AfterDawn.com Mainosta sivuillamme
User Käyttäjä Salasana  
  Puuttuuko tunnus? Liity jäseneksi nyt!.
Salasana hukassa? Klikkaa tästä. 		 
  Etusivu   Uutiset   Oppaat   Ohjelmat   Sanasto   Laitevertailu   Profiilit   Keskustelu  
 Yksityisviestit     Luo uusi yksityisviesti     Kaikki uudet viestit     Ilman vastauksia olevat viestiketjut     Hae viestejä
lauantai 15.11.2025 / 00:52
Hae keskustelualueilta:        In English   Suomeksi   På svenska
afterdawn.com > keskustelu > yleistä keskustelua tietokoneista > virukset ja haittaohjelmat - hijackthis -logit > hjt loki. en tiiä mikä virus mul on konees
Näytä aiheet
 
Keskustelualueet
Keskustelualueet
hjt loki. en tiiä mikä virus mul on konees
  Siirry:
 
Kirjoittaja Viesti
krizu7
Junior Member
_ 		24. elokuuta 2008 @ 20:41 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
nojoo, kun avaan koneen siihe tulee kaikkee skeidaa, avaa taustakuvaks jonku linkin pas** sivulle ja poisti melkeen kaikki pikakuvakkeet eikä c ja d asemat näy omassa tietokoneessa ja kellon vieressä lukee koko ajan virus alert! neuvokaa!
mutta tässä loki:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:37: VIRUS ALERT!, on 24.8.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\WINDOWS\system32\Fast.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Elisa\Avustaja\Elisa.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\Restore\rstrui.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
F3 - REG:win.ini: run="C:\Documents and Settings\Kristian\Application Data\Adobe\Manager.exe"
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: qalkfxor - {18C388BB-5014-4906-AE38-E62BA5AA7387} - C:\WINDOWS\qalkfxor.dll
O4 - HKLM\..\Run: [BackgroundSwitcher] C:\WINDOWS\system32\bgswitch.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [Elisa Avustaja] "C:\Program Files\Elisa\Avustaja\Elisa.exe"
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Sol...wn.cab56986.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupd...b?1170431845328
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O20 - AppInit_DLLs: npuclm.dll
O21 - SSODL: rqbmvpso - {098FA224-148C-4B98-AED4-64327D7B365F} - C:\WINDOWS\rqbmvpso.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Pinnacle Systems tvtv Spooler (EpgSpooler) - - c:\progra~1\pinnacle\mediac~1\epgspo~2.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Program Files\TuneUp WinStyler\WinStylerThemeSvc.exe (file missing)
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 8519 bytes
[ + lainaa]

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 21. syyskuuta 2008 @ 13:17
Hujo
Suspended permanently
_ 		26. elokuuta 2008 @ 11:54 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Lataa SmitfraudFix (c) S!Ri
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita ponnahtava rapport ? muistion sisältö viestiketjuusi.
Löytyy myös C:\rapport.txt

Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
(AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
silloin ne saattavat varoittaa käyttäjää.

=============

1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

===========

Lataa Malwarebytes' Anti-Malware työpöydällesi.

1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.

===========

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

[ + lainaa]
Voiko tietsikka koskaan toimia?
krizu7
Junior Member
_ 		28. elokuuta 2008 @ 15:03 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Elikkä avast! antivirus kertoi että virus on BV: Malware-gen.

Mutta SmitfraudFix loki.

SmitFraudFix v2.339

Scan done at 14:08:31.40, to 28.08.2008
Run from C:\Documents and Settings\Kristian\Omat tiedostot\viruspoisto\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Elisa\Avustaja\Elisa.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\WINDOWS\System32\snmp.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Fast.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Fraps\fraps.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Kristian


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Kristian\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Kristian\Suosikit


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"SubscribedURL"=""
"FriendlyName"="Privacy Protection"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller - Paketinajoituksen miniportti
DNS Server Search Order: 10.0.0.2

HKLM\SYSTEM\CCS\Services\Tcpip\..\{AA31FE89-EF07-40F8-8426-FB401BF3A353}: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AA31FE89-EF07-40F8-8426-FB401BF3A353}: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\..\{AA31FE89-EF07-40F8-8426-FB401BF3A353}: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS3\Services\Tcpip\..\{AA31FE89-EF07-40F8-8426-FB401BF3A353}: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End


Ja Combofix loki.

ComboFix 08-08-27.05 - Kristian 2008-08-28 14:11:20.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.480 [GMT 3:00]
Running from: C:\Documents and Settings\Kristian\Omat tiedostot\viruspoisto\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Kristian\Cookies\kristian@clicktorrent[2].txt

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-07-28 to 2008-08-28 )))))))))))))))))
.

2008-08-28 12:32 . 2008-08-21 23:41 87,552 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-08-27 18:53 . 2008-04-14 19:11 23,040 --a------ C:\WINDOWS\system32\AAP.DLL
2008-08-27 18:51 . 2008-04-14 19:11 988,672 --a------ C:\WINDOWS\system32\AAK.dll
2008-08-27 18:51 . 2008-04-14 19:11 680,448 --a------ C:\WINDOWS\system32\AAD.DLL
2008-08-27 18:51 . 2008-08-27 18:53 255 --a------ C:\WINDOWS\system32\ad_away.lic
2008-08-27 08:25 . 2008-08-27 08:25 <KANSIO> d-------- C:\WINDOWS\SQL9_KB948109_ENU
2008-08-26 21:29 . 2008-08-27 18:02 <KANSIO> d-------- C:\MFT 16173
2008-08-26 19:37 . 2008-08-26 19:46 <KANSIO> d-------- C:\Program Files\DreamRender
2008-08-26 19:37 . 2006-12-07 15:01 20,480 --a------ C:\WINDOWS\system32\DreamSaver.scr
2008-08-26 18:37 . 2008-08-26 18:37 <KANSIO> d-------- C:\Program Files\CCleaner
2008-08-26 16:58 . 2008-08-26 16:58 579,072 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-08-26 16:55 . 2008-08-26 16:55 <KANSIO> d-------- C:\WINDOWS\ERUNT
2008-08-26 14:31 . 2008-08-28 14:08 2,704 --a------ C:\WINDOWS\system32\tmp.reg
2008-08-26 14:30 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-08-26 14:30 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-08-26 14:30 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-08-26 14:30 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-08-26 14:30 . 2008-08-14 21:52 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-08-26 14:30 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
2008-08-26 14:30 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-08-26 14:30 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-08-26 14:30 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-08-25 21:38 . 2008-08-28 13:13 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-25 21:38 . 2008-08-25 21:38 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-25 19:01 . 2008-08-25 19:01 <KANSIO> d-------- C:\Documents and Settings\Jõrjestelmõnvalvoja
2008-08-25 14:39 . 2008-08-25 14:39 10,838 --ah----- C:\WINDOWS\Stereo.GID
2008-08-25 14:38 . 2008-08-25 14:38 <KANSIO> d-------- C:\Program Files\Stereogram
2008-08-25 14:38 . 2001-03-17 00:32 1,139,389 --a------ C:\WINDOWS\STEREO.HLP
2008-08-25 14:38 . 2001-03-15 23:36 997 --a------ C:\WINDOWS\Stereo.cnt
2008-08-25 14:33 . 2008-08-25 14:33 <KANSIO> d-------- C:\Temp\MB
2008-08-25 14:33 . 2008-08-25 14:33 <KANSIO> d-------- C:\Temp
2008-08-25 14:33 . 2008-08-25 14:33 <KANSIO> d-------- C:\Program Files\Drempels
2008-08-24 18:39 . 2008-08-24 18:40 135,936 --a------ C:\WINDOWS\system32\xmdfkirw.dll
2008-08-24 18:25 . 2005-02-07 15:44 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
2008-08-24 18:25 . 2005-02-07 15:44 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
2008-08-24 18:25 . 2007-12-24 20:16 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
2008-08-24 18:25 . 2007-12-24 20:16 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
2008-08-24 18:25 . 2005-02-07 15:44 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
2008-08-24 18:25 . 2005-02-07 15:44 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
2008-08-24 18:25 . 2005-02-07 13:53 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
2008-08-24 18:25 . 2005-02-07 13:53 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
2008-08-24 18:25 . 2005-02-07 13:53 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Omat tiedostot
2008-08-24 18:25 . 2005-02-07 13:53 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Omat tiedostot
2008-08-24 18:25 . 2005-02-07 13:48 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
2008-08-24 18:25 . 2005-02-07 13:48 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
2008-08-24 18:25 . 2005-02-07 15:44 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
2008-08-24 18:25 . 2005-02-07 15:44 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
2008-08-24 18:25 . 2008-08-24 18:25 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja
2008-08-24 18:12 . 2008-08-24 13:45 188,416 --a------ C:\WINDOWS\rqbmvpso.dll
2008-08-24 18:12 . 2008-08-24 13:45 155,648 --a------ C:\WINDOWS\qalkfxor.dll
2008-08-24 18:12 . 2008-08-24 13:45 86,016 --a------ C:\WINDOWS\rvoelbxt.exe
2008-08-24 17:27 . 2008-08-24 17:27 732,765 --a------ C:\WINDOWS\system32\CSRLT.EXE
2008-08-24 17:27 . 2008-08-24 17:27 732,765 --a------ C:\WINDOWS\MSBLT.EXE
2008-08-24 17:27 . 2008-08-24 18:16 0 --a------ C:\WINDOWS\system32\sc01.sc
2008-08-23 20:29 . 2008-08-23 20:29 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-08-23 20:28 . 2008-08-23 20:28 <KANSIO> d-------- C:\VundoFix Backups
2008-08-23 19:42 . 2008-08-26 08:16 <KANSIO> d-------- C:\Documents and Settings\Kristian\Application Data\Sony
2008-08-23 19:23 . 2008-08-26 08:16 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Sony
2008-08-23 18:11 . 2008-08-23 18:11 <KANSIO> d-------- C:\Program Files\TuneUp Utilities 2008
2008-08-23 18:11 . 2008-08-23 18:11 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-08-23 18:11 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-08-23 16:05 . 2008-08-23 19:22 <KANSIO> d-------- C:\Program Files\Sony
2008-08-22 20:02 . 2008-08-22 20:02 <KANSIO> d-------- C:\Program Files\FDRLab
2008-08-22 19:28 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-22 19:03 . 2008-08-20 17:59 167,424 --a------ C:\WINDOWS\system32\MSA.cpl
2008-08-21 19:05 . 2008-08-21 19:05 68,608 --a------ C:\NOTEPAD.EXE
2008-08-21 19:05 . 2008-08-21 19:05 10,752 --a------ C:\SOUND_VER1.1577.0.MP3.0XE
2008-08-21 19:04 . 2008-08-21 19:04 <KANSIO> d-------- C:\Documents and Settings\Kristian\Application Data\Publish Providers
2008-08-21 18:49 . 2008-08-21 18:49 <KANSIO> d-------- C:\WINDOWS\system32\XPSViewer
2008-08-21 18:48 . 2008-08-21 18:48 <KANSIO> d-------- C:\Program Files\Reference Assemblies
2008-08-21 18:48 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-08-21 18:46 . 2008-08-21 18:46 <KANSIO> d-------- C:\Program Files\TechSmith
2008-08-21 18:46 . 2008-08-21 18:46 <KANSIO> d-------- C:\Program Files\Common Files\TechSmith Shared
2008-08-21 18:46 . 2008-08-21 18:46 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\TechSmith
2008-08-21 18:38 . 2008-08-21 19:09 <KANSIO> d-------- C:\Program Files\Sony Setup
2008-08-21 17:28 . 2008-08-21 19:03 <KANSIO> d-------- C:\Program Files\Asprate
2008-08-20 20:53 . 2001-04-18 11:32 205,848 --a------ C:\WINDOWS\system32\Threed32.ocx
2008-08-20 20:53 . 2000-12-06 00:00 109,248 --a------ C:\WINDOWS\system32\MSWINSCK.OCX
2008-08-20 20:53 . 2000-07-15 00:00 101,888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL
2008-08-20 20:53 . 2001-08-27 15:12 19,490 --a------ C:\WINDOWS\system32\IPCFLT.VXD
2008-08-15 22:40 . 2008-08-15 22:52 <KANSIO> d-------- C:\Program Files\Microsoft Picture It!
2008-08-14 20:13 . 2008-08-15 23:24 <KANSIO> d-------- C:\Documents and Settings\Kristian\Application Data\gtk-2.0
2008-08-14 20:13 . 2008-08-14 20:13 <KANSIO> d-------- C:\Documents and Settings\Kristian\.thumbnails
2008-08-14 20:11 . 2008-08-21 16:32 <KANSIO> d-------- C:\Documents and Settings\Kristian\.gimp-2.4
2008-08-14 20:10 . 2008-08-14 20:10 <KANSIO> d-------- C:\Program Files\GIMP-2.0
2008-08-14 14:25 . 2008-05-01 17:35 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-14 14:24 . 2008-04-11 22:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-08-12 20:50 . 2008-08-12 20:50 <KANSIO> d--h----- C:\WINDOWS\PIF
2008-08-12 20:50 . 2008-08-19 19:17 <KANSIO> d-------- C:\Program Files\Charlie II
2008-08-11 20:10 . 2008-08-11 20:16 <KANSIO> d-------- C:\BOWEP
2008-08-11 20:10 . 1991-09-12 00:00 271,264 --a------ C:\WINDOWS\VBRUN100.DLL
2008-08-11 20:10 . 1991-09-12 00:00 19,200 --a------ C:\WINDOWS\WEPUTIL.DLL
2008-08-11 20:10 . 2008-08-13 18:29 107 --a------ C:\WINDOWS\entpack.ini
2008-08-11 19:21 . 1993-08-18 00:00 286,768 --a------ C:\WINDOWS\HELPHLPR.DLL
2008-08-11 19:21 . 1993-08-18 00:00 2,333 --a------ C:\WINDOWS\WAVEMIX.INI
2008-08-11 19:21 . 2008-08-11 19:22 273 --a------ C:\WINDOWS\ARCADE.INI
2008-08-11 15:12 . 2008-08-11 15:12 0 --a------ C:\WINDOWS\RussSqr.INI
2008-08-11 14:58 . 2008-08-11 14:58 <KANSIO> d-------- C:\Documents and Settings\Kristian\Application Data\The Labyrinth Plus! Edition
2008-08-11 14:50 . 2008-08-11 14:52 <KANSIO> d-------- C:\Program Files\Microsoft Plus!
2008-08-10 17:31 . 2008-08-10 17:31 <KANSIO> d-------- C:\Program Files\Temp
2008-08-07 10:25 . 2007-04-09 13:23 28,040 --a------ C:\WINDOWS\system32\mdimon.dll
2008-08-07 10:22 . 2008-08-07 10:22 <KANSIO> d-------- C:\Program Files\Microsoft ActiveSync
2008-08-07 10:20 . 2008-08-26 08:12 <KANSIO> d-------- C:\Program Files\Microsoft.NET
2008-08-06 21:16 . 2008-08-06 21:16 63 --a------ C:\WINDOWS\mdm.ini
2008-08-06 11:06 . 2008-08-07 10:45 391 --a------ C:\WINDOWS\ODBC.INI
2008-08-05 22:32 . 2008-08-14 16:40 <KANSIO> d-------- C:\Program Files\Thoosje Sidebar V2.3
2008-08-05 22:16 . 2008-08-05 22:16 5,760,054 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp
2008-08-05 22:16 . 2008-08-05 22:16 64,832 --a------ C:\WINDOWS\BricoPackUninst.cmd
2008-08-05 22:14 . 2008-08-05 22:16 6,120 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-08-05 22:13 . 2008-08-05 22:13 <KANSIO> d-------- C:\WINDOWS\BricoPacks
2008-08-05 20:15 . 2008-08-25 14:17 <KANSIO> d-------- C:\Program Files\Windows Live Safety Center
2008-08-05 19:58 . 2008-08-20 19:00 <KANSIO> d-------- C:\Program Files\MTA San Andreas
2008-08-05 16:51 . 2008-08-05 16:51 0 --a------ C:\WINDOWS\MovieEdit.INI
2008-08-04 21:29 . 2008-08-04 21:29 26,112 --a------ C:\WINDOWS\system32\OPNKIJHB.0LL
2008-08-04 19:38 . 2008-08-04 16:00 218,624 --a------ C:\WINDOWS\system32\uxtheme.backup
2008-08-04 16:00 . 2008-04-14 19:11 218,624 --a------ C:\WINDOWS\system32\uxtheme.uxtender
2008-08-04 14:59 . 2008-08-04 14:59 244 --ah----- C:\sqmnoopt10.sqm
2008-08-04 14:59 . 2008-08-04 14:59 232 --ah----- C:\sqmdata10.sqm
2008-08-02 16:56 . 2008-08-02 16:56 <KANSIO> d-------- C:\Program Files\Rockstar Games
2008-07-31 10:25 . 2008-08-07 10:40 <KANSIO> d-------- C:\WINDOWS\ShellNew
2008-07-31 10:24 . 2008-07-31 10:24 <KANSIO> d-------- C:\WINDOWS\Twain32
2008-07-31 10:24 . 2008-07-31 10:24 <KANSIO> d-------- C:\Documents and Settings\Kristian\Application Data\Microsoft Web Folders
2008-07-29 18:31 . 2008-07-29 18:31 <KANSIO> d-------- C:\Program Files\YouTube Downloader
2008-07-29 16:23 . 2001-10-05 15:59 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-07-29 16:23 . 2001-10-05 15:59 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-28 11:10 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-28 09:38 --------- d-----w C:\Program Files\Cheat Engine
2008-08-27 05:26 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-08-26 11:50 --------- d-----w C:\Documents and Settings\Kristian\Application Data\wsInspector
2008-08-26 05:39 --------- d-----w C:\Documents and Settings\Kristian\Application Data\uTorrent
2008-08-24 17:58 2,864 ----a-w C:\WINDOWS\system32\winsock.dll
2008-08-24 15:16 --------- d-----w C:\Program Files\Google
2008-08-24 14:26 --------- d-----w C:\Program Files\MagicISO
2008-08-23 15:42 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-23 15:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-08-22 16:29 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-08-22 16:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2008-08-19 16:36 --------- d-----w C:\Documents and Settings\Kristian\Application Data\LimeWire
2008-08-17 15:53 --------- d-----w C:\Program Files\LimeWire
2008-08-17 12:01 17,144 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-08-15 18:38 --------- d-----w C:\Program Files\Fraps
2008-08-08 09:21 23 ----a-w C:\Documents and Settings\Kristian\jagex_runescape_preferences.dat
2008-08-06 17:58 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-08-06 17:58 262,144 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-08-06 15:51 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-05 08:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-29 14:37 --------- d-----w C:\Program Files\Project64 1.6
2008-07-22 13:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 19:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-18 18:39 586,752 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-07-16 17:47 --------- d-----w C:\Program Files\mp3DirectCut
2008-07-13 12:47 --------- d-----w C:\Program Files\Sun
2008-07-13 12:46 --------- d-----w C:\Program Files\Java
2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-06 18:55 --------- d-----w C:\Program Files\Apache2
2008-07-06 11:08 --------- d-----w C:\Program Files\WinImage
2008-07-06 09:46 --------- d-----w C:\Documents and Settings\Kristian\Application Data\TuneUp Software
2008-07-05 17:31 --------- d-----w C:\Program Files\PerformanceTest
2008-07-05 16:54 --------- d-----w C:\Program Files\PC Wizard 2004
2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:29 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:47 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-03-06 18:15 689 ----a-w C:\Documents and Settings\Kristian\jdraw.v1.1.5.dat
.

((((((((((((((((((((((((((((( snapshot@2008-08-25_19.00.50.37 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-26 05:12:14 363,376 ----a-w C:\WINDOWS\assembly\GAC_32\Microsoft.SqlServer.BatchParser\9.0.242.0__89845dcd8080cc91\microsoft.sqlserver.batchparser.dll
+ 2008-08-26 05:12:15 78,192 ----a-w C:\WINDOWS\assembly\GAC_32\Microsoft.SqlServer.MgdSqlDumper\9.0.242.0__89845dcd8080cc91\microsoft.sqlserver.mgdsqldumper.dll
+ 2008-08-26 05:16:12 245,760 ----a-w C:\WINDOWS\assembly\GAC_MSIL\log4net\1.2.10.30000__3cda94b1926e6fbc\log4net.dll
+ 2008-08-26 05:12:29 546,160 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.AnalysisServices.AdomdClient\9.0.242.0__89845dcd8080cc91\Microsoft.AnalysisServices.AdomdClient.dll
+ 2008-08-26 05:12:15 140,656 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.AnalysisServices.DeploymentEngine\9.0.242.0__89845dcd8080cc91\Microsoft.AnalysisServices.DeploymentEngine.dll
+ 2008-08-26 05:12:15 1,217,904 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.AnalysisServices\9.0.242.0__89845dcd8080cc91\Microsoft.AnalysisServices.DLL
+ 2008-08-26 05:12:14 38,256 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.DataWarehouse.Interfaces\9.0.242.0__89845dcd8080cc91\Microsoft.DataWarehouse.Interfaces.DLL
+ 2008-08-26 05:02:06 136,560 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.NetEnterpriseServers.ExceptionMessageBox\9.0.242.0__89845dcd8080cc91\Microsoft.NetEnterpriseServers.ExceptionMessageBox.dll
+ 2008-08-26 05:12:14 157,040 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.ConnectionInfo\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.ConnectionInfo.dll
+ 2008-08-26 05:02:07 46,448 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.CustomControls\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.CustomControls.dll
+ 2008-08-26 05:02:07 202,096 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.GridControl\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.GridControl.dll
+ 2008-08-26 05:12:22 16,600 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.Instapi\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.InstApi.dll
+ 2008-08-26 05:12:14 71,024 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.RegSvrEnum\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.RegSvrEnum.dll
+ 2008-08-26 05:12:15 558,448 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.Rmo\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.Rmo.dll
+ 2008-08-26 05:12:14 42,352 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.ServiceBrokerEnum\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.ServiceBrokerEnum.dll
+ 2008-08-26 05:02:07 289,496 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.Setup\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.Setup.dll
+ 2008-08-26 05:12:13 1,598,832 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.Smo\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.Smo.dll
+ 2008-08-26 05:12:13 222,576 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.SmoEnum\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.SmoEnum.dll
+ 2008-08-26 05:12:13 906,608 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.SqlEnum\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.SqlEnum.dll
+ 2008-08-26 05:12:16 43,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.SqlTDiagM\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.SqlTDiagM.dll
+ 2008-08-26 05:12:13 20,184 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.SString\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.SString.dll
+ 2008-08-26 05:02:07 595,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.WizardFrameworkLite\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.WizardFrameworkLite.dll
+ 2008-08-26 05:12:14 46,448 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.WmiEnum\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.WmiEnum.dll
+ 2008-08-26 05:12:15 84,696 ----a-w C:\WINDOWS\assembly\GAC_MSIL\MSClusterLib\1.0.0.0__89845dcd8080cc91\MSClusterLib.dll
+ 2008-08-26 05:16:09 65,536 ----a-w C:\WINDOWS\assembly\GAC_MSIL\NullableTypes\1.2.2336.27002__3cda94b1926e6fbc\NullableTypes.dll
+ 2008-08-26 05:16:10 6,144 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_da_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:10 9,728 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_de_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:10 9,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_es_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:10 9,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_fi_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:10 9,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_fr_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:10 9,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_it_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:10 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_ja-JP_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:10 6,144 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_ja_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:10 7,680 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_ko_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:11 9,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_nl_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:11 9,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_no_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:11 9,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_pt-BR_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:11 7,680 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_pt-PT_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:11 10,240 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_ru_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:11 9,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_sv_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:11 9,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_zh-CHS_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:11 9,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared.resources\2.3.2930.23764_zh-CHT_3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.resources.dll
+ 2008-08-26 05:16:10 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.clrshared\2.3.2930.23764__3cda94b1926e6fbc\Sony.MediaSoftware.clrshared.dll
+ 2008-08-26 05:16:09 323,584 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.MediaMgr.resources\2.3.2930.23790_de_3cda94b1926e6fbc\Sony.MediaSoftware.MediaMgr.resources.dll
+ 2008-08-26 05:16:09 696,320 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.MediaMgr.resources\2.3.2930.23790_es_3cda94b1926e6fbc\Sony.MediaSoftware.MediaMgr.resources.dll
+ 2008-08-26 05:16:10 307,200 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.MediaMgr.resources\2.3.2930.23790_fr_3cda94b1926e6fbc\Sony.MediaSoftware.MediaMgr.resources.dll
+ 2008-08-26 05:16:10 385,024 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.MediaMgr.resources\2.3.2930.23790_ja-JP_3cda94b1926e6fbc\Sony.MediaSoftware.MediaMgr.resources.dll
+ 2008-08-26 05:16:10 24,576 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.MediaMgr.resources\2.3.2930.23790_ja_3cda94b1926e6fbc\Sony.MediaSoftware.MediaMgr.resources.dll
+ 2008-08-26 05:16:09 2,142,208 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Sony.MediaSoftware.MediaMgr\2.3.2930.23790__3cda94b1926e6fbc\Sony.MediaSoftware.MediaMgr.dll
+ 2008-08-26 05:16:11 282,624 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Syncfusion.Core\4.102.0.62__632609b4d040f6b4\Syncfusion.Core.dll
+ 2008-08-26 05:16:11 16,384 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Syncfusion.Grid.Base\4.102.0.1003__3cda94b1926e6fbc\Syncfusion.Grid.Base.dll
+ 2008-08-26 05:16:11 1,527,808 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Syncfusion.Grid.Windows\4.102.0.1003__3cda94b1926e6fbc\Syncfusion.Grid.Windows.dll
+ 2008-08-26 05:16:12 1,208,320 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Syncfusion.Shared.Base\4.102.0.1003__3cda94b1926e6fbc\Syncfusion.Shared.Base.dll
+ 2008-08-26 05:16:12 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Syncfusion.Shared.Windows\4.102.0.1003__3cda94b1926e6fbc\Syncfusion.Shared.Windows.dll
+ 2008-08-26 05:16:12 16,384 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Syncfusion.Tools.Base\4.102.0.1003__3cda94b1926e6fbc\Syncfusion.Tools.Base.dll
+ 2008-08-26 05:16:12 2,297,856 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Syncfusion.Tools.Windows\4.102.0.1003__3cda94b1926e6fbc\Syncfusion.Tools.Windows.dll
+ 2008-08-26 05:17:34 712,704 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\log4net\363b5937b9ec1d5456b0014857e49e69\log4net.ni.dll
+ 2008-08-26 05:03:36 249,856 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.NetEnterp#\d62b526d1272eeaecfd853c43e71aa4f\Microsoft.NetEnterpriseServers.ExceptionMessageBox.ni.dll
+ 2008-08-26 05:03:44 90,112 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\12e799894c1489f12ca14adcbbb211a1\Microsoft.SqlServer.CustomControls.ni.dll
+ 2008-08-26 05:04:24 561,152 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\84d53b2db1d75c1e776fcf7b77493836\Microsoft.SqlServer.GridControl.ni.dll
+ 2008-08-26 05:11:19 1,028,096 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\bef302ed13baa690c3333ffe54a14f1d\Microsoft.SqlServer.WizardFrameworkLite.ni.dll
+ 2008-08-26 05:10:48 376,832 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\d7b4b5139c4f2ba122b5c92493806fae\Microsoft.SqlServer.Setup.ni.dll
+ 2008-08-26 05:16:54 221,184 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\NullableTypes\3b43fad2d3fe9ece4b0af4cfae1237a6\NullableTypes.ni.dll
+ 2008-08-26 05:17:32 1,040,384 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Sony.MediaSoftware.#\6857cfe10f516d0841981eb5ec5432df\Sony.MediaSoftware.clrshared.ni.dll
+ 2008-08-26 05:17:11 3,846,144 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Sony.MediaSoftware.#\a5e9d79fc420d67ad2ede90301a5f1d9\Sony.MediaSoftware.MediaMgr.ni.dll
+ 2008-08-26 05:17:36 389,120 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Syncfusion.Core\447e5e71e795c342bb9546e2e10a593c\Syncfusion.Core.ni.dll
+ 2008-08-26 05:17:24 18,432 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Syncfusion.Grid.Base\ee68255250f95f64d56c93d97b661e7e\Syncfusion.Grid.Base.ni.dll
+ 2008-08-26 05:17:05 4,497,408 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Syncfusion.Grid.Win#\0c4570dd99762d0a4188904ef4ebec92\Syncfusion.Grid.Windows.ni.dll
+ 2008-08-26 05:17:29 3,641,344 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Syncfusion.Shared.B#\0ddb92374124f3c5b0806534b4a76569\Syncfusion.Shared.Base.ni.dll
+ 2008-08-26 05:17:38 102,400 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Syncfusion.Shared.W#\68959841700e767dd432ec6100d59db1\Syncfusion.Shared.Windows.ni.dll
+ 2008-08-26 05:17:37 18,944 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Syncfusion.Tools.Ba#\1a8d7098dd316a30a75c663cca10b671\Syncfusion.Tools.Base.ni.dll
+ 2008-08-26 05:17:22 6,709,248 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Syncfusion.Tools.Wi#\b2fea00c7cc092f0d54b94d6eb985842\Syncfusion.Tools.Windows.ni.dll
+ 2008-08-07 13:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-08-26 13:55:34 8,237,056 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-08-26 13:55:34 299,008 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-08-07 13:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-08-26 13:55:32 8,237,056 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-08-26 13:55:32 299,008 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2007-02-10 02:09:12 127,856 ----a-w C:\WINDOWS\SQL9_KB948109_ENU\batchparser90.dll
+ 2007-02-10 02:09:20 1,039,728 ----a-w C:\WINDOWS\SQL9_KB948109_ENU\dbghelp.dll
+ 2007-02-10 02:15:30 1,160,560 ----a-w C:\WINDOWS\SQL9_KB948109_ENU\dumpdatastore.dll
+ 2008-07-19 05:28:52 2,527,232 ----a-w C:\WINDOWS\SQL9_KB948109_ENU\hotfix.exe
+ 2005-10-13 20:26:42 548,864 ----a-w C:\WINDOWS\SQL9_KB948109_ENU\msvcp80.dll
+ 2005-10-13 20:26:42 626,688 ----a-w C:\WINDOWS\SQL9_KB948109_ENU\msvcr80.dll
+ 2007-02-10 02:29:52 143,728 ----a-w C:\WINDOWS\SQL9_KB948109_ENU\sqlcmd.exe
+ 2007-02-10 02:29:52 533,872 ----a-w C:\WINDOWS\SQL9_KB948109_ENU\sqldiscoveryapi.dll
+ 2007-02-10 02:29:54 230,256 ----a-w C:\WINDOWS\SQL9_KB948109_ENU\sqlsetupvista.dll
- 2007-07-30 16:19:20 92,504 -c--a-w C:\WINDOWS\system32\dllcache\cdm.dll
+ 2008-07-18 19:10:48 94,920 -c--a-w C:\WINDOWS\system32\dllcache\cdm.dll
- 2007-07-30 16:19:36 549,720 -c--a-w C:\WINDOWS\system32\dllcache\wuapi.dll
+ 2008-07-18 19:09:44 563,912 -c--a-w C:\WINDOWS\system32\dllcache\wuapi.dll
- 2007-07-30 16:19:16 53,080 -c--a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
+ 2008-07-18 19:10:42 53,448 -c--a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
- 2007-07-30 16:19:42 1,712,984 -c--a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
+ 2008-07-18 19:09:42 1,811,656 -c--a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
- 2007-07-30 16:19:32 325,976 -c--a-w C:\WINDOWS\system32\dllcache\wucltui.dll
+ 2008-07-18 19:09:46 325,832 -c--a-w C:\WINDOWS\system32\dllcache\wucltui.dll
- 2007-07-30 16:18:40 33,624 -c--a-w C:\WINDOWS\system32\dllcache\wups.dll
+ 2008-07-18 19:10:20 36,552 -c--a-w C:\WINDOWS\system32\dllcache\wups.dll
- 2007-07-30 16:19:28 203,096 -c--a-w C:\WINDOWS\system32\dllcache\wuweb.dll
+ 2008-07-18 19:09:44 205,000 -c--a-w C:\WINDOWS\system32\dllcache\wuweb.dll
- 2008-08-24 12:59:56 600,528 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-08-25 19:01:02 600,528 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2008-08-21 15:52:23 81,922 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-08-27 14:57:02 99,804 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-08-21 15:52:23 96,340 ----a-w C:\WINDOWS\system32\perfc00B.dat
+ 2008-08-27 14:57:02 114,222 ----a-w C:\WINDOWS\system32\perfc00B.dat
- 2008-08-21 15:52:23 465,852 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-08-27 14:57:02 512,560 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-08-21 15:52:23 441,916 ----a-w C:\WINDOWS\system32\perfh00B.dat
+ 2008-08-27 14:57:02 488,624 ----a-w C:\WINDOWS\system32\perfh00B.dat
+ 2008-07-18 19:10:20 36,552 ----a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.784\wups.dll
+ 2008-07-18 19:10:40 45,768 ----a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.784\wups2.dll
+ 2007-02-10 02:29:52 67,952 ----a-w C:\WINDOWS\system32\sqlctr90.dll
+ 2007-02-10 02:29:52 2,234,224 ----a-w C:\WINDOWS\system32\sqlncli.dll
+ 2008-08-28 08:53:09 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5bc.dat
+ 2008-08-28 08:52:55 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_7e8.dat
- 2008-08-25 15:50:39 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_9b0.dat
+ 2008-08-28 08:53:22 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_9b0.dat
+ 2005-09-22 20:49:12 95,744 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841\ATL80.dll
+ 2005-09-22 22:16:02 1,093,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80.dll
+ 2005-09-22 22:16:06 1,079,808 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80u.dll
+ 2005-09-22 22:16:08 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80.dll
+ 2005-09-22 22:16:10 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80u.dll
+ 2005-09-22 21:58:06 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHS.dll
+ 2005-09-22 21:58:06 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHT.dll
+ 2005-09-22 21:58:06 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80DEU.dll
+ 2005-09-22 21:58:06 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ENU.dll
+ 2005-09-22 21:58:06 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ESP.dll
+ 2005-09-22 21:58:06 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80FRA.dll
+ 2005-09-22 21:58:06 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ITA.dll
+ 2005-09-22 21:58:06 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80JPN.dll
+ 2005-09-22 21:58:06 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80KOR.dll
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 19:12 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-14 15:39 68856]
"F-Secure GUI component"="C:\Program Files\F-Secure\FSGUI\fsguiexe.exe" [2004-09-09 17:07 213051]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackgroundSwitcher"="C:\WINDOWS\system32\bgswitch.exe" [2001-10-19 13:14 19520]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [2001-10-19 13:14 45632]
"Elisa Avustaja"="C:\Program Files\Elisa\Avustaja\Elisa.exe" [2007-10-22 16:15 189768]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 22:12 30248]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 22:10 46632]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2003-11-10 18:06 406016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"ControlCenter3"="C:\Program Files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 16:58 65536]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 10:03 210472]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 17:38 78008]
"SoundMan"="SOUNDMAN.EXE" [2004-12-22 19:09 77824 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 19:29 39264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"rqbmvpso"= {549488B7-0277-4067-A19A-81113C8487CD} - C:\WINDOWS\rqbmvpso.dll [2008-08-24 13:45 188416]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonui.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\mshta.exe"=
"C:\\WINDOWS\\system32\\java.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe"=
"C:\\Program Files\\Tremulous\\tremulous.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Documents and Settings\\Kristian\\Omat tiedostot\\CS\\hl.exe"=
"C:\\Program Files\\Codemasters\\Worms 4 Mayhem\\WORMS 4 MAYHEM.EXE"=
"C:\\Program Files\\Xider\\EsR DEMO\\ESR DEMO.exe"=
"C:\\Program Files\\ActionWheelRacer\\wheelracer.exe"=
"C:\\MBHH2003\\Huvi\\BVolley\\volley.exe"=
"C:\\Program Files\\Silent Grove Studios\\Dawnspire\\Dawnspire.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe"=
"C:\\Documents and Settings\\Kristian\\Omat tiedostot\\CS\\hlds.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windowsin vertaisjärjestelmäryhmittely
"3540:UDP"= 3540:UDP:PNRP (Peer Name Resolution Protocol)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2004-09-17 17:52]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 17:35]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 17:37]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2008-01-29 17:11]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 19:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2004-09-10 19:14]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2003-02-06 15:32]
R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-10-12 08:34]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2008-04-14 19:12]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2007-11-15 22:38]
R3 3xHybrid;Pinnacle PCTV 300i Stereo DVB-T;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2004-09-03 13:14]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-02-26 22:08]
S3 p2pgasvc;Vertaisverkon ryhmätodennus;C:\WINDOWS\system32\svchost.exe [2008-04-14 19:12]
S3 p2pimsvc;Vertaisverkon käyttäjätietojen hallinta;C:\WINDOWS\system32\svchost.exe [2008-04-14 19:12]
S3 p2psvc;Vertaisverkko;C:\WINDOWS\system32\svchost.exe [2008-04-14 19:12]
S3 PNRPSvc;Vertaiskoneen nimenselvitysprotokolla;C:\WINDOWS\system32\svchost.exe [2008-04-14 19:12]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-08-23 18:11]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
'Ajoitetut tehtävät'-kansion sisältö

2008-08-23 C:\WINDOWS\Tasks\1-Click Maintenance.job
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe [2008-01-08 13:31]

2008-08-05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57]

2008-08-28 C:\WINDOWS\Tasks\MP Scheduled Scan.job
- C:\Program Files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]

2008-08-28 C:\WINDOWS\Tasks\Scheduled scanning task.job
- C:\PROGRA~1\F-Secure\ANTI-V~1\fsav.exe [2004-08-30 19:18]

2008-08-28 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.fi/
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/keyword/%s
O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 -: Open Picture in &Microsoft PhotoDraw - C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-28 14:15:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-28 14:17:22
ComboFix-quarantined-files.txt 2008-08-28 11:17:16
ComboFix2.txt 2008-08-25 19:21:32
ComboFix3.txt 2008-08-25 16:01:42

Pre-Run: 95,065,415,680 tavua vapaana
Post-Run: 95,240,491,008 tavua vapaana

445 --- E O F --- 2008-08-27 05:29:20


Malwarebyes loki.

Malwarebytes' Anti-Malware 1.25
Tietokantaversio: 1062
Windows 5.1.2600 Service Pack 3

14:03:14 28.8.2008
mbam-log-08-28-2008 (14-03-03).txt

Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 238487
Kulunut aika: 1 hour(s), 54 minute(s), 41 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 1
Saastuneita rekisteriarvoja: 1
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 3
Saastuneita tiedostoja: 18

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> No action taken.

Saastuneita rekisteriarvoja:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0\source (Trojan.FakeAlert) -> No action taken.

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
C:\WINDOWS\privacy_danger (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\privacy_danger\images (Trojan.FakeAlert) -> No action taken.
C:\Program Files\Adware Away (Rogue.AdwareAway) -> No action taken.

Saastuneita tiedostoja:
C:\WINDOWS\privacy_danger\index.htm (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\privacy_danger\images\capt.gif (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\privacy_danger\images\danger.jpg (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\privacy_danger\images\down.gif (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\privacy_danger\images\spacer.gif (Trojan.FakeAlert) -> No action taken.
C:\Program Files\Adware Away\explorerbar.tmp (Rogue.AdwareAway) -> No action taken.
C:\Program Files\Adware Away\folderdll.tmp (Rogue.AdwareAway) -> No action taken.
C:\Program Files\Adware Away\nameserver.tmp (Rogue.AdwareAway) -> No action taken.
C:\Program Files\Adware Away\notifydll.tmp (Rogue.AdwareAway) -> No action taken.
C:\Program Files\Adware Away\protocolfilter.tmp (Rogue.AdwareAway) -> No action taken.
C:\Program Files\Adware Away\securitysite.tmp (Rogue.AdwareAway) -> No action taken.
C:\Program Files\Adware Away\shellextension.tmp (Rogue.AdwareAway) -> No action taken.
C:\Program Files\Adware Away\shellextensionhook.tmp (Rogue.AdwareAway) -> No action taken.
C:\Program Files\Adware Away\SPAP.tmp (Rogue.AdwareAway) -> No action taken.
C:\Program Files\Adware Away\svchostdll.tmp (Rogue.AdwareAway) -> No action taken.
C:\Program Files\Adware Away\sysrestriction.tmp (Rogue.AdwareAway) -> No action taken.
C:\Program Files\Adware Away\uninstall.tmp (Rogue.AdwareAway) -> No action taken.
C:\WINDOWS\adaway.lic (Rogue.AdwareAway) -> No action taken.


SDFix loki.


SDFix: Version 1.219
Run by Kristian on to 28.08.2008 at 14:26

Microsoft Windows XP [versio 5.1.2600]
Running From: C:\Documents and Settings\Kristian\Omat tiedostot\viruspoisto\SDfix\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\privacy_danger\index.htm - Deleted
C:\WINDOWS\privacy_danger\images\capt.gif - Deleted
C:\WINDOWS\privacy_danger\images\danger.jpg - Deleted
C:\WINDOWS\privacy_danger\images\down.gif - Deleted
C:\WINDOWS\privacy_danger\images\spacer.gif - Deleted



Folder C:\WINDOWS\privacy_danger - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-28 14:34:57
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:2a,5c,d0,23,3f,62,5f,bf,8b,2d,a4,9d,14,98,83,95,c6,f9,32,46,a8,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000001
"khjeh"=hex:6e,d1,1c,e5,d8,35,0a,6e,f3,7d,82,6e,38,82,37,a4,24,27,e7,a1,42,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,f4,55,49,29,75,72,2a,3d,14,92,c9,08,08,f5,a9,66,9a,..
"khjeh"=hex:4a,b6,fa,a4,db,2f,bb,9a,f2,36,29,ae,81,ef,0e,d0,ce,fa,fe,79,17,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:c4,2a,2c,cf,6a,18,cf,ee,dd,e5,be,af,56,85,9e,1f,af,db,9c,8f,8b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:a1,06,71,a1,75,00,0c,33,9c,21,00,24,c3,a6,15,00,73,7c,28,8f,a6,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:2a,5c,d0,23,3f,62,5f,bf,8b,2d,a4,9d,14,98,83,95,c6,f9,32,46,a8,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000001
"khjeh"=hex:6e,d1,1c,e5,d8,35,0a,6e,f3,7d,82,6e,38,82,37,a4,24,27,e7,a1,42,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,f4,55,49,29,75,72,2a,3d,14,92,c9,08,08,f5,a9,66,9a,..
"khjeh"=hex:4a,b6,fa,a4,db,2f,bb,9a,f2,36,29,ae,81,ef,0e,d0,ce,fa,fe,79,17,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:9c,e4,24,71,c7,cb,51,94,51,16,5b,e5,aa,77,10,e8,1f,3d,6d,59,f0,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:a1,06,71,a1,75,00,0c,33,9c,21,00,24,c3,a6,15,00,73,7c,28,8f,a6,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:2a,5c,d0,23,3f,62,5f,bf,8b,2d,a4,9d,14,98,83,95,c6,f9,32,46,a8,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000001
"khjeh"=hex:6e,d1,1c,e5,d8,35,0a,6e,f3,7d,82,6e,38,82,37,a4,24,27,e7,a1,42,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,f4,55,49,29,75,72,2a,3d,14,92,c9,08,08,f5,a9,66,9a,..
"khjeh"=hex:4a,b6,fa,a4,db,2f,bb,9a,f2,36,29,ae,81,ef,0e,d0,ce,fa,fe,79,17,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:9c,e4,24,71,c7,cb,51,94,51,16,5b,e5,aa,77,10,e8,1f,3d,6d,59,f0,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:a1,06,71,a1,75,00,0c,33,9c,21,00,24,c3,a6,15,00,73,7c,28,8f,a6,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Pinnacle\\MediaCenter\\PMC.exe"="C:\\Program Files\\Pinnacle\\MediaCenter\\PMC.exe:LocalSubNet:Enabled:Pmc.exe"
"C:\\Program Files\\Pinnacle\\MediaCenter\\PmcSettings.exe"="C:\\Program Files\\Pinnacle\\MediaCenter\\PmcSettings.exe:LocalSubNet:Enabled:pmcsettings.exe"
"C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe:LocalSubNet:Enabled:PMSManager.exe"
"C:\\Program Files\\Pinnacle\\MediaCenter\\tvtvWizard.exe"="C:\\Program Files\\Pinnacle\\MediaCenter\\tvtvWizard.exe:LocalSubNet:Enabled:tvtvWizard.exe"
"C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaServer\\PMSInstallInit.exe"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaServer\\PMSInstallInit.exe:LocalSubNet:Enabled:PMSInstallInit.exe"
"C:\\WINDOWS\\system32\\mshta.exe"="C:\\WINDOWS\\system32\\mshta.exe:*:Enabled:Microsoft (R) HTML Application host"
"C:\\WINDOWS\\system32\\java.exe"="C:\\WINDOWS\\system32\\java.exe:*:Disabled:Java(TM) 2 Platform Standard Edition binary"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe"="C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe:*:Enabled:Avustaja"
"C:\\Program Files\\Tremulous\\tremulous.exe"="C:\\Program Files\\Tremulous\\tremulous.exe:*:Enabled:tremulous"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"="C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe:*:Enabled:F-Secure Automatic Update"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Documents and Settings\\Kristian\\Omat tiedostot\\CS\\hl.exe"="C:\\Documents and Settings\\Kristian\\Omat tiedostot\\CS\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Codemasters\\Worms 4 Mayhem\\WORMS 4 MAYHEM.EXE"="C:\\Program Files\\Codemasters\\Worms 4 Mayhem\\WORMS 4 MAYHEM.EXE:*:Enabled:Worms 4 Mayhem"
"C:\\Program Files\\Pinnacle\\MediaCenter\\EpgSpoolerSrv.exe"="C:\\Program Files\\Pinnacle\\MediaCenter\\EpgSpoolerSrv.exe:LocalSubNet:Disabled:EpgSpoolerSrv.exe"
"C:\\Program Files\\Xider\\EsR DEMO\\ESR DEMO.exe"="C:\\Program Files\\Xider\\EsR DEMO\\ESR DEMO.exe:*:Disabled:ESR DEMO"
"C:\\Program Files\\ActionWheelRacer\\wheelracer.exe"="C:\\Program Files\\ActionWheelRacer\\wheelracer.exe:*:Disabled:wheelracer"
"C:\\MBHH2003\\Huvi\\BVolley\\volley.exe"="C:\\MBHH2003\\Huvi\\BVolley\\volley.exe:*:Disabled:volley"
"C:\\Program Files\\Silent Grove Studios\\Dawnspire\\Dawnspire.exe"="C:\\Program Files\\Silent Grove Studios\\Dawnspire\\Dawnspire.exe:*:Enabled:Dawnspire"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\\Documents and Settings\\Kristian\\Omat tiedostot\\CS\\hlds.exe"="C:\\Documents and Settings\\Kristian\\Omat tiedostot\\CS\\hlds.exe:*:Enabled:HLDS Launcher"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaCenterService\\PMC.Service.Main.exe"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaCenterService\\PMC.Service.Main.exe:LocalSubNet:Disabled:PMCService"
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe:*:Enabled:Et?tuki - Windows Messenger ja ??niyhteys"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :


File Backups: - C:\DOCUME~1\Kristian\OMATTI~1\VIRUSP~1\SDfix\SDFix\backups\backups.zip

Files with Hidden Attributes :

Fri 11 Mar 2005 325 ..SH. --- "C:\BOOT.BAK"
Mon 12 Oct 1998 233,472 A..H. --- "C:\Program Files\eGames\Blast Thru Special Edition\WCSUP.DLL"
Fri 17 Jul 1998 1,315,072 A..H. --- "C:\Program Files\eGames\Moonshot\wcsup.dll"
Tue 28 Sep 1999 794,112 A..H. --- "C:\Program Files\eGames\Nebula Fighter Special Edition\WCSUP.DLL"
Sun 6 Feb 2000 69,632 A..H. --- "C:\Program Files\eGames\Tile Blazer Special Edition\WCSUP.DLL"
Wed 19 Sep 2007 70,144 ..SHR --- "C:\Program Files\Xider\EsR DEMO\Setup.exe"
Mon 23 Jul 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a7b63628b39fd8bdb7e535e34d0ea696\BIT3.tmp"
Wed 27 Aug 2008 165,232 A..H. --- "C:\Documents and Settings\Kristian\Application Data\Microsoft\Virtual PC\VPCKeyboard.dll"
Fri 2 Nov 2007 28,672 A..H. --- "C:\Documents and Settings\Kristian\Omat tiedostot\aq\AQ Elite [Lore3403]\AxInterop.ShockwaveFlashObjects.dll"
Fri 2 Nov 2007 32,768 A..H. --- "C:\Documents and Settings\Kristian\Omat tiedostot\aq\AQ Elite [Lore3403]\Interop.ShockwaveFlashObjects.dll"

Finished!

Ja vielä uusi HJT loki

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:52:42, on 28.8.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Fast.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Elisa\Avustaja\Elisa.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [BackgroundSwitcher] C:\WINDOWS\system32\bgswitch.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [Elisa Avustaja] "C:\Program Files\Elisa\Avustaja\Elisa.exe"
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [F-Secure GUI component] C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Sol...wn.cab56986.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resourc...lscbase5036.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupd...b?1170431845328
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O21 - SSODL: rqbmvpso - {549488B7-0277-4067-A19A-81113C8487CD} - C:\WINDOWS\rqbmvpso.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Pinnacle Systems tvtv Spooler (EpgSpooler) - - c:\progra~1\pinnacle\mediac~1\epgspo~2.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Program Files\TuneUp WinStyler\WinStylerThemeSvc.exe (file missing)
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 9233 bytes


huhhuh tulipa paljon tekstiä... Mutta voitteko nyt neuvoa vähän tuon viruksen poistossa
[ + lainaa]
Hujo
Suspended permanently
_ 		28. elokuuta 2008 @ 15:23 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Lataa Tästä Ccleaner
CCleaner v2.05.555- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
Asennuksen jälkeen aukaise CCleaner.
Valitse vasemmalta pystyrivistä Options.
Valitse viereisestä pystyrivistä Settings.
Language kohtaan valitse Suomi.

Puhdistaja
Valitse vasemmalta pystyrivistä Puhdistaja.
Paina alhaalta Tutki.
Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
Kun tutkiminen on valmis, paina Aja CCleaner.
Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.

Rekisterin virheiden korjaus
Valitse vasemmalta pystyrivistä Rekisteri.
Paina alhaalta Etsi rekisterin virheitä.
Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
Saat vielä varmistus kysymyksen, paina Ok.
Kun virheet on korjattu, paina Sulje.
Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.

================

Sitten uusiksi tuo Malwarebytes' Anti-Malware ajo

5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.

===============

sitten koneella on avast ja F-secure kumpi on käytössä
[ + lainaa]
Voiko tietsikka koskaan toimia?

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 28. elokuuta 2008 @ 15:29
krizu7
Junior Member
_ 		28. elokuuta 2008 @ 16:28 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
tuosta vielä että laitanko täyden skannin anti-malwareen
ps. käytän pääosassa avastia. pitäisikö f-secure poistaa

EDIT: laitoin nyt täyden skannin meneen :)
[ + lainaa]

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 28. elokuuta 2008 @ 16:39
Hujo
Suspended permanently
_ 		28. elokuuta 2008 @ 16:56 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
juu laita täysi scannaus anti-malwareen

Poista F-secure


[ + lainaa]
Voiko tietsikka koskaan toimia?
krizu7
Junior Member
_ 		28. elokuuta 2008 @ 18:24 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
noniin, f-secure lähti, anti-malwarenkin tarkistus on kohta lopuillaan, mutta ruutuun aukeaa noin 30 min välein tätä system-defender pas*aa http://www.system-defender.com/freeware/...=&lndid=37&p=01 <-- tuota... hermot meneeeeeee
[ + lainaa]

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 28. elokuuta 2008 @ 18:26
krizu7
Junior Member
_ 		28. elokuuta 2008 @ 18:30 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
noniin, anti-malware skannaus loppu ja tässä loki:

Malwarebytes' Anti-Malware 1.25
Tietokantaversio: 1062
Windows 5.1.2600 Service Pack 3

18:26:09 28.8.2008
mbam-log-08-28-2008 (18-26-09).txt

Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 236781
Kulunut aika: 1 hour(s), 46 minute(s), 38 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 1
Saastuneita rekisteriarvoja: 1
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 2
Saastuneita tiedostoja: 5

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Saastuneita rekisteriarvoja:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0\source (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
C:\WINDOWS\privacy_danger (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Saastuneita tiedostoja:
C:\WINDOWS\privacy_danger\index.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\capt.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\danger.jpg (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\down.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\spacer.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.


ja puhdistin myös CCleanerilla.

mutta vieläkin tuo pas*a tulee käynnistäessä ja tuota system-defenderiikin vielä tulee
[ + lainaa]

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 28. elokuuta 2008 @ 18:34
Hujo
Suspended permanently
_ 		28. elokuuta 2008 @ 18:43 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
hmm...

et vieläkään tehnyt tuota

6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.

================

Tarkista koneesi F-Securen online skannerilla

Huom, skanneri toimii vain Internet Explorer selaimella

* Lue sivun ohjeet huolella läpi
* Klikkaa Start scanning
* Mikäli saat [color=blue]Internet Explorer[/color] -suojausvaroituksen, klikkaa Asenna
* Klikkaa Accept
* Klikkaa Custom Scan
* Säädä asetukset seuraavasti

o "Virus Scan Option" kohdasta valitse Scan whole system
o "Other Scan Option" kohdasta valitse Scan All Files
o Valitse Scan whole system for rootkits
o Valitse Scan whole system for spyware
o Laita ruksi kohtaan Scan inside archives
o Varmista että Use advanced heuristics on valittuna

* Klikkaa Start
* Skannaus käynnistyy kun tarvittavat tiedostot/päivitykset on ladattu
* Odota kärsivällisesti
* Kun sakannaus on suoritettu, klikkaa Automatic cleaning
* Klikkaa Show Report
* Raportti aukeaa selaimessa, kopioi teksti kokonaan
* Liitä kopioitu teksti esim. muistioon tai Wordiin ja tallenna työpöydälle
* Voit sulkea skannerin
* Lähetä raportti viestiketjuusi

Älä tee muuta sillä voi aiheuttaa koneen jumiutumisen

==============

Poista tuo ja lataa uusi versio

SmitFraudFix v2.339
uusi versio on v2.341
[ + lainaa]
Voiko tietsikka koskaan toimia?

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 28. elokuuta 2008 @ 18:51
krizu7
Junior Member
_ 		28. elokuuta 2008 @ 19:04 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
hmm, siis olen poistanut nuo, mutta nuo lokitiedostot olen ottanut ennen poistamista kun tallensin ne omiin tiedostoihin (ssis ennen poistamista tallennettu loki)
mutta nyt skannaan tuolla
[ + lainaa]
krizu7
Junior Member
_ 		28. elokuuta 2008 @ 19:18 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
ja hmm, tuossa linkissä oli vanha 2.339? mulla on se jo
[ + lainaa]
Hujo
Suspended permanently
_ 		28. elokuuta 2008 @ 19:31 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
tuolla ylhäälä on tämmönen kohta
Lataa SmitfraudFix (c) S!Ri
sitä kun Klikkaa ei tuu vanhaa

Klikka tuosta
Linkki
[ + lainaa]
Voiko tietsikka koskaan toimia?

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 28. elokuuta 2008 @ 19:33
krizu7
Junior Member
_ 		29. elokuuta 2008 @ 14:25 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Njoo, tässä f-securen loki:

Scanning Report
Friday, August 29, 2008 07:24:03 - 14:07:39
Computer name: WINXP-SP2
Scanning type: Scan system for malware, rootkits
Target: C:\


--------------------------------------------------------------------------------

Result: 16 malware found
FraudTool.Win32.MSAntivirus (spyware)
System
Rogue:W32/IeDefender.CT (spyware)
System
TrackingCookie.2o7 (spyware)
System
TrackingCookie.Advertising (spyware)
System
TrackingCookie.Atdmt (spyware)
System
TrackingCookie.Doubleclick (spyware)
System
TrackingCookie.Tradedoubler (spyware)
System
TrackingCookie.Webtrends (spyware)
System
TrackingCookie.Xiti (spyware)
System
TrackingCookie.Yieldmanager (spyware)
System
Trojan-Downloader.Win32.Agent.adfi (virus)
C:\Program Files\Trend Micro\HijackThis\backups\backup-20080823-203248-381.dll (Renamed & Submitted)
Trojan.Win32.Agent (virus)
System
Trojan.Win32.Agent.zfy (virus)
C:\SOUND_VER1.1577.0.MP3.0XE
Trojan.Win32.Monderc (virus)
System
Trojan.Win32.Monderc.gen (virus)
C:\WINDOWS\system32\OPNKIJHB.0LL
Trojan.Win32.Small.xsi (virus)
C:\QooBox\Quarantine\C\Documents and Settings\Kristian\Application Data\Adobe\Manager.exe.vir (Renamed)

--------------------------------------------------------------------------------

Statistics
Scanned:
Files: 649403
System: 7783
Not scanned: 262
Actions:
Disinfected: 0
Renamed: 2
Deleted: 0
None: 14
Submitted: 1
Files not scanned:
?????IBERFIL.SYS
C:\PAGEFILE.SYS
C:\WINDOWS\TEMP\PERFLIB_PERFDATA_32C.DAT
C:\WINDOWS\TEMP\PERFLIB_PERFDATA_640.DAT
C:\WINDOWS\TEMP\PERFLIB_PERFDATA_778.DAT
C:\WINDOWS\TEMP\PERFLIB_PERFDATA_7D0.DAT
C:\WINDOWS\TEMP\PERFLIB_PERFDATA_930.DAT
C:\WINDOWS\TEMP\_AVAST4_\WEBSHLOCK.TXT
C:\WINDOWS\SYSTEM32\BIOS1.ROM
C:\WINDOWS\SYSTEM32\XMDFKIRW.DLL
C:\WINDOWS\SYSTEM32\DRIVERS\SPTD.SYS
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SAM
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.TMP.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG
bios1.rom
main_file_cache.dat
vanhat/main_file_cache.dat
C:\WINDOWS\.SILABCLIENT_STORE_32\MAIN_FILE_CACHE.DAT
C:\WINDOWS\.RK_SAVE_32\MAIN_FILE_CACHE.DAT
vanhat/main_file_cache.dat
main_file_cache.dat
C:\WINDOWS\.OBGARG\CACHE\MAIN_FILE_CACHE.DAT
C:\WINDOWS\.OBGARG\CACHE\VANHAT\MAIN_FILE_CACHE.DAT
C:\WINDOWS\.MPR_FILE_STORE_32\MAIN_FILE_CACHE.DAT
C:\WINDOWS\.MPR_FILE_STORE_32\VANHAT\MAIN_FILE_CACHE.DAT
C:\WINDOWS\.JAGEX_CACHE_32\RUNESCAPE\MAIN_FILE_CACHE.DAT2
C:\WINDOWS\.JAGEX_CACHE_32\RUNESCAPE\MAIN_FILE_CACHE.IDX13
C:\WINDOWS\.JAGEX_CACHE_32\MONKEYPUZZLE2\MAIN_FILE_CACHE.DAT2
C:\PROGRAM FILES\WSOY\SUOMEN LINNUT 2 CD-FACTA\ISHIELD\SETUP.ILG
C:\PROGRAM FILES\THOOSJE SIDEBAR V2.3\APPDATA\{CF803823-A125-480C-9B0B-B7EED5FD98C2}.DXSTAT
C:\PROGRAM FILES\PROJECT64 1.6\SAVE\SMASH BROTHERS.SRA
JSR Client\cache\main_file_cache.dat
C:\PROGRAM FILES\MOPARSCAPE\HYBRIDSCAPE\DATA\SELLABLE.DAT
C:\PROGRAM FILES\MOPARSCAPE\HYBRIDSCAPE\DATA\TRADEABLE.DAT
C:\PROGRAM FILES\MOPARSCAPE\HYBRIDSCAPE\DATA\TWOHANDED.DAT
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\MASTER.MDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\MASTLOG.LDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\MODEL.MDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\MODELLOG.LDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\PINNACLESYS_GLOBALCONTEXT.MDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\PINNACLESYS_GLOBALCONTEXT_LOG.LDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\TEMPDB.MDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\TEMPLOG.LDF
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\FACES.R8
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\GASPUMP1.R8
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\NCALL.R8
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\PARTH.R8
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\SMOKE_BK.R8
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\SMOKE_WT.R8
C:\PROGRAM FILES\INSTALLSHIELD INSTALLATION INFORMATION\{6304CCF6-3343-4DA5-96B6-84B3A644B93B}\SETUP.ILG
C:\PROGRAM FILES\INSTALLSHIELD INSTALLATION INFORMATION\{0552A36D-0D7E-4FF5-8FDB-6629ABA7C779}\SETUP.ILG
C:\PROGRAM FILES\INFOGRAMES\ASTERIX MEGA MADNESS\MINI GAME\ASTERIX.CFG
C:\PROGRAM FILES\GREENSTREET\GAMES\SUPER BUBBLE POP\TEMP\SHOCK.CHN
C:\PROGRAM FILES\EGAMES\NEBULA FIGHTER SPECIAL EDITION\MENU\1ROCK-A.CKY
C:\PROGRAM FILES\EGAMES\NEBULA FIGHTER SPECIAL EDITION\MENU\2TORP-A.CKY
C:\PROGRAM FILES\EGAMES\NEBULA FIGHTER SPECIAL EDITION\MENU\3SMAS-A.CKY
C:\PROGRAM FILES\EGAMESX???
C:\HIBERFIL.SYS
C:\PAGEFILE.SYS
C:\WINDOWS\TEMP\PERFLIB_PERFDATA_32C.DAT
C:\WINDOWS\TEMP\PERFLIB_PERFDATA_640.DAT
C:\WINDOWS\TEMP\PERFLIB_PERFDATA_778.DAT
C:\WINDOWS\TEMP\PERFLIB_PERFDATA_7D0.DAT
C:\WINDOWS\TEMP\PERFLIB_PERFDATA_930.DAT
C:\WINDOWS\TEMP\_AVAST4_\WEBSHLOCK.TXT
C:\WINDOWS\SYSTEM32\BIOS1.ROM
C:\WINDOWS\SYSTEM32\XMDFKIRW.? lxm??OWS\SYSTEM32\DRIVERS\SPTD.SYS
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SAM
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.TMP.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG
bios1.rom
main_file_cache.dat
vanhat/main_file_cache.dat
C:\WINDOWS\.SILABCLIENT_STORE_32\MAIN_FILE_CACHE.DAT
C:\WINDOWS\.RK_SAVE_32\MAIN_FILE_CACHE.DAT
vanhat/main_file_cache.dat
main_file_cache.dat
C:\WINDOWS\.OBGARG\CACHE\MAIN_FILE_CACHE.DAT
C:\WINDOWS\.OBGARG\CACHE\VANHAT\MAIN_FILE_CACHE.DAT
C:\WINDOWS\.MPR_FILE_STORE_32\MAIN_FILE_CACHE.DAT
C:\WINDOWS\.MPR_FILE_STORE_32\VANHAT\MAIN_FILE_CACHE.DAT
C:\WINDOWS\.JAGEX_CACHE_32\RUNESCAPE\MAIN_FILE_CACHE.DAT2
C:\WINDOWS\.JAGEX_CACHE_32\RUNESCAPE\MAIN_FILE_CACHE.IDX13
C:\WINDOWS\.JAGEX_CACHE_32\MONKEYPUZZLE2\MAIN_FILE_CACHE.DAT2
C:\PROGRAM FILES\WSOY\SUOMEN LINNUT 2 CD-FACTA\ISHIELD\SETUP.ILG
C:\PROGRAM FILES\THOOSJE SIDEBAR V2.3\APPDATA\{CF803823-A125-480C-9B0B-B7EED5FD98C2}.DXSTAT
C:\PROGRAM FILES\PROJECT64 1.6\SAVE\SMASH BROTHERS.SRA
JSR Client\cache\main_file_cache.dat
C:\PROGRAM FILES\MOPARSCAPE\HYBRIDSCAPE\DATA\SELLABLE.DAT
C:\PROGRAM FILES\MOPARSCAPE\HYBRIDSCAPE\DATA\TRADEABLE.DAT
C:\PROGRAM FILES\MOPARSCAPE\HYBRIDSCAPE\DATA\TWOHANDED.DAT
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\MASTER.MDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\MASTLOG.LDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\MODEL.MDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\MODELLOG.LDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\PINNACLESYS_GLOBALCONTEXT.MDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\PINNACLESYS_GLOBALCONTEXT_LOG.LDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\TEMPDB.MDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\TEMPLOG.LDF
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\FACES.R8
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\GASPUMP1.R8
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\NCALL.R8
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\PARTH.R8
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\SMOKE_BK.R8
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\SMOKE_WT.R8
C:\PROGRAM FILES\INSTALLSHIELD INSTALLATION INFORMATION\{6304CCF6-3343-4DA5-96B6-84B3A644B93B}\SETUP.ILG
C:\PROGRAM FILES\INSTALLSHIELD INSTALLATION INFORMATION\{0552A36D-0D7E-4FF5-8FDB-6629ABA7C779}\SETUP.ILG
C:\PROGRAM FILES\INFOGRAMES\ASTERIX MEGA MADNESS\MINI GAME\ASTERIX.CFG
C:\PROGRAM FILES\GREENSTREET\GAMES\SUPER BUBBLE POP\TEMP\SHOCK.CHN
C:\PROGRAM FILES\EGAMES\NEBULA FIGHTER SPECIAL EDITION\MENU\1ROCK-A.CKY
C:\PROGRAM FILES\EGAMES\NEBULA FIGHTER SPECIAL EDITION\MENU\2TORP-A.CKY
C:\PROGRAM FILES\EGAMES\NEBULA FIGHTER SPECIAL EDITION\MENU\3SMAS-A.CKY
C:\PROGRAM FILES\EGAMES\NEBULA FIGHTER SPECIAL EDITION\MENU\4LASE-A.CKY
C:\PROGRAM FILES\EGAMES\NEBULA FIGHTER SPECIAL EDITION\MENU\LOGOLGT.CKY C:\HIBERFIL.SYS
C:\PAGEFILE.SYS
C:\WINDOWS\TEMP\PERFLIB_PERFDATA_32C.DAT
C:\WINDOWS\TEMP\PERFLIB_PERFDATA_640.DAT
C:\WINDOWS\TEMP\PERFLIB_PERFDATA_778.DAT
C:\WINDOWS\TEMP\PERFLIB_PERFDATA_7D0.DAT
C:\WINDOWS\TEMP\PERFLIB_PERFDATA_930.DAT
C:\WINDOWS\TEMP\_AVAST4_\WEBSHLOCK.TXT
C:\WINDOWS\SYSTEM32\BIOS1.ROM
C:\WINDOWS\SYSTEM32\XMDFKIRW.DLL
C:\WINDOWS\SYSTEM32\DRIVERS\SPTD.SYS
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SAM
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.TMP.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG
bios1.rom
main_file_cache.dat
vanhat/main_file_cache.dat
C:\WINDOWS\.SILABCLIENT_STORE_32\MAIN_FILE_CACHE.DAT
C:\WINDOWS\.RK_SAVE_32\MAIN_FILE_CACHE.DAT
vanhat/main_file_cache.dat
main_file_cache.dat
C:\WINDOWS\.OBGARG\CACHE\MAIN_FILE_CACHE.DAT
C:\WINDOWS\.OBGARG\CACHE\VANHAT\MAIN_FILE_CACHE.DAT
C:\WINDOWS\.MPR_FILE_STORE_32\MAIN_FILE_CACHE.DAT
C:\WINDOWS\.MPR_FILE_STORE_32\VANHAT\MAIN_FILE_CACHE.DAT
C:\WINDOWS\.JAGEX_CACHE_32\RUNESCAPE\MAIN_FILE_CACHE.DAT2
C:\WINDOWS\.JAGEX_CACHE_32\RUNESCAPE\MAIN_FILE_CACHE.IDX13
C:\WINDOWS\.JAGEX_CACHE_32\MONKEYPUZZLE2\MAIN_FILE_CACHE.DAT2
C:\PROGRAM FILES\WSOY\SUOMEN LINNUT 2 CD-FACTA\ISHIELD\SETUP.ILG
C:\PROGRAM FILES\THOOSJE SIDEBAR V2.3\APPDATA\{CF803823-A125-480C-9B0B-B7EED5FD98C2}.DXSTAT
C:\PROGRAM FILES\PROJECT64 1.6\SAVE\SMASH BROTHERS.SRA
JSR Client\cache\main_file_cache.dat
C:\PROGRAM FILES\MOPARSCAPE\HYBRIDSCAPE\DATA\SELLABLE.DAT
C:\PROGRAM FILES\MOPARSCAPE\HYBRIDSCAPE\DATA\TRADEABLE.DAT
C:\PROGRAM FILES\MOPARSCAPE\HYBRIDSCAPE\DATA\TWOHANDED.DAT
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\MASTER.MDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\MASTLOG.LDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\MODEL.MDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\MODELLOG.LDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\PINNACLESYS_GLOBALCONTEXT.MDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\PINNACLESYS_GLOBALCONTEXT_LOG.LDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\TEMPDB.MDF
C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$PINNACLESYS\DATA\TEMPLOG.LDF
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\FACES.R8
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\GASPUMP1.R8
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\NCALL.R8
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\PARTH.R8
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\SMOKE_BK.R8
C:\PROGRAM FILES\MICROSOFT GAMES\MICROSOFT FLIGHT SIMULATOR X\TEXTURE\SMOKE_WT.R8
C:\PROGRAM FILES\INSTALLSHIELD INSTALLATION INFORMATION\{6304CCF6-3343-4DA5-96B6-84B3A644B93B}\SETUP.ILG
C:\PROGRAM FILES\INSTALLSHIELD INSTALLATION INFORMATION\{0552A36D-0D7E-4FF5-8FDB-6629ABA7C779}\SETUP.ILG
C:\PROGRAM FILES\INFOGRAMES\ASTERIX MEGA MADNESS\MINI GAME\ASTERIX.CFG
C:\PROGRAM FILES\GREENSTREET\GAMES\SUPER BUBBLE POP\TEMP\SHOCK.CHN
C:\PROGRAM FILES\EGAMES\NEBULA FIGHTER SPECIAL EDITION\MENU\1ROCK-A.CKY
C:\PROGRAM FILES\EGAMES\NEBULA FIGHTER SPECIAL EDITION\MENU\2TORP-A.CKY
C:\PROGRAM FILES\EGAMES\NEBULA FIGHTER SPECIAL EDITION\MENU\3SMAS-A.CKY
C:\PROGRAM FILES\EGAMES\NEBULA FIGHTER SPECIAL EDITION\MENU\4LASE-A.CKY
C:\PROGRAM FILES\EGAMES\NEBULA FIGHTER SPECIAL EDITION\MENU\LOGOLGT.CKY
C:\PROGRAM FILES\EGAMES\NEBULA FIGHTER SPECIAL EDITION\MENU\LOGOML.CKY
C:\PROGRAM FILES\EGAMES\NEBULA FIGHTER SPECIAL EDITATA\MAP+?LIxm??LLY.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\MULTI_TRAITOROUSWATERS.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\MULTI_TUTORIAL1.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\MULTI_TUTORIAL3.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\MULTI_VALLEYOFTHEDINO.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\NICETOSIEGEYOU.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\OUTTAKEDINERMIGHT.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\OUTTAKELIGHT.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\OUTTAKESCREENTEST.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\OUTTAKETINCANWALLY.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\OUTTAKE_DESTRUCTANDSERVE.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\OUTTAKE_DINERMIGHTDANCE.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\OUTTAKE_GIBBONTAKE.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\OUTTAKE_JOUSTABOUTIT.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\OUTTAKE_MINEALLMINE.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\OUTTAKE_THELANDTHATWORMSFORGOT.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\PLTEST.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\RIVERBOATHARBOUR.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\SNEAKYBRIDGETHIEVES.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\SPLP_HIGHNOONHIJINX.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\SPLP_NICETOSIEGEYOU.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\STATUEDEFEND.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\STORMTHECASTLE.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\TELEPORT TEST.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\TEMP.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\THECRATEESCAPE.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\THELANDTHATWORMSFORGOT.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\THEWINDYWIZARD.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\THISGAMEDOESDRAGON.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\TINCANWALLY TEMP.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\TINCANWALLY.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\TRAITOROUSWATERS.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\TURKISHDELIGHTS.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\TUTORIAL1.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\TUTORIAL2.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\TUTORIAL3.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\VALLEYOFTHEDINO.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\WEAPONSTEST.HMP
C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\WORMWIGSBIGRIGJIG.HMP
C:\PROGRAM FILES\BRUCE LEE REMAKE\DATA\AI.DAT
C:\Program Files\ActionWheelRacer\common.erp\?.L??Kg?PK
C:\Program Files\ActionWheelRacer\wheelracer.erp\?.L??Kg?PK
C:\Program Files\ActionWheelRacer\wheelracer.erp\
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\NTUSER.DAT
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\NTUSER.DAT.LOG
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT.LOG
C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\NTUSER.DAT
C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\NTUSER.DAT.LOG
C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT
C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT.LOG
C:\DOCUMENTS AND SETTINGS\KRISTIAN\NTUSER.DAT
C:\DOCUMENTS AND SETTINGS\KRISTIAN\NTUSER.DAT.LOG
C:\DOCUMENTS AND SETTINGS\KRISTIAN\OMAT TIEDOSTOT\BIONICLE NESTLE.ISO
C:\DOCUMENTS AND SETTINGS\KRISTIAN\OMAT TIEDOSTOT\VIRTUAL PC\VIRTUAL MACHINE ADDITIONS\VIRTUAL DISK PRECOMPACTOR.ISO
C:\DOCUMENTS AND SETTINGS\KRISTIAN\OMAT TIEDOSTOT\VIRTUAL PC\VIRTUAL MACHINE ADDITIONS\VMADDITIONS.ISO
C:\DOCUMENTS AND SETTINGS\KRISTIAN\OMAT TIEDOSTOT\SMYGB\POKEMON SILVER.SAV
C:\DOCUMENTS AND SETTINGS\KRISTIAN\OMAT TIEDOSTOT\SMYGB\SUPER MARIO BROS. DELUXE (U) (V1.0) [C][H1] (MONO).SAV
C:\DOCUMENTS AND SETTINGS\KRISTIAN\OMAT TIEDOSTOT\OMAT MUSIIKKITIEDOSTOT\WORMS ARMAGEDDON.MP3
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\ of the Hero.jar
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\+(+Space+Shooter+).jar
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\+2.jar
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\+Addict+Rally.jar
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\+Black+Jack+Adrian.jar
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\+Blocks+(+Puzzle+).jar
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\+Breaker+Deluxe.jar
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\+Camels.jar
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\+Chaser.jar
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\+Clash.jar
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\+dolphin.jar
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\+Elements.jar
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\+Fire.jar
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\+Flytrap.jar
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\+Force.jar
C:\Documents and Settings\Kristian\Omat tiedostot\LimeWire\Incomplete\T-116726247-1420 Mobile.Java.Games.rar\1420 Mobile.Java.Games\+Gamble.jar
C:\DOCUMENTS AND SETTINGS\KRISTIAN\OMAT TIEDOSTOT\K?NNYK?N VARMUUSKOPIOT\MUSIIKKI\WORMS ARMAGEDDON.MP3
C:\DOCUMENTS AND SETTINGS\KRISTIAN\OMAT TIEDOSTOT\GTA SAN ANDREAS USER FILES\USER TRACKS\WORMS ARMAGEDDON.MP3
C:\DOCUMENTS AND SETTINGS\KRISTIAN\OMAT TIEDOSTOT\DOWNLOADS\OFFICE2003\MICROSOFT OFFICE 2003 PROFESSIONAL.ISO
C:\Documents and Settings\Kristian\Omat tiedostot\Downloads\office2003\SETUP.APM\ams_xml_pl.xml
C:\Documents and Settings\Kristian\Omat tiedostot\Downloads\office2003\SETUP.APM\ams_xml_temp.xml
C:\DOCUMENTS AND SETTINGS\KRISTIAN\OMAT TIEDOSTOT\DOWNLOADS\MICROSOFT PLUS! SUPERPACK FOR WINDOWS XP\MICROSOFTPLUS!.ISO
C:\DOCUMENTS AND SETTINGS\KRISTIAN\OMAT TIEDOSTOT\DOWNLOADS\MICROSOFT PLUS! 95\PLUS.ISO
C:\DOCUMENTS AND SETTINGS\KRISTIAN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT
C:\DOCUMENTS AND SETTINGS\KRISTIAN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT.LOG
C:\DOCUMENTS AND SETTINGS\KRISTIAN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\CARDSPACE\CARDSPACE.DB
C:\DOCUMENTS AND SETTINGS\KRISTIAN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\CARDSPACE\CARDSPACE.DB.SHADOW
C:\DOCUMENTS AND SETTINGS\KRISTIAN\DODIAN.COM\CACHE\.FILE_STORE_32\MAIN_FILE_CACHE.DAT
C:\DOCUMENTS AND SETTINGS\KRISTIAN\DODIAN.COM\CACHE\.FILE_STORE_32\VANHAT\MAIN_FILE_CACHE.DAT
C:\DOCUMENTS AND SETTINGS\KRISTIAN\.FRUGOO_FILE_STORE_32\MAIN_FILE_CACHE.DAT
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\VISIO\CATALOG.WCI\00000002.PS2
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\VISIO\CATALOG.WCI\CISL0001.001
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\VISIO\CATALOG.WCI\CISL0001.002
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MESSENGER PLUS!\CUSTOM SOUNDS\#1A2C3F22474C.DAT
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\BROTHER\BRLOG\BRBSTMON.LOG


--------------------------------------------------------------------------------

Options
Scanning engines:
F-Secure USS: 2.30.0
F-Secure Hydra: 2.8.8110, 2008-08-29
F-Secure AVP: 7.0.171, 2008-08-28
F-Secure Pegasus: 1.20.0, 2008-04-15
F-Secure Blacklight: 1.0.68
Scanning options:
Scan all files
Scan inside archives
Use Advanced heuristics


ja sitten vielä uusi Smitfraudfix loki:

SmitFraudFix v2.341

Scan done at 14:13:20.56, pe 29.08.2008
Run from C:\Documents and Settings\Kristian\Omat tiedostot\viruspoisto\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Elisa\Avustaja\Elisa.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
C:\WINDOWS\system32\Fast.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\WinFlip\WinFlip.exe
C:\Program Files\internet explorer\iexplore.exe
C:\DOCUME~1\Kristian\LOCALS~1\Temp\OnlineScanner\Anti-Virus\fsgk32.exe
C:\DOCUME~1\Kristian\LOCALS~1\Temp\OnlineScanner\Anti-Virus\fssm32.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Vista Rainbar\Rainmeter.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\rvoelbxt.exe FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Kristian


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Kristian\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Kristian\Suosikit


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="file:///C:\\WINDOWS\\privacy_danger\\index.htm"
"SubscribedURL"=""
"FriendlyName"="Privacy Protection"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

[!] Suspicious: rqbmvpso.dll
SSODL: rqbmvpso - {549488B7-0277-4067-A19A-81113C8487CD}


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller - Paketinajoituksen miniportti
DNS Server Search Order: 10.0.0.2

HKLM\SYSTEM\CCS\Services\Tcpip\..\{AA31FE89-EF07-40F8-8426-FB401BF3A353}: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AA31FE89-EF07-40F8-8426-FB401BF3A353}: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\..\{AA31FE89-EF07-40F8-8426-FB401BF3A353}: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS3\Services\Tcpip\..\{AA31FE89-EF07-40F8-8426-FB401BF3A353}: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End



mitäs tän jälkee?
[ + lainaa]
Hujo
Suspended permanently
_ 		29. elokuuta 2008 @ 14:49 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Printtaa ohjeet ulos

Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.

Vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.

Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.

Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".

Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.

Varoitus : Ajamalla optio 2:n EI-tarttuneessa tietokoneessa, poistaa sinun työpöytäsi taustakuvan.

[ + lainaa]
Voiko tietsikka koskaan toimia?
krizu7
Junior Member
_ 		29. elokuuta 2008 @ 15:11 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
noniin, tein ton. onko vielä jotain?
[ + lainaa]
Hujo
Suspended permanently
_ 		29. elokuuta 2008 @ 15:19 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Lataa OTMoveIt
OTMoveIt ja tallenna se työpöydällesi.

Tuplaklikkaa OTMoveIt.exe.
Klikkaa CleanUp!.
Valitse Yes kun kysytään "Begin cleanup Process?".
Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.

HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.

=============

nyt sillä varmaankin pärjää pari päivää
[ + lainaa]
Voiko tietsikka koskaan toimia?
Mainos
_ 		__
 
_
krizu7
Junior Member
_ 		29. elokuuta 2008 @ 17:10 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
siis KIITOS!! kone on nyt paljon nopeampi eikä nuo pas*at hypi silmille enää. Kiitän avusta =) ilmoitan sitten tänne vielä jos tähän koneeseen jotain tulee.
[ + lainaa]
Aiheeseen liittyviä linkkejä
Lataa uusin versio HijackThis-ohjelmasta täältä!
 
Aiheeseen liittyviä viestiketjuja Viestejä Viimeisin viesti Keskustelualue
HJT Logi 2 3. kesäkuuta 2014 Virukset ja haittaohjelmat - HijackThis -logit
HJT-logi ja vale-firefox ongelmia....virus koneella ? 4 6. toukokuuta 2014 Virukset ja haittaohjelmat - HijackThis -logit
HJT logi, kone jumittaa 1 3. huhtikuuta 2014 Virukset ja haittaohjelmat - HijackThis -logit
Näppäimistö sekoilee hjt log 1 2. huhtikuuta 2014 Virukset ja haittaohjelmat - HijackThis -logit
HJT-log ja Malwarebytes- log, Troijalainen? Apu tarpeen! 2 10. maaliskuuta 2014 Virukset ja haittaohjelmat - HijackThis -logit
HJT-loki, kone valtavan hidas ja perusskannereiden läpi ajamisella ei vaikutusta 1 19. helmikuuta 2014 Virukset ja haittaohjelmat - HijackThis -logit
probook 445 hjt-logit 1 19. tammikuuta 2014 Virukset ja haittaohjelmat - HijackThis -logit
HJT loki tarkastukseen 1 19. tammikuuta 2014 Virukset ja haittaohjelmat - HijackThis -logit
Win7 + HJT ongelma ja kummitteleva Mass effect 2 1 11. tammikuuta 2014 Windows -ongelmat
HJT-logia.. 1 9. tammikuuta 2014 Virukset ja haittaohjelmat - HijackThis -logit

 
afterdawn.com > keskustelu > yleistä keskustelua tietokoneista > virukset ja haittaohjelmat - hijackthis -logit > hjt loki. en tiiä mikä virus mul on konees
 

Apua ongelmiin: AfterDawnin keskustelualueet | AfterDawnin Vastaukset
Uutiset: IT-alan uutiset | Uutisia puhelimista
Musiikkia: MP3Lizard.com
Tuotearviot: Laitevertailu | Vertaa puhelimia | Vertaa kännykkäliittymiä
Pelit: Pelitiedostot, pelidemot ja trailerit
Ohjelmat: download.fi | AfterDawnin ohjelma-alueet
International: AfterDawn in English | Software downloads | Free, legal MP3s | AfterDawn på svenska
RSS -syötteet: AfterDawnin uutiset | Uusimmat ohjelmapäivitykset | Keskustelualueiden viestit
Tietoja: Tietoa AfterDawn Oy:stä | Mainosta sivuillamme | Sivuston käyttöehdot ja tietoja yksityisyydensuojasta
Ota yhteyttä: Lähetä palautetta | Ota yhteyttä mainosmyyntiimme
 
  © 1999-2025 AfterDawn Oy