|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Aukeaa ponnahdusikkunoita
|
|
|
ajga
Suspended due to non-functional email address
|
8. toukokuuta 2008 @ 14:02 |
Linkki tähän viestiin
|
Mulla aukeaa ponnahdusikkunoita, vaikka en ole netissä, missä ongelma?
Ainakin yhellä ohjelmalla löytyi joku searchpound-vakoiluohjelma, mutta milläs minä sen poistan?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:59:00, on 8.5.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\PROGRA~1\ROUTER~1\ROUTERCONTROL.EXE
C:\windows\system32\jnwnw64p.exe
C:\WINDOWS\system32\tcntokdm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Hamachi\hamachi.exe
C:\xampp\mysql\bin\winmysqladmin.exe
C:\xampp\apache\bin\apache.exe
C:\ColdFusion8\jnbridge\CF8DotNetsvc.exe
C:\ColdFusion8\runtime\bin\jrunsvc.exe
C:\ColdFusion8\jnbridge\JNBDotNetSide.exe
C:\ColdFusion8\db\slserver54\bin\swagent.exe
C:\ColdFusion8\runtime\bin\jrun.exe
C:\ColdFusion8\db\slserver54\bin\swstrtr.exe
C:\ColdFusion8\db\slserver54\bin\swsoc.exe
C:\ColdFusion8\verity\k2\_nti40\bin\k2admin.exe
C:\Program Files\CPUCooL\CooLSrv.exe
C:\xampp\apache\bin\apache.exe
C:\xampp\mysql\bin\mysqld-nt.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\ColdFusion8\verity\k2\_nti40\bin\k2server.exe
C:\WINDOWS\system32\PnkBstrA.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\ColdFusion8\verity\k2\_nti40\bin\k2index.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\cmd.exe
C:\Documents and Settings\Aarni\Omat tiedostot\Downloads\PC_GTA.SanAndreas -(rip)-(ToeD)\PC_GTA.SanAndreas -(rip)-(ToeD)\PC_GTA.SanAndreas -(rip)-(ToeD)\GTA.San.Andreas\anim\uha.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\Rundll32.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ircdown.com/index.php?rvs=hompag&hl=fi
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O1 - Hosts: 92.48.81.32 iHabbixReloaded
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: gooochi browser optimizer - {b2dba423-fc43-a96b-ebd9-474fb6ac016b} - C:\WINDOWS\system32\{49311914-d60c-1257-1903-afa393b2ee32}.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe"
O4 - HKLM\..\Run: [RIS2PostReboot] C:\Program Files\LEGO MINDSTORMS\RIS 2.0\LaunchRIS2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RouterControl] C:\PROGRA~1\ROUTER~1\ROUTERCONTROL.EXE
O4 - HKLM\..\Run: [{96-6F-F9-91-DW}] C:\windows\system32\jnwnw64p.exe DWrvgXX
O4 - HKLM\..\Run: [spa_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\{49311914-d60c-1257-1903-afa393b2ee32}.dll" DllInit
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\tcntokdm.exe DWrvgXX
O4 - HKLM\..\Run: [{4852e897-071a-3d4b-047e-ddea47663f24}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\{49311914-d60c-1257-1903-afa393b2ee32}.dll" DllInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: CPUCooL.lnk = C:\Program Files\CPUCooL\CPUCooL.exe
O4 - Startup: Deewoo.lnk = C:\WINDOWS\system32\tcntokdm.exe
O4 - Startup: Diino.lnk = C:\Program Files\Diino\Diino.exe
O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\jnwnw64p.exe
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: WinMySQLadmin.lnk = C:\xampp\mysql\bin\winmysqladmin.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Apache2.2 - Apache Software Foundation - C:\xampp\apache\bin\apache.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ColdFusion 8 .NET Service - Unknown owner - C:\ColdFusion8\jnbridge\CF8DotNetsvc.exe
O23 - Service: ColdFusion 8 Application Server - Macromedia Inc. - C:\ColdFusion8\runtime\bin\jrunsvc.exe
O23 - Service: ColdFusion 8 ODBC Agent - Unknown owner - C:\ColdFusion8\db\slserver54\bin\swagent.exe
O23 - Service: ColdFusion 8 ODBC Server - Unknown owner - C:\ColdFusion8\db\slserver54\bin\swstrtr.exe
O23 - Service: ColdFusion 8 Search Server - Verity, Inc. - C:\ColdFusion8\verity\k2\_nti40\bin\k2admin.exe
O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - C:\Program Files\CPUCooL\CooLSrv.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - c:\xampp\FileZillaFTP\FileZillaServer.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: mysql - Unknown owner - C:\xampp\mysql\bin\mysqld-nt.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SSL-Explorer - Unknown owner - C:\Program Files\sslexplorer\install\platforms\windows\wrapper.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: XAMPP Service (XAMPP) - Unknown owner - C:\xampp\service.exe
--
End of file - 8729 bytes
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 8. toukokuuta 2008 @ 14:12
|
|
Hujo
Suspended permanently
|
8. toukokuuta 2008 @ 19:55 |
Linkki tähän viestiin
|
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan:
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä
Jossakin koneissa hakataan F8:sin sijasta F5:tä
" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
Voiko tietsikka koskaan toimia?
|
|
ajga
Suspended due to non-functional email address
|
9. toukokuuta 2008 @ 12:19 |
Linkki tähän viestiin
|
|
En pääse vikasietolaan vaikka hakkaisin F5 ntai F8 näppäimiä
|
|
Hujo
Suspended permanently
|
10. toukokuuta 2008 @ 00:33 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
==============
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
Voiko tietsikka koskaan toimia?
|
|
Mainos
|
|
|
|
ajga
Suspended due to non-functional email address
|
14. toukokuuta 2008 @ 14:25 |
Linkki tähän viestiin
|
Combofix logi: ComboFix 08-05-12.1 - Aarni 2008-05-14 13:24:47.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.969 [GMT 3:00]
Running from: C:\Documents and Settings\Aarni\Työpöytä\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Aarni\Käynnistä-valikko\Ohjelmat\Käynnistys\Deewoo.lnk
C:\Documents and Settings\Aarni\Käynnistä-valikko\Ohjelmat\Käynnistys\DW_Start.lnk
C:\WINDOWS\system32\{49311914-d60c-1257-1903-afa393b2ee32}.dll
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\zxdnt3d.cfg
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-14 to 2008-05-14 )))))))))))))))))
.
2008-05-14 13:20 . 2008-05-14 13:20 <KANSIO> d-------- C:\WINDOWS\LastGood
2008-05-12 15:26 . 2008-05-12 15:26 <KANSIO> d-------- C:\TempDVD
2008-05-12 15:26 . 2008-05-12 15:35 <KANSIO> d-------- C:\dvdsanta
2008-05-12 15:24 . 2008-05-12 15:35 <KANSIO> d-------- C:\Program Files\dvdSanta
2008-05-12 12:47 . 2008-05-12 12:48 401,972 --a------ C:\WINDOWS\system32\g38.exe
2008-05-11 17:36 . 2008-05-11 17:36 49,205 --a------ C:\WINDOWS\system32\jrwnw64k.exe
2008-05-10 10:08 . 2008-05-10 10:08 200,777 --a------ C:\WINDOWS\system32\ocntskdm.exe
2008-05-10 10:08 . 2008-05-10 10:08 49,199 --a------ C:\WINDOWS\system32\rwwnw64d.exe
2008-05-10 09:49 . 2008-05-10 09:49 <KANSIO> d-------- C:\WINDOWS\ERUNT
2008-05-10 09:48 . 2008-05-10 09:48 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Subversion
2008-05-09 14:49 . 2008-05-09 14:49 <KANSIO> d-------- C:\Program Files\Real
2008-05-09 14:49 . 2008-05-09 14:49 <KANSIO> d-------- C:\Program Files\Common Files\xing shared
2008-05-09 14:49 . 2008-05-09 14:49 <KANSIO> d-------- C:\Program Files\Common Files\Real
2008-05-09 14:49 . 2008-05-09 14:49 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-05-09 14:49 . 2008-05-09 14:49 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-05-09 13:36 . 2008-05-09 13:36 <KANSIO> d-------- C:\gta.sa
2008-05-07 15:44 . 2008-01-20 20:25 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
2008-05-07 15:44 . 2008-01-20 20:25 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
2008-05-07 15:44 . 2008-05-14 13:27 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
2008-05-07 15:44 . 2008-05-14 13:27 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
2008-05-07 15:44 . 2008-01-20 20:25 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
2008-05-07 15:44 . 2008-01-20 20:25 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
2008-05-07 15:44 . 2008-01-20 20:25 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
2008-05-07 15:44 . 2008-01-20 20:25 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
2008-05-07 15:44 . 2008-01-20 18:29 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
2008-05-07 15:44 . 2008-01-20 18:29 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
2008-05-07 15:44 . 2008-01-20 20:25 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
2008-05-07 15:44 . 2008-01-20 20:25 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
2008-05-07 15:44 . 2008-05-07 15:44 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja
2008-05-07 15:44 . 2008-05-14 13:24 1,024 --ah----- C:\Documents and Settings\Järjestelmänvalvoja\ntuser.dat.LOG
2008-05-07 15:44 . 2008-05-14 13:24 1,024 --ah----- C:\Documents and Settings\Järjestelmänvalvoja\ntuser.dat.LOG
2008-05-07 13:36 . 2008-05-07 13:36 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2008-05-05 18:07 . 2008-05-05 18:07 <KANSIO> d-------- C:\Program Files\SystemRequirementsLab
2008-05-05 18:06 . 2008-05-05 18:07 <KANSIO> d-------- C:\Documents and Settings\Aarni\Application Data\SystemRequirementsLab
2008-05-05 17:35 . 2008-05-05 17:35 <KANSIO> d-------- C:\Documents and Settings\Aarni\Application Data\Diino
2008-05-05 17:34 . 2008-05-05 17:35 <KANSIO> d-------- C:\Program Files\Diino
2008-05-05 17:08 . 2008-05-05 17:08 <KANSIO> d-------- C:\Program Files\Rockstar Games
2008-05-04 12:03 . 2008-05-04 12:03 401,443 --a------ C:\WINDOWS\system32\g24.exe
2008-05-04 12:03 . 2008-05-12 12:48 63,902 --a------ C:\WINDOWS\system32\{49311914-d60c-1257-1903-afa393b2ee32}.dll-uninst.exe
2008-05-04 10:10 . 2008-05-04 10:10 <KANSIO> d-------- C:\Program Files\KGB Archiver
2008-05-04 10:00 . 2008-05-04 10:00 49,185 --a------ C:\WINDOWS\system32\jnwnw64p.exe
2008-05-04 09:35 . 2008-05-04 09:35 89,070 --a------ C:\WINDOWS\system32\myss_sb_uninstall.exe
2008-05-04 09:35 . 2008-05-10 10:09 88,961 --a------ C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe
2008-05-04 09:35 . 2008-05-07 15:55 859 --a------ C:\WINDOWS\system32\winpfz33.sys
2008-05-04 09:34 . 2008-05-04 09:34 298,311 --a------ C:\WINDOWS\system32\gside.exe
2008-05-04 09:34 . 2008-05-04 09:34 63,925 --a------ C:\WINDOWS\system32\{a6dc7cc7-ff8d-d943-072f-4a21001f50d8}.dll-uninst.exe
2008-05-04 09:18 . 2008-05-04 09:18 <KANSIO> d-------- C:\Program Files\RouterControl
2008-05-04 09:18 . 2008-04-14 20:51 330,336 --a------ C:\WINDOWS\RCoUn.EXE
2008-05-04 09:18 . 2008-05-04 09:18 2,177 -r------- C:\WINDOWS\RouterControl_Uninstall.in
2008-05-04 09:08 . 2008-05-04 09:08 <KANSIO> d-------- C:\Program Files\RapidLeecher
2008-05-03 09:56 . 2008-05-03 09:57 <KANSIO> d-------- C:\Program Files\UseNeXT
2008-04-30 13:07 . 2008-05-03 10:07 <KANSIO> d-------- C:\Documents and Settings\Aarni\Application Data\UseNeXT
2008-04-29 15:51 . 2008-04-29 15:51 <KANSIO> d-------- C:\Program Files\Game_Maker7
2008-04-29 15:51 . 2008-04-29 15:51 0 --ah----- C:\WINDOWS\SwSys2.bmp
2008-04-29 15:51 . 2008-04-29 15:51 0 --ah----- C:\WINDOWS\SwSys1.bmp
2008-04-29 15:28 . 2008-04-29 15:28 <KANSIO> d-------- C:\tmp
2008-04-29 15:28 . 2008-05-11 18:57 <KANSIO> d--h----- C:\Documents and Settings\Aarni\.lpof123
2008-04-29 15:28 . 2008-05-11 18:57 <KANSIO> d-------- C:\Documents and Settings\Aarni\.borland
2008-04-29 15:28 . 2007-03-19 01:00 1,470,464 --a------ C:\WINDOWS\system32\libmySQL.dll
2008-04-29 15:28 . 2007-03-19 01:00 425,984 --a------ C:\WINDOWS\system32\gds32.dll
2008-04-28 16:49 . 2008-04-29 15:02 445 --a------ C:\Documents and Settings\Aarni\regwizard.log
2008-04-28 16:36 . 2008-04-28 16:43 <KANSIO> d--h----- C:\Documents and Settings\All Users\Application Data\{BB9698C8-6CDB-4A48-90AB-23351A9EB3D0}
2008-04-28 16:33 . 2008-04-29 15:26 <KANSIO> d-------- C:\Program Files\CodeGear
2008-04-28 16:19 . 2008-04-28 16:49 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\CodeGear
2008-04-28 16:07 . 2008-04-28 16:09 <KANSIO> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-04-28 15:25 . 2008-04-29 15:19 <KANSIO> d--h----- C:\Documents and Settings\All Users\Application Data\{B59CE2E6-B15A-4F23-BD0E-72BF2ADDC3C7}
2008-04-25 14:46 . 2008-05-12 16:30 <KANSIO> d-------- C:\Documents and Settings\Aarni\Application Data\BitTorrent
2008-04-25 14:45 . 2008-04-25 14:45 <KANSIO> d-------- C:\Program Files\DNA
2008-04-25 14:45 . 2008-04-25 14:45 <KANSIO> d-------- C:\Program Files\BitTorrent
2008-04-25 14:45 . 2008-05-14 13:27 <KANSIO> d-------- C:\Documents and Settings\Aarni\Application Data\DNA
2008-04-25 11:06 . 2007-12-09 18:52 <KANSIO> d-------- C:\Documents and Settings\Aarni\text
2008-04-25 11:05 . 2008-05-04 10:19 <KANSIO> d-------- C:\Documents and Settings\Aarni\models
2008-04-25 11:05 . 2007-12-06 17:28 <KANSIO> d-------- C:\Documents and Settings\Aarni\data
2008-04-25 11:04 . 2007-12-09 22:07 <KANSIO> d-------- C:\Documents and Settings\Aarni\audio
2008-04-18 14:13 . 2008-05-03 09:55 <KANSIO> d-------- C:\Program Files\ghjhj
2008-04-18 13:40 . 2008-04-18 13:40 <KANSIO> d--h----- C:\WINDOWS\PIF
2008-04-17 14:55 . 2008-04-17 14:55 328,704 --a------ C:\WINDOWS\system32\{a6dc7cc7-ff8d-d943-072f-4a21001f50d8}.dll
2008-04-14 14:10 . 2008-04-14 14:15 <KANSIO> d-------- C:\Program Files\mIRC
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-14 10:28 --------- d-----w C:\Documents and Settings\Aarni\Application Data\Hamachi
2008-05-08 10:58 --------- d-----w C:\Program Files\Trend Micro
2008-05-05 12:46 --------- d-----w C:\Documents and Settings\Aarni\Application Data\LimeWire
2008-05-03 06:54 --------- d-----w C:\Program Files\Steam
2008-05-03 06:48 --------- d-----w C:\Program Files\01-mp3search
2008-05-03 06:45 311,994,712 ----a-w C:\Program Files\b.rar
2008-05-03 06:43 303,549,346 ----a-w C:\Program Files\a.rar
2008-04-28 13:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-04-28 13:07 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-25 10:53 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-25 10:53 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-04-25 08:50 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-04-13 12:03 --------- d-----w C:\Program Files\Cheat Engine
2008-04-11 15:46 334,848 ----a-w C:\WINDOWS\system32\myss_sb.dll
2008-04-09 10:58 --------- d-----w C:\Program Files\PHP Editor
2008-04-01 10:14 --------- d-----w C:\Program Files\Sun
2008-04-01 10:14 --------- d-----w C:\Program Files\Java
2008-03-31 12:44 --------- d-----w C:\Program Files\iHabbix Ltd
2008-03-31 12:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-31 12:40 --------- d-----w C:\Program Files\iHabbix Scripting Ltd
2008-03-30 17:07 36,368 ----a-w C:\WINDOWS\system32\drivers\tmpreflt.sys
2008-03-30 17:07 204,816 ----a-w C:\WINDOWS\system32\drivers\tmxpflt.sys
2008-03-30 16:50 1,169,240 ----a-w C:\WINDOWS\system32\drivers\VsapiNT.sys
2008-03-27 15:35 333,824 ----a-w C:\WINDOWS\system32\mysidesearch_sidebar.dll
2008-03-25 12:59 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-03-25 12:57 --------- d-----w C:\Program Files\Microsoft Visual Studio 9.0
2008-03-25 12:57 --------- d-----w C:\Program Files\Microsoft Synchronization Services
2008-03-25 12:57 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-03-25 12:54 --------- d-----w C:\Program Files\Microsoft SDKs
2008-03-25 12:49 --------- d-----w C:\Program Files\PremiumSoft
2008-03-25 12:19 --------- d-----w C:\Program Files\TortoiseSVN
2008-03-25 12:19 --------- d-----w C:\Documents and Settings\Aarni\Application Data\Subversion
2008-03-24 14:11 --------- d-----w C:\Program Files\MSBuild
2008-03-24 12:11 --------- d-----w C:\Program Files\Reference Assemblies
2008-03-24 12:10 --------- d-----w C:\Program Files\MSXML 6.0
2008-03-22 14:20 --------- d-----w C:\Documents and Settings\Aarni\Application Data\U3
2008-03-22 07:20 --------- d-----w C:\Program Files\sslexplorer
2008-03-22 07:19 --------- d-----w C:\Program Files\Common Files\i4j_jres
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 11:54 21 ---ha-w C:\qpmd8379.bin
2008-03-19 11:53 36,864 ----a-w C:\WINDOWS\system32\cfperfmon_8.dll
2008-03-19 11:52 --------- d--h--w C:\Program Files\Zero G Registry
2008-03-17 12:33 6,660,096 ----a-w C:\WINDOWS\system32\myodbc3S.dll
2008-03-17 12:33 2,187,264 ----a-w C:\WINDOWS\system32\myodbc3.dll
2008-03-17 12:33 114,688 ----a-w C:\WINDOWS\system32\myodbc3i.exe
2008-03-17 12:33 106,496 ----a-w C:\WINDOWS\system32\myodbc3m.exe
2008-03-15 07:50 --------- d-----w C:\Documents and Settings\Aarni\Application Data\FileZilla
2008-03-05 13:03 479,752 ----a-w C:\WINDOWS\system32\XAudio2_0.dll
2008-03-05 13:03 238,088 ----a-w C:\WINDOWS\system32\xactengine3_0.dll
2008-03-05 13:00 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_3.dll
2008-03-05 12:56 3,786,760 ----a-w C:\WINDOWS\system32\D3DX9_37.dll
2008-03-05 12:56 1,420,824 ----a-w C:\WINDOWS\system32\D3DCompiler_37.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-18 16:33 249,856 ------w C:\WINDOWS\Setup1.exe
2008-02-16 09:02 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-20 15:25 32 ----a-r C:\Documents and Settings\All Users\hash.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9506910A-0F94-4ea1-B567-7070428B8B2B}]
2008-03-27 18:35 333824 --a------ C:\WINDOWS\system32\mysidesearch_sidebar.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN]
@={30351346-7B7D-4FCC-81B4-1E394CA267EB}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN]
@={30351347-7B7D-4FCC-81B4-1E394CA267EB}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN]
@={30351348-7B7D-4FCC-81B4-1E394CA267EB}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN]
@={3035134B-7B7D-4FCC-81B4-1E394CA267EB}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN]
@={3035134C-7B7D-4FCC-81B4-1E394CA267EB}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN]
@={3035134D-7B7D-4FCC-81B4-1E394CA267EB}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN]
@={3035134E-7B7D-4FCC-81B4-1E394CA267EB}
[HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll
[HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll
[HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll
[HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll
[HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll
[HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll
[HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-21 16:07 68856]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-05-08 18:23 289088]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-01-08 12:01 16059904 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 13:04 2879488 C:\WINDOWS\SkyTel.exe]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe" [2005-12-06 12:49 897089]
"RIS2PostReboot"="C:\Program Files\LEGO MINDSTORMS\RIS 2.0\LaunchRIS2.exe" [2001-04-27 15:19 212992]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"RouterControl"="C:\PROGRA~1\ROUTER~1\ROUTERCONTROL.EXE" [2008-04-14 20:51 3179520]
"{96-6F-F9-91-DW}"="C:\windows\system32\jrwnw64k.exe" [2008-05-11 17:36 49205]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-05-09 14:49 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
C:\Documents and Settings\Aarni\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
CPUCooL.lnk - C:\Program Files\CPUCooL\CPUCooL.exe [2007-09-01 11:30:18 605184]
Diino.lnk - C:\Program Files\Diino\Diino.exe [2008-05-05 17:34:59 4475304]
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2008-03-02 12:09:24 624416]
WinMySQLadmin.lnk - C:\xampp\mysql\bin\winmysqladmin.exe [2007-12-21 05:00:28 936448]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Steam\\steamapps\\aarnis\\half-life 2 deathmatch\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\xampp\\apache\\bin\\apache.exe"=
"C:\\xampp\\MercuryMail\\mercury.exe"=
"C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"=
"C:\\Program Files\\Opera 9.5 beta\\opera.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\WinSCP\\WinSCP.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"C:\\xampp\\mysql\\bin\\mysqld.exe"=
"C:\\Program Files\\sslexplorer\\install-sslexplorer.exe"=
"C:\\Program Files\\iHabbix Ltd\\iHabbix.exe"=
"C:\\WINDOWS\\system32\\java.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\WS_FTP\\WS_FTP95.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Mozilla Firefox\\Counter-Strike 1.6 + Half-Life\\hl.exe"=
"C:\\Program Files\\Mozilla Firefox\\Counter-Strike 1.6 + Half-Life\\hltv.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\CodeGear\\Delphi for PHP\\1.0\\debugger\\DbgListener.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"90:TCP"= 90:TCP:serveri
R2 Apache2.2;Apache2.2;"C:\xampp\apache\bin\apache.exe" -k runservice []
R2 ColdFusion 8 .NET Service;ColdFusion 8 .NET Service;C:\ColdFusion8\jnbridge\CF8DotNetsvc.exe [2008-03-19 14:54]
R2 ColdFusion 8 Application Server;ColdFusion 8 Application Server;"C:\ColdFusion8\runtime\bin\jrunsvc.exe" [2007-07-11 20:36]
R2 ColdFusion 8 ODBC Agent;ColdFusion 8 ODBC Agent;C:\ColdFusion8\db\slserver54\bin\swagent.exe "ColdFusion 8 ODBC Agent" []
R2 ColdFusion 8 ODBC Server;ColdFusion 8 ODBC Server;C:\ColdFusion8\db\slserver54\bin\swstrtr.exe "ColdFusion 8 ODBC Server" []
R2 ColdFusion 8 Search Server;ColdFusion 8 Search Server;"C:\ColdFusion8\verity\k2\_nti40\bin\k2admin.exe" -cfg "C:\ColdFusion8\verity\k2\common\verity.cfg" -ntstart 1 []
R2 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 06:29]
S2 SSL-Explorer;SSL-Explorer;"C:\Program Files\sslexplorer\install\platforms\windows\wrapper.exe" -s "C:\Program Files\sslexplorer\conf\wrapper.conf" []
S2 XAMPP;XAMPP Service;C:\xampp\service.exe [2007-12-21 05:01]
S3 LTower;LEGO USB Tower Driver;C:\WINDOWS\system32\Drivers\LTower.sys [2001-04-25 17:44]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fcd83c21-c9b7-11dc-aff2-003018b12fe5}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-05-11 15:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-14 13:27:52
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\Documents and Settings\Aarni\Local Settings\Application Data\Opera\Opera 9.5 beta\profile\cache4\opr03SWI 3 bytes
scan completed successfully
hidden files: 1
**************************************************************************
.
Completion time: 2008-05-14 13:32:04
ComboFix-quarantined-files.txt 2008-05-14 10:32:02
Pre-Run: 175,710,322,688 tavua vapaana
Post-Run: 176,805,212,160 tavua vapaana
284 --- E O F --- 2008-04-11 09:19:31
Malwarebytes:
Malwarebytes' Anti-Malware 1.12
Tietokantaversio: 745
Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 385996
Kulunut aika: 44 minute(s), 44 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 1
Saastuneita rekisteriavaimia: 11
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 16
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
C:\WINDOWS\system32\mysidesearch_sidebar.dll (Adware.BHO) -> Unloaded module successfully.
Saastuneita rekisteriavaimia:
HKEY_CLASSES_ROOT\CLSID\{9506910a-0f94-4ea1-b567-7070428b8b2b} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1e404d48-670a-4085-a6a0-d195793ddd33} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1e404d48-670a-4085-a6a0-d195793ddd33} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9506910a-0f94-4ea1-b567-7070428b8b2b} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{faba076a-478a-4c32-a0a5-c774607901c2} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{faba076a-478a-4c32-a0a5-c774607901c2} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{9f593aac-ca4c-4a41-a7ff-a00812192d61} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{749ec66f-a838-4b38-b8e5-e65d905fff74} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mysidesearchsearchassistant (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gooochi (Adware.Vapsup) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\MySidesearch (Adware.BHO) -> Quarantined and deleted successfully.
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
C:\WINDOWS\system32\mysidesearch_sidebar.dll (Adware.BHO) -> Delete on reboot.
C:\QooBox\Quarantine\C\WINDOWS\system32\{49311914-d60c-1257-1903-afa393b2ee32}.dll.vir (Adware.Vapsup) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{66577C50-E82F-45F6-963E-86C73A88A6A3}\RP71\A0040794.exe (Adware.SearchAid) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{66577C50-E82F-45F6-963E-86C73A88A6A3}\RP71\A0040797.exe (Adware.SearchAid) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{66577C50-E82F-45F6-963E-86C73A88A6A3}\RP73\A0041172.exe (Adware.Rotator) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{66577C50-E82F-45F6-963E-86C73A88A6A3}\RP74\A0052670.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{66577C50-E82F-45F6-963E-86C73A88A6A3}\RP74\A0052761.exe (Adware.Vapsup) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{66577C50-E82F-45F6-963E-86C73A88A6A3}\RP75\A0054831.dll (Adware.Vapsup) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\myss_sb.dll (Adware.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\myss_sb_uninstall.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\{49311914-d60c-1257-1903-afa393b2ee32}.dll-uninst.exe (Adware.Vapsup) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winpfz33.sys (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\{a6dc7cc7-ff8d-d943-072f-4a21001f50d8}.dll-uninst.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\{a6dc7cc7-ff8d-d943-072f-4a21001f50d8}.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rwwnw64d.exe (Adware.Zenosearch) -> Quarantined and deleted successfully.
|
|
