|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Onko täällä jotain vikaa??
|
|
|
autsvaara
Junior Member
|
26. elokuuta 2008 @ 17:53 |
Linkki tähän viestiin
|
Netti lähettää jotai koko ajan jotain en vaan tiedä mitä?
Jos joku löytää jotain niin suur kiitosta vaan...
Nod32 ja zone alert ei löydä mitään eikä malware bytes...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:33:46, on 26.8.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Hamachi\hamachi.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://spartani.com/home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Hamachi Service (HamachiService) - LogMeIn Inc. - C:\Program Files\Hamachi\hamachi.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 6998 bytes
ComboFix 08-08-25.01 - kubla 2008-08-26 17:42:20.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1035.18.1520 [GMT 3:00]
Running from: C:\Documents and Settings\kubla\Työpöytä\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-07-26 to 2008-08-26 )))))))))))))))))
.
2008-08-26 16:28 . 2008-08-26 16:31 <KANSIO> d-------- C:\Program Files\Winamp
2008-08-26 16:28 . 2008-08-26 16:33 <KANSIO> d-------- C:\Documents and Settings\kubla\Application Data\Winamp
2008-08-25 16:17 . 2008-08-25 16:17 <KANSIO> d-------- C:\Program Files\Uniblue
2008-08-25 15:41 . 2008-08-25 16:19 <KANSIO> d-------- C:\Documents and Settings\kubla\Application Data\Uniblue
2008-08-24 21:45 . 2008-08-24 21:54 <KANSIO> d-------- C:\Documents and Settings\kubla\Application Data\BSplayer PRO
2008-08-23 13:37 . 2008-08-26 16:35 <KANSIO> d-------- C:\Documents and Settings\kubla\Application Data\Azureus
2008-08-23 13:37 . 2008-08-23 13:37 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2008-08-23 13:36 . 2008-08-23 13:36 <KANSIO> d-------- C:\Program Files\Vuze
2008-08-22 21:23 . 2008-08-22 21:26 <KANSIO> d-------- C:\Program Files\MSN Messenger
2008-08-22 13:20 . 2008-08-22 13:37 <KANSIO> d-------- C:\Program Files\PC Doc Pro
2008-08-22 13:20 . 2001-08-17 00:00 494,352 --a------ C:\WINDOWS\system32\SHDOC401.DLL
2008-08-22 13:20 . 1998-06-24 00:00 164,144 --a------ C:\WINDOWS\system32\COMCT232.OCX
2008-08-22 13:20 . 2000-05-22 15:58 83,144 --a------ C:\WINDOWS\system32\PICCLP32.OCX
2008-08-22 13:20 . 2007-12-19 16:12 53,248 --a------ C:\WINDOWS\system32\ArmAccess.dll
2008-08-22 12:57 . 2008-08-25 16:20 <KANSIO> d-------- C:\Program Files\Net Tools
2008-08-22 12:39 . 2008-08-22 12:39 126,976 --a------ C:\WINDOWS\system32\UAService7.exe
2008-08-22 10:25 . 2008-08-22 10:25 <KANSIO> d-------- C:\Documents and Settings\kubla\dwhelper
2008-08-22 09:57 . 2008-08-22 09:57 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
2008-08-22 09:55 . 2008-08-22 09:55 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
2008-08-22 09:55 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-08-22 09:54 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-08-22 09:54 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-08-22 09:54 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-08-22 09:54 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-08-22 09:54 . 2008-05-07 07:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
2008-08-22 09:54 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-08-21 22:46 . 2006-05-25 15:52 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
2008-08-21 22:46 . 2003-02-02 20:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2008-08-21 22:46 . 2005-08-26 01:50 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
2008-08-21 22:46 . 2002-03-06 01:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2008-08-21 22:46 . 2006-06-19 13:01 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
2008-08-21 22:45 . 2008-08-21 22:45 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Simply Super Software
2008-08-21 22:40 . 2008-08-21 22:40 <KANSIO> d-------- C:\Documents and Settings\kubla\Application Data\Simply Super Software
2008-08-21 22:03 . 2008-08-21 22:49 <KANSIO> d-------- C:\Program Files\Trojan Remover
2008-08-21 21:25 . 2008-08-21 21:25 <KANSIO> d-------- C:\Documents and Settings\kubla\Application Data\BWMeterPro
2008-08-21 21:24 . 2008-08-21 21:25 <KANSIO> d-------- C:\Program Files\BandwidthMeterPro
2008-08-19 18:28 . 2008-08-19 18:28 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Ubisoft
2008-08-18 22:57 . 2008-08-18 22:57 <KANSIO> d-------- C:\WINDOWS\system32\xlive
2008-08-17 15:58 . 2008-08-17 15:58 <KANSIO> d-------- C:\Program Files\JoWooD
2008-08-14 21:16 . 2008-08-14 21:51 <KANSIO> d--h----- C:\WINDOWS\system32\CTF
2008-08-13 16:17 . 2004-09-15 15:00 10,129,408 --a--c--- C:\WINDOWS\system32\dllcache\hwxkor.dll
2008-08-13 16:15 . 2001-08-18 06:36 8,704 --a------ C:\WINDOWS\system32\kbdjpn.dll
2008-08-13 16:13 . 2008-08-14 06:48 <KANSIO> d-------- C:\Documents and Settings\kubla\Application Data\ppstream
2008-08-13 15:50 . 2008-08-22 09:55 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-13 15:50 . 2008-08-13 15:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-12 16:32 . 2008-06-03 12:22 413,696 -ra------ C:\WINDOWS\system32\ATIDEMGX.dll
2008-08-12 16:32 . 2008-06-03 12:02 307,200 -ra------ C:\WINDOWS\system32\atiiiexx.dll
2008-08-12 16:32 . 2008-04-29 06:09 172,033 -ra------ C:\WINDOWS\system32\atiicdxx.dat
2008-08-12 16:32 . 2008-05-23 03:46 13,848 -ra------ C:\WINDOWS\atiogl.xml
2008-08-12 16:09 . 2008-06-03 11:47 3,107,788 -ra------ C:\WINDOWS\system32\ativvaxx.dat
2008-08-12 16:09 . 2008-06-03 11:47 3,107,788 -ra------ C:\WINDOWS\system32\ativva5x.dat
2008-08-12 16:09 . 2008-06-03 11:47 887,724 -ra------ C:\WINDOWS\system32\ativva6x.dat
2008-08-12 16:09 . 2007-08-31 22:20 7,167 -ra------ C:\WINDOWS\system32\atifglpf.xml
2008-08-12 16:03 . 2008-08-12 16:03 <KANSIO> d-------- C:\Documents and Settings\NetworkService\Käynnistä-valikko
2008-08-11 23:13 . 2008-08-11 23:13 <KANSIO> d-------- C:\Documents and Settings\kubla\Application Data\TrojanHunter
2008-08-11 20:17 . 2008-08-11 20:17 <KANSIO> d-------- C:\Program Files\TVAnts
2008-08-11 20:13 . 2008-08-11 20:13 361,344 --a------ C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
2008-08-11 19:56 . 2008-08-11 19:56 <KANSIO> d-------- C:\Program Files\Marsu-Fix
2008-08-11 16:02 . 2008-08-11 16:02 <KANSIO> d-------- C:\Program Files\ABIT
2008-08-11 16:02 . 2004-10-13 04:30 23,612 --a------ C:\WINDOWS\system32\FlashMenu.sys
2008-08-10 18:14 . 2008-08-10 18:15 <KANSIO> d-------- C:\Program Files\Hamachi
2008-08-10 18:03 . 2008-08-26 16:48 <KANSIO> d-------- C:\Documents and Settings\kubla\Application Data\Hamachi
2008-08-10 18:02 . 2008-08-10 18:36 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-08-10 16:38 . 2008-08-10 16:38 <KANSIO> d-------- C:\Program Files\Activision
2008-08-10 16:28 . 2008-08-17 11:14 <KANSIO> d-------- C:\torrentit
2008-08-08 18:04 . 2008-08-22 09:33 <KANSIO> d-------- C:\Documents and Settings\kubla\Tracing
2008-08-08 15:37 . 2008-08-08 15:38 38 --a------ C:\WINDOWS\avisplitter.INI
2008-08-06 16:08 . 2008-08-06 16:08 <KANSIO> d-------- C:\Program Files\Sierra Entertainment
2008-08-05 19:54 . 2008-08-05 19:54 <KANSIO> d-------- C:\WINDOWS\system32\AGEIA
2008-08-05 19:54 . 2008-08-06 15:09 <KANSIO> d-------- C:\Program Files\AGEIA Technologies
2008-08-05 10:55 . 2008-08-10 17:38 319 --a------ C:\WINDOWS\game.ini
2008-08-05 10:25 . 2008-08-05 10:25 <KANSIO> d--hs---- C:\WINDOWS\ftpcache
2008-08-04 18:20 . 2008-05-21 08:53 141,824 -ra------ C:\WINDOWS\system32\drivers\AtiHdmi.sys
2008-08-04 18:13 . 2008-07-22 00:14 9,728 --a------ C:\WINDOWS\system32\RtNicProp32.dll
2008-08-04 17:56 . 2008-08-11 20:45 <KANSIO> d-------- C:\Program Files\ATI
2008-08-04 00:19 . 2008-08-04 00:19 <KANSIO> d-------- C:\Program Files\AMD
2008-08-02 22:49 . 2008-08-02 22:49 <KANSIO> d-------- C:\Program Files\Common Files\Labtec
2008-08-02 22:48 . 2008-08-02 22:48 <KANSIO> d-------- C:\Program Files\Labtec
2008-08-02 22:48 . 2008-08-02 22:48 <KANSIO> d-------- C:\Program Files\Common Files\LogiShrd
2008-07-29 02:01 . 2008-07-29 02:08 <KANSIO> d-------- C:\Downloads
2008-07-29 01:59 . 2008-07-29 02:27 <KANSIO> d-------- C:\Program Files\BitComet
2008-07-29 01:15 . 2008-07-29 01:15 <KANSIO> d-------- C:\Program Files\Defraggler
2008-07-27 21:15 . 2008-07-27 21:28 <KANSIO> d-------- C:\Program Files\Qtracker
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-26 13:48 411,284 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-26 13:48 34,795,296 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-25 13:20 --------- d-----w C:\Program Files\uTorrent
2008-08-25 12:54 --------- d-----w C:\Program Files\Steam
2008-08-24 18:49 --------- d-----w C:\Program Files\Webteh
2008-08-24 08:57 --------- d--h--w C:\Documents and Settings\kubla\Application Data\uTorrent
2008-08-23 18:08 --------- d-----w C:\Program Files\RevConnect
2008-08-23 10:36 --------- d-----w C:\Program Files\Vuze
2008-08-22 07:06 --------- d-----w C:\Program Files\Nokia
2008-08-22 07:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-08-22 07:05 --------- d-----w C:\Program Files\Common Files\Nokia
2008-08-22 06:56 --------- d--h--w C:\Documents and Settings\kubla\Application Data\Nokia
2008-08-22 06:36 --------- d-----w C:\Program Files\Windows Live
2008-08-21 19:50 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-21 13:40 --------- d-----w C:\Program Files\Pocket Tanks Deluxe
2008-08-19 15:38 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-08-19 13:27 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-08-17 12:01 38,472 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-17 12:01 17,144 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-08-15 19:58 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-15 17:16 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-08-15 17:16 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-08-14 19:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-14 19:46 --------- d-----w C:\Program Files\QuickTime
2008-08-12 13:03 1,655,253 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-08-11 16:56 159,841 ----a-w C:\WINDOWS\Marsu-Fix Uninstaller.exe
2008-08-10 15:16 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-08-10 14:39 22,328 ----a-w C:\Documents and Settings\kubla\Application Data\PnkBstrK.sys
2008-08-08 15:20 65,204 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_08_08_18_12_38_small.dmp.zip
2008-08-08 15:20 63,967 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_08_08_18_12_34_small.dmp.zip
2008-08-06 12:10 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-05 21:26 --------- d-----w C:\Program Files\PowerArchiver
2008-07-29 06:23 --------- d--h--w C:\Documents and Settings\kubla\Application Data\MSN6
2008-07-28 19:55 --------- d-----w C:\Program Files\ProPilkki2
2008-07-27 23:00 --------- d-----w C:\Program Files\EA Sports
2008-07-27 13:30 --------- d--h--w C:\Documents and Settings\kubla\Application Data\PC Suite
2008-07-26 14:02 --------- d-----w C:\Program Files\Java
2008-07-26 14:01 --------- d-----w C:\Program Files\JLC's Software
2008-07-26 14:00 --------- d-----w C:\Program Files\AutoShutdown
2008-07-24 18:49 --------- d-----w C:\Program Files\Soldier of Fortune II - Double Helix
2008-07-24 06:07 --------- d-----w C:\Program Files\DiskTrix
2008-07-23 19:56 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-07-23 19:20 109,249 ----a-w C:\Program Files\MSWINSCK.OCX
2008-07-23 09:01 --------- d-----w C:\Program Files\ESET
2008-07-23 09:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-07-23 08:55 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-07-23 07:45 --------- d-----w C:\Program Files\Eidos
2008-07-22 06:43 20,122,101 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2008_07_22_01_38_18_full.dmp.zip
2008-07-21 17:37 --------- d-----w C:\Program Files\Bus Driver
2008-07-18 15:22 --------- d-----w C:\Program Files\Yahoo!
2008-07-18 15:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\MAGIX
2008-07-18 14:58 --------- d--h--w C:\Documents and Settings\kubla\Application Data\MAGIX
2008-07-17 18:03 --------- d-----w C:\Program Files\Project64 1.6
2008-07-16 23:38 --------- d-----w C:\Program Files\Driver-Soft
2008-07-16 22:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-07-16 19:00 --------- d-----w C:\Program Files\AVS4YOU
2008-07-15 21:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Suite
2008-07-15 17:11 --------- d-----w C:\Program Files\Elisa
2008-07-15 17:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Emotum
2008-07-15 17:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Elisa
2008-07-15 14:47 --------- d-----w C:\Program Files\DSL Speed
2008-07-15 08:59 --------- d--h--w C:\Documents and Settings\kubla\Application Data\Media Player Classic
2008-07-15 08:58 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-07-13 21:49 --------- d-----w C:\Program Files\Lavalys
2008-07-13 16:17 --------- d-----w C:\Program Files\Blitzkrieg 2
2008-07-12 22:09 --------- d-----w C:\Program Files\ToniArts
2008-07-12 21:48 --------- d-----w C:\Program Files\Sun
2008-07-11 13:23 --------- d-----w C:\Program Files\Music NFO Builder
2008-07-10 23:49 --------- d--h--w C:\Documents and Settings\kubla\Application Data\Atari
2008-07-10 23:24 --------- d-----w C:\Program Files\RegCure
2008-07-10 22:24 --------- d-----w C:\Program Files\Hasbro
2008-07-10 15:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\CMUV
2008-07-09 12:51 --------- d-----w C:\Program Files\Frets on Fire
2008-07-09 06:05 75,248 ----a-w C:\WINDOWS\zllsputility.exe
2008-07-09 06:05 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll
2008-07-08 21:50 --------- d--h--w C:\Documents and Settings\kubla\Application Data\MailFrontier
2008-07-07 12:16 --------- d-----w C:\Program Files\D-Link
2008-07-07 12:16 --------- d-----w C:\Program Files\ANI
2008-07-06 18:04 --------- d-----w C:\Program Files\PANZERS - Phase1
2008-07-04 20:37 --------- d-----w C:\Program Files\WinUAE
2008-07-02 21:11 --------- d--h--w C:\Documents and Settings\kubla\Application Data\InstallShield
2008-07-02 21:11 --------- d-----w C:\Program Files\Realtek
2008-07-01 20:54 --------- d-----w C:\Program Files\EsetOnlineScanner
2008-06-30 10:54 --------- d--h--w C:\Documents and Settings\kubla\Application Data\Leadertech
2008-06-29 09:52 --------- d-----w C:\Program Files\ThriXXX
2008-06-29 09:31 --------- d--h--w C:\Documents and Settings\kubla\Application Data\Oxin's Style!
2008-06-28 20:32 --------- d-----w C:\Program Files\Rockstar Games
2008-06-12 18:36 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2008-06-03 09:46 10,276,864 ----a-w C:\WINDOWS\system32\atioglx2.dll
2008-06-03 09:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2008-06-03 09:11 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2008-06-03 09:11 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2008-06-03 09:11 180,224 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2008-06-03 09:11 139,264 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2008-06-03 09:11 139,264 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2008-06-03 09:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2008-06-03 09:08 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2008-06-03 09:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2008-06-03 08:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag.dll
2008-06-03 08:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx.dll
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 19:12 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 09:05 919016]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 19:12 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Bluetooth Manager.lnk]
backup=C:\WINDOWS\pss\Bluetooth Manager.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THGuard
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2005-09-08 12:06 94208 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
--a------ 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 2006-03-18 05:24 184320 C:\Program Files\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\RevConnect\\DCPlusPlus.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\ProPilkki2\\ProPilkki2.exe"=
"C:\\Program Files\\B2BPOKER\\Pokerihuone\\jre\\bin\\javaw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Steam\\SteamApps\\harry7344\\half-life 2 deathmatch\\hl2.exe"=
"C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe"=
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe"=
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe"=
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"D:\\pelejä\\Flatout III\\FlatOut Ultimate Carnage\\Fouc.exe"=
"C:\\Program Files\\Messenger\\Msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"13695:TCP"= 13695:TCP:BitComet 13695 TCP
"13695:UDP"= 13695:UDP:BitComet 13695 UDP
"7948:TCP"= 7948:TCP:BitComet 7948 TCP
"7948:UDP"= 7948:UDP:BitComet 7948 UDP
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-03-13 16:52]
R2 HamachiService;Hamachi Service;C:\Program Files\Hamachi\hamachi.exe [2008-08-10 18:36]
S3 F-Secure Standalone Minifilter;F-Secure Standalone Minifilter;C:\DOCUME~1\kubla\LOCALS~1\Temp\OnlineScanner\Anti-Virus\fsgk.sys []
S3 gkmixern;gkmixern;C:\DOCUME~1\kubla\LOCALS~1\Temp\gkmixern.sys []
S3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\system32\drivers\mbamswissarmy.sys [2008-08-17 15:01]
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys []
.
'Ajoitetut tehtävät'-kansion sisältö
2008-08-26 C:\WINDOWS\Tasks\RegCure Program Check.job
- C:\Program Files\RegCure\RegCure.exe [2008-07-11 02:18]
2008-08-21 C:\WINDOWS\Tasks\RegCure.job
- C:\Program Files\RegCure\RegCure.exe [2008-07-11 02:18]
2008-08-25 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe [2007-05-16 10:45]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\kubla\Application Data\Mozilla\Firefox\Profiles\7yyx48ph.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://irc-galleria.net/
FF -: plugin - C:\Program Files\Adobe\Acrobat 5.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll
FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-26 17:46:09
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-08-26 17:49:42
ComboFix-quarantined-files.txt 2008-08-26 14:49:35
ComboFix2.txt 2008-08-11 18:00:32
ComboFix3.txt 2008-06-27 20:48:24
ComboFix4.txt 2008-06-23 21:00:19
ComboFix5.txt 2008-08-26 14:38:54
Pre-Run: 11,492,634,624 tavua vapaana
Post-Run: 11,473,432,576 tavua vapaana
301 --- E O F --- 2008-06-16 00:00:57
|
|
Hujo
Suspended permanently
|
26. elokuuta 2008 @ 18:40 |
Linkki tähän viestiin
|
Poista lisää poista sovelutuksesta
ZoneAlarm Spy Blocker
Poista kansio vikasiedossa
C:\Program Files\ZoneAlarmSB
============
scannaa hjt:llä merkkaa paina Fix checked
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
===========
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan:
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä
Jossakin koneissa hakataan F8:sin sijasta F5:tä
" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
Voiko tietsikka koskaan toimia?
|
|
autsvaara
Junior Member
|
26. elokuuta 2008 @ 20:03 |
Linkki tähän viestiin
|
tässähän tää :)
Ongelma jatkuu vielä netti lähettää ja vastaan ottaa koko ajan jotain??
SDFix: Version 1.219
Run by kubla on ti 26.08.2008 at 19:49
Microsoft Windows XP [versio 5.1.2600]
Running From: C:\Program Files\Sdfix\SDFix
Checking Services :
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
Checking Files :
No Trojan Files Found
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-26 19:56:54
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0014350016de]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf41]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0014350016de]
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:000000b2
"TracesSuccessful"=dword:0000000b
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\RevConnect\\DCPlusPlus.exe"="C:\\Program Files\\RevConnect\\DCPlusPlus.exe:*:Enabled:DC++"
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"="C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe:*:Enabled:Nokia Software Updater"
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"="C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process "
"C:\\Program Files\\ProPilkki2\\ProPilkki2.exe"="C:\\Program Files\\ProPilkki2\\ProPilkki2.exe:*:Enabled:Main executable for PP2"
"C:\\Program Files\\B2BPOKER\\Pokerihuone\\jre\\bin\\javaw.exe"="C:\\Program Files\\B2BPOKER\\Pokerihuone\\jre\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\Program Files\\Steam\\SteamApps\\harry7344\\half-life 2 deathmatch\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\harry7344\\half-life 2 deathmatch\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe"="C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe:*:Enabled:Elisa Avustaja"
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe"="C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe:*:Enabled:World in Conflict"
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe"="C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe:*:Enabled:World in Conflict - Online Only"
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe"="C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe:*:Enabled:World in Conflict - Dedicated Server"
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"D:\\pelej?\\Flatout III\\FlatOut Ultimate Carnage\\Fouc.exe"="D:\\pelej?\\Flatout III\\FlatOut Ultimate Carnage\\Fouc.exe:*:Enabled:FlatOut Ultimate Carnage"
"C:\\Program Files\\Messenger\\Msmsgs.exe"="C:\\Program Files\\Messenger\\Msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
Remaining Files :
Files with Hidden Attributes :
Tue 22 Apr 2008 625,664 ..SH. --- "C:\Program Files\Internet Explorer\iexplore.exe"
Thu 12 Apr 2007 1,661,304 ..SH. --- "C:\Program Files\Messenger\Msmsgs.exe"
Mon 14 Apr 2008 60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe"
Sat 5 Jan 2008 4,378,338 A.SH. --- "C:\Program Files\vixy.net\conv.exe"
Mon 14 Apr 2008 4,639 A.SH. --- "C:\Program Files\Windows Media Player\mplayer2.exe"
Wed 15 Nov 2006 64,000 A.SH. --- "C:\Program Files\Windows Media Player\wmplayer.exe"
Sun 15 Jun 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sun 25 May 2008 593 A..H. --- "C:\Documents and Settings\kubla\Application Data\Google\GoogleEarth\myplaces.kml.tmp"
Thu 24 Jan 2008 141 A..H. --- "C:\Documents and Settings\kubla\Application Data\Microsoft\Internet Explorer\brndlog.bak"
Wed 5 Apr 2006 110,592 A..H. --- "C:\Documents and Settings\kubla\Application Data\U3\temp\cleanup.exe"
Sun 6 Jul 2008 15,872 A..HR --- "C:\Documents and Settings\kubla\Application Data\Microsoft\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C9.exe"
Thu 17 Jul 2008 40,960 A..HR --- "C:\Documents and Settings\kubla\Application Data\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe"
Thu 17 Jul 2008 40,960 A..HR --- "C:\Documents and Settings\kubla\Application Data\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe"
Thu 17 Jul 2008 8,854 A..HR --- "C:\Documents and Settings\kubla\Application Data\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\Uninstall_Project64__9559F7CA5E344237A2D9D856464AD727.exe"
Tue 15 Jul 2008 60,090 A..H. --- "C:\Documents and Settings\kubla\Application Data\Mozilla\Firefox\Profiles\7yyx48ph.default\bookmarks.bak"
Wed 31 Oct 2007 892,928 A..H. --- "C:\Documents and Settings\kubla\Application Data\Mozilla\Firefox\Profiles\7yyx48ph.default\extensions\fi@dictionaries.addons.mozilla.org\voikko\WINNT_x86-msvc\iconv.dll"
Wed 31 Oct 2007 45,056 A..H. --- "C:\Documents and Settings\kubla\Application Data\Mozilla\Firefox\Profiles\7yyx48ph.default\extensions\fi@dictionaries.addons.mozilla.org\voikko\WINNT_x86-msvc\intl.dll"
Wed 31 Oct 2007 629,016 A..H. --- "C:\Documents and Settings\kubla\Application Data\Mozilla\Firefox\Profiles\7yyx48ph.default\extensions\fi@dictionaries.addons.mozilla.org\voikko\WINNT_x86-msvc\libglib-2.0-0.dll"
Wed 26 Dec 2007 52,740 A..H. --- "C:\Documents and Settings\kubla\Application Data\Mozilla\Firefox\Profiles\7yyx48ph.default\extensions\fi@dictionaries.addons.mozilla.org\voikko\WINNT_x86-msvc\libvoikko-1.dll"
Wed 31 Oct 2007 722,283 A..H. --- "C:\Documents and Settings\kubla\Application Data\Mozilla\Firefox\Profiles\7yyx48ph.default\extensions\fi@dictionaries.addons.mozilla.org\voikko\WINNT_x86-msvc\malaga.dll"
Sat 19 Jan 2008 110,592 A..H. --- "C:\Documents and Settings\kubla\Application Data\Mozilla\Firefox\Profiles\7yyx48ph.default\extensions\fi@dictionaries.addons.mozilla.org\platform\WINNT_x86-msvc\components\myspellext.dll"
Finished!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:41:04, on 26.8.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Hamachi\hamachi.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://spartani.com/home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll/206 (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Hamachi Service (HamachiService) - LogMeIn Inc. - C:\Program Files\Hamachi\hamachi.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 5988 bytes
|
|
Hujo
Suspended permanently
|
26. elokuuta 2008 @ 20:13 |
Linkki tähän viestiin
|
|
toi eset ei näy tuolla käynnistyvissä onkos siinä lisensiä jäljellä
Voiko tietsikka koskaan toimia?
|
|
autsvaara
Junior Member
|
26. elokuuta 2008 @ 20:17 |
Linkki tähän viestiin
|
se ei ollut päällä ku otin login
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:16:39, on 26.8.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Hamachi\hamachi.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://spartani.com/home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll/206 (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Hamachi Service (HamachiService) - LogMeIn Inc. - C:\Program Files\Hamachi\hamachi.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 6087 bytes
|
|
Hujo
Suspended permanently
|
26. elokuuta 2008 @ 20:31 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 26. elokuuta 2008 @ 20:34
|
|
Mainos
|
|
|
|
autsvaara
Junior Member
|
26. elokuuta 2008 @ 20:36 |
Linkki tähän viestiin
|
|
ok...kiitoksiaa paljon :)
|
|
