|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Firefox käynnistyy todella hitaasti ja kone hidatestelee muutenkin. (HJT)
|
|
|
Terodo
Junior Member
|
5. kesäkuuta 2008 @ 13:33 |
Linkki tähän viestiin
|
Tässä on tämä HJT logi jos joku osaisi auttaa että onko täällä jotain ihmeellistä.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:27:20, on 5.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\BMWgroup\ETKLokal\transbase\tbmux32.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Vista Start Menu\VistaStartMenu.exe
C:\Program Files\Shock Utility\ShockAero3D\ShockAero3D.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [VistaStartMenu] "C:\Program Files\Vista Start Menu\VistaStartMenu.exe"
O4 - HKCU\..\Run: [ShockAero3D] C:\Program Files\Shock Utility\ShockAero3D\ShockAero3D.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Global Startup: ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Autodata Limited License Service - Autodata Limited - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Bwsvc - BUFFALO INC. - C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Transbase - Transaction Software, D 81737 Munich - C:\BMWgroup\ETKLokal\transbase\tbmux32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
--
End of file - 8135 bytes
|
|
Hujo
Suspended permanently
|
5. kesäkuuta 2008 @ 18:55 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Voiko tietsikka koskaan toimia?
|
|
Terodo
Junior Member
|
5. kesäkuuta 2008 @ 21:12 |
Linkki tähän viestiin
|
ComboFix 08-06-05.2 - Tero 2008-06-05 20:41:23.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1499 [GMT 3:00]
Running from: C:\Documents and Settings\Tero\Työpöytä\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\config.ini
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-05 to 2008-06-05 )))))))))))))))))
.
2008-06-05 20:49 . 2008-06-05 20:50 <KANSIO> d-------- C:\Temp
2008-06-05 20:49 . 2008-06-05 20:49 53,248 --a------ C:\Temp\catchme.dll
2008-06-05 13:27 . 2008-06-05 13:27 <KANSIO> d-------- C:\HJT
2008-06-04 17:31 . 2008-06-04 17:31 <KANSIO> d-------- C:\Documents and Settings\Tero\Application Data\Uniblue
2008-06-01 17:19 . 2008-06-01 17:19 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Codemasters
2008-06-01 13:55 . 2008-03-05 15:56 3,786,760 --a------ C:\WINDOWS\system32\D3DX9_37.dll
2008-06-01 13:55 . 2008-03-05 15:56 1,420,824 --a------ C:\WINDOWS\system32\D3DCompiler_37.dll
2008-06-01 13:55 . 2008-04-28 15:53 805,400 -ra------ C:\WINDOWS\system32\tmpD1.tmp
2008-06-01 13:55 . 2008-04-28 15:53 805,400 -ra------ C:\WINDOWS\system32\tmpD0.tmp
2008-06-01 13:55 . 2008-03-05 16:03 479,752 --a------ C:\WINDOWS\system32\XAudio2_0.dll
2008-06-01 13:55 . 2008-02-05 23:07 462,864 --a------ C:\WINDOWS\system32\d3dx10_37.dll
2008-06-01 13:55 . 2008-03-05 16:03 238,088 --a------ C:\WINDOWS\system32\xactengine3_0.dll
2008-06-01 13:55 . 2008-03-05 16:00 25,608 --a------ C:\WINDOWS\system32\X3DAudio1_3.dll
2008-06-01 13:38 . 2008-06-01 13:38 <KANSIO> d-------- C:\Program Files\Codemasters
2008-05-30 16:37 . 2008-05-30 16:37 <KANSIO> d-------- C:\Program Files\Rhodan
2008-05-28 22:18 . 2008-06-03 20:50 <KANSIO> d--hs---- C:\Boot
2008-05-28 22:18 . 2008-01-19 10:45 333,203 -rahs---- C:\bootmgr
2008-05-28 22:18 . 2008-05-28 22:18 8,192 -ra-s---- C:\BOOTSECT.BAK
2008-05-28 11:43 . 2008-05-28 11:43 <KANSIO> d--hs---- C:\$RECYCLE.BIN
2008-05-28 11:42 . 2007-03-17 14:41 171,136 -rahs---- C:\grldr
2008-05-27 20:31 . 2008-05-27 21:01 1,905 --a------ C:\WINDOWS\diagwrn.xml
2008-05-27 20:31 . 2008-05-27 21:01 1,905 --a------ C:\WINDOWS\diagerr.xml
2008-05-22 20:11 . 2008-02-07 17:10 <KANSIO> d--h----- C:\ckis
2008-05-22 19:35 . 2008-05-28 17:44 96,966 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-05-22 19:35 . 2008-05-29 20:57 88,774 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-05-22 19:34 . 2008-06-05 20:50 15,341,344 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-22 19:34 . 2008-06-05 20:49 256,032 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-22 19:34 . 2008-06-04 17:40 207,332 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-22 19:34 . 2008-06-04 17:40 28,604 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-15 15:31 . 2008-05-15 15:33 <KANSIO> d-------- C:\Documents and Settings\Tero\Application Data\Nikon
2008-05-15 15:31 . 2004-09-14 16:11 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-05-15 15:31 . 2001-10-05 16:31 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-05-15 15:27 . 2008-05-15 15:27 <KANSIO> d-------- C:\Program Files\Nikon
2008-05-15 15:27 . 2008-05-15 15:33 <KANSIO> d-------- C:\Program Files\Common Files\Nikon
2008-05-15 15:27 . 2008-05-15 15:27 <KANSIO> d-------- C:\Program Files\Common Files\muvee Technologies
2008-05-15 15:27 . 2008-05-15 15:27 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Ultima_T15
2008-05-15 15:27 . 2008-05-15 15:27 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Nikon
2008-05-15 15:27 . 2008-05-15 15:27 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\EnterNHelp
2008-05-15 15:27 . 2008-06-05 14:05 20 ---h----- C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
2008-05-15 06:39 . 2008-05-15 06:40 <KANSIO> d-------- C:\Program Files\GmRekTopo
2008-05-15 06:39 . 2008-05-15 06:39 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Genimap
2008-05-14 13:29 . 2008-05-14 13:40 <KANSIO> d-------- C:\Documents and Settings\Tero\Application Data\News to Screen
2008-05-12 17:03 . 2008-05-12 17:03 85 --a------ C:\WINDOWS\Crypkey.ini
2008-05-12 17:02 . 2008-05-12 17:02 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\WorkshopData
2008-05-12 17:02 . 1999-06-19 00:49 165,888 --a------ C:\WINDOWS\Ckconfig.exe
2008-05-12 17:02 . 2006-02-16 16:29 102,592 --a------ C:\WINDOWS\system32\corojdk11.dll
2008-05-12 17:02 . 2006-09-22 02:33 69,632 --a------ C:\WINDOWS\system32\Crypserv.exe
2008-05-12 17:02 . 2006-01-10 05:47 31,846 --a------ C:\WINDOWS\system32\Ckldrv.sys
2008-05-12 17:02 . 1996-05-03 20:21 27,648 -ra------ C:\WINDOWS\Setup_ck.exe
2008-05-12 17:02 . 1996-05-03 18:36 18,432 --a------ C:\WINDOWS\Setup_ck.dll
2008-05-12 17:02 . 1995-07-04 21:33 11,776 --a------ C:\WINDOWS\Ckrfresh.exe
2008-05-12 16:59 . 2008-05-12 16:59 <KANSIO> d--h----- C:\Program Files\Zero G Registry
2008-05-12 16:59 . 2008-05-12 17:02 <KANSIO> d-------- C:\Program Files\Vivid WorkshopData ATI
2008-05-12 16:58 . 2008-05-12 16:58 <KANSIO> d--h----- C:\Documents and Settings\Tero\InstallAnywhere
2008-05-12 16:53 . 2008-05-12 16:54 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro
2008-05-12 16:52 . 2008-05-12 16:53 <KANSIO> d-------- C:\Program Files\DAEMON Tools Pro
2008-05-12 16:45 . 2008-05-12 16:45 <KANSIO> d-------- C:\Documents and Settings\Tero\Application Data\DAEMON Tools Pro
2008-05-12 12:56 . 2008-05-12 12:57 <KANSIO> d-------- C:\Program Files\Shock Utility
2008-05-12 12:56 . 2008-05-12 12:57 65,536 --a------ C:\WINDOWS\IFinst27.exe
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-05 16:01 --------- d-----w C:\Documents and Settings\Tero\Application Data\uTorrent
2008-06-05 15:55 196,608 ----a-w C:\WINDOWS\system32\drivers\nAsmedia.bin
2008-06-04 18:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-06-04 14:38 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-04 14:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-04 14:33 --------- d-----w C:\Documents and Settings\Tero\Application Data\Vista Start Menu
2008-06-01 15:07 --------- d-----w C:\Program Files\DVDCoverPrint
2008-06-01 10:55 444,952 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-06-01 10:55 109,080 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-06-01 10:55 --------- d-----w C:\Program Files\OpenAL
2008-05-28 14:44 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-05-22 17:10 --------- d-----w C:\Program Files\Kaspersky Lab
2008-05-17 04:46 --------- d-----w C:\Program Files\DC++
2008-05-15 12:27 106,496 ----a-w C:\WINDOWS\system32\ATL71.DLL
2008-05-15 12:26 --------- d-----w C:\Program Files\QuickTime Alternative
2008-05-15 12:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-12 14:02 --------- d-----w C:\Program Files\Vivid WorkshopData ATI
2008-04-28 12:48 --------- d-----w C:\Documents and Settings\Tero\Application Data\Touchstone
2008-04-28 10:13 --------- d-----w C:\Program Files\Touchstone
2008-04-28 10:13 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-04-28 10:13 --------- d-----w C:\Program Files\AGEIA Technologies
2008-04-22 02:53 --------- d-----w C:\Program Files\Vista Start Menu
2008-04-19 13:11 --------- d-----w C:\Program Files\THQ
2008-04-16 16:44 --------- d-----w C:\Program Files\Your Company Name
2008-04-16 10:00 230,664 ----a-w C:\WINDOWS\system32\PDBoot.exe
2008-04-12 05:18 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-12 05:18 22,328 ----a-w C:\Documents and Settings\Tero\Application Data\PnkBstrK.sys
2008-04-12 05:17 2,337,865 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-04-12 05:17 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-04-12 05:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ubisoft
2008-04-12 05:05 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-04-12 04:53 --------- d-----w C:\Program Files\Ubisoft
2008-04-10 09:08 71,184 ----a-r C:\WINDOWS\system32\drivers\DefragFS.sys
2008-04-07 12:11 --------- d-----w C:\Program Files\Arjaloc
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-15 13:23 116,224 ----a-w C:\WINDOWS\system32\ssms.exe
2008-03-14 05:12 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll
2008-03-14 05:12 2,272 ----a-w C:\WINDOWS\system32\w95inf16.dll
2008-03-12 11:53 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-03-12 11:53 286,720 ------w C:\WINDOWS\Setup1.exe
2008-03-11 17:56 64,111 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-03-11 17:56 6,112 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-03-11 17:56 219,136 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-03-10 17:44 21 ----a-w C:\ADTARC.dat
2007-09-10 14:13 1 ----a-w C:\Documents and Settings\Tero\SI.bin
.
<pre>
----a-w 48,925 2008-02-24 16:51:05 C:\Documents and Settings\Tero\Omat tiedostot\Vastaanotetut tiedostot\Windows XP Pro Serial Key Changer .exe
</pre>
------- Sigcheck -------
2007-06-13 16:22 975872 bfb589091060c9e3c5e6f55c6881ed78 C:\WINDOWS\explorer.exe
2007-06-13 16:10 1033728 fb53c3b1e17f62e8fcb07caaf4c4272e C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2006-03-02 15:00 1032704 43c0b3d357f319875a51bc111f393147 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2007-06-13 16:22 975872 bfb589091060c9e3c5e6f55c6881ed78 C:\WINDOWS\system32\dllcache\explorer.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-19 01:05 630784]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 15:00 15360]
"VistaStartMenu"="C:\Program Files\Vista Start Menu\VistaStartMenu.exe" [2008-04-20 23:18 2670296]
"ShockAero3D"="C:\Program Files\Shock Utility\ShockAero3D\ShockAero3D.exe" [2008-03-03 04:39 1121792]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 16:08 136136]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-21 12:11 925696]
"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 16:49 77824]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15:00 15360]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 17:15 1634304]
C:\Documents and Settings\Tero\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 22:41:18 65536]
C:\Documents and Settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
ClientManager3.lnk - C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe [2007-11-14 21:44:53 466944]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUSGamerOSD]
--a------ 2007-06-01 09:37 380928 C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2006-03-02 15:00 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
C:\Program Files\DAEMON Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\BUFFALO\\Client Manager3\\BWSVC\\bwsvc.exe"=
"C:\\Program Files\\BUFFALO\\Client Manager3\\AOSS\\aoss.exe"=
"C:\\Program Files\\Activision Value\\Soldier of Fortune Payback\\sof3.exe"=
"C:\\Program Files\\Atari\\Test Drive Unlimited\\TestDriveUnlimited.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"C:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
"C:\\Program Files\\Sega\\The Club\\Launcher.exe"=
"C:\\Program Files\\Sega\\The Club\\TheClub.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
"C:\\BMWgroup\\ETKLokal\\javaclient\\j2re1.4.2_01\\bin\\java.exe"=
"C:\\BMWgroup\\ETKLokal\\javaclient\\ETK.exe"=
"C:\\Program Files\\Touchstone\\Turok\\Binaries\\TurokGame.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.321\\English\\setup.exe"=
"C:\\Program Files\\Codemasters\\GRID\\GRID.exe"=
R1 BUFADPT;BUFADPT;C:\WINDOWS\system32\BUFADPT.SYS [2007-01-11 10:19]
R2 PD91Agent;PD91Agent;"C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe" [2008-04-16 13:00]
R2 Transbase;Transbase;C:\BMWgroup\ETKLokal\transbase\tbmux32.exe [2004-08-05 13:02]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2006-03-02 15:00]
R3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys [2007-05-31 14:29]
R3 CBBCM43;BUFFALO WLI-CB-XXX Series Wireless LAN Adapter;C:\WINDOWS\system32\DRIVERS\CBG54.sys [2005-11-01 11:13]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [2007-05-31 14:29]
S3 BFAIFILT;BFAIFILT;C:\WINDOWS\system32\Drivers\bfaifilt.sys [2004-07-13 14:49]
S3 PD91Engine;PD91Engine;"C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe" [2008-04-16 13:00]
S3 rt70x86;BUFFALO RT2500 USB Wireless Driver;C:\WINDOWS\system32\DRIVERS\netr70.sys [2006-12-27 11:41]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-01-04 15:10]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
*Newly Created Service* - CATCHME
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-05-30 14:17:04 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-05 20:49:53
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
Completion time: 2008-06-05 20:52:00
ComboFix-quarantined-files.txt 2008-06-05 17:50:57
Pre-Run: 8,197,152,768 tavua vapaana
Post-Run: 8,140,161,024 tavua vapaana
244 --- E O F --- 2008-05-15 00:00:43
Siinä olisi loki tällä erää. Kiitos jo valmiiksi avusta. Jatkan aamulla.
|
|
Hujo
Suspended permanently
|
5. kesäkuuta 2008 @ 21:24 |
Linkki tähän viestiin
|
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
Voiko tietsikka koskaan toimia?
|
|
Mainos
|
|
|
|
Terodo
Junior Member
|
8. kesäkuuta 2008 @ 07:47 |
Linkki tähän viestiin
|
|
Malwarebytes' Anti-Malware 1.15
Tietokantaversio: 831
5:36:05 7.6.2008
mbam-log-6-7-2008 (05-36-05).txt
Tarkistustyyppi: Täysi tarkistus (C:\|J:\|K:\|)
Tarkistetut kohteet: 340724
Kulunut aika: 1 hour(s), 13 minute(s), 35 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)
Login sisältö näytti tältä. Sama vika vaan jatkuu. Muutkin ohjelmat on alkanu takkuamaan. Mutta yleisimmin Firefoxin kun yrittää käynnistää niin se käynnistyy prosesseihin mutta näytölle ei tule mitään eikä sovelluksissa näy mitään.
|
|
