|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
HJT-loki tarkastettavaksi
|
|
|
aaffyli
Junior Member
|
4. toukokuuta 2008 @ 20:28 |
Linkki tähän viestiin
|
Palomuuri kaatuilee aina tietyin väliajoin. Löytyykö tästä mitään syytä sille?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:22:30, on 4.5.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\RivaTuner v2.07\RivaTuner.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\STINGE~1\wh_exec.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
E:\pelit\steam\steam.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system\Cm106eye.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CM106Sound] RunDll32 CM106.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.07\RivaTuner.exe" /S
O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.07\RivaTuner.exe" /T
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [WheelMouse] C:\STINGE~1\wh_exec.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "e:\pelit\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
--
End of file - 5862 bytes
|
|
Hujo
Suspended permanently
|
5. toukokuuta 2008 @ 13:02 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
===========
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan:
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä
Jossakin koneissa hakataan F8:sin sijasta F5:tä
" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
Voiko tietsikka koskaan toimia?
|
|
aaffyli
Junior Member
|
5. toukokuuta 2008 @ 14:20 |
Linkki tähän viestiin
|
ComboFix 08-05-01.3 - Omistaja 2008-05-05 14:10:57.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.2522 [GMT 3:00]
Running from: D:\Lataukset\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-05 to 2008-05-05 )))))))))))))))))
.
2008-04-26 23:14 . 2008-04-26 23:14 <KANSIO> d-------- C:\Program Files\Astonsoft
2008-04-26 23:14 . 2008-04-27 01:23 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\DeepBurner
2008-04-26 23:08 . 2008-04-26 23:08 <KANSIO> d-------- C:\Program Files\Ahead
2008-04-23 13:39 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2008-04-23 13:38 . 2008-04-23 13:38 <KANSIO> d-------- C:\WINDOWS\system32\ageia
2008-04-23 13:38 . 2008-04-23 13:38 <KANSIO> d-------- C:\Program Files\AGEIA Technologies
2008-04-21 12:41 . 2008-04-21 12:41 <KANSIO> d-------- C:\Program Files\Panda Security
2008-04-21 12:41 . 2008-04-21 12:41 1,859 --a------ C:\WINDOWS\mozver.dat
2008-04-20 21:00 . 2008-04-26 17:04 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\skypePM
2008-04-20 21:00 . 2008-04-20 21:00 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-04-20 20:57 . 2008-04-26 17:18 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Skype
2008-04-20 20:56 . 2008-04-20 20:56 <KANSIO> d-------- C:\Program Files\Skype
2008-04-20 20:56 . 2008-04-20 20:56 <KANSIO> d-------- C:\Program Files\Common Files\Skype
2008-04-20 20:56 . 2008-04-20 20:56 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2008-04-20 11:34 . 2008-04-20 11:34 <KANSIO> d-------- C:\Program Files\Innovative Solutions
2008-04-19 15:37 . 2008-04-19 15:37 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\DAEMON Tools
2008-04-19 15:37 . 2008-04-19 15:37 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-04-17 14:45 . 2008-04-17 14:45 <KANSIO> d---s---- C:\Documents and Settings\Omistaja\UserData
2008-04-13 18:28 . 2008-04-13 18:28 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Grisoft
2008-04-13 18:28 . 2008-04-13 18:28 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-13 18:28 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-12 19:27 . 2008-04-12 19:27 <KANSIO> d-------- C:\Program Files\Cyber Snipa Stinger Mouse
2008-04-11 16:48 . 2008-04-11 20:06 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Microsoft Games
2008-04-11 13:49 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2008-04-11 13:49 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2008-04-11 13:49 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2008-04-11 13:49 . 2007-03-12 16:42 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll
2008-04-11 13:49 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2008-04-11 13:49 . 2007-03-15 16:57 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll
2008-04-11 13:49 . 2006-09-28 16:05 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
2008-04-11 13:49 . 2007-04-04 18:53 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll
2008-04-11 13:49 . 2006-09-28 16:03 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2008-04-11 12:57 . 2008-04-12 19:30 <KANSIO> d-------- C:\Stinger Mouse Driver
2008-04-07 18:18 . 2008-05-05 14:07 <KANSIO> d-------- C:\Program Files\Mozilla Thunderbird
2008-04-07 18:18 . 2008-04-07 18:18 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Thunderbird
2008-04-05 16:10 . 2008-04-05 16:14 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Winamp
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-05 10:44 --------- d-----w C:\Program Files\SpeedFan
2008-05-05 10:09 69,960 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
2008-05-02 19:03 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-02 19:03 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-05-01 08:57 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\dvdcss
2008-04-23 20:22 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-23 13:25 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\OpenOffice.org2
2008-04-23 10:25 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-19 14:26 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-04-05 13:10 --------- d-----w C:\Program Files\Winamp
2008-04-03 17:15 --------- d-----w C:\Program Files\Trend Micro
2008-04-01 12:14 --------- d--h--w C:\Program Files\CanonBJ
2008-04-01 12:14 --------- d--h--w C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-03-30 20:47 --------- d-----w C:\Program Files\eRightSoft
2008-03-30 20:47 --------- d-----w C:\Program Files\AviSynth 2.5
2008-03-26 20:32 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-03-26 10:03 --------- d-----w C:\Program Files\Audacity
2008-03-26 07:04 --------- d-----w C:\Program Files\Java
2008-03-26 07:03 --------- d-----w C:\Program Files\Common Files\Java
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-17 16:52 --------- d-----w C:\Program Files\Fraps
2008-03-17 10:35 --------- d-----w C:\Program Files\ATITool
2008-03-17 10:06 --------- d-----w C:\Program Files\EvilLyrics
2008-03-13 13:22 --------- d-----w C:\Program Files\CD-DA X-Tractor
2008-03-12 22:13 --------- d-----w C:\Program Files\Foxit Software
2008-03-09 22:06 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-03-08 23:32 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-08 23:26 2,278,400 ----a-w C:\WINDOWS\system32\TUKernel.exe
2008-03-08 23:24 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\TuneUp Software
2008-03-08 23:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-03-08 23:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-08 23:12 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-08 23:08 --------- d-----w C:\Program Files\Samurize
2008-03-08 21:42 --------- d-----w C:\Program Files\A4Tech
2008-03-08 20:22 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-08 19:45 98,304 ----a-w C:\WINDOWS\system32CmdLineExt.dll
2008-03-08 19:06 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\vlc
2008-03-08 16:02 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Talkback
2008-03-08 16:01 --------- d-----w C:\Program Files\Mozilla Firefox 3 Beta 3
2008-03-08 13:31 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-03-08 13:31 262,144 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-03-08 10:36 22,328 ----a-w C:\Documents and Settings\Omistaja\Application Data\PnkBstrK.sys
2008-03-08 09:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-03-08 08:42 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Ventrilo
2008-03-08 03:10 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-08 03:10 --------- d-----w C:\Program Files\Windows Live
2008-03-08 02:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-08 02:35 --------- d-----w C:\Program Files\Logitech
2008-03-08 02:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
2008-03-08 02:33 --------- d-----w C:\Program Files\IrfanView
2008-03-08 02:12 --------- d-----w C:\Program Files\Sharkoon Majestic 5.1 USB
2008-03-08 02:05 --------- d-----w C:\Program Files\IZArc
2008-03-08 02:00 --------- d-----w C:\Program Files\RivaTuner v2.07
2008-03-08 01:49 --------- d-----w C:\Program Files\VideoLAN
2008-03-08 01:45 --------- d-----w C:\Program Files\Ventrilo
2008-03-08 01:23 --------- d-----w C:\Program Files\Alwil Software
2008-03-08 00:15 --------- d-----w C:\Program Files\U-ABIT
2008-03-08 00:14 --------- d-----w C:\Program Files\DIFX
2008-03-08 00:14 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\InstallShield
2008-03-08 00:12 463,524 ----a-w C:\m630a15.zip
2008-03-08 00:06 --------- d-----w C:\Program Files\Sunbelt Software
2008-03-07 23:44 --------- d-----w C:\Program Files\Intel
2008-03-07 23:42 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-03-07 23:42 --------- d-----w C:\Program Files\Realtek
2008-03-07 23:41 --------- d-----w C:\Program Files\Marvell
2008-03-07 23:26 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-16 09:02 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-07 13:15 408,576 ----a-w C:\WINDOWS\system32\Smab.dll
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"Steam"="e:\pelit\steam\steam.exe" [2008-03-28 09:04 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 13:04 2879488 C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-01-30 13:54 16116224 C:\WINDOWS\RTHDCPL.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 20:37 79224]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2007-12-05 02:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2007-12-05 02:41 81920]
"CM106Sound"="CM106.cpl" []
"Launch LCDMon"="C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-12-13 18:43 2051096]
"Launch LGDCore"="C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-12-13 18:57 2095640]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 21:49 36352]
"RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.07\RivaTuner.exe" [2008-03-02 20:20 2686976]
"RivaTuner"="C:\Program Files\RivaTuner v2.07\RivaTuner.exe" [2008-03-02 20:20 2686976]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"WheelMouse"="C:\STINGE~1\wh_exec.exe" [2007-11-10 22:08 98304]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 02:12 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll
"vidc.yv12"= yv12vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"E:\\Pelit\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe"=
"E:\\Pelit\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe"=
"E:\\Pelit\\Flagship Studios\\Hellgate London\\Launcher.exe"=
"E:\\Pelit\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
"E:\\Pelit\\Steam\\steamapps\\aaffyli@sunpoint.net\\counter-strike\\hl.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 20:31]
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 11:21]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 11:21]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 20:35]
R2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 11:21]
R3 CM1063264;C-Media CM106 Like Sound UDAX Interface;C:\WINDOWS\system32\drivers\CM106.sys [2007-02-02 15:29]
R3 whfltr2k;WheelMouse USB Lower Filter Driver;C:\WINDOWS\system32\DRIVERS\whfltr2k.sys [2007-01-26 02:45]
S0 uGuru;uGuru;C:\WINDOWS\system32\Drivers\uGuru.sys []
S3 Memctl;Memctl;C:\Program Files\U-ABIT\FlashMenu\Memctl.sys [2006-04-18 15:53]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbb9a53c-0e13-11dd-a555-00508db506ab}]
\Shell\AutoRun\command - H:\Setup.exe
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-05 14:14:01
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\Documents and Settings\Omistaja\Local Settings\Application Data\Microsoft\Messenger\aaffyli@gmail.com\SharingMetadata\Working\database_7C84_31C5_8431_82A6\$db_clean$ 0 bytes
scan completed successfully
hidden files: 34
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\STINGE~1\wh_hook.dll
.
Completion time: 2008-05-05 14:15:14
ComboFix-quarantined-files.txt 2008-05-05 11:15:10
Pre-Run: 65,155,366,912 tavua vapaana
Post-Run: 65,213,104,128 tavua vapaana
196 --- E O F --- 2008-04-09 12:54:47
|
|
aaffyli
Junior Member
|
5. toukokuuta 2008 @ 15:03 |
Linkki tähän viestiin
|
SDFix: Version 1.179
Run by Omistaja on ma 05.05.2008 at 14:31
Microsoft Windows XP [versio 5.1.2600]
Running From: C:\DOCUME~1\Omistaja\TYPYT~1\SDFix
Checking Services :
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
Checking Files :
No Trojan Files Found
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-05 14:58:07
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
IPC error: 2 Määritettyä tiedostoa ei löydy.
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d1,de,19,77,96,f0,7e,ee,78,61,51,cb,aa,53,ad,2a,a6,81,25,d0,84,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d1,de,19,77,96,f0,7e,ee,78,61,51,cb,aa,53,ad,2a,a6,81,25,d0,84,..
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000070
"TracesSuccessful"=dword:00000004
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 33
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"E:\\Pelit\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe"="E:\\Pelit\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe:*:Enabled:etqwded.exe"
"E:\\Pelit\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe"="E:\\Pelit\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe:*:Enabled:Enemy Territory - QUAKE Wars(TM) "
"E:\\Pelit\\Flagship Studios\\Hellgate London\\Launcher.exe"="E:\\Pelit\\Flagship Studios\\Hellgate London\\Launcher.exe:*:Enabled:Hellgate: London"
"E:\\Pelit\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"="E:\\Pelit\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe:*:Enabled:Gears of War"
"E:\\Pelit\\Steam\\steamapps\\aaffyli@sunpoint.net\\counter-strike\\hl.exe"="E:\\Pelit\\Steam\\steamapps\\aaffyli@sunpoint.net\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
Remaining Files :
File Backups: - C:\DOCUME~1\Omistaja\TYPYT~1\SDFix\backups\backups.zip
Files with Hidden Attributes :
Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 3 May 2006 163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
Wed 21 Feb 2007 31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
Mon 17 Dec 2007 27,648 ..SH. --- "C:\WINDOWS\system32\Smab0.dll"
Sun 26 Jun 2005 616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
Wed 22 Jun 2005 45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
Fri 14 Mar 2008 13,824 A.SHR --- "C:\Program Files\eRightSoft\SUPER\DXdump.exe"
Sun 23 Mar 2008 72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
Tue 2 Oct 2007 16,384 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
Sun 9 Jun 2002 36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
Tue 10 Dec 2002 102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
Tue 10 Dec 2002 208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
Sun 9 Jun 2002 40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
Sun 4 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
Tue 10 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
Fri 20 Feb 2004 232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll"
Sun 9 Jun 2002 525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll"
Tue 10 Dec 2002 245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll"
Tue 10 Dec 2002 45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll"
Tue 10 Dec 2002 98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll"
Tue 10 Dec 2002 94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll"
Tue 10 Dec 2002 90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll"
Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
Sun 9 Jun 2002 49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll"
Thu 20 Mar 2008 5,632 ..SHR --- "C:\Program Files\eRightSoft\SUPER\spk\1stRun.exe"
Sat 8 Mar 2008 2,599,664 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\870c95332c9b60b05a7d2b36b49b0d75\BITD.tmp"
Finished!
|
|
aaffyli
Junior Member
|
5. toukokuuta 2008 @ 15:06 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:04:14, on 5.5.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Program Files\RivaTuner v2.07\RivaTuner.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\STINGE~1\wh_exec.exe
C:\WINDOWS\system\Cm106eye.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
E:\pelit\steam\steam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CM106Sound] RunDll32 CM106.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.07\RivaTuner.exe" /S
O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.07\RivaTuner.exe" /T
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [WheelMouse] C:\STINGE~1\wh_exec.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "e:\pelit\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
--
End of file - 6054 bytes
|
|
Hujo
Suspended permanently
|
5. toukokuuta 2008 @ 18:47 |
Linkki tähän viestiin
|
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
Voiko tietsikka koskaan toimia?
|
|
aaffyli
Junior Member
|
5. toukokuuta 2008 @ 20:08 |
Linkki tähän viestiin
|
|
Malwarebytes' Anti-Malware 1.11
Tietokantaversio: 720
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|)
Tarkistetut kohteet: 113917
Kulunut aika: 58 minute(s), 31 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)
|
|
Hujo
Suspended permanently
|
5. toukokuuta 2008 @ 21:53 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
|
|
aaffyli
Junior Member
|
8. toukokuuta 2008 @ 14:14 |
Linkki tähän viestiin
|
|
ei löytynyt tuollakaan ohjelmalla mitään
|
|
Hujo
Suspended permanently
|
8. toukokuuta 2008 @ 19:51 |
Linkki tähän viestiin
|
|
vieläkö menee nurin
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 8. toukokuuta 2008 @ 19:52
|
|
aaffyli
Junior Member
|
8. toukokuuta 2008 @ 20:05 |
Linkki tähän viestiin
|
|
Juu, vielhän se kaatuilee.
Pitäis varmaankii vaihtaa muuria.
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
8. toukokuuta 2008 @ 20:07 |
Linkki tähän viestiin
|
|
juu vaiha muuri
Voiko tietsikka koskaan toimia?
|
|
