|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
hjt-logi (eri kone)
|
|
|
sami1
Junior Member
|
25. kesäkuuta 2008 @ 16:50 |
Linkki tähän viestiin
|
joo elikkä tääki kone sekasin.ehkä vielä pahemmassakin kunnossa? Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:36:32, on 25.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\winudpmgr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\winudmr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\telecms.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: (no name) - {06E12C36-760F-4D92-8509-5E5DBF12C423} - C:\WINDOWS\system32\urqPfEwT.dll (file missing)
O2 - BHO: (no name) - {2F4AE09E-9B7D-48F0-BEED-4CF5CCD82892} - C:\WINDOWS\system32\ljJCuTlJ.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: {0622970d-d184-90db-9114-b41afff0f6a9} - {9a6f0fff-a14b-4119-bd09-481dd0792260} - C:\WINDOWS\system32\qocamnnp.dll
O2 - BHO: (no name) - {BE7E4CE1-8CBA-44A6-956F-462A667D3286} - C:\WINDOWS\system32\ddcYoOig.dll
O3 - Toolbar: Mirar - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\system32\version69ie7fix.dll
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [ERScw] "C:\Program Files\Common Files\ErrorSafe\ERScw.exe" -c
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Control Server] wksmgrtsgs.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [MSN] C:\Windows\mservice.exe
O4 - HKLM\..\Run: [Microsoft] vintxp.exe
O4 - HKLM\..\Run: [Windows UDP Control Center] winudpmgr.exe
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Intranet] ftp.exe
O4 - HKLM\..\Run: [psyspy-2.1.4 Client Server] C:\WINDOWS\system32\telecms.exe
O4 - HKLM\..\Run: [Windows svchost] avserv.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\system32\spoolsvc.exe
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O4 - HKLM\..\Run: [a04d5464] rundll32.exe "C:\WINDOWS\system32\hgecrune.dll",b
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BMa37e67f8] Rundll32.exe "C:\WINDOWS\system32\lylxmoyg.dll",s
O4 - HKLM\..\RunServices: [Microsoft] vintxp.exe
O4 - HKLM\..\RunServices: [Intranet] ftp.exe
O4 - HKLM\..\RunServices: [psyspy-2.1.4 Client Server] C:\WINDOWS\system32\telecms.exe
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Error Safe] "C:\Program Files\Error Safe Free\ers.exe" /min
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MalP] C:\WINDOWS\winampe.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://click.getmirar.com (HKLM)
O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/Ap...ap/DigWXMSN.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O20 - Winlogon Notify: ddcYoOig - C:\WINDOWS\SYSTEM32\ddcYoOig.dll
O20 - Winlogon Notify: urqPfEwT - urqPfEwT.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
--
End of file - 10053 bytes
|
Senior Member
4 tuotearviota
|
25. kesäkuuta 2008 @ 17:12 |
Linkki tähän viestiin
|
Pikkasen on poistettavaa koneella :D
Poista lisää tai poista sovelluksen kautta
SweetIM
Error Safe
1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä:
Combofix.exe
Combofix.exe
Avaa Muistio ja kopioi/liitä Lainaus: laatikon sisältö sinne:
Lainaus:
File::
C:\WINDOWS\wksmgrtsgs.exe
C:\Windows\mservice.exe
C:\WINDOWS\vintxp.exe
C:\WINDOWS\winudpmgr.exe
C:\WINDOWS\winudspm.exe
C:\WINDOWS\ftp.exe
C:\WINDOWS\system32\telecms.exe
C:\WINDOWS\avserv.exe
C:\WINDOWS\system32\spoolsvc.exe
C:\WINDOWS\winudmr.exe
C:\WINDOWS\system32\hgecrune.dll
C:\WINDOWS\system32\lylxmoyg.dll
C:\WINDOWS\winampe.exe
C:\WINDOWS\system32\version69ie7fix.dll
C:\WINDOWS\system32\ddcYoOig.dll
C:\WINDOWS\system32\qocamnnp.dll
C:\WINDOWS\system32\telecms.exe
Tallenna nimellä CFScript (itse asiassa combofix tunnistaa tuon vaikka tiedostopääte ei olisi
edes .txt).
Sitten raahaa ja pudota CFScript ComboFix.exeen kuten alla.(Älä klikkaa)
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.
Sammuta selain ja muut ohjelmat Fixin ajaksi. (ei virustorjuntaa)
Käynnistä HijackThis:ja Scan ja ruksaa seuraavat punaisella listatut tiedostot sekä poista ne.(fix Chekked)
O2 - BHO: (no name) - {06E12C36-760F-4D92-8509-5E5DBF12C423} - C:\WINDOWS\system32\urqPfEwT.dll (file missing)
O2 - BHO: (no name) - {2F4AE09E-9B7D-48F0-BEED-4CF5CCD82892} - C:\WINDOWS\system32\ljJCuTlJ.dll (file missing)
O2 - BHO: {0622970d-d184-90db-9114-b41afff0f6a9} - {9a6f0fff-a14b-4119-bd09-481dd0792260} - C:\WINDOWS\system32\qocamnnp.dll
O2 - BHO: (no name) - {BE7E4CE1-8CBA-44A6-956F-462A667D3286} - C:\WINDOWS\system32\ddcYoOig.dll
O3 - Toolbar: Mirar - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\system32\version69ie7fix.dll
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [ERScw] "C:\Program Files\Common Files\ErrorSafe\ERScw.exe" -c
O4 - HKLM\..\Run: [Windows Control Server] wksmgrtsgs.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [MSN] C:\Windows\mservice.exe
O4 - HKLM\..\Run: [Microsoft] vintxp.exe
O4 - HKLM\..\Run: [Windows UDP Control Center] winudpmgr.exe
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Intranet] ftp.exe
O4 - HKLM\..\Run: [psyspy-2.1.4 Client Server] C:\WINDOWS\system32\telecms.exe
O4 - HKLM\..\Run: [Windows svchost] avserv.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\system32\spoolsvc.exe
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O4 - HKLM\..\Run: [a04d5464] rundll32.exe "C:\WINDOWS\system32\hgecrune.dll",b
O4 - HKLM\..\Run: [BMa37e67f8] Rundll32.exe "C:\WINDOWS\system32\lylxmoyg.dll",s
O4 - HKLM\..\RunServices: [Microsoft] vintxp.exe
O4 - HKLM\..\RunServices: [Intranet] ftp.exe
O4 - HKLM\..\RunServices: [psyspy-2.1.4 Client Server] C:\WINDOWS\system32\telecms.exe
O4 - HKCU\..\Run: [Error Safe] "C:\Program Files\Error Safe Free\ers.exe" /min
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [MalP] C:\WINDOWS\winampe.exe
O15 - Trusted Zone: http://click.getmirar.com (HKLM)
O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O20 - Winlogon Notify: ddcYoOig - C:\WINDOWS\SYSTEM32\ddcYoOig.dll
O20 - Winlogon Notify: urqPfEwT - urqPfEwT.dll (file missing)
Tyhjennä roskakori ja käynnistä koneesi uudelleen.
Postita tänne seuraavat lokit:
* Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
* (C:\ComboFix.txt) raportti
*
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan:
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä
Jossakin koneissa hakataan F8:sin sijasta F5:tä
" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 25. kesäkuuta 2008 @ 17:25
|
|
sami1
Junior Member
|
26. kesäkuuta 2008 @ 01:40 |
Linkki tähän viestiin
|
ai vähä sai poistaa :D laitan kaikki logit nyt samassa: ComboFix 08-06-20.4 - saarela 2008-06-25 23:46:17.2 - NTFSx86
Running from: C:\Documents and Settings\saarela\Työpöytä\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BMa37e67f8.xml
C:\WINDOWS\pskt.ini
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-25 to 2008-06-25 )))))))))))))))))
.
2008-06-25 23:26 . 2008-06-25 23:45 414 ---hsc--- C:\WINDOWS\system32\enurcegh.ini
2008-06-25 16:36 . 2008-06-25 16:36 <KANSIO> d----c--- C:\Program Files\Trend Micro
2008-06-25 16:21 . 2008-06-25 16:21 118 --a--c--- C:\WINDOWS\system32\MRT.INI
2008-06-25 16:09 . 2008-06-25 16:09 <KANSIO> d----c--- C:\WINDOWS\DA15D5355E1D4076B5208571346D6238.TMP
2008-06-25 15:55 . 2008-06-25 15:55 25,600 --a--c--- C:\WINDOWS\system32\ddcYoOig.dll
2008-06-25 14:09 . 2008-06-25 14:09 <KANSIO> d----c--- C:\Program Files\Alwil Software
2008-06-25 14:00 . 2008-06-25 14:00 39,075 -r-hsc--- C:\WINDOWS\avserv.exe
2008-06-25 13:33 . 2008-06-25 13:33 81,920 --a--c--- C:\WINDOWS\system32\hgecrune.dll
2008-06-25 13:31 . 2008-06-25 13:31 99,840 --a--c--- C:\WINDOWS\system32\qocamnnp.dll
2008-06-25 13:31 . 2008-06-25 13:31 91,136 --a--c--- C:\WINDOWS\system32\lylxmoyg.dll
2008-06-23 13:53 . 2008-06-23 13:53 99,328 --a--c--- C:\WINDOWS\system32\lrabqbqc.dll
2008-06-23 13:50 . 2008-06-23 13:50 91,136 --a--c--- C:\WINDOWS\system32\oatqawfb.dll
2008-06-21 19:44 . 2008-06-21 19:44 1,635 --a--c--- C:\WINDOWS\system32\raoza.exe
2008-06-15 12:35 . 2008-06-15 12:35 177 ---hsc--- C:\WINDOWS\system32\vjjkcrfe.tmp
2008-06-15 12:35 . 2008-06-15 12:35 153 ---hsc--- C:\WINDOWS\system32\vjjkcrfe.ini
2008-06-14 11:28 . 2008-06-14 11:28 80,896 --a------ C:\WINDOWS\system32\uigdjkhl.dll
2008-06-14 11:25 . 2008-06-14 11:25 98,304 --a------ C:\WINDOWS\system32\tsaellvv.dll
2008-06-14 11:23 . 2008-06-14 11:23 89,600 --a------ C:\WINDOWS\system32\wlpxhedm.dll
2008-06-13 23:09 . 2008-06-13 23:09 <KANSIO> d----c--- C:\Program Files\Apple Software Update
2008-06-13 18:06 . 2008-06-13 18:06 98,304 --a------ C:\WINDOWS\system32\ehlrlhwd.dll
2008-06-13 18:03 . 2008-06-13 18:03 89,600 --a------ C:\WINDOWS\system32\lxcklfjk.dll
2008-06-13 11:25 . 2008-06-13 11:25 <KANSIO> d----c--- C:\Documents and Settings\NetworkService\Application Data\Symantec
2008-06-12 18:07 . 2008-06-12 18:07 233 ---hsc--- C:\WINDOWS\system32\jsusdarm.tmp
2008-06-12 18:07 . 2008-06-12 18:07 177 ---hsc--- C:\WINDOWS\system32\jsusdarm.ini
2008-06-11 06:03 . 2008-06-14 00:30 345 --ahsc--- C:\WINDOWS\system32\IiQpWvut.ini
2008-06-11 06:00 . 2008-06-11 06:00 45,056 --a--c--- C:\is155815.exe
2008-06-10 17:07 . 2008-06-10 17:07 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Comodo
2008-06-10 17:07 . 2008-06-10 17:07 434,252 --a--c--- C:\WINDOWS\system32\MSVCRTD.DLL
2008-06-10 17:07 . 2008-06-10 17:07 216,576 --a--c--- C:\WINDOWS\system32\monln.dll
2008-06-10 15:08 . 2008-06-10 16:45 45,056 -----c--- C:\mzdza.exe
2008-06-09 21:53 . 2008-06-09 22:10 50,418 -----c--- C:\mzda.exe
2008-06-09 19:35 . 2008-06-09 19:35 29,342 --a--c--- C:\s.exe
2008-06-09 19:35 . 2008-06-09 19:35 29,342 --a--c--- C:\gf.exe
2008-06-09 17:31 . 2008-06-09 17:31 29,342 --a--c--- C:\gpf.exe
2008-06-09 17:19 . 2008-06-10 15:43 2,231 --a--c--- C:\pfs.exe
2008-06-09 15:52 . 2008-06-09 15:52 29,342 --a--c--- C:\pf.exe
2008-06-09 15:51 . 2008-06-09 15:51 29,342 -r-hsc--- C:\WINDOWS\winudmr.exe
2008-06-09 15:51 . 2008-06-10 15:42 2,231 --a--c--- C:\ps.exe
2008-06-06 20:41 . 2008-06-08 18:51 2,231 --a--c--- C:\hszs.exe
2008-06-06 20:09 . 2008-06-08 18:51 2,231 --a--c--- C:\shz.exe
2008-06-06 15:15 . 2008-06-06 15:15 49,156 --a--c--- C:\szs.exe
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a--c--- C:\Documents and Settings\saarela\sz.exe
2008-06-06 14:58 . 2008-06-06 20:46 49,156 --a--c--- C:\sz.exe
2008-06-06 14:06 . 2008-06-06 14:06 2,232 --a--c--- C:\sexx22.exe
2008-06-06 14:06 . 2008-06-06 14:06 2,232 --a--c--- C:\sexx2.exe
2008-06-06 13:46 . 2008-06-06 14:48 2,232 --a--c--- C:\Documents and Settings\saarela\sex2.exe
2008-06-06 13:23 . 2008-06-08 18:52 2,232 --a--c--- C:\sex2.exe
2008-06-06 13:21 . 2008-06-06 13:21 49,156 --a--c--- C:\sex.exe
2008-06-06 12:06 . 2008-06-06 12:06 <KANSIO> d----c--- C:\Program Files\Common Files\PCSuite
2008-06-06 12:05 . 2008-06-06 12:05 <KANSIO> d----c--- C:\Program Files\DIFX
2008-06-06 12:03 . 2008-06-06 12:03 <KANSIO> d----c--- C:\Program Files\PC Connectivity Solution
2008-06-06 10:23 . 2008-06-06 12:13 2,232 --a--c--- C:\sf.exe
2008-06-06 10:23 . 2008-06-06 12:13 2,232 --a--c--- C:\fa.exe
2008-06-06 10:22 . 2008-06-06 13:12 2,232 --a--c--- C:\f.exe
2008-06-04 16:59 . 2008-06-04 16:59 3,424 --a--c--- C:\is155400.exe
2008-06-04 11:39 . 2008-06-04 11:39 3,421 --a--c--- C:\setz.exe
2008-06-03 21:57 . 2008-06-03 21:57 86,548 --a--c--- C:\f.bat
2008-06-03 14:11 . 2008-06-10 15:12 345 --ahsc--- C:\WINDOWS\system32\OpqprBeg.ini
2008-06-02 22:19 . 2008-06-04 17:00 3,423 --a--c--- C:\stp.exe
2008-06-02 21:35 . 2008-06-02 21:35 96,950 --a--c--- C:\Documents and Settings\saarela\setup.exe
2008-06-02 21:28 . 2008-06-02 21:28 96,950 --a--c--- C:\stupx.exe
2008-06-02 21:23 . 2008-06-02 21:23 96,950 -r-hsc--- C:\WINDOWS\mservice.exe
2008-06-02 21:23 . 2008-06-02 21:23 96,950 --a--c--- C:\stup.exe
2008-06-02 19:03 . 2008-06-02 19:03 5,120 --a--c--- C:\rpqlvo.exe
2008-06-02 19:03 . 2008-06-02 19:04 2 --a--c--- C:\-1605544757
2008-06-02 19:02 . 2008-06-02 19:03 5,120 --a--c--- C:\abhwevhi.exe
2008-06-02 19:01 . 2008-06-02 19:02 8,192 --a--c--- C:\uucn.exe
2008-06-02 18:59 . 2008-06-02 19:00 8,192 --a--c--- C:\vieiiy.exe
2008-06-02 18:58 . 2008-06-02 18:59 6,144 --a--c--- C:\hldtlwe.exe
2008-06-02 17:35 . 2008-06-03 16:28 60,114 --a--c--- C:\bot1.exe
2008-06-01 16:50 . 2008-06-04 11:39 3,423 --a--c--- C:\WINDOWS\is154890.exe
2008-06-01 16:46 . 2008-06-01 16:46 86,512 --a--c--- C:\irc.com
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a--c--- C:\Documents and Settings\saarela\setup1.exe
2008-05-31 14:08 . 2008-05-31 15:14 86,512 --a--c--- C:\setup1.exe
2008-05-30 22:12 . 2008-05-30 22:12 60,132 --a--c--- C:\dcsi.exe
2008-05-30 20:03 . 2008-05-30 20:03 83,400 -r-hsc--- C:\WINDOWS\winudpmgr.exe
2008-05-30 20:03 . 2008-05-30 20:44 83,400 --a--c--- C:\img.exe
2008-05-30 13:31 . 2008-05-30 20:44 86,498 --a--c--- C:\com.com
2008-05-29 22:03 . 2008-05-29 23:00 96,768 -----c--- C:\is15480.exe
2008-05-29 19:38 . 2008-05-29 19:38 40,960 --a--c--- C:\dsdc.exe
2008-05-29 18:21 . 2008-05-29 22:56 60,132 --a--c--- C:\ddc.exe
2008-05-29 11:51 . 2008-05-29 11:51 150,528 --a--c--- C:\51261.exe
2008-05-29 11:51 . 2008-06-02 19:04 40,960 --a--c--- C:\d.exe
2008-05-28 20:26 . 2008-05-28 20:26 40,960 --a--c--- C:\dczi.exe
2008-05-28 19:27 . 2008-05-28 20:10 56,832 --a--c--- C:\sxy1.com
2008-05-28 19:21 . 2008-05-28 19:21 56,832 --a--c--- C:\sxy.com
2008-05-28 14:00 . 2008-06-03 10:43 345 --ahsc--- C:\WINDOWS\system32\xyGQstwa.ini
2008-05-28 13:56 . 2008-05-28 13:56 40,960 --a--c--- C:\dciz.exe
2008-05-28 13:56 . 2008-05-29 18:27 3,422 --a--c--- C:\seffdxy.com
2008-05-28 13:54 . 2008-06-08 21:29 2,231 --a--c--- C:\is154890.exe
2008-05-27 18:26 . 2008-05-27 20:38 40,960 --a--c--- C:\dchi.exe
2008-05-27 17:52 . 2008-05-27 17:52 56,832 --a--c--- C:\seffxy.com
2008-05-27 16:59 . 2008-05-27 16:59 28,672 --a--c--- C:\gay.exe
2008-05-27 16:58 . 2008-05-27 16:58 56,832 --a--c--- C:\sefxy.com
2008-05-27 16:53 . 2008-05-30 22:48 60,132 --a--c--- C:\dci.exe
2008-05-27 16:44 . 2008-06-01 20:46 86,502 --a--c--- C:\sexy.com
2008-05-27 16:44 . 2008-05-29 18:28 3,424 --a--c--- C:\DivxCodec.exe
2008-05-27 16:43 . 2008-05-27 16:43 56,832 -r-hsc--- C:\WINDOWS\winudspm.exe
2008-05-26 22:41 . 2008-05-26 22:41 19 --a--c--- C:\WINDOWS\SoundConverter.INI
2008-05-26 22:28 . 2008-05-26 22:28 55,296 --a--c--- C:\lgcagja.exe
2008-05-26 18:29 . 2008-05-26 22:28 55,296 --a--c--- C:\gfgaa.exe
2008-05-26 17:25 . 2008-05-26 19:20 55,296 --a--c--- C:\lgagja.exe
2008-05-26 17:21 . 2008-05-26 17:21 55,296 --a--c--- C:\lgaja.exe
2008-05-26 17:08 . 2008-05-26 22:28 40,960 --a--c--- C:\results.exe
2008-05-25 20:24 . 2008-05-25 20:24 55,296 --a--c--- C:\Documents and Settings\saarela\gaa.exe
2008-05-25 19:56 . 2008-05-25 19:56 55,296 --a--c--- C:\gggaa.exe
2008-05-25 17:30 . 2008-05-26 14:53 55,296 --a--c--- C:\ggaa.exe
2008-05-25 17:21 . 2008-05-26 14:54 55,296 --a--c--- C:\lgaa.exe
2008-05-25 16:16 . 2008-05-25 16:16 55,296 --a--c--- C:\lga.exe
2008-05-25 15:36 . 2008-05-25 15:36 55,296 --a--c--- C:\ga.exe
2008-05-25 12:08 . 2008-05-25 12:08 55,296 -r-hsc--- C:\WINDOWS\winudpmg.exe
2008-05-25 12:08 . 2008-05-25 15:35 40,960 --a--c--- C:\resvult.exe
2008-05-25 12:07 . 2008-05-26 22:29 55,296 --a--c--- C:\gaa.exe
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-25 20:15 --------- dc----w C:\Program Files\InternetSoftware
2008-06-25 13:12 --------- dc-h--w C:\Program Files\InstallShield Installation Information
2008-06-25 13:12 --------- dc----w C:\Program Files\Creative
2008-06-25 11:45 --------- dc----w C:\Program Files\Common Files\ErrorSafe
2008-06-25 11:05 73,890 -c--a-w C:\WINDOWS\photos_2008.zip
2008-06-25 11:04 --------- dc----w C:\Program Files\Common Files\Symantec Shared
2008-06-25 11:03 --------- dc----w C:\Program Files\Norton AntiVirus
2008-06-25 11:03 --------- dc----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-15 06:02 --------- dc----w C:\Program Files\Symantec
2008-06-14 17:59 272,128 -c----w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-12 16:15 --------- dc----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-06-10 14:07 499,712 -c--a-w C:\WINDOWS\system32\msvcp71.dll
2008-06-10 14:07 348,160 -c--a-w C:\WINDOWS\system32\msvcr71.dll
2008-06-10 14:07 1,060,864 -c--a-w C:\WINDOWS\system32\MFC71.dll
2008-06-06 09:43 --------- dc----w C:\Documents and Settings\saarela\Application Data\LimeWire
2008-06-06 09:08 --------- dc----w C:\Documents and Settings\saarela\Application Data\Nokia
2008-06-06 09:06 --------- dc----w C:\Program Files\Nokia
2008-05-26 11:52 40,960 -c--a-w C:\result.exe
2008-05-25 12:03 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-24 16:11 40,960 -c--a-w C:\rs.exe
2008-05-24 15:28 --------- dc----w C:\Documents and Settings\saarela\Application Data\MSN6
2008-05-24 15:27 --------- dc----w C:\Documents and Settings\All Users\Application Data\MSN6
2008-05-24 08:12 156,160 -c--a-w C:\121c16333.exe
2008-05-23 15:55 156,160 -c--a-w C:\121c6333.exe
2008-05-23 10:07 156,160 -c--a-w C:\121c1d6333.exe
2008-05-19 14:42 25,253 -c--a-w C:\tbot.exe
2008-05-19 14:41 436,736 -c--a-w C:\qs.exe
2008-05-19 13:01 436,736 -c--a-w C:\q.exe
2008-05-08 12:28 202,752 -c--a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:15 1,288,192 -c--a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 -c--a-w C:\WINDOWS\system32\wininet.dll
2008-04-13 16:39 26,794 -c--a-w C:\WINDOWS\img21812.zip
2008-03-25 04:51 621,344 -c--a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 -c--a-w C:\WINDOWS\system32\msjint40.dll
2006-12-17 15:54 104 -csh--r C:\WINDOWS\system32\BEA8CDDED6.sys
2005-10-27 17:18 56 -csh--r C:\WINDOWS\system32\D2AB4915F8.sys
2007-03-27 16:25 248 -csh--r C:\WINDOWS\system32\D6DECDA8BE.sys
2007-03-27 16:25 11,846 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-06-13 13:22 249,496 -csh--r C:\WINDOWS\system32\telecms.exe
2007-06-13 13:22 156,160 -csh--r C:\WINDOWS\system32\winampaa.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F4AE09E-9B7D-48F0-BEED-4CF5CCD82892}]
C:\WINDOWS\system32\ljJCuTlJ.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9a6f0fff-a14b-4119-bd09-481dd0792260}]
2008-06-25 13:31 99840 --a--c--- C:\WINDOWS\system32\qocamnnp.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BE7E4CE1-8CBA-44A6-956F-462A667D3286}]
2008-06-25 15:55 25600 --a--c--- C:\WINDOWS\system32\ddcYoOig.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [ ]
"Error Safe"="C:\Program Files\Error Safe Free\ers.exe" [ ]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
"MalP"="C:\WINDOWS\winampe.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 15:54 241664]
"ATIPTA"="C:\ATI-CPanel\atiptaxx.exe" [2004-06-24 21:10 339968]
"SoundMan"="SOUNDMAN.EXE" [2003-08-05 15:59 57344 C:\WINDOWS\SOUNDMAN.EXE]
"NetLimiter"="C:\Program Files\NetLimiter\NetLimiter.exe" [2004-03-31 16:23 823296]
"Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CAMTRAY.EXE" [2004-04-29 11:59 245760]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 00:11 49152]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
"ERScw"="C:\Program Files\Common Files\ErrorSafe\ERScw.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Windows UDP Control"="winudspm.exe" [2008-05-27 16:43 56832 C:\WINDOWS\winudspm.exe]
"Intranet"="ftp.exe" [2004-09-15 02:12 44544 C:\WINDOWS\system32\ftp.exe]
"Windows svchost"="avserv.exe" [2008-06-25 14:00 39075 C:\WINDOWS\avserv.exe]
"Spooler SubSystem App"="C:\WINDOWS\system32\spoolsvc.exe" [2007-06-13 16:22 35840]
"Windows Controls Center"="winudmr.exe" [2008-06-09 15:51 29342 C:\WINDOWS\winudmr.exe]
"a04d5464"="C:\WINDOWS\system32\hgecrune.dll" [2008-06-25 13:33 81920]
"BMa37e67f8"="C:\WINDOWS\system32\lylxmoyg.dll" [2008-06-25 13:31 91136]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Intranet"="ftp.exe" [2004-09-15 02:12 44544 C:\WINDOWS\system32\ftp.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 02:12 15360]
C:\Documents and Settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 22:31:38 241664]
HP Image Zone -pikak?ynnistys.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 23:06:36 53248]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2005-11-05 21:10:35 118784]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{BE7E4CE1-8CBA-44A6-956F-462A667D3286}"= C:\WINDOWS\system32\ddcYoOig.dll [2008-06-25 15:55 25600]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcYoOig]
ddcYoOig.dll 2008-06-25 15:55 25600 C:\WINDOWS\system32\ddcYoOig.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqPfEwT]
urqPfEwT.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.HFYU"= huffyuv.dll
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"msacm.divxa32"= DivXa32.acm
"vidc.ffds"= C:\Program Files\ffdshow\ffdshow.ax
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\WINDOWS\\system32\\winampaa.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\telecms.exe"=
"C:\\WINDOWS\\system32\\spoolsvc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2193:UDP"= 2193:UDP:Windows Media Format SDK (firefox.exe)
"2192:UDP"= 2192:UDP:Windows Media Format SDK (firefox.exe)
"2195:UDP"= 2195:UDP:Windows Media Format SDK (firefox.exe)
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
S3 adxapie;adxapie;C:\DOCUME~1\saarela\LOCALS~1\Temp\adxapie.sys []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cd50c27f-4a5a-11dc-a50f-000fea4d8ef5}]
\Shell\AutoRun\command - N:\play/mplay.exe
\Shell\jidea_install_cmd\command - N:\play/mplay.exe
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-06-13 21:23:41 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-13 12:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
"2008-06-25 20:48:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-25 23:48:14
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
Completion time: 2008-06-25 23:51:23
ComboFix-quarantined-files.txt 2008-06-25 20:50:21
ComboFix2.txt 2008-06-25 20:34:57
Pre-Run: 1,193,496,576 tavua vapaana
Post-Run: 1,171,689,472 tavua vapaana
273 --- E O F --- 2008-06-25 14:13:15 Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:32:39, on 26.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: {0622970d-d184-90db-9114-b41afff0f6a9} - {9a6f0fff-a14b-4119-bd09-481dd0792260} - C:\WINDOWS\system32\qocamnnp.dll
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [psyspy-2.1.4 Client Server] C:\WINDOWS\system32\telecms.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/Ap...ap/DigWXMSN.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
--
End of file - 7087 bytes
tehty uusiks SDfixin jälkeen. eli tuore on.... SDFix: Version 1.197
Run by saarela on to 26.06.2008 at 01:03
Microsoft Windows XP [versio 5.1.2600]
Running From: C:\DOCUME~1\saarela\TYPYT~1\SDFix
Checking Services :
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
Checking Files :
Trojan Files Found:
C:\-16055~1 - Deleted
C:\GF.EXE - Deleted
C:\GPF.EXE - Deleted
C:\PF.EXE - Deleted
C:\f.bat - Deleted
C:\WINDOWS\img21812.zip - Deleted
C:\WINDOWS\photos_2008.zip - Deleted
C:\WINDOWS\avserv.exe - Deleted
C:\WINDOWS\system32\spoolsvc.exe - Deleted
C:\WINDOWS\system32\winampaa.exe - Deleted
C:\WINDOWS\winudmr.exe - Deleted
C:\WINDOWS\winudpmg.exe - Deleted
C:\WINDOWS\winudpmgr.exe - Deleted
C:\WINDOWS\winudspm.exe - Deleted
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-26 01:12:58
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Download]
"LastSuccessTime"="2008-06-25 20:31:12"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000004c
"TracesSuccessful"=dword:00000005
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"="C:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe:*:Disabled:HP Software Update Client"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe:*:Enabled:Et?tuki - Windows Messenger ja ??niyhteys"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Disabled:Firefox"
"C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Enabled:Windows© NetMeeting©"
"C:\\WINDOWS\\system32\\winampaa.exe"="C:\\WINDOWS\\system32\\winampaa.exe:*:Enabled:winampaa"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\WINDOWS\\system32\\telecms.exe"="C:\\WINDOWS\\system32\\telecms.exe:*:Enabled:psyspy-2.1.4 Client Server"
"C:\\WINDOWS\\system32\\spoolsvc.exe"="C:\\WINDOWS\\system32\\spoolsvc.exe:*:Enabled:Spooler SubSystem App"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
Remaining Files :
File Backups: - C:\DOCUME~1\saarela\TYPYT~1\SDFix\backups\backups.zip
Files with Hidden Attributes :
Mon 2 Jun 2008 96,950 ..SHR --- "C:\WINDOWS\mservice.exe"
Wed 25 Jun 2008 29,359 A.SHR --- "C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\usb323.exe"
Sun 17 Dec 2006 104 ..SHR --- "C:\WINDOWS\system32\BEA8CDDED6.sys"
Thu 27 Oct 2005 56 ..SHR --- "C:\WINDOWS\system32\D2AB4915F8.sys"
Tue 27 Mar 2007 248 ..SHR --- "C:\WINDOWS\system32\D6DECDA8BE.sys"
Thu 12 Jun 2008 233 ..SH. --- "C:\WINDOWS\system32\jsusdarm.tmp"
Tue 27 Mar 2007 11,846 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Wed 13 Jun 2007 249,496 ..SHR --- "C:\WINDOWS\system32\telecms.exe"
Sun 15 Jun 2008 177 ..SH. --- "C:\WINDOWS\system32\vjjkcrfe.tmp"
Wed 25 Oct 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 30 Jan 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0045d90d3c637c74f834c75fe192b558\BIT4.tmp"
Tue 10 Jun 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cf7ced0e70c80a1e476f1abf49afecb1\BITC5.tmp"
Thu 18 May 2006 0 A.SH. --- "C:\Documents and Settings\saarela\Omat tiedostot\Omat eBook-kirjat\Omat albumit\Omat kuvatiedostot\DCIM\100SSCAM\SIV39.tmp"
Finished!
oli siinäkin hommansa :)
|
Senior Member
4 tuotearviota
|
26. kesäkuuta 2008 @ 09:25 |
Linkki tähän viestiin
|
Huhuhuh vielläkin löyty piiiiitkä lista poistettavia :D
1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä:
Combofix.exe
Combofix.exe
Avaa Muistio ja kopioi/liitä Lainaus: laatikon sisältö sinne:
Lainaus:
File::
C:\WINDOWS\avserv.exe
C:\WINDOWS\system32\hgecrune.dll
C:\WINDOWS\system32\qocamnnp.dll
C:\WINDOWS\system32\lylxmoyg.dll
C:\WINDOWS\system32\lrabqbqc.dll
C:\WINDOWS\system32\oatqawfb.dll
C:\WINDOWS\system32\raoza.exe
C:\WINDOWS\system32\vjjkcrfe.tmp
C:\WINDOWS\system32\vjjkcrfe.ini
C:\WINDOWS\system32\uigdjkhl.dll
C:\WINDOWS\system32\tsaellvv.dll
C:\WINDOWS\system32\wlpxhedm.dll
C:\WINDOWS\system32\ehlrlhwd.dll
C:\WINDOWS\system32\lxcklfjk.dll
C:\is155815.exe
C:\mzdza.exe
C:\mzda.exe
C:\s.exe
C:\gf.exe
C:\gpf.exe
C:\pfs.exe
C:\pf.exe
C:\WINDOWS\winudmr.exe
C:\ps.exe
C:\hszs.exe
C:\shz.exe
C:\szs.exe
C:\Documents and Settings\saarela\sz.exe
C:\sz.exe
C:\sexx22.exe
C:\sexx2.exe
C:\Documents and Settings\saarela\sex2.exe
C:\sex2.exe
C:\sex.exe
C:\sf.exe
C:\fa.exe
C:\f.exe
C:\is155400.exe
C:\setz.exe
C:\f.bat
C:\stp.exe
C:\Documents and Settings\saarela\setup.exe
C:\stupx.exe
C:\WINDOWS\mservice.exe
C:\stup.exe
C:\rpqlvo.exe
C:\-1605544757
C:\abhwevhi.exe
C:\uucn.exe
C:\vieiiy.exe
C:\hldtlwe.exe
C:\bot1.exe
C:\WINDOWS\is154890.exe
C:\irc.com
C:\Documents and Settings\saarela\setup1.exe
C:\setup1.exe
C:\dcsi.exe
C:\WINDOWS\winudpmgr.exe
C:\img.exe
C:\com.com
C:\is15480.exe
C:\dsdc.exe
C:\ddc.exe
C:\51261.exe
C:\d.exe
C:\dczi.exe
C:\sxy1.com
C:\sxy.com
C:\dciz.exe
C:\seffdxy.com
C:\is154890.exe
C:\dchi.exe
C:\seffxy.com
C:\gay.exe
C:\sefxy.com
C:\dci.exe
C:\sexy.com
C:\WINDOWS\winudspm.exe
C:\lgcagja.exe
C:\gfgaa.exe
C:\lgagja.exe
C:\lgaja.exe
C:\results.exe
:\Documents and Settings\saarela\gaa.exe
C:\gggaa.exe
C:\ggaa.exe
C:\lgaa.exe
C:\lga.exe
C:\ga.exe
C:\WINDOWS\winudpmg.exe
C:\resvult.exe
C:\gaa.exe
C:\WINDOWS\system32\telecms.exe
Tallenna nimellä CFScript (itse asiassa combofix tunnistaa tuon vaikka tiedostopääte ei olisi
edes .txt).
Sitten raahaa ja pudota CFScript ComboFix.exeen kuten alla.(Älä klikkaa)
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.
Sammuta selain ja muut ohjelmat Fixin ajaksi. (ei virustorjuntaa)
Käynnistä HijackThis:ja Scan ja ruksaa seuraavat punaisella listatut tiedostot sekä poista ne.(fix Chekked)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [psyspy-2.1.4 Client Server] C:\WINDOWS\system32\telecms.exe
Tyhjennä roskakori ja käynnistä koneesi uudelleen.
Postita tänne seuraavat lokit:
* Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
* (C:\ComboFix.txt) raportti
*
|
|
sami1
Junior Member
|
26. kesäkuuta 2008 @ 14:07 |
Linkki tähän viestiin
|
kone toimii jo mainiosti paremmin! jopa nettikin toimii kunnolla :) Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:04:26, on 26.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/Ap...ap/DigWXMSN.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
--
End of file - 6782 bytes ComboFix 08-06-20.4 - saarela 2008-06-26 13:38:53.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.234 [GMT 3:00]
Running from: C:\Documents and Settings\saarela\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\saarela\Työpöytä\CFScript.txt.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
:\Documents and Settings\saarela\gaa.exe
C:\-1605544757
C:\51261.exe
C:\abhwevhi.exe
C:\bot1.exe
C:\com.com
C:\d.exe
C:\dchi.exe
C:\dci.exe
C:\dciz.exe
C:\dcsi.exe
C:\dczi.exe
C:\ddc.exe
C:\Documents and Settings\saarela\setup.exe
C:\Documents and Settings\saarela\setup1.exe
C:\Documents and Settings\saarela\sex2.exe
C:\Documents and Settings\saarela\sz.exe
C:\dsdc.exe
C:\f.bat
C:\f.exe
C:\fa.exe
C:\ga.exe
C:\gaa.exe
C:\gay.exe
C:\gf.exe
C:\gfgaa.exe
C:\ggaa.exe
C:\gggaa.exe
C:\gpf.exe
C:\hldtlwe.exe
C:\hszs.exe
C:\img.exe
C:\irc.com
C:\is15480.exe
C:\is154890.exe
C:\is155400.exe
C:\is155815.exe
C:\lga.exe
C:\lgaa.exe
C:\lgagja.exe
C:\lgaja.exe
C:\lgcagja.exe
C:\mzda.exe
C:\mzdza.exe
C:\pf.exe
C:\pfs.exe
C:\ps.exe
C:\results.exe
C:\resvult.exe
C:\rpqlvo.exe
C:\s.exe
C:\seffdxy.com
C:\seffxy.com
C:\sefxy.com
C:\setup1.exe
C:\setz.exe
C:\sex.exe
C:\sex2.exe
C:\sexx2.exe
C:\sexx22.exe
C:\sexy.com
C:\sf.exe
C:\shz.exe
C:\stp.exe
C:\stup.exe
C:\stupx.exe
C:\sxy.com
C:\sxy1.com
C:\sz.exe
C:\szs.exe
C:\uucn.exe
C:\vieiiy.exe
C:\WINDOWS\avserv.exe
C:\WINDOWS\is154890.exe
C:\WINDOWS\mservice.exe
C:\WINDOWS\system32\ehlrlhwd.dll
C:\WINDOWS\system32\hgecrune.dll
C:\WINDOWS\system32\lrabqbqc.dll
C:\WINDOWS\system32\lxcklfjk.dll
C:\WINDOWS\system32\lylxmoyg.dll
C:\WINDOWS\system32\oatqawfb.dll
C:\WINDOWS\system32\qocamnnp.dll
C:\WINDOWS\system32\raoza.exe
C:\WINDOWS\system32\telecms.exe
C:\WINDOWS\system32\tsaellvv.dll
C:\WINDOWS\system32\uigdjkhl.dll
C:\WINDOWS\system32\vjjkcrfe.ini
C:\WINDOWS\system32\vjjkcrfe.tmp
C:\WINDOWS\system32\wlpxhedm.dll
C:\WINDOWS\winudmr.exe
C:\WINDOWS\winudpmg.exe
C:\WINDOWS\winudpmgr.exe
C:\WINDOWS\winudspm.exe
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\abhwevhi.exe
C:\bot1.exe
C:\com.com
C:\dchi.exe
C:\dci.exe
C:\dciz.exe
C:\dcsi.exe
C:\dczi.exe
C:\ddc.exe
C:\Documents and Settings\saarela\setup.exe
C:\Documents and Settings\saarela\setup1.exe
C:\Documents and Settings\saarela\sex2.exe
C:\Documents and Settings\saarela\sz.exe
C:\dsdc.exe
C:\fa.exe
C:\ga.exe
C:\gaa.exe
C:\gay.exe
C:\gfgaa.exe
C:\ggaa.exe
C:\gggaa.exe
C:\hldtlwe.exe
C:\hszs.exe
C:\img.exe
C:\irc.com
C:\is15480.exe
C:\is154890.exe
C:\is155400.exe
C:\is155815.exe
C:\lga.exe
C:\lgaa.exe
C:\lgagja.exe
C:\lgaja.exe
C:\lgcagja.exe
C:\mzda.exe
C:\mzdza.exe
C:\pfs.exe
C:\ps.exe
C:\results.exe
C:\resvult.exe
C:\rpqlvo.exe
C:\seffdxy.com
C:\seffxy.com
C:\sefxy.com
C:\setup1.exe
C:\setz.exe
C:\sex.exe
C:\sex2.exe
C:\sexx2.exe
C:\sexx22.exe
C:\sexy.com
C:\sf.exe
C:\shz.exe
C:\stp.exe
C:\stup.exe
C:\stupx.exe
C:\sxy.com
C:\sxy1.com
C:\sz.exe
C:\szs.exe
C:\uucn.exe
C:\vieiiy.exe
C:\WINDOWS\is154890.exe
C:\WINDOWS\mservice.exe
C:\WINDOWS\system32\ehlrlhwd.dll
C:\WINDOWS\system32\hgecrune.dll
C:\WINDOWS\system32\lrabqbqc.dll
C:\WINDOWS\system32\lxcklfjk.dll
C:\WINDOWS\system32\lylxmoyg.dll
C:\WINDOWS\system32\oatqawfb.dll
C:\WINDOWS\system32\qocamnnp.dll
C:\WINDOWS\system32\raoza.exe
C:\WINDOWS\system32\telecms.exe
C:\WINDOWS\system32\tsaellvv.dll
C:\WINDOWS\system32\uigdjkhl.dll
C:\WINDOWS\system32\vjjkcrfe.ini
C:\WINDOWS\system32\vjjkcrfe.tmp
C:\WINDOWS\system32\wlpxhedm.dll
.
((((( Tiedostot, jotka on luotu seuraavalla aikav?lill?: 2008-05-26 to 2008-06-26 )))))))))))))))))
.
2008-06-26 00:58 . 2008-06-26 00:59 <KANSIO> d----c--- C:\WINDOWS\ERUNT
2008-06-26 00:45 . 2008-06-26 13:28 32,256 --a--c--- C:\is155932.exe
2008-06-25 23:26 . 2008-06-25 23:45 414 ---hsc--- C:\WINDOWS\system32\enurcegh.ini
2008-06-25 16:36 . 2008-06-25 16:36 <KANSIO> d----c--- C:\Program Files\Trend Micro
2008-06-25 16:21 . 2008-06-25 16:21 118 --a--c--- C:\WINDOWS\system32\MRT.INI
2008-06-25 16:09 . 2008-06-25 16:09 <KANSIO> d----c--- C:\WINDOWS\DA15D5355E1D4076B5208571346D6238.TMP
2008-06-25 14:09 . 2008-06-25 14:09 <KANSIO> d----c--- C:\Program Files\Alwil Software
2008-06-13 23:09 . 2008-06-13 23:09 <KANSIO> d----c--- C:\Program Files\Apple Software Update
2008-06-13 11:25 . 2008-06-13 11:25 <KANSIO> d----c--- C:\Documents and Settings\NetworkService\Application Data\Symantec
2008-06-12 18:07 . 2008-06-12 18:07 233 ---hsc--- C:\WINDOWS\system32\jsusdarm.tmp
2008-06-12 18:07 . 2008-06-12 18:07 177 ---hsc--- C:\WINDOWS\system32\jsusdarm.ini
2008-06-11 06:03 . 2008-06-14 00:30 345 --ahsc--- C:\WINDOWS\system32\IiQpWvut.ini
2008-06-10 17:07 . 2008-06-10 17:07 <KANSIO> d----c--- C:\Documents and Settings\All Users\Application Data\Comodo
2008-06-10 17:07 . 2008-06-10 17:07 434,252 --a--c--- C:\WINDOWS\system32\MSVCRTD.DLL
2008-06-10 17:07 . 2008-06-10 17:07 216,576 --a--c--- C:\WINDOWS\system32\monln.dll
2008-06-06 12:06 . 2008-06-06 12:06 <KANSIO> d----c--- C:\Program Files\Common Files\PCSuite
2008-06-06 12:05 . 2008-06-06 12:05 <KANSIO> d----c--- C:\Program Files\DIFX
2008-06-06 12:03 . 2008-06-06 12:03 <KANSIO> d----c--- C:\Program Files\PC Connectivity Solution
2008-06-03 14:11 . 2008-06-10 15:12 345 --ahsc--- C:\WINDOWS\system32\OpqprBeg.ini
2008-05-28 14:00 . 2008-06-03 10:43 345 --ahsc--- C:\WINDOWS\system32\xyGQstwa.ini
2008-05-27 16:44 . 2008-05-29 18:28 3,424 --a--c--- C:\DivxCodec.exe
2008-05-26 22:41 . 2008-05-26 22:41 19 --a--c--- C:\WINDOWS\SoundConverter.INI
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-25 20:15 --------- dc----w C:\Program Files\InternetSoftware
2008-06-25 13:12 --------- dc-h--w C:\Program Files\InstallShield Installation Information
2008-06-25 13:12 --------- dc----w C:\Program Files\Creative
2008-06-25 11:45 --------- dc----w C:\Program Files\Common Files\ErrorSafe
2008-06-25 11:04 --------- dc----w C:\Program Files\Common Files\Symantec Shared
2008-06-25 11:03 --------- dc----w C:\Program Files\Norton AntiVirus
2008-06-25 11:03 --------- dc----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-15 06:02 --------- dc----w C:\Program Files\Symantec
2008-06-14 17:59 272,128 -c----w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-12 16:15 --------- dc----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-06-06 09:43 --------- dc----w C:\Documents and Settings\saarela\Application Data\LimeWire
2008-06-06 09:08 --------- dc----w C:\Documents and Settings\saarela\Application Data\Nokia
2008-06-06 09:06 --------- dc----w C:\Program Files\Nokia
2008-05-26 11:52 40,960 -c--a-w C:\result.exe
2008-05-25 17:24 55,296 -c--a-w C:\Documents and Settings\saarela\gaa.exe
2008-05-25 12:03 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-24 16:11 40,960 -c--a-w C:\rs.exe
2008-05-24 15:28 --------- dc----w C:\Documents and Settings\saarela\Application Data\MSN6
2008-05-24 15:27 --------- dc----w C:\Documents and Settings\All Users\Application Data\MSN6
2008-05-24 08:12 156,160 -c--a-w C:\121c16333.exe
2008-05-23 15:55 156,160 -c--a-w C:\121c6333.exe
2008-05-23 10:07 156,160 -c--a-w C:\121c1d6333.exe
2008-05-19 14:42 25,253 -c--a-w C:\tbot.exe
2008-05-19 14:41 436,736 -c--a-w C:\qs.exe
2008-05-08 12:28 202,752 -c--a-w C:\WINDOWS\system32\drivers\rmcast.sys
2006-12-17 15:54 104 -csh--r C:\WINDOWS\system32\BEA8CDDED6.sys
2005-10-27 17:18 56 -csh--r C:\WINDOWS\system32\D2AB4915F8.sys
2007-03-27 16:25 248 -csh--r C:\WINDOWS\system32\D6DECDA8BE.sys
2007-03-27 16:25 11,846 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
(((((((((((((((((((((((((((((( Rekisterin k?ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji? arvoja ja laillisia oletusarvoja ei n?ytet?
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [ ]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 15:54 241664]
"ATIPTA"="C:\ATI-CPanel\atiptaxx.exe" [2004-06-24 21:10 339968]
"SoundMan"="SOUNDMAN.EXE" [2003-08-05 15:59 57344 C:\WINDOWS\SOUNDMAN.EXE]
"NetLimiter"="C:\Program Files\NetLimiter\NetLimiter.exe" [2004-03-31 16:23 823296]
"Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CAMTRAY.EXE" [2004-04-29 11:59 245760]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 00:11 49152]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 02:12 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.HFYU"= huffyuv.dll
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"msacm.divxa32"= DivXa32.acm
"vidc.ffds"= C:\Program Files\ffdshow\ffdshow.ax
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2193:UDP"= 2193:UDP:Windows Media Format SDK (firefox.exe)
"2192:UDP"= 2192:UDP:Windows Media Format SDK (firefox.exe)
"2195:UDP"= 2195:UDP:Windows Media Format SDK (firefox.exe)
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
S3 adxapie;adxapie;C:\DOCUME~1\saarela\LOCALS~1\Temp\adxapie.sys []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cd50c27f-4a5a-11dc-a50f-000fea4d8ef5}]
\Shell\AutoRun\command - N:\play/mplay.exe
\Shell\jidea_install_cmd\command - N:\play/mplay.exe
.
'Ajoitetut teht?v?t'-kansion sis?lt?
"2008-06-13 21:23:41 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-13 12:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
"2008-06-26 10:53:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-26 13:44:43
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
.
**************************************************************************
.
Completion time: 2008-06-26 13:54:19 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-26 10:53:56
ComboFix2.txt 2008-06-25 20:59:19
Pre-Run: 898,023,424 tavua vapaana
Post-Run: 923,234,304 tavua vapaana
326 --- E O F --- 2008-06-25 23:05:06
|
|
sami1
Junior Member
|
26. kesäkuuta 2008 @ 15:06 |
Linkki tähän viestiin
|
|
menihän kaikki oikein. ja vastatkaa nopeemmin jos pystytte pliis. on hieman kiire.
|
Senior Member
4 tuotearviota
|
26. kesäkuuta 2008 @ 15:13 |
Linkki tähän viestiin
|
No niin nyt näyttää hyvältä :D
Poista käsin alla oleva tiedosta.
C:\is155932.exe
Tyhjennä roskakori.
******************************************
Kirjoita windowsin käynnistävalikon suorita-kenttään ComboFix.exe /u paina OK
***************************************************************************
Lataa Malwarebytes' Anti-Malware työpöydällesi.
* Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
* Lopuksi varmistu, että seuraavat on valittu: Päivitä Malwarebytes' Anti-Malware ja Käynnistä Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Lopeta.
* Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
* Kun ohjelma on latautunut, valitse Suorita täysi tarkistus ja klikkaa Tarkista.
* Kun skanni on valmis, klikkaa OK ja sitten Näytä tulokset nähdäksesi tulokset.
* Varmistu, että kaikki on merkitty ja klikkaa Poista valitut.
* Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös
täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
* Lähetä lokin sisältö seuraavassa viestissäsi + uusi hjt-loki.
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 26. kesäkuuta 2008 @ 15:15
|
|
sami1
Junior Member
|
26. kesäkuuta 2008 @ 16:36 |
Linkki tähän viestiin
|
jokos kohta alkaa kone olla puhadas:)? Malwarebytes' Anti-Malware 1.18
Tietokantaversio: 893
16:33:40 26.6.2008
mbam-log-6-26-2008 (16-33-40).txt
Tarkistustyyppi: Täysi tarkistus (C:\|L:\|)
Tarkistetut kohteet: 113693
Kulunut aika: 1 hour(s), 1 minute(s), 1 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 9
Saastuneita rekisteriarvoja: 1
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 2
Saastuneita tiedostoja: 13
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
HKEY_CLASSES_ROOT\internetsoftware.pornpro_bho.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Mirar (AdWare.Mirar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\PlayMP3 (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fbrowsingadvisor_is1 (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{be7e4ce1-8cba-44a6-956f-462a667d3286} (Trojan.Vundo) -> Quarantined and deleted successfully.
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
C:\Program Files\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowserAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
Saastuneita tiedostoja:
C:\result.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\rs.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\saarela\gaa.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\XPCOMEvents.dll (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ftp.exe.tmp (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\IXPCOMEvents.xpt (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\Logo.png (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\main.db (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\unins000.dat (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\unins000.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\sähkö ja teleurakoi\setup.exe (Trojan.Agent) -> Quarantined and deleted successfully.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:34:51, on 26.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/Ap...ap/DigWXMSN.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
--
End of file - 6725 bytes
|
Senior Member
4 tuotearviota
|
26. kesäkuuta 2008 @ 16:49 |
Linkki tähän viestiin
|
Kone varmaan on nopeampi nytten?
Loppu siivoukset.
Lataa CCleaner tästä
- Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
- Asennuksen jälkeen aukaise CCleaner.
- Valitse vasemmalta pystyrivistä Options.
- Valitse viereisestä pystyrivistä Settings.
- Language kohtaan valitse Suomi.
- Käynnistä CCleaner.
- Valitse Valinnat.
- Paina Lisäasetukset.
- Ota ruksi pois kohdasta "Poista vain yli 48 tuntia vanhat tiedostot Windowsin tilapäiskansioista".
Puhdistaja
- Valitse vasemmalta pystyrivistä Puhdistaja.
- Paina alhaalta Tutki.
Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
- Kun tutkiminen on valmis, paina Aja CCleaner.
Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.
Rekisterin virheiden korjaus
- Valitse vasemmalta pystyrivistä Rekisteri.
- Paina alhaalta Etsi rekisterin virheitä.
- Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
- Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
- Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
- Saat vielä varmistus kysymyksen, paina Ok.
- Kun virheet on korjattu, paina Sulje.
Nyt voit suljea CCleanerin painamalla oikealta ylhäältä punaista rastia.
Javan päivitys ja välimuistin tyhjennys:
1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
Niissä pitäisi olla seuraava kuva vieressä:
3. Valitse kaikki entiset Java versiosi ja valitse Poista.
4. Asenna uusin Java päivitys seuraavasta linkistä..
5. Käynnistä kone uudelleen asennuksen jälkeen:
http://java.sun.com/javase/downloads/index.jsp
Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u6
Paina Download
Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.
6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.
(Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).
8. Varmista että kaikki kaksi valintaa ovat rastitettuja:
*Applications and Applets
*Trace and Log Files
Ja paina OK -nappia
9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
10. Klikkaa OK jättääksesi Java asetusikkunasi.
|
|
sami1
Junior Member
|
26. kesäkuuta 2008 @ 17:50 |
Linkki tähän viestiin
|
|
kiitoksia. kone toimii:) ja vielä sen verran ku broidi sanoi että tartten avastin lisäks vielä zonealarmin, pitääkö paikkansa?ja en saa avastia näkymään oikeessa alareunassa vaikka se on päällä
|
Senior Member
4 tuotearviota
|
26. kesäkuuta 2008 @ 18:11 |
Linkki tähän viestiin
|
Poista Avast ja asenna uudelleen tuon pitäisi auttaa.
|
|
Mainos
|
|
|
|
sami1
Junior Member
|
26. kesäkuuta 2008 @ 19:07 |
Linkki tähän viestiin
|
näin teen. ja sitte tässä ois toinen hjt-logi: eri kone taas :) Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:02:57, on 26.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/d...://uk.yahoo.com
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe /idle
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Contact Manager Alerts] C:\Program Files\Contact Manager\Alerts.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?807f936eb60e4329894f01c05d48b8c8
O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?807f936eb60e4329894f01c05d48b8c8
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resourc...lscbase4009.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=19588
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/Ap...ap/PhtPkMSN.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/Ap...ap/DigWXMSN.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game09.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
--
End of file - 8357 bytes
viittitkö vielä tsekkaa kiitos:) tein tähän jo aikasemmin tän mutta tein jonku virheen ni siks pitää tehä uusiks. ja en raaski formatoida tätä
|
|
