|
TurvaPc.com ongelma. Selain ei toimi ja kone hidastunut. HjT-logi
|
|
|
vihu
Newbie
|
21. kesäkuuta 2008 @ 16:20 |
Linkki tähän viestiin
|
Otsikon mukainen ongelma. Kone siis hidastunut ja selain (firefox) ei suostu toimimaan normaalisti. Konetta olen koittanut puhdistaa jo useillakin ohjelmilla mutta sitkeässä tuntuu pöpö olevan. Mikä siis avuksi.
Kiitoksia jo etukäteen auttajille.
HjT-Logi:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:18:03, on 21.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\WindowBlinds\wbload.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Autodesk\Data Management Server 5\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\Rundll32.exe
D:\program files\steam\steam.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Autodesk\Data Management Server 5\Server\Webserver\Connectivity.EDMWS.Server.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\FSPC\fspc.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\FSAUA\program\fsus.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: {d4867f76-1cb8-dc7a-2b04-70cd14a617d6} - {6d716a41-dc07-40b2-a7cd-8bc167f7684d} - C:\WINDOWS\system32\gpxpycpq.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [tvjbmonitor] C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BMfb6f8009] Rundll32.exe "C:\WINDOWS\system32\fwnmdomf.dll",s
O4 - HKCU\..\Run: [Steam] "d:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure\FSPC\fspcmsie.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O20 - Winlogon Notify: rqRJBTmM - rqRJBTmM.dll (file missing)
O20 - Winlogon Notify: ssqPjghE - ssqPjghE.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Data Management Job Dispatch - Autodesk Inc - C:\Program Files\Autodesk\Data Management Server 5\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
O23 - Service: Autodesk EDM Server - - C:\Program Files\Autodesk\Data Management Server 5\Server\Webserver\Connectivity.EDMWS.Server.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 10117 bytes
"Mä uskon ufoihin, ne tulee mua hakemaan." -Häiriköt-
|
|
Hujo
Suspended permanently
|
21. kesäkuuta 2008 @ 16:44 |
Linkki tähän viestiin
|
koneella kaksi vurustorjuntaa poista toinen
avast ja f-secure
==========
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
=============
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
Lainaus:
File::
C:\WINDOWS\system32\gpxpycpq.dll
C:\WINDOWS\system32\fwnmdomf.dll
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
=======
scannaa hjt:llä merkkaa paina Fix checked
O2 - BHO: {d4867f76-1cb8-dc7a-2b04-70cd14a617d6} - {6d716a41-dc07-40b2-a7cd-8bc167f7684d} - C:\WINDOWS\system32\gpxpycpq.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BMfb6f8009] Rundll32.exe "C:\WINDOWS\system32\fwnmdomf.dll",s
O20 - Winlogon Notify: rqRJBTmM - rqRJBTmM.dll (file missing)
O20 - Winlogon Notify: ssqPjghE - ssqPjghE.dll (file missing)
=========
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
Voiko tietsikka koskaan toimia?
|
|
vihu
Newbie
|
22. kesäkuuta 2008 @ 10:26 |
Linkki tähän viestiin
|
Miltähän mahtaa nyt näyttää nuo logit.
ComboFix logi:
ComboFix 08-06-20.4 - Vihulainen 2008-06-21 17:06:46.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.436 [GMT 3:00]
Running from: C:\Documents and Settings\Vihulainen\Desktop\virus\ComboFix.exe
Command switches used :: C:\Documents and Settings\Vihulainen\Desktop\virus\CFScript.txt
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BMfb6f8009.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\ajyvbcxr.ini
C:\WINDOWS\system32\egwsborl.dll
C:\WINDOWS\system32\GNXIOqss.ini
C:\WINDOWS\system32\gpxpycpq.dll
C:\WINDOWS\system32\mogqmsng.ini
C:\WINDOWS\system32\nxlptgih.dll
C:\WINDOWS\system32\oytqmtbh.dll
C:\WINDOWS\system32\rfutfuhf.dll
C:\WINDOWS\system32\ssqOIXNG.dll
C:\WINDOWS\system32\uluubglg.ini
.
((((((((((((((((((((((((( Files Created from 2008-05-21 to 2008-06-21 )))))))))))))))))))))))))))))))
.
2008-06-21 17:22 . 2008-06-21 17:22 110,419 --a------ C:\WINDOWS\BMfb6f8009.xml
2008-06-21 14:17 . 2008-06-21 14:17 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-20 16:56 . 2008-06-20 16:56 79,360 --a------ C:\WINDOWS\system32\glgbuulu.dll
2008-06-20 16:53 . 2008-06-20 16:53 90,112 --a------ C:\WINDOWS\system32\fwnmdomf.dll
2008-06-19 21:35 . 2008-06-19 21:35 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-19 21:35 . 2008-06-19 21:35 <DIR> d-------- C:\Documents and Settings\Vihulainen\Application Data\Malwarebytes
2008-06-19 21:35 . 2008-06-19 21:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-19 21:35 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-19 21:35 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-19 21:34 . 2008-06-19 21:35 <DIR> d-------- C:\Program Files\CCleaner
2008-06-19 21:33 . 2008-06-19 21:33 <DIR> d-------- C:\Program Files\Alwil Software
2008-06-19 21:33 . 2003-03-18 23:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-06-19 19:55 . 2008-06-19 19:55 <DIR> d-------- C:\Program Files\Opera
2008-06-15 14:58 . 2008-06-15 14:58 <DIR> d-------- C:\Program Files\Lavasoft
2008-06-15 14:58 . 2008-06-15 15:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-15 14:57 . 2008-06-15 14:57 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-15 14:45 . 2008-06-19 16:55 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-15 14:45 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-06-15 14:45 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-06-15 14:45 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-06-15 14:45 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-06-15 14:44 . 2008-06-15 14:54 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-06-15 14:44 . 2008-06-15 14:44 <DIR> d-------- C:\Documents and Settings\Vihulainen\Application Data\PC Tools
2008-06-14 11:27 . 2008-06-14 11:27 6,144 --a------ C:\sixomsn.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-19 16:58 --------- d-----w C:\Documents and Settings\Vihulainen\Application Data\uTorrent
2008-06-19 16:57 --------- d-----w C:\Program Files\mIRC
2008-06-15 09:10 --------- d-----w C:\Program Files\Dofus
2008-06-04 18:00 --------- d-----w C:\Documents and Settings\Vihulainen\Application Data\dvdcss
2008-05-16 22:45 --------- d-----w C:\Program Files\FlashFXP
2008-05-16 08:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-05-12 18:05 --------- d-----w C:\Documents and Settings\Vihulainen\Application Data\OpenOffice.org2
2008-05-12 09:04 1,901 ----a-w C:\WINDOWS\panose.bin
2008-05-10 15:07 --------- d-----w C:\Program Files\SpeedFan
2008-05-09 19:57 --------- d-----w C:\Program Files\Virtual Earth 3D
2008-05-09 19:42 --------- d-----w C:\Program Files\Photosynth
2008-05-09 19:30 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-04-29 08:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 08:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 08:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
2008-04-12 09:37 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-04-12 09:37 110,592 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-03-26 08:09 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-25 07:20 219,936 ----a-w C:\WINDOWS\system32\msltus40.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="d:\program files\steam\steam.exe" [2008-03-29 16:45 1271032]
"CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 17:44 140288]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 13:03 94208 C:\WINDOWS\KHALMNPR.Exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 13:03 94208 C:\WINDOWS\KHALMNPR.Exe]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 12:12 90112]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 17:28 790528]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.EXE" [2006-12-25 12:16 172081]
"F-Secure TNB"="C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" [2006-12-25 12:16 724992]
"LogonStudio"="C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [2002-09-03 19:38 987187]
"BootSkin Startup Jobs"="C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" [2004-04-26 17:21 270336]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 11:54 282624]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 20:05 257088]
"tvjbmonitor"="C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe" [2006-12-26 17:08 53248]
"BMfb6f8009"="C:\WINDOWS\system32\fwnmdomf.dll" [2008-06-20 16:53 90112]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:56 15360]
C:\Documents and Settings\Vihulainen\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart17.exe [2006-03-23 22:16:32 11000]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2006-11-11 23:53:17 671744]
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 23:07:32 81920]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqRJBTmM]
rqRJBTmM.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqPjghE]
ssqPjghE.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\PROGRA~1\WI559D~1\fastload.dll 2001-12-20 23:34 24576 C:\PROGRA~1\WI559D~1\fastload.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\ff_vfw.dll
"vidc.wmv3"= C:\PROGRA~1\COMBIN~1\Filters\wmv9vcm.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
"C:\\Program Files\\FlashGet\\flashget.exe"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2006-12-25 12:16]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure\HIPS\fshs.sys [2006-12-25 12:17]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-09-01 13:32]
R2 MSSQL$AUTODESKVAULT;MSSQL$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe" -sAUTODESKVAULT []
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\minifilter\fsgk.sys [2006-12-25 12:16]
S3 MODRC;Ultima Infrared Receiver;C:\WINDOWS\system32\DRIVERS\modrc.sys [2007-02-06 12:10]
S3 SQLAgent$AUTODESKVAULT;SQLAgent$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlagent.EXE" -i AUTODESKVAULT []
S3 ZD1211U(3COM Corporation);3COM OfficeConnect Wireless 11g Compact USB Adapter(3COM Corporation);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2005-03-28 14:24]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2006-12-25 12:16]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2006-12-25 12:16]
.
Contents of the 'Scheduled Tasks' folder
"2008-06-03 08:29:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-21 17:21:56
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\fwnmdomf.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\WindowBlinds\wbload.exe
C:\Program Files\Autodesk\Data Management Server 5\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
C:\Program Files\Autodesk\Data Management Server 5\Server\Webserver\Connectivity.EDMWS.Server.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\FSPC\fspc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\PROGRA~1\F-Secure\Common\FSM32.EXE
C:\Program Files\F-Secure\FWES\program\fsdfwd.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
.
**************************************************************************
.
Completion time: 2008-06-21 17:28:20 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-21 14:28:08
Pre-Run: 4,848,656,384 bytes free
Post-Run: 5,233,786,880 bytes free
205 --- E O F --- 2008-05-22 07:56:00
Malwarebytes logi:
Malwarebytes' Anti-Malware 1.17
Database version: 869
5:47:22 22.6.2008
mbam-log-6-22-2008 (05-47-22).txt
Scan type: Full Scan (C:\|D:\|G:\|)
Objects scanned: 179334
Time elapsed: 1 hour(s), 1 minute(s), 38 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
"Mä uskon ufoihin, ne tulee mua hakemaan." -Häiriköt-
|
|
Hujo
Suspended permanently
|
22. kesäkuuta 2008 @ 13:38 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
|
|
vihu
Newbie
|
22. kesäkuuta 2008 @ 14:56 |
Linkki tähän viestiin
|
Ala boksiin kyllä tuli yksi rivi mutta en sitä saanut kopioitua millään. ohjelma kun sammuttaa itsensä ennen kuin sille pystyy mitään tekemään.
Tuossa nyt kuitenkin tuo logi
Sun Jun 22 14:54:38 2008 => **********************************************************
Sun Jun 22 14:54:38 2008 => eScan AntiVirus Toolkit Utility.
Sun Jun 22 14:54:38 2008 => Copyright © 2003-2004, MicroWorld Technologies Inc.
Sun Jun 22 14:54:38 2008 =>
Sun Jun 22 14:54:38 2008 => Support: support@mwti.net
Sun Jun 22 14:54:38 2008 => Web: http://www.mwti.net
Sun Jun 22 14:54:38 2008 => **********************************************************
Sun Jun 22 14:54:38 2008 => Version 4.4.7
Sun Jun 22 14:54:38 2008 => Log File: C:\KASPER~1\mwav.log
Sun Jun 22 14:54:38 2008 => Latest Date of files inside MWAV: 22 Jun 2008 09:22:08.
Sun Jun 22 14:54:38 2008 => Options Selected by User:
Sun Jun 22 14:54:38 2008 => Memory Check: Enabled
Sun Jun 22 14:54:38 2008 => Registry Check: Enabled
Sun Jun 22 14:54:38 2008 => StartUp Folder Check: Enabled
Sun Jun 22 14:54:38 2008 => System Folder Check: Enabled
Sun Jun 22 14:54:38 2008 => System Area Check: Disabled
Sun Jun 22 14:54:38 2008 => Services Check: Enabled
Sun Jun 22 14:54:38 2008 => Drive Check: Disabled
Sun Jun 22 14:54:38 2008 => All Drive Check :Enabled
Sun Jun 22 14:54:38 2008 => Scanning Type: Scan And Clean
Sun Jun 22 14:54:38 2008 => Folder Check: Disabled
Sun Jun 22 14:54:38 2008 => ***** Scanning Memory Files *****
Sun Jun 22 14:54:38 2008 => Scanning File C:\WINDOWS\system32\services.exe
Sun Jun 22 14:54:38 2008 => Scanning File C:\WINDOWS\system32\lsass.exe
Sun Jun 22 14:54:38 2008 => Scanning File C:\WINDOWS\system32\Ati2evxx.exe
Sun Jun 22 14:54:38 2008 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Jun 22 14:54:38 2008 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Jun 22 14:54:38 2008 => Scanning File C:\WINDOWS\system32\Ati2evxx.exe
Sun Jun 22 14:54:38 2008 => Scanning File C:\PROGRA~1\Lavasoft\Ad-Aware\AAWSER~1.EXE
Sun Jun 22 14:54:38 2008 => Scanning File C:\WINDOWS\system32\spoolsv.exe
Sun Jun 22 14:54:38 2008 => Scanning File C:\PROGRA~1\Autodesk\DATAMA~1\Server\Dispatch\CONNEC~1.EXE
Sun Jun 22 14:54:38 2008 => Scanning File C:\PROGRA~1\Autodesk\DATAMA~1\Server\WEBSER~1\CONNEC~1.EXE
Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\ANTI-V~1\fsgk32st.exe
Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\Common\FSMA32.EXE
Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\ANTI-V~1\FSGK32.EXE
Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\Common\FSMB32.EXE
Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\MICROS~4\MSSQL$~1\Binn\sqlservr.exe
Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\Common\FCH32.EXE
Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\ANALOG~1\SoundMAX\SMAgent.exe
Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\WI559D~1\wbload.exe
Sun Jun 22 14:54:39 2008 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\ANTI-V~1\fsqh.exe
Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\Common\FAMEH32.EXE
Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\FSPC\fspc.exe
Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\FSAUA\program\fsaua.exe
Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\ANTI-V~1\fssm32.exe
Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\F-Secure\FWES\Program\fsdfwd.exe
Sun Jun 22 14:54:39 2008 => Scanning File C:\WINDOWS\system32\WgaTray.exe
Sun Jun 22 14:54:39 2008 => Scanning File C:\WINDOWS\Explorer.EXE
Sun Jun 22 14:54:39 2008 => Scanning File C:\PROGRA~1\ANALOG~1\SoundMAX\SMax4PNP.exe
Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\F-Secure\Common\FSM32.EXE
Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\ATITEC~1\ATI.ACE\CLI.EXE
Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\iTunes\ITUNES~1.EXE
Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\MMEDIA\TVJUKE~1.0\TVJBMO~1.EXE
Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\CursorXP\CursorXP.exe
Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\Logitech\SetPoint\SetPoint.exe
Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\iPod\bin\IPODSE~1.EXE
Sun Jun 22 14:54:40 2008 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\COMMON~1\Logitech\KHALSH~1\KHALMNPR.EXE
Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\ATITEC~1\ATI.ACE\cli.exe
Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\ATITEC~1\ATI.ACE\cli.exe
Sun Jun 22 14:54:40 2008 => Scanning File C:\WINDOWS\system32\wuauclt.exe
Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\F-Secure\ANTI-V~1\fsav32.exe
Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\F-Secure\FSGUI\fsguidll.exe
Sun Jun 22 14:54:40 2008 => Scanning File D:\PROGRA~1\Steam\steam.exe
Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\Winamp\winamp.exe
Sun Jun 22 14:54:40 2008 => Scanning File C:\PROGRA~1\MOZILL~1\firefox.exe
Sun Jun 22 14:54:41 2008 => Scanning File C:\PROGRA~1\mIRC\mirc.exe
Sun Jun 22 14:54:41 2008 => File C:\PROGRA~1\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.621. No Action Taken.
Sun Jun 22 14:54:41 2008 => Scanning File C:\PROGRA~1\MSNMES~1\msnmsgr.exe
Sun Jun 22 14:54:41 2008 => Scanning File C:\PROGRA~1\MSNMES~1\usnsvc.exe
Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\system32\notepad.exe
Sun Jun 22 14:54:41 2008 => Scanning File C:\Kaspersky\mwavscan.com
Sun Jun 22 14:54:41 2008 => Scanning File C:\Kaspersky\kavss.exe
Sun Jun 22 14:54:41 2008 => ***** Scanning Registry Files *****
Sun Jun 22 14:54:41 2008 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
Sun Jun 22 14:54:41 2008 => *** File C:\WINDOWS\system32\SHELL32.dll having Size Restriction ***
Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\system32\SHELL32.dll [**]
Sun Jun 22 14:54:41 2008 => *** File C:\WINDOWS\system32\SHELL32.dll having Size Restriction ***
Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\system32\SHELL32.dll [**]
Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\system32\webcheck.dll
Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\system32\stobject.dll
Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\system32\upnpui.dll
Sun Jun 22 14:54:41 2008 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects
Sun Jun 22 14:54:41 2008 => {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} = C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
Sun Jun 22 14:54:41 2008 => Scanning File C:\PROGRA~1\Java\JRE16~4.0_0\bin\ssv.dll
Sun Jun 22 14:54:41 2008 => {F156768E-81EF-470C-9057-481BA8380DBA} = C:\Program Files\FlashGet\getflash.dll
Sun Jun 22 14:54:41 2008 => Scanning File C:\PROGRA~1\FlashGet\getflash.dll
Sun Jun 22 14:54:41 2008 => Scanning HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\Explorer.exe
Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\system32\userinit.exe
Sun Jun 22 14:54:41 2008 => Scanning HKCU\Control Panel\Desktop
Sun Jun 22 14:54:41 2008 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\KHALMNPR.EXE
Sun Jun 22 14:54:41 2008 => Scanning File C:\WINDOWS\KHALMNPR.EXE
Sun Jun 22 14:54:41 2008 => Scanning File C:\PROGRA~1\ATITEC~1\ATI.ACE\CLIStart.exe
Sun Jun 22 14:54:41 2008 => Scanning File C:\PROGRA~1\ANALOG~1\SoundMAX\SMax4PNP.exe
Sun Jun 22 14:54:42 2008 => Scanning File C:\PROGRA~1\F-Secure\Common\FSM32.EXE
Sun Jun 22 14:54:42 2008 => Scanning File C:\PROGRA~1\F-Secure\FSGUI\TNBUtil.exe
Sun Jun 22 14:54:42 2008 => Scanning File C:\PROGRA~1\WINCUS~1\LOGONS~1\LOGONS~1.EXE
Sun Jun 22 14:54:42 2008 => Scanning File C:\PROGRA~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe
Sun Jun 22 14:54:42 2008 => Scanning File C:\WINDOWS\system32\NeroCheck.exe
Sun Jun 22 14:54:42 2008 => Scanning File C:\PROGRA~1\iTunes\ITUNES~1.EXE
Sun Jun 22 14:54:42 2008 => Scanning File C:\PROGRA~1\MMEDIA\TVJUKE~1.0\TVJBMO~1.EXE
Sun Jun 22 14:54:42 2008 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Sun Jun 22 14:54:42 2008 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
Sun Jun 22 14:54:42 2008 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Sun Jun 22 14:54:42 2008 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sun Jun 22 14:54:42 2008 => Scanning File d:\PROGRA~1\steam\steam.exe
Sun Jun 22 14:54:42 2008 => Scanning File C:\PROGRA~1\CursorXP\CursorXP.exe
Sun Jun 22 14:54:42 2008 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Sun Jun 22 14:54:42 2008 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
Sun Jun 22 14:54:42 2008 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Sun Jun 22 14:54:42 2008 => Scanning HKCR\txtfile\shell\open\command
Sun Jun 22 14:54:42 2008 => Scanning HKCR\comfile\shell\open\command
Sun Jun 22 14:54:42 2008 => Scanning HKCR\exefile\shell\open\command
Sun Jun 22 14:54:42 2008 => Scanning HKCR\dllfile\shell\open\command
Sun Jun 22 14:54:42 2008 => Scanning HKCR\batfile\shell\open\command
Sun Jun 22 14:54:42 2008 => Scanning HKCR\piffile\shell\open\command
Sun Jun 22 14:54:42 2008 => Scanning HKCR\scrfile\shell\open\command
Sun Jun 22 14:54:47 2008 => **********************************************************
Sun Jun 22 14:54:47 2008 => eScan AntiVirus Toolkit Utility.
Sun Jun 22 14:54:47 2008 => Copyright © 2003-2004, MicroWorld Technologies Inc.
Sun Jun 22 14:54:47 2008 => **********************************************************
Sun Jun 22 14:54:47 2008 => Version 4.4.7
Sun Jun 22 14:54:47 2008 => Log File: C:\KASPER~1\mwav.log
Sun Jun 22 14:54:47 2008 => Latest Date of files inside MWAV: 22 Jun 2008 09:22:08.
Sun Jun 22 14:54:51 2008 => AV Library Loaded...
Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\kavss.exe
Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\Getvlist.exe
Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\kavss.dll
Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\kavssdi.dll
Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\kavssi.dll
Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\kavvlg.dll
Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\msvlclnt.dll
Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\ipc.dll
Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\main.avi
Sun Jun 22 14:54:51 2008 => Scanning File C:\KASPER~1\virus.avi
Sun Jun 22 14:54:51 2008 => Virus Database Date: 2008/06/22
Sun Jun 22 14:54:51 2008 => Virus Database Count: 880092
"Mä uskon ufoihin, ne tulee mua hakemaan." -Häiriköt-
|
|
Hujo
Suspended permanently
|
22. kesäkuuta 2008 @ 15:11 |
Linkki tähän viestiin
|
|
scannaa uusi hjt:n loki
Voiko tietsikka koskaan toimia?
|
|
vihu
Newbie
|
22. kesäkuuta 2008 @ 15:14 |
Linkki tähän viestiin
|
Tuossahan tuo
HjT logi:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:13:26, on 22.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Autodesk\Data Management Server 5\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
C:\Program Files\Autodesk\Data Management Server 5\Server\Webserver\Connectivity.EDMWS.Server.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\WindowBlinds\wbload.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\FSPC\fspc.exe
C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
D:\Program Files\Steam\steam.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\mIRC\mirc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [tvjbmonitor] C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe
O4 - HKCU\..\Run: [Steam] "d:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure\FSPC\fspcmsie.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Data Management Job Dispatch - Autodesk Inc - C:\Program Files\Autodesk\Data Management Server 5\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
O23 - Service: Autodesk EDM Server - - C:\Program Files\Autodesk\Data Management Server 5\Server\Webserver\Connectivity.EDMWS.Server.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 8779 bytes
"Mä uskon ufoihin, ne tulee mua hakemaan." -Häiriköt-
|
|
Hujo
Suspended permanently
|
22. kesäkuuta 2008 @ 15:29 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
|
|
Mainos
|
|
|
|
vihu
Newbie
|
23. kesäkuuta 2008 @ 09:42 |
Linkki tähän viestiin
|
|
Kyllähä tää ny tuntuu toimiva iha kute pitääki. Taitaa olla pöpö poissa.
"Mä uskon ufoihin, ne tulee mua hakemaan." -Häiriköt-
|
