt.exe
C:\Windows\system32\ifxtcs.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\IfxPsdSv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Windows\System32\ACEngSvr.exe
C:\ProgramData\zqbupexg\nytyfwjc.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Program Files\P4P\P4P.exe
C:\Program Files\ATK Hotkey\KBFiltr.exe
C:\Windows\ASScrPro.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\zcxenytg.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Infineon\Security Platform Software\PSDrt.exe
C:\Program Files\Infineon\Security Platform Software\SpTna.exe
C:\Program Files\Spyware Doctor\pctsGui.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wermgr.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {3484EB5F-6599-411F-8169-1171991BD71C} - C:\Windows\system32\ljJyWqqp.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: DVA Storm - {D3593B96-4822-434E-82B4-A54C29FCC7F5} - C:\Windows\lgmxvpatdbr.dll
O2 - BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: qtvglped - {41B15C1C-2C15-49E4-B6A4-C940F885290E} - C:\Windows\qtvglped.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [PowerForPhone] "C:\Program Files\P4P\P4P.exe"
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe
O4 - HKLM\..\Run: [IFXSPMGT] C:\Windows\system32\ifxspmgt.exe /NotifyLogon
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\opnNHwXP.dll,#1
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [0c9cf2bb] rundll32.exe "C:\Windows\system32\nyvgklqa.dll",b
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [jlksqzrq] C:\Windows\system32\zcxenytg.exe
O4 - HKLM\..\Policies\Explorer\Run: [Wt6Mrq19nv] C:\ProgramData\zqbupexg\nytyfwjc.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: ASUS Security Protect Manager e-Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
O9 - Extra 'Tools' menuitem: ASUS Security Protect Manager e-&Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: APSHook.dll
O21 - SSODL: pmsoarbf - {498133E0-DA6D-4629-A020-409385506FC4} - C:\Windows\pmsoarbf.dll
O21 - SSODL: omlbpkaw - {D9D8BEFE-40A5-46E8-AC4B-B1E678D9B958} - C:\Windows\omlbpkaw.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\Windows\system32\ifxspmgt.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\Windows\system32\ifxtcs.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Windows\system32\IfxPsdSv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 13584 bytes

Käyttiksenä siis WIndows Vista Home Premium

edit: ongelma numero 3 lisätty
[ + lainaa]
A man walked into a bar
-OUCH!

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 15. huhtikuuta 2008 @ 12:23
Hujo
Suspended permanently
_ 		15. huhtikuuta 2008 @ 14:03 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Koneesa ei ole muuta kuin pelkää ongelmaa ;)

===========

Avaa Windows Defender.
Klikkaa Tools ja General Settings.
Selaa alas ja ota rasti pois Turn on real-time protection (recommended)-kohdasta.
Tämän jälkeen klikkaa Save ja sulje Windows Defender.

===========

Lataa TÄSTÄ VundoFix.exe työpöydällesi.

Tupla-klikkaa VundoFix.exe ajaaksesi sen.
Klikkaa Scan for Vundo valintaa.
Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
Sinulta kysytään haluatko poistaa filut - klikkaa YES.
Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.

===========

1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

=============

Lataa SmitfraudFix (c) S!Ri
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita ponnahtava rapport ? muistion sisältö viestiketjuusi.
Löytyy myös C:\rapport.txt

Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
(AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
silloin ne saattavat varoittaa käyttäjää.

=============

Lataa Malwarebytes' Anti-Malware työpöydällesi.

1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.

===========

Älä käyttä nyt järjestelmän palautusta ollenkaan
[ + lainaa]
Voiko tietsikka koskaan toimia?

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 15. huhtikuuta 2008 @ 14:13
kumiorava
Member
_ 		15. huhtikuuta 2008 @ 16:42 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Vundofix ei mitään löytänyt.

Tuorein HJT loki:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:31:54, on 15.4.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\system32\WLANExt.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Windows\system32\ifxspmgt.exe
C:\Windows\system32\ifxtcs.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\IfxPsdSv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Windows\System32\ACEngSvr.exe
C:\Windows\system32\conime.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\ATK Hotkey\KBFiltr.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Windows\ASScrPro.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Infineon\Security Platform Software\PSDrt.exe
C:\Program Files\Infineon\Security Platform Software\SpTna.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\notepad.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [PowerForPhone] "C:\Program Files\P4P\P4P.exe"
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe
O4 - HKLM\..\Run: [IFXSPMGT] C:\Windows\system32\ifxspmgt.exe /NotifyLogon
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: ASUS Security Protect Manager e-Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
O9 - Extra 'Tools' menuitem: ASUS Security Protect Manager e-&Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: APSHook.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\Windows\system32\ifxspmgt.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\Windows\system32\ifxtcs.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Windows\system32\IfxPsdSv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 12286 bytes

_________________________________________


Combofix loki:
ComboFix 08-04-14.2 - Taneli 2008-04-15 15:11:13.1 - NTFSx86
Microsoft® Windows Vista? Home Premium 6.0.6000.0.1252.1.1035.18.1757 [GMT 3:00]
Running from: C:\Users\Taneli\Desktop\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\akl
C:\Program Files\akl\akl.dll
C:\Program Files\akl\akl.exe
C:\Program Files\akl\uninstall.exe
C:\Program Files\akl\unsetup.exe
C:\Program Files\p4p
C:\Program Files\p4p\Bookmark.ini
C:\Program Files\p4p\P4P.exe
C:\Program Files\p4p\RING.WAV
C:\Program Files\PC-Cleaner
C:\Users\Taneli\Desktopblackbird.jpg
C:\Users\Taneli\DesktopEditorFKWP1.5.exe
C:\Users\Taneli\DesktopEditorFKWP2.0.exe
C:\Users\Taneli\Desktopfilemanagerclient.exe
C:\Users\Taneli\Desktopfkwp1.5.exe
C:\Users\Taneli\Desktopfkwp2.0.exe
C:\Users\Taneli\Desktopfwebd.exe
C:\Users\Taneli\DesktopFWebdEditor.exe
C:\Users\Taneli\DesktopTrojan.Win32.BlackBird.exe
C:\Users\Taneli\Desktopvirii
C:\Windows\a.bat
C:\Windows\base64.tmp
C:\Windows\bdn.com
C:\Windows\FVProtect.exe
C:\Windows\iTunesMusic.exe
C:\Windows\mslagent
C:\Windows\mslagent\2_mslagent.dll
C:\Windows\mslagent\mslagent.exe
C:\Windows\mslagent\uninstall.exe
C:\Windows\mssecu.exe
C:\Windows\system32\aokokghr.dll
C:\Windows\system32\ljJaxYsp.dll
C:\Windows\system32\ljJyWqqp.dll
C:\Windows\system32\pmnNFwuV.dll
C:\Windows\System32\pqqWyJjl.ini
C:\Windows\System32\pqqWyJjl.ini2
C:\Windows\System32\psYxaJjl.ini
C:\Windows\System32\psYxaJjl.ini2
C:\Windows\System32\rhgkokoa.ini
C:\Windows\system32\ssqPfcca.dll
C:\Windows\System32\VuwFNnmp.ini
C:\Windows\System32\VuwFNnmp.ini2
C:\Windows\system32\xxywWqOI.dll
C:\Windows\system32akttzn.exe
C:\Windows\system32anticipator.dll
C:\Windows\system32awtoolb.dll
C:\Windows\system32bdn.com
C:\Windows\system32bsva-egihsg52.exe
C:\Windows\system32dpcproxy.exe
C:\Windows\system32emesx.dll
C:\Windows\system32h@tkeysh@@k.dll
C:\Windows\system32hoproxy.dll
C:\Windows\system32hxiwlgpm.dat
C:\Windows\system32hxiwlgpm.exe
C:\Windows\system32medup012.dll
C:\Windows\system32medup020.dll
C:\Windows\system32msgp.exe
C:\Windows\system32msnbho.dll
C:\Windows\system32mssecu.exe
C:\Windows\system32msvchost.exe
C:\Windows\system32mtr2.exe
C:\Windows\system32mwin32.exe
C:\Windows\system32netode.exe
C:\Windows\system32newsd32.exe
C:\Windows\system32ps1.exe
C:\Windows\system32psof1.exe
C:\Windows\system32psoft1.exe
C:\Windows\system32regc64.dll
C:\Windows\system32regm64.dll
C:\Windows\system32Rundl1.exe
C:\Windows\system32smp
C:\Windows\system32smp\msrc.exe
C:\Windows\system32sncntr.exe
C:\Windows\system32ssurf022.dll
C:\Windows\system32ssvchost.com
C:\Windows\system32ssvchost.exe
C:\Windows\system32sysreq.exe
C:\Windows\system32taack.dat
C:\Windows\system32taack.exe
C:\Windows\system32temp#01.exe
C:\Windows\system32thun.dll
C:\Windows\system32thun32.dll
C:\Windows\system32VBIEWER.OCX
C:\Windows\system32vbsys2.dll
C:\Windows\system32vcatchpi.dll
C:\Windows\system32winlogonpc.exe
C:\Windows\system32winsystem.exe
C:\Windows\system32WINWGPX.EXE
C:\Windows\userconfig9x.dll
C:\Windows\Web\def.htm
C:\Windows\winsystem.exe
C:\Windows\zip1.tmp
C:\Windows\zip2.tmp
C:\Windows\zip3.tmp
C:\Windows\zipped.tmp

.
((((( Tiedostot, jotka on luotu seuraavalla aikav?lill?: 2008-03-15 to 2008-04-15 )))))))))))))))))
.

2008-04-15 15:55 . 2008-04-15 15:55 110,592 --a------ C:\Windows\System32\jwfwnmto.exe
2008-04-15 14:40 . 2008-04-15 14:40 <KANSIO> d-------- C:\VundoFix Backups
2008-04-15 08:34 . 2008-04-15 08:34 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-04-15 08:22 . 2008-04-15 13:22 474 ---hs---- C:\Windows\System32\aqlkgvyn.ini
2008-04-15 07:53 . 2008-04-15 07:53 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\PC Tools
2008-04-15 07:53 . 2008-04-15 15:54 <KANSIO> d-a------ C:\ProgramData\TEMP
2008-04-15 07:53 . 2008-04-15 07:55 <KANSIO> d-------- C:\Program Files\Spyware Doctor
2008-04-15 07:53 . 2007-12-10 13:53 81,288 --a------ C:\Windows\System32\drivers\iksyssec.sys
2008-04-15 07:53 . 2007-12-10 13:53 66,952 --a------ C:\Windows\System32\drivers\iksysflt.sys
2008-04-15 07:53 . 2008-02-01 11:55 42,376 --a------ C:\Windows\System32\drivers\ikfilesec.sys
2008-04-15 07:53 . 2007-12-10 13:53 29,576 --a------ C:\Windows\System32\drivers\kcom.sys
2008-04-15 03:05 . 2008-04-15 03:06 <KANSIO> d-------- C:\ProgramData\Lavasoft
2008-04-15 03:05 . 2008-04-15 03:05 <KANSIO> d-------- C:\Program Files\Lavasoft
2008-04-15 03:04 . 2008-04-15 03:04 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-15 02:52 . 2008-04-15 02:52 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Grisoft
2008-04-15 02:52 . 2008-04-15 02:52 <KANSIO> d-------- C:\ProgramData\Grisoft
2008-04-15 02:52 . 2007-05-30 15:10 10,872 --a------ C:\Windows\System32\drivers\AvgAsCln.sys
2008-04-14 20:39 . 2008-04-15 08:13 354 ---hs---- C:\Windows\System32\adknoxcj.ini
2008-04-14 20:24 . 2008-04-14 20:24 <KANSIO> d-------- C:\ProgramData\zqbupexg
2008-04-14 20:24 . 2008-04-14 19:49 290,816 --a------ C:\Windows\lgmxvpatdbr.dll
2008-04-14 20:24 . 2008-04-14 19:49 217,088 --a------ C:\Windows\omlbpkaw.dll
2008-04-14 20:24 . 2008-04-14 19:49 172,032 --a------ C:\Windows\pmsoarbf.dll
2008-04-14 20:24 . 2008-04-14 19:49 151,552 --a------ C:\Windows\qtvglped.dll
2008-04-14 20:24 . 2008-04-14 19:49 94,208 --a------ C:\Windows\npqtsrak.exe
2008-04-14 20:24 . 2008-04-14 20:24 90,112 --a------ C:\Windows\System32\zcxenytg.exe
2008-04-14 20:24 . 2008-04-14 19:49 81,920 --a------ C:\Windows\rtqmekwg.exe
2008-04-12 18:19 . 2008-04-12 19:42 <KANSIO> d-------- C:\Program Files\Windows Live
2008-04-12 18:19 . 2008-04-12 19:42 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-04-12 18:18 . 2008-04-12 18:18 <KANSIO> d-------- C:\ProgramData\WLInstaller
2008-04-11 13:15 . 2008-04-11 13:15 249,856 --------- C:\Windows\Setup1.exe
2008-04-11 13:15 . 2008-04-11 13:15 73,216 --a------ C:\Windows\ST6UNST.EXE
2008-04-11 09:00 . 2008-04-11 09:00 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\ASUS Security Protect Manager
2008-04-10 21:31 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Searches
2008-04-10 21:31 . 2008-04-10 21:31 <KANSIO> d-------- C:\Users\Riikka\AppData\Roaming\Infineon
2008-04-10 21:30 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Contacts
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Videos
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Saved Games
2008-04-10 21:29 . 2008-03-17 14:02 <KANSIO> d-------- C:\Users\Riikka\Roaming
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Pictures
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Music
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Links
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Downloads
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Documents
2008-04-10 21:29 . 2006-11-02 15:37 <KANSIO> d-------- C:\Users\Riikka\AppData\Roaming\Media Center Programs
2008-04-10 21:29 . 2008-04-10 21:31 <KANSIO> d--h----- C:\Users\Riikka\AppData
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> d-------- C:\Users\Riikka
2008-04-08 19:28 . 2008-04-08 19:28 <KANSIO> d-------- C:\Program Files\EA Games
2008-04-07 21:58 . 2008-04-08 19:48 <KANSIO> d-------- C:\Program Files\RegCleaner
2008-04-07 18:13 . 2008-04-07 18:13 <KANSIO> d-------- C:\Program Files\ASUS Security Center
2008-04-06 23:54 . 2008-04-06 23:54 <KANSIO> d-------- C:\Program Files\SINOSUN
2008-04-06 23:54 . 2006-06-16 18:13 42,579 --a------ C:\Windows\System32\drivers\PrivateDisk.sys
2008-04-06 22:11 . 2008-04-06 22:11 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
2008-04-06 20:26 . 2008-04-06 20:26 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Ahead
2008-04-06 17:18 . 2008-04-10 19:34 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\dvdcss
2008-04-06 13:07 . 2008-04-06 13:07 <KANSIO> d-------- C:\ProgramData\LightScribe
2008-04-06 11:37 . 2008-04-06 11:37 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\DAEMON Tools
2008-04-06 11:37 . 2008-04-06 11:37 717,296 --a------ C:\Windows\System32\drivers\sptd.sys
2008-04-06 08:11 . 2008-04-06 08:11 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\BSplayer Pro
2008-04-06 08:11 . 2008-04-06 08:20 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\BSplayer
2008-04-06 08:11 . 2008-04-06 08:11 <KANSIO> d-------- C:\Program Files\Webteh
2008-04-06 03:06 . 2008-04-06 03:06 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-04-06 03:06 . 2008-04-06 03:06 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-04-06 03:04 . 2008-04-06 03:04 <KANSIO> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-06 03:04 . 2008-04-06 03:04 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
2008-04-06 03:04 . 2008-04-06 03:04 41,984 --a------ C:\Windows\System32\drivers\monitor.sys
2008-04-05 17:22 . 2008-04-14 19:32 89,214 --a------ C:\Users\Taneli\AppData\Roaming\nvModes.dat
2008-04-05 15:56 . 2008-04-05 15:56 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Miranda
2008-04-05 15:56 . 2008-04-05 15:56 <KANSIO> d-------- C:\Program Files\Miranda IM
2008-04-05 15:28 . 2008-04-05 15:35 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Mp3tag
2008-04-05 15:28 . 2008-04-05 15:28 <KANSIO> d-------- C:\Program Files\Mp3tag
2008-04-05 14:39 . 2008-04-14 17:58 49 --a------ C:\Windows\NeroDigital.ini
2008-04-05 14:02 . 2008-04-05 14:02 <KANSIO> d-------- C:\Program Files\Nokia
2008-04-05 14:01 . 2008-04-15 08:01 <KANSIO> d-------- C:\Program Files\Common Files\LightScribe
2008-04-05 13:59 . 2008-04-05 13:59 <KANSIO> d-------- C:\ProgramData\Nero
2008-04-05 13:59 . 2008-04-05 13:59 <KANSIO> d-------- C:\Program Files\Nero
2008-04-05 13:59 . 2008-04-05 14:00 <KANSIO> d-------- C:\Program Files\Common Files\Ahead
2008-04-05 13:38 . 2008-04-05 13:38 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Thunderbird
2008-04-05 13:38 . 2008-04-05 13:38 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Talkback
2008-04-05 13:38 . 2008-04-05 13:38 <KANSIO> d-------- C:\Program Files\Mozilla Thunderbird
2008-04-05 13:37 . 2008-04-05 13:37 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\vlc
2008-04-05 13:00 . 2008-04-14 20:16 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\uTorrent
2008-04-05 13:00 . 2008-04-05 13:00 <KANSIO> d-------- C:\Program Files\uTorrent
2008-04-05 12:17 . 2008-04-05 12:17 <KANSIO> d-------- C:\Program Files\Common Files\SWF Studio
2008-04-05 12:17 . 2000-05-22 11:58 647,872 --------- C:\Windows\System32\Mscomct2.ocx
2008-04-05 12:17 . 1999-10-11 04:00 41,984 --------- C:\Windows\Ctregrun.exe
2008-04-05 12:16 . 1999-06-25 10:55 149,504 --a------ C:\Windows\UNWISE.EXE
2008-04-05 12:11 . 2008-04-05 23:18 <KANSIO> d-------- C:\Program Files\Creative
2008-04-05 12:09 . 2008-04-05 12:09 16 --a------ C:\Windows\System32\coh.cache
2008-04-05 12:07 . 2008-04-11 09:20 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\foobar2000
2008-04-05 12:04 . 2008-04-05 12:04 <KANSIO> d-------- C:\Program Files\VideoLAN
2008-04-05 12:03 . 2008-04-05 12:03 <KANSIO> d-------- C:\Program Files\foobar2000
2008-04-05 11:57 . 2008-04-05 11:57 0 --a------ C:\Windows\nsreg.dat
2008-04-05 11:56 . 2008-04-05 11:56 1,712,984 --a------ C:\Windows\System32\wuaueng.dll
2008-04-05 11:56 . 2008-04-05 11:56 1,524,224 --a------ C:\Windows\System32\wucltux.dll
2008-04-05 11:56 . 2008-04-05 11:56 53,080 --a------ C:\Windows\System32\wuauclt.exe
2008-04-05 11:56 . 2008-04-05 11:56 43,352 --a------ C:\Windows\System32\wups2.dll
2008-04-05 11:55 . 2008-04-05 11:55 549,720 --a------ C:\Windows\System32\wuapi.dll
2008-04-05 11:55 . 2008-04-05 11:55 163,000 --a------ C:\Windows\System32\wuwebv.dll
2008-04-05 11:55 . 2008-04-05 11:55 80,896 --a------ C:\Windows\System32\wudriver.dll
2008-04-05 11:55 . 2008-04-05 11:55 33,624 --a------ C:\Windows\System32\wups.dll

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-06 00:16 --------- d-----w C:\Program Files\Windows Sidebar
2008-04-06 00:16 --------- d-----w C:\Program Files\Windows Mail
2008-04-06 00:03 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-04-06 00:01 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-04-06 00:01 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-04-06 00:01 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-04-06 00:01 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-04-05 10:37 --------- d-----w C:\Users\Taneli\AppData\Roaming\vlc
2008-03-17 10:47 319,456 ----a-w C:\Windows\DIFxAPI.dll
2008-03-17 10:17 174 --sha-w C:\Program Files\desktop.ini
2008-03-17 10:13 --------- d-----w C:\Program Files\Windows Defender
2008-03-17 10:13 --------- d-----w C:\Program Files\Windows Calendar
2008-03-17 09:15 88,576 ----a-w C:\Windows\System32\avifil32.dll
2008-03-17 09:14 8,192 ----a-w C:\Windows\System32\riched32.dll
2008-03-17 08:56 160,872 ----a-w C:\Windows\System32\halmacpi.dll
2008-03-17 08:56 134,760 ----a-w C:\Windows\System32\halacpi.dll
.

(((((((((((((((((((((((((((((( Rekisterin k?ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji? arvoja ja laillisia oletusarvoja ei n?ytet?

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D3593B96-4822-434E-82B4-A54C29FCC7F5}]
2008-04-14 19:49 290816 --a------ C:\Windows\lgmxvpatdbr.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41B15C1C-2C15-49E4-B6A4-C940F885290E}"= "C:\Windows\qtvglped.dll" [2008-04-14 19:49 151552]

[HKEY_CLASSES_ROOT\clsid\{41b15c1c-2c15-49e4-b6a4-c940f885290e}]
[HKEY_CLASSES_ROOT\qtvglped.1]
[HKEY_CLASSES_ROOT\TypeLib\{ECF15ED5-D379-484F-9B33-356630682F1C}]
[HKEY_CLASSES_ROOT\qtvglped]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 15:35 125440]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 15:36 201728]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-06-20 12:49 451872]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 12:39 486856]
"jlksqzrq"="C:\Windows\system32\zcxenytg.exe" [2008-04-14 20:24 90112]
"vjyfunip"="C:\Windows\system32\jwfwnmto.exe" [2008-04-15 15:55 110592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-03-17 12:01 1006264]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-05 13:17 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-05 13:17 8534560]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-05 13:17 81920]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 00:58 115816]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-27 08:10 4702208 C:\Windows\RtHDVCpl.exe]
"Skytel"="Skytel.exe" [2007-08-03 08:22 1826816 C:\Windows\SkyTel.exe]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-10-24 05:02 178712]
"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-24 20:31 630784]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-03 00:24 857648]
"ATKMEDIA"="C:\Program Files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 18:27 61440]
"PowerForPhone"="C:\Program Files\P4P\P4P.exe" [ ]
"ASUS Camera ScreenSaver"="C:\Windows\ASScrProlog.exe" [2008-03-17 14:22 37232]
"ASUS Screen Saver Protector"="C:\Windows\ASScrPro.exe" [2008-03-17 14:23 33136]
"IFXSPMGT"="C:\Windows\system32\ifxspmgt.exe" [2007-02-26 06:29 677408]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [2007-06-01 10:06 1629744]
"InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe" [2007-06-01 10:05 1057328]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"CognizanceTS"="C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll" [2003-12-22 05:12 17920]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-02-01 11:55 1103240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"Wt6Mrq19nv"= C:\ProgramData\zqbupexg\nytyfwjc.exe

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{C14E6230-757D-4246-81CE-B34E2940C722}"= C:\Windows\system32\xxywWqOI.dll [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"pmsoarbf"= {498133E0-DA6D-4629-A020-409385506FC4} - C:\Windows\pmsoarbf.dll [2008-04-14 19:49 172032]
"omlbpkaw"= {D9D8BEFE-40A5-46E8-AC4B-B1E678D9B958} - C:\Windows\omlbpkaw.dll [2008-04-14 19:49 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{B7C18FE5-8C7C-467A-8019-84A12062E95F}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{26D0F558-1907-4B86-9B37-E20FF300460E}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{987FA836-853D-47C1-96E7-E8B2538FBEB4}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{F678EA31-D085-4070-A22B-E4116D035E22}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{78A5D15E-56E2-4A94-B1C2-32DF9B7760EA}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{7F576416-BF94-4EDA-B8F2-56A0C02C4824}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 lullaby;lullaby;C:\Windows\system32\DRIVERS\lullaby.sys [2007-09-27 01:03]
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080407.003\IDSvix86.sys [2008-03-12 08:30]
R1 ItSDisk;ItSDisk;C:\Windows\system32\Drivers\ItSDisk.sys [2006-05-17 01:14]
R1 PersonalSecureDrive;PersonalSecureDrive;C:\Windows\system32\drivers\psd.sys [2007-01-23 15:07]
R2 ASBroker;Logon Session Broker;C:\Windows\System32\svchost.exe [2006-11-02 12:45]
R2 ASChannel;Local Communication Channel;C:\Windows\System32\svchost.exe [2006-11-02 12:45]
R2 HFGService;Handsfree Headset Service;C:\Windows\system32\svchost.exe [2006-11-02 12:45]
R2 PrivateDiskDriver;Private Encrypted Virtual Disk Driver;C:\Windows\system32\drivers\PrivateDisk.sys [2006-06-16 18:13]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;C:\Windows\system32\DRIVERS\l160x86.sys [2007-10-31 14:55]
R3 DCamUSBET;USB2.0 1.3M UVC WebCam;C:\Windows\system32\DRIVERS\etDevice.sys [2007-09-06 11:43]
R3 FiltUSBET;ET USB Device Lower Filter;C:\Windows\system32\DRIVERS\etFilter.sys [2007-10-15 10:39]
R3 ScanUSBET;ET USB Still Image Capture Device;C:\Windows\system32\DRIVERS\etScan.sys [2007-09-06 18:45]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-01-09 17:31]
S3 BthAudioHF;BthAudioHF-palvelu;C:\Windows\system32\DRIVERS\BthAudioHF.sys [2008-03-17 13:53]
S3 bthav;Bluetooth-AV-profiili;C:\Windows\system32\drivers\bthav.sys [2008-03-17 13:53]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
GPSvcGroup REG_MULTI_SZ GPSvc
bthaudiosvc REG_MULTI_SZ HFGService
Cognizance REG_MULTI_SZ ASBroker ASChannel

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94bb1e85-040c-11dd-ad8c-000ea6f33381}]
\shell\AutoRun\command - F:\autorun.exe

*Newly Created Service* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
'Ajoitetut teht?v?t'-kansion sis?lt?
"2008-04-14 17:28:20 C:\Windows\Tasks\Norton Internet Security - Run Full System Scan - Taneli.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeB/TASK:
"2008-04-15 09:00:05 C:\Windows\Tasks\Security Platform Backup Schedule.job"
- C:\Program Files\Infineon\Security Platform Software\SpBackupWz.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-15 15:55:17
Windows 6.0.6000 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\System32\wlanext.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMON.EXE
C:\Windows\System32\IFXTCS.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\IfxPsdSv.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\asghost.exe
C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ATK Hotkey\HControl.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\ASUS\ASUS CopyProtect\ASPG.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Windows\System32\ACEngSvr.exe
C:\Windows\System32\conime.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\ATK Hotkey\KBFiltr.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\regsvr32.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Infineon\Security Platform Software\PSDrt.exe
C:\Program Files\Infineon\Security Platform Software\SpTNA.exe
C:\Windows\System32\wbem\WMIADAP.exe
C:\Windows\System32\dllhost.exe
.
**************************************************************************
.
Completion time: 2008-04-15 15:58:24 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-15 12:58:16

Pre-Run: 81,377,071,104 tavua vapaana
Post-Run: 80,503,406,592 tavua vapaana
.
2008-04-15 09:46:27 --- E O F ---


______________________________________________________

SmitFraudFix loki:
SmitFraudFix v2.314

Scan done at 16:01:23,13, ti 15.04.2008
Run from C:\Users\Taneli\Desktop\SmitfraudFix
OS: Microsoft Windows [versio 6.0.6000] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\system32\WLANExt.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Windows\system32\ifxspmgt.exe
C:\Windows\system32\ifxtcs.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\IfxPsdSv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Windows\System32\ACEngSvr.exe
C:\Windows\system32\conime.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\ATK Hotkey\KBFiltr.exe
C:\Windows\system32\CF12924.exe
C:\ProgramData\zqbupexg\nytyfwjc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Windows\ASScrPro.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\jwfwnmto.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Infineon\Security Platform Software\PSDrt.exe
C:\Program Files\Infineon\Security Platform Software\SpTna.exe
\\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\ComboFix\handle.cfexe
C:\ComboFix\sed.cfexe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Taneli


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Taneli\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Taneli\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
+--------------------------------------------------+
[!] Suspicious: lgmxvpatdbr.dll
BHO: DVA Storm - {D3593B96-4822-434E-82B4-A54C29FCC7F5}
TypeLib: {23034122-FC83-4D09-9452-9840B6545ABF}
Interface: {3C40E9CB-6EE3-4D48-8D73-1BDBF05A9683}
Interface: {FD74A196-BE7F-4A94-BA77-B75DDD098CB6}

[!] Suspicious: qtvglped.dll
Toolbar: qtvglped - {41B15C1C-2C15-49E4-B6A4-C940F885290E}
TypeLib: {ECF15ED5-D379-484F-9B33-356630682F1C}
Interface: {ABBE25B1-BE73-4744-B520-B1C73711C88C}
Classe: qtvglped.bekb
Classe: qtvglped.ToolBar.1

[!] Suspicious: pmsoarbf.dll
SSODL: pmsoarbf - {498133E0-DA6D-4629-A020-409385506FC4}

[!] Suspicious: omlbpkaw.dll
SSODL: omlbpkaw - {D9D8BEFE-40A5-46E8-AC4B-B1E678D9B958}


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="APSHook.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Atheros L1 Gigabit Ethernet 10/100/1000Base-T Controller
DNS Server Search Order: 212.146.0.10
DNS Server Search Order: 212.146.30.200
DNS Server Search Order: 212.146.30.201

HKLM\SYSTEM\CCS\Services\Tcpip\..\{DB97BCE6-88AD-4E22-A361-DA3CE7240CE0}: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
HKLM\SYSTEM\CS1\Services\Tcpip\..\{DB97BCE6-88AD-4E22-A361-DA3CE7240CE0}: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
HKLM\SYSTEM\CS2\Services\Tcpip\..\{DB97BCE6-88AD-4E22-A361-DA3CE7240CE0}: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End



_____________________________________________

Malwarebyte's anti-malware loki:
Malwarebytes' Anti-Malware 1.11
Tietokantaversio: 631

Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
Tarkistetut kohteet: 138325
Kulunut aika: 24 minute(s), 2 second(s)

Saastuneita muistiprosesseja: 2
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 24
Saastuneita rekisteriarvoja: 7
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 12

Saastuneita muistiprosesseja:
C:\Windows\System32\jwfwnmto.exe (Trojan.FakeAlert) -> Unloaded process successfully.
C:\ProgramData\zqbupexg\nytyfwjc.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
HKEY_CLASSES_ROOT\CLSID\{c14e6230-757d-4246-81ce-b34e2940c722} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{abbe25b1-be73-4744-b520-b1c73711c88c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{ecf15ed5-d379-484f-9b33-356630682f1c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3c40e9cb-6ee3-4d48-8d73-1bdbf05a9683} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fd74a196-be7f-4a94-ba77-b75ddd098cb6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{23034122-fc83-4d09-9452-9840b6545abf} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d3593b96-4822-434e-82b4-a54c29fcc7f5} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d3593b96-4822-434e-82b4-a54c29fcc7f5} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\qtvglped.bekb (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{41b15c1c-2c15-49e4-b6a4-c940f885290e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\qtvglped.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6b56c13c-90bf-44f1-ac8c-e8f7015d92a5} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d9d8befe-40a5-46e8-ac4b-b1e678d9b958} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1e11d7be-3dc2-49e9-be69-a24c4f9fc5e5} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{498133e0-da6d-4629-a020-409385506fc4} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

Saastuneita rekisteriarvoja:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jlksqzrq (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjyfunip (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Wt6Mrq19nv (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{c14e6230-757d-4246-81ce-b34e2940c722} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{41b15c1c-2c15-49e4-b6a4-c940f885290e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\omlbpkaw (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\pmsoarbf (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
C:\Windows\System32\zcxenytg.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\jwfwnmto.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\ProgramData\zqbupexg\nytyfwjc.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\lgmxvpatdbr.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\qtvglped.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Windows\System32\ssqPfcca.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Windows\System32\xxywWqOI.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Windows\Web\def.htm.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\npqtsrak.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\omlbpkaw.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\pmsoarbf.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\rtqmekwg.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.




[ + lainaa]
A man walked into a bar
-OUCH!
Hujo
Suspended permanently
_ 		15. huhtikuuta 2008 @ 17:03 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
ajas uudestaan tuo smitfraudfix sillä optio 1
[ + lainaa]
Voiko tietsikka koskaan toimia?
kumiorava
Member
_ 		15. huhtikuuta 2008 @ 18:35 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Tässäpä uusi smitfraudfix loki:

SmitFraudFix v2.314

Scan done at 18:32:35,35, ti 15.04.2008
Run from C:\Users\Taneli\Desktop\SmitfraudFix
OS: Microsoft Windows [versio 6.0.6000] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\system32\WLANExt.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Windows\system32\ifxspmgt.exe
C:\Windows\system32\ifxtcs.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\IfxPsdSv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Windows\System32\ACEngSvr.exe
C:\Windows\system32\conime.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\ATK Hotkey\KBFiltr.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Windows\ASScrPro.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Infineon\Security Platform Software\PSDrt.exe
C:\Program Files\Infineon\Security Platform Software\SpTna.exe
C:\Windows\Explorer.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
\\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Taneli


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Taneli\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Taneli\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="APSHook.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Atheros L1 Gigabit Ethernet 10/100/1000Base-T Controller
DNS Server Search Order: 212.146.0.10
DNS Server Search Order: 212.146.30.200
DNS Server Search Order: 212.146.30.201

HKLM\SYSTEM\CCS\Services\Tcpip\..\{DB97BCE6-88AD-4E22-A361-DA3CE7240CE0}: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
HKLM\SYSTEM\CS1\Services\Tcpip\..\{DB97BCE6-88AD-4E22-A361-DA3CE7240CE0}: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
HKLM\SYSTEM\CS2\Services\Tcpip\..\{DB97BCE6-88AD-4E22-A361-DA3CE7240CE0}: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End


[ + lainaa]
A man walked into a bar
-OUCH!
Hujo
Suspended permanently
_ 		15. huhtikuuta 2008 @ 18:41 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
scannaa uusi hjt:n loki
[ + lainaa]
Voiko tietsikka koskaan toimia?
kumiorava
Member
_ 		15. huhtikuuta 2008 @ 20:11 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:10:00, on 15.4.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\system32\WLANExt.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Windows\system32\ifxspmgt.exe
C:\Windows\system32\ifxtcs.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\IfxPsdSv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Windows\System32\ACEngSvr.exe
C:\Windows\system32\conime.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\ATK Hotkey\KBFiltr.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Windows\ASScrPro.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Infineon\Security Platform Software\PSDrt.exe
C:\Program Files\Infineon\Security Platform Software\SpTna.exe
C:\Windows\Explorer.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Spyware Doctor\pctsGui.exe
C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [PowerForPhone] "C:\Program Files\P4P\P4P.exe"
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe
O4 - HKLM\..\Run: [IFXSPMGT] C:\Windows\system32\ifxspmgt.exe /NotifyLogon
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: ASUS Security Protect Manager e-Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
O9 - Extra 'Tools' menuitem: ASUS Security Protect Manager e-&Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: APSHook.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\Windows\system32\ifxspmgt.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\Windows\system32\ifxtcs.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Windows\system32\IfxPsdSv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 12396 bytes

[ + lainaa]
A man walked into a bar
-OUCH!
Hujo
Suspended permanently
_ 		15. huhtikuuta 2008 @ 20:15 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Loki ok kuinkas kone jakselee.
[ + lainaa]
Voiko tietsikka koskaan toimia?
kumiorava
Member
_ 		15. huhtikuuta 2008 @ 20:40 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
paljon paremmin jo! Mm. tehtävienhallinta on jo palannut eikä mainoksia enää tule. Vaikuttaa siltä että saatiin pahimmat sonnat pois koneelta. Kiitoksia paljon! Mihin minä oikein joutuisin ilman afterdawnia...

AInoastaan tuo spyware doctor vielä löytää jotain sontaa mutta niiden riskitaso on "alhainen". Poistaa niitä ei voi kun tuo on joku kokeiluversio tms. KYllä siellä joukossa näyttää peräti joku troijalainenkin olevan. Saisikohan nämä jollain konstilla vielä pois kun ei niistä kyllä hyötyäkään koneen toiminnalle ole.
[ + lainaa]
A man walked into a bar
-OUCH!

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 15. huhtikuuta 2008 @ 20:43
Hujo
Suspended permanently
_ 		15. huhtikuuta 2008 @ 20:53 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
ajas tuo combofix uudelleen
[ + lainaa]
Voiko tietsikka koskaan toimia?

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 15. huhtikuuta 2008 @ 20:54
kumiorava
Member
_ 		15. huhtikuuta 2008 @ 22:20 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
sen tein... tässä uusin loki. pistän tuon spyware doctorin scannailemaan ja katson mitä tulee...

ComboFix 08-04-14.2 - Taneli 2008-04-15 21:35:19.2 - NTFSx86
Microsoft® Windows Vista? Home Premium 6.0.6000.0.1252.1.1035.18.1610 [GMT 3:00]
Running from: C:\Users\Taneli\Desktop\ComboFix.exe
.

((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-03-15 to 2008-04-15 )))))))))))))))))
.

2008-04-15 16:04 . 2008-04-15 16:04 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Malwarebytes
2008-04-15 16:04 . 2008-04-15 16:04 <KANSIO> d-------- C:\ProgramData\Malwarebytes
2008-04-15 16:04 . 2008-04-15 16:04 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-15 16:01 . 2008-04-15 18:32 5,176 --a------ C:\Windows\System32\tmp.reg
2008-04-15 16:00 . 2007-09-06 00:22 289,144 --a------ C:\Windows\System32\VCCLSID.exe
2008-04-15 16:00 . 2006-04-27 17:49 288,417 --a------ C:\Windows\System32\SrchSTS.exe
2008-04-15 16:00 . 2008-04-14 19:28 86,528 --a------ C:\Windows\System32\VACFix.exe
2008-04-15 16:00 . 2008-04-12 13:49 82,432 --a------ C:\Windows\System32\IEDFix.exe
2008-04-15 16:00 . 2003-06-05 21:13 53,248 --a------ C:\Windows\System32\Process.exe
2008-04-15 16:00 . 2004-07-31 18:50 51,200 --a------ C:\Windows\System32\dumphive.exe
2008-04-15 16:00 . 2007-10-04 00:36 25,600 --a------ C:\Windows\System32\WS2Fix.exe
2008-04-15 14:40 . 2008-04-15 14:40 <KANSIO> d-------- C:\VundoFix Backups
2008-04-15 08:34 . 2008-04-15 08:34 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-04-15 08:22 . 2008-04-15 13:22 474 ---hs---- C:\Windows\System32\aqlkgvyn.ini
2008-04-15 07:53 . 2008-04-15 07:53 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\PC Tools
2008-04-15 07:53 . 2008-04-15 21:19 <KANSIO> d-a------ C:\ProgramData\TEMP
2008-04-15 07:53 . 2008-04-15 07:55 <KANSIO> d-------- C:\Program Files\Spyware Doctor
2008-04-15 07:53 . 2007-12-10 13:53 81,288 --a------ C:\Windows\System32\drivers\iksyssec.sys
2008-04-15 07:53 . 2007-12-10 13:53 66,952 --a------ C:\Windows\System32\drivers\iksysflt.sys
2008-04-15 07:53 . 2008-02-01 11:55 42,376 --a------ C:\Windows\System32\drivers\ikfilesec.sys
2008-04-15 07:53 . 2007-12-10 13:53 29,576 --a------ C:\Windows\System32\drivers\kcom.sys
2008-04-15 03:05 . 2008-04-15 03:06 <KANSIO> d-------- C:\ProgramData\Lavasoft
2008-04-15 03:05 . 2008-04-15 03:05 <KANSIO> d-------- C:\Program Files\Lavasoft
2008-04-15 03:04 . 2008-04-15 03:04 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-15 02:52 . 2008-04-15 02:52 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Grisoft
2008-04-15 02:52 . 2008-04-15 02:52 <KANSIO> d-------- C:\ProgramData\Grisoft
2008-04-15 02:52 . 2007-05-30 15:10 10,872 --a------ C:\Windows\System32\drivers\AvgAsCln.sys
2008-04-14 20:39 . 2008-04-15 08:13 354 ---hs---- C:\Windows\System32\adknoxcj.ini
2008-04-14 20:24 . 2008-04-15 16:30 <KANSIO> d-------- C:\ProgramData\zqbupexg
2008-04-12 18:19 . 2008-04-12 19:42 <KANSIO> d-------- C:\Program Files\Windows Live
2008-04-12 18:19 . 2008-04-12 19:42 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-04-12 18:18 . 2008-04-12 18:18 <KANSIO> d-------- C:\ProgramData\WLInstaller
2008-04-11 13:15 . 2008-04-11 13:15 249,856 --------- C:\Windows\Setup1.exe
2008-04-11 13:15 . 2008-04-11 13:15 73,216 --a------ C:\Windows\ST6UNST.EXE
2008-04-11 09:00 . 2008-04-11 09:00 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\ASUS Security Protect Manager
2008-04-10 21:31 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Searches
2008-04-10 21:31 . 2008-04-10 21:31 <KANSIO> d-------- C:\Users\Riikka\AppData\Roaming\Infineon
2008-04-10 21:30 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Contacts
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Videos
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Saved Games
2008-04-10 21:29 . 2008-03-17 14:02 <KANSIO> d-------- C:\Users\Riikka\Roaming
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Pictures
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Music
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Links
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Downloads
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> dr------- C:\Users\Riikka\Documents
2008-04-10 21:29 . 2006-11-02 15:37 <KANSIO> d-------- C:\Users\Riikka\AppData\Roaming\Media Center Programs
2008-04-10 21:29 . 2008-04-10 21:31 <KANSIO> d--h----- C:\Users\Riikka\AppData
2008-04-10 21:29 . 2008-04-15 08:01 <KANSIO> d-------- C:\Users\Riikka
2008-04-08 19:28 . 2008-04-08 19:28 <KANSIO> d-------- C:\Program Files\EA Games
2008-04-07 21:58 . 2008-04-08 19:48 <KANSIO> d-------- C:\Program Files\RegCleaner
2008-04-07 18:13 . 2008-04-07 18:13 <KANSIO> d-------- C:\Program Files\ASUS Security Center
2008-04-06 23:54 . 2008-04-06 23:54 <KANSIO> d-------- C:\Program Files\SINOSUN
2008-04-06 23:54 . 2006-06-16 18:13 42,579 --a------ C:\Windows\System32\drivers\PrivateDisk.sys
2008-04-06 22:11 . 2008-04-06 22:11 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
2008-04-06 20:26 . 2008-04-06 20:26 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Ahead
2008-04-06 17:18 . 2008-04-10 19:34 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\dvdcss
2008-04-06 13:07 . 2008-04-06 13:07 <KANSIO> d-------- C:\ProgramData\LightScribe
2008-04-06 11:37 . 2008-04-06 11:37 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\DAEMON Tools
2008-04-06 11:37 . 2008-04-06 11:37 717,296 --a------ C:\Windows\System32\drivers\sptd.sys
2008-04-06 08:11 . 2008-04-06 08:11 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\BSplayer Pro
2008-04-06 08:11 . 2008-04-06 08:20 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\BSplayer
2008-04-06 08:11 . 2008-04-06 08:11 <KANSIO> d-------- C:\Program Files\Webteh
2008-04-06 03:06 . 2008-04-06 03:06 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-04-06 03:06 . 2008-04-06 03:06 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-04-06 03:04 . 2008-04-06 03:04 <KANSIO> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-06 03:04 . 2008-04-06 03:04 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
2008-04-06 03:04 . 2008-04-06 03:04 41,984 --a------ C:\Windows\System32\drivers\monitor.sys
2008-04-05 17:22 . 2008-04-14 19:32 89,214 --a------ C:\Users\Taneli\AppData\Roaming\nvModes.dat
2008-04-05 15:56 . 2008-04-05 15:56 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Miranda
2008-04-05 15:56 . 2008-04-05 15:56 <KANSIO> d-------- C:\Program Files\Miranda IM
2008-04-05 15:28 . 2008-04-05 15:35 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Mp3tag
2008-04-05 15:28 . 2008-04-05 15:28 <KANSIO> d-------- C:\Program Files\Mp3tag
2008-04-05 14:39 . 2008-04-14 17:58 49 --a------ C:\Windows\NeroDigital.ini
2008-04-05 14:02 . 2008-04-05 14:02 <KANSIO> d-------- C:\Program Files\Nokia
2008-04-05 14:01 . 2008-04-15 08:01 <KANSIO> d-------- C:\Program Files\Common Files\LightScribe
2008-04-05 13:59 . 2008-04-05 13:59 <KANSIO> d-------- C:\ProgramData\Nero
2008-04-05 13:59 . 2008-04-05 13:59 <KANSIO> d-------- C:\Program Files\Nero
2008-04-05 13:59 . 2008-04-05 14:00 <KANSIO> d-------- C:\Program Files\Common Files\Ahead
2008-04-05 13:38 . 2008-04-05 13:38 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Thunderbird
2008-04-05 13:38 . 2008-04-05 13:38 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\Talkback
2008-04-05 13:38 . 2008-04-05 13:38 <KANSIO> d-------- C:\Program Files\Mozilla Thunderbird
2008-04-05 13:37 . 2008-04-05 13:37 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\vlc
2008-04-05 13:00 . 2008-04-14 20:16 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\uTorrent
2008-04-05 13:00 . 2008-04-05 13:00 <KANSIO> d-------- C:\Program Files\uTorrent
2008-04-05 12:17 . 2008-04-05 12:17 <KANSIO> d-------- C:\Program Files\Common Files\SWF Studio
2008-04-05 12:17 . 2000-05-22 11:58 647,872 --------- C:\Windows\System32\Mscomct2.ocx
2008-04-05 12:17 . 1999-10-11 04:00 41,984 --------- C:\Windows\Ctregrun.exe
2008-04-05 12:16 . 1999-06-25 10:55 149,504 --a------ C:\Windows\UNWISE.EXE
2008-04-05 12:11 . 2008-04-05 23:18 <KANSIO> d-------- C:\Program Files\Creative
2008-04-05 12:09 . 2008-04-05 12:09 16 --a------ C:\Windows\System32\coh.cache
2008-04-05 12:07 . 2008-04-11 09:20 <KANSIO> d-------- C:\Users\Taneli\AppData\Roaming\foobar2000
2008-04-05 12:04 . 2008-04-05 12:04 <KANSIO> d-------- C:\Program Files\VideoLAN
2008-04-05 12:03 . 2008-04-05 12:03 <KANSIO> d-------- C:\Program Files\foobar2000
2008-04-05 11:57 . 2008-04-05 11:57 0 --a------ C:\Windows\nsreg.dat
2008-04-05 11:56 . 2008-04-05 11:56 1,712,984 --a------ C:\Windows\System32\wuaueng.dll
2008-04-05 11:56 . 2008-04-05 11:56 1,524,224 --a------ C:\Windows\System32\wucltux.dll
2008-04-05 11:56 . 2008-04-05 11:56 53,080 --a------ C:\Windows\System32\wuauclt.exe
2008-04-05 11:56 . 2008-04-05 11:56 43,352 --a------ C:\Windows\System32\wups2.dll
2008-04-05 11:55 . 2008-04-05 11:55 549,720 --a------ C:\Windows\System32\wuapi.dll

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-06 00:16 --------- d-----w C:\Program Files\Windows Sidebar
2008-04-06 00:16 --------- d-----w C:\Program Files\Windows Mail
2008-04-06 00:03 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-04-06 00:01 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-04-06 00:01 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-04-06 00:01 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-04-06 00:01 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-04-05 10:37 --------- d-----w C:\Users\Taneli\AppData\Roaming\vlc
2008-03-17 10:47 319,456 ----a-w C:\Windows\DIFxAPI.dll
2008-03-17 10:17 174 --sha-w C:\Program Files\desktop.ini
2008-03-17 10:13 --------- d-----w C:\Program Files\Windows Defender
2008-03-17 10:13 --------- d-----w C:\Program Files\Windows Calendar
2008-03-17 09:15 88,576 ----a-w C:\Windows\System32\avifil32.dll
2008-03-17 09:14 8,192 ----a-w C:\Windows\System32\riched32.dll
2008-03-17 08:56 160,872 ----a-w C:\Windows\System32\halmacpi.dll
2008-03-17 08:56 134,760 ----a-w C:\Windows\System32\halacpi.dll
.

((((((((((((((((((((((((((((( snapshot@2008-04-15_15.57.30.54 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-15 12:54:28 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-04-15 12:55:46 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-04-15 12:55:46 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-04-15 12:54:04 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-04-15 17:34:54 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-04-15 12:54:04 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-04-15 17:34:54 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-04-15 12:54:04 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-04-15 17:34:54 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-04-15 11:42:25 103,924 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-04-15 15:53:04 103,924 ----a-w C:\Windows\System32\perfc009.dat
- 2008-04-15 11:42:25 83,896 ----a-w C:\Windows\System32\perfc00B.dat
+ 2008-04-15 15:53:04 83,896 ----a-w C:\Windows\System32\perfc00B.dat
- 2008-04-15 11:42:25 79,320 ----a-w C:\Windows\System32\perfc014.dat
+ 2008-04-15 15:53:04 79,320 ----a-w C:\Windows\System32\perfc014.dat
- 2008-04-15 11:42:26 81,394 ----a-w C:\Windows\System32\perfc01D.dat
+ 2008-04-15 15:53:04 81,394 ----a-w C:\Windows\System32\perfc01D.dat
- 2008-04-15 11:42:25 610,142 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-04-15 15:53:04 610,142 ----a-w C:\Windows\System32\perfh009.dat
- 2008-04-15 11:42:25 459,542 ----a-w C:\Windows\System32\perfh00B.dat
+ 2008-04-15 15:53:04 459,542 ----a-w C:\Windows\System32\perfh00B.dat
- 2008-04-15 11:42:26 468,364 ----a-w C:\Windows\System32\perfh014.dat
+ 2008-04-15 15:53:04 468,364 ----a-w C:\Windows\System32\perfh014.dat
- 2008-04-15 11:42:26 463,874 ----a-w C:\Windows\System32\perfh01D.dat
+ 2008-04-15 15:53:04 463,874 ----a-w C:\Windows\System32\perfh01D.dat
- 2008-04-15 11:38:06 5,388 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2799988849-141376510-2707820881-1000_UserData.bin
+ 2008-04-15 12:56:04 5,638 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2799988849-141376510-2707820881-1000_UserData.bin
- 2008-04-15 11:38:05 82,106 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-04-15 12:56:03 82,444 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 15:35 125440]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 15:36 201728]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-06-20 12:49 451872]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 12:39 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-03-17 12:01 1006264]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-05 13:17 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-05 13:17 8534560]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-05 13:17 81920]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 00:58 115816]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-27 08:10 4702208 C:\Windows\RtHDVCpl.exe]
"Skytel"="Skytel.exe" [2007-08-03 08:22 1826816 C:\Windows\SkyTel.exe]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-10-24 05:02 178712]
"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-24 20:31 630784]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-03 00:24 857648]
"ATKMEDIA"="C:\Program Files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 18:27 61440]
"PowerForPhone"="C:\Program Files\P4P\P4P.exe" [ ]
"ASUS Camera ScreenSaver"="C:\Windows\ASScrProlog.exe" [2008-03-17 14:22 37232]
"ASUS Screen Saver Protector"="C:\Windows\ASScrPro.exe" [2008-03-17 14:23 33136]
"IFXSPMGT"="C:\Windows\system32\ifxspmgt.exe" [2007-02-26 06:29 677408]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [2007-06-01 10:06 1629744]
"InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe" [2007-06-01 10:05 1057328]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"CognizanceTS"="C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll" [2003-12-22 05:12 17920]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-02-01 11:55 1103240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{B7C18FE5-8C7C-467A-8019-84A12062E95F}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{26D0F558-1907-4B86-9B37-E20FF300460E}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{987FA836-853D-47C1-96E7-E8B2538FBEB4}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{F678EA31-D085-4070-A22B-E4116D035E22}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{78A5D15E-56E2-4A94-B1C2-32DF9B7760EA}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{7F576416-BF94-4EDA-B8F2-56A0C02C4824}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 lullaby;lullaby;C:\Windows\system32\DRIVERS\lullaby.sys [2007-09-27 01:03]
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080407.003\IDSvix86.sys [2008-03-12 08:30]
R1 ItSDisk;ItSDisk;C:\Windows\system32\Drivers\ItSDisk.sys [2006-05-17 01:14]
R1 PersonalSecureDrive;PersonalSecureDrive;C:\Windows\system32\drivers\psd.sys [2007-01-23 15:07]
R2 ASBroker;Logon Session Broker;C:\Windows\System32\svchost.exe [2006-11-02 12:45]
R2 ASChannel;Local Communication Channel;C:\Windows\System32\svchost.exe [2006-11-02 12:45]
R2 HFGService;Handsfree Headset Service;C:\Windows\system32\svchost.exe [2006-11-02 12:45]
R2 PrivateDiskDriver;Private Encrypted Virtual Disk Driver;C:\Windows\system32\drivers\PrivateDisk.sys [2006-06-16 18:13]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;C:\Windows\system32\DRIVERS\l160x86.sys [2007-10-31 14:55]
R3 DCamUSBET;USB2.0 1.3M UVC WebCam;C:\Windows\system32\DRIVERS\etDevice.sys [2007-09-06 11:43]
R3 FiltUSBET;ET USB Device Lower Filter;C:\Windows\system32\DRIVERS\etFilter.sys [2007-10-15 10:39]
R3 ScanUSBET;ET USB Still Image Capture Device;C:\Windows\system32\DRIVERS\etScan.sys [2007-09-06 18:45]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-01-09 17:31]
S3 BthAudioHF;BthAudioHF-palvelu;C:\Windows\system32\DRIVERS\BthAudioHF.sys [2008-03-17 13:53]
S3 bthav;Bluetooth-AV-profiili;C:\Windows\system32\drivers\bthav.sys [2008-03-17 13:53]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
GPSvcGroup REG_MULTI_SZ GPSvc
bthaudiosvc REG_MULTI_SZ HFGService
Cognizance REG_MULTI_SZ ASBroker ASChannel

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94bb1e85-040c-11dd-ad8c-000ea6f33381}]
\shell\AutoRun\command - F:\autorun.exe

*Newly Created Service* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-04-14 17:28:20 C:\Windows\Tasks\Norton Internet Security - Run Full System Scan - Taneli.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeB/TASK:
"2008-04-15 09:00:05 C:\Windows\Tasks\Security Platform Backup Schedule.job"
- C:\Program Files\Infineon\Security Platform Software\SpBackupWz.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-15 21:54:15
Windows 6.0.6000 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-15 21:55:34
ComboFix-quarantined-files.txt 2008-04-15 18:55:26
ComboFix2.txt 2008-04-15 12:58:26

Pre-Run: 79,756,898,304 tavua vapaana
Post-Run: 79,515,619,328 tavua vapaana
.
2008-04-15 09:46:27 --- E O F ---

EDIT: vielä näyttää jonkun verran sontaa löytyvän
[ + lainaa]
A man walked into a bar
-OUCH!

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 15. huhtikuuta 2008 @ 22:27
Hujo
Suspended permanently
_ 		15. huhtikuuta 2008 @ 22:27 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Päivitä AVG Anti-Spyware 7.5 ja aja vikasiedossa.
[ + lainaa]
Voiko tietsikka koskaan toimia?
kumiorava
Member
_ 		16. huhtikuuta 2008 @ 15:01 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Juu kyllä se AVG jotain tracking cookieta löysi ja poisti, mutta ei spyware doctorin löytämiä troijalaisia. Spyware doctor näyttää pikaskannauksen jälkeenkin vielä 6 uhkaa ja 40 tartuntaa... Mikään muu ohjelma mitä olen kokeilut ei tunnu näitä löytävän.
[ + lainaa]
A man walked into a bar
-OUCH!
Hujo
Suspended permanently
_ 		16. huhtikuuta 2008 @ 19:51 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Lataa Atribunen ATF Cleaner

Ohjeet;

Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.Main:n alla valitse: Select All
Klikkaa Empty Selected valintaa.
Jos käytät FireFoxia selaimenasi Klikkaa Firefox yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Jos käytät Operaa selaimenasiKlikkaa Opera yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa taas.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)

[ + lainaa]
Voiko tietsikka koskaan toimia?
Mainos
_ 		__
 
_
kumiorava
Member
_ 		17. huhtikuuta 2008 @ 11:46 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Juu suoritin tuon ATF:n. Tilanne ei sittenkään vielä näytä korjaantuneen... Noita troijalaisia tuppaa tulemaan uusia jatkuvalla syötöllä. Esim. Trojan.Virtumonde ja Trojan.Downloader.Conhook. Vaikka onnistuisi aina kyseiset poistamaan, tulee niitä sitten aina uusia.

Yksi ongelma myös minkä tuossa huomasin niin symantecin phishing filter on maissa eikä suostu enää menemään päälle.

Toinen ongelma joka iski eilen illalla on että jostain syystä kumpikaan selain ei oikein tahdo toimia. Aloitussivulle ne menee, mutta ei sitten millekkään muulle... Mahtaakohan ongelma olla pöpöissä vai onko verkossa vikaa. Nyt työskentelen kotikoneella, joka saman modeemin kautta verkossa että verkon kyllä luulisi toimivan ainakin osittain :)

Internet explorerissa tuntu (sillon kun selaimet vielä toimi) olevan suurempiakin ongelmia. Kokoajan heitteli jollekkin sivustoille missä tarjottiin taas jotain ohjelmistoja spywaren poistamiseen.

EDIT: myös windowsin päivityksen kanssa tuntuu olevan ongelmia. Päivitykset on valmiina mutta kun sulkee koneen asentaakseen päivitykset, tulee ruutuun teksti ettei saa sammuttaa konetta koska asentaa päivityksiä jne jne. Tätä kestää varmaan n. ½ tuntia jonka jälkeen kone sammuu, mutta kun koneen käynnistää taas niin päivitykset eivät ole asentuneet.

EDIT 2:konetta käynnistettäessä tulee seuraava virheilmoitus:
Virhe ladattaessa C:\Windows\system32\awtsPihI.dll
Määritettyä osaa ei löydy

Seuraavan kerran pääsen koneellani verkkoon todennäköisesti vasta viikon päästä perjantaina. Saapuneet viestit voin lukea puhelimella, mutta en tod. näk. voi ainakaan mitään ohjelmia ladata tms. Kone on kyllä mukana, että jos tulee korjausehdotuksia niin pääsen kyllä testaamaan.
[ + lainaa]
A man walked into a bar
-OUCH!

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 17. huhtikuuta 2008 @ 15:28
afterdawn.com > keskustelu > yleistä keskustelua tietokoneista > virukset ja haittaohjelmat - hijackthis -logit > virusongelma
 

Apua ongelmiin: AfterDawnin keskustelualueet | AfterDawnin Vastaukset
Uutiset: IT-alan uutiset | Uutisia puhelimista
Musiikkia: MP3Lizard.com
Tuotearviot: Laitevertailu | Vertaa puhelimia | Vertaa kännykkäliittymiä
Pelit: Pelitiedostot, pelidemot ja trailerit
Ohjelmat: download.fi | AfterDawnin ohjelma-alueet
International: AfterDawn in English | Software downloads | Free, legal MP3s | AfterDawn på svenska
RSS -syötteet: AfterDawnin uutiset | Uusimmat ohjelmapäivitykset | Keskustelualueiden viestit
Tietoja: Tietoa AfterDawn Oy:stä | Mainosta sivuillamme | Sivuston käyttöehdot ja tietoja yksityisyydensuojasta
Ota yhteyttä: Lähetä palautetta | Ota yhteyttä mainosmyyntiimme
 
  © 1999-2025 AfterDawn Oy