|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Kone tilttailee.
|
|
|
hac
Suspended due to non-functional email address
|
8. helmikuuta 2009 @ 13:44 |
Linkki tähän viestiin
|
Eli koneeni tilttailee kesken pelaamisen ja jopa elokuvien katsomisen joten näkyykö tässä jotakin outoa ja mitä pitäisi tehdä?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:43:01, on 8.2.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\Windows\V0350Mon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Steam\Steam.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\DllHost.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton-työkalurivi - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IS CfgWiz] "C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" /MODULE CfgWiz /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVFX Engine] "C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe"
O4 - HKLM\..\Run: [V0350Mon.exe] C:\Windows\V0350Mon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PSPVideo9] C:\Program Files\pspvideo9\pspVideo9.exe -t
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O13 - Gopher Prefix:
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/j...ows-i586-jc.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Packard Bell BV - C:\Program Files\Packard bell\SAXO27\HIDSERVICE.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\Program Files\Norton Internet Security\isPwdSvc.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SrvCDEject - Unknown owner - C:\Program Files\Packard Bell\SrvCDEject.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
Kiitos ja anteeksi
|
|
Hujo
Suspended permanently
|
8. helmikuuta 2009 @ 15:11 |
Linkki tähän viestiin
|
Koneella kaksi virustorjuntaa
avira ja norton poista toinen
==============
scannaa hjt:llä merkkaa paina Fix checked
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
=============
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi
Voiko tietsikka koskaan toimia?
|
|
hac
Suspended due to non-functional email address
|
8. helmikuuta 2009 @ 17:24 |
Linkki tähän viestiin
|
|
Malwarebytes' Anti-Malware 1.33
Tietokantaversio: 1738
Windows 6.0.6001 Service Pack 1
8.2.2009 17:21:30
mbam-log-2009-02-08 (17-21-30).txt
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|F:\|G:\|H:\|)
Tarkistetut kohteet: 129725
Kulunut aika: 55 minute(s), 41 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)
Tälläistä tuli? mikä voi olla vikana? ja en saa poistettua nortonia se ei vain suostu poistumaan en tiedä miksi
Kiitos ja anteeksi
|
|
Hujo
Suspended permanently
|
8. helmikuuta 2009 @ 17:49 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 8. helmikuuta 2009 @ 17:50
|
|
hac
Suspended due to non-functional email address
|
8. helmikuuta 2009 @ 21:38 |
Linkki tähän viestiin
|
|
Joo nyt on poistettu mutta kone tilttailee vieläkin koska ram muisti täyttyy yht äkkiä joten onko jotain muuta outoa tuolla?
Kiitos ja anteeksi
|
|
Hujo
Suspended permanently
|
8. helmikuuta 2009 @ 22:03 |
Linkki tähän viestiin
|
1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
Combofix1
Combofix2
Älä asenna palautus consolia
2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
===============
Luo poistolista:
? Avaa HiJackThis
? Klikkaa "Configure" valintaa oikealla alhaalla
? Klikkaa "Misc Tools"
? Klikkaa boxia joka sanoo "Uninstall Manager"
? Klikkaa valintaa "Save list"
? Kopioi ja liitä kyseinen lista muistiosta ketjuusi
===============
scannaa uusi hjt:n loki
Voiko tietsikka koskaan toimia?
|
|
hac
Suspended due to non-functional email address
|
8. helmikuuta 2009 @ 22:48 |
Linkki tähän viestiin
|
ComboFix 09-02-08.01 - gigantti 2009-02-08 22:34:31.1 - NTFSx86
Microsoft® Windows Vista? Home Premium 6.0.6001.1.1252.1.1035.18.2046.1014 [GMT 2:00]
Sijainti: c:\users\gigantti\Desktop\ComboFix.exe
* Uusi palautuspiste luotu
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-08 to 2009-02-08 )))))))))))))))))
.
2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\Malwarebytes
2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\users\All Users\Malwarebytes
2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\programdata\Malwarebytes
2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-08 16:18 . 2009-01-14 16:11 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2009-02-08 16:18 . 2009-01-14 16:11 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2009-02-08 13:40 . 2009-02-08 13:40 <KANSIO> d-------- c:\program files\Trend Micro
2009-02-05 18:50 . 2009-02-05 18:50 <KANSIO> d-------- c:\windows\System32\IOSUBSYS
2009-01-27 12:02 . 2009-01-27 12:02 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\Samsung
2009-01-27 11:48 . 2007-07-03 16:58 106,792 --a------ c:\windows\System32\drivers\sscdmdm.sys
2009-01-27 11:48 . 2007-07-03 16:54 80,552 --a------ c:\windows\System32\drivers\sscdbus.sys
2009-01-27 11:48 . 2007-07-03 16:57 11,944 --a------ c:\windows\System32\drivers\sscdmdfl.sys
2009-01-27 11:48 . 2007-07-03 17:00 9,256 --a------ c:\windows\System32\drivers\sscdwhnt.sys
2009-01-27 11:48 . 2007-07-03 17:00 9,256 --a------ c:\windows\System32\drivers\sscdwh.sys
2009-01-27 11:48 . 2007-07-03 16:56 9,256 --a------ c:\windows\System32\drivers\sscdcmnt.sys
2009-01-27 11:48 . 2007-07-03 16:56 9,256 --a------ c:\windows\System32\drivers\sscdcm.sys
2009-01-27 11:45 . 2009-01-27 11:49 <KANSIO> d-------- c:\windows\System32\Samsung_USB_Drivers
2009-01-27 11:44 . 2009-01-27 11:44 <KANSIO> d-------- c:\program files\Samsung
2009-01-27 11:44 . 2009-01-27 12:00 5,632 --a------ c:\windows\System32\drivers\StarOpen.sys
2009-01-27 11:44 . 2005-08-28 20:51 766 --a------ c:\windows\System32\Uninstall.ico
2009-01-23 09:33 . 2009-01-23 09:33 <KANSIO> d-------- c:\program files\AviSynth 2.5
2009-01-22 08:52 . 2009-01-22 08:52 <KANSIO> d-------- c:\program files\Smart Projects
2009-01-18 21:26 . 2009-01-18 21:26 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\AdobeUM
2009-01-15 15:52 . 2009-02-04 22:11 <KANSIO> d-------- c:\program files\Common Files\Steam
2009-01-15 15:41 . 2009-02-08 21:33 <KANSIO> d-------- c:\program files\Steam
2009-01-15 15:40 . 2009-01-15 15:41 <KANSIO> d-------- c:\windows\048298C9A4D3490B9FF9AB023A9238F3.TMP
2009-01-14 23:27 . 2009-01-14 23:27 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\OpenOffice.org
2009-01-14 23:22 . 2009-01-14 23:22 <KANSIO> d-------- c:\program files\OpenOffice.org 3
2009-01-14 15:45 . 2009-01-14 15:45 <KANSIO> d-------- c:\users\All Users\Avira
2009-01-14 15:45 . 2009-01-14 15:45 <KANSIO> d-------- c:\programdata\Avira
2009-01-14 15:45 . 2009-01-14 15:45 <KANSIO> d-------- c:\program files\Avira
2009-01-14 08:27 . 2008-12-16 04:42 288,768 --a------ c:\windows\System32\drivers\srv.sys
2009-01-12 16:50 . 2009-01-12 16:50 <KANSIO> d-------- c:\program files\URUSoft
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-08 20:34 524,288 --sha-w c:\users\Järjestelmänvalvoja1\NTUSER.DAT
2009-02-08 19:30 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-02-07 19:34 --------- d-----w c:\users\gigantti\AppData\Roaming\uTorrent
2009-02-07 19:27 --------- d-----w c:\users\gigantti\AppData\Roaming\LimeWire
2009-02-05 16:50 --------- d-----w c:\program files\Google
2009-01-27 09:44 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-22 16:28 --------- d-----w c:\program files\World of Warcraft
2009-01-18 21:38 --------- d-----w c:\program files\Common Files\Adobe
2009-01-14 14:01 --------- d-----w c:\users\gigantti\AppData\Roaming\Packard Bell
2009-01-14 13:59 --------- d-----w c:\program files\Windows Mail
2009-01-10 20:01 --------- d-----w c:\programdata\Roxio
2009-01-09 17:24 --------- d-----w c:\users\gigantti\AppData\Roaming\Roxio
2009-01-06 08:21 --------- d-----w c:\users\gigantti\AppData\Roaming\PeerNetworking
2009-01-05 18:47 --------- d-----w c:\users\gigantti\AppData\Roaming\vlc
2009-01-02 12:11 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-01-02 11:03 410,984 ----a-w c:\windows\System32\deploytk.dll
2009-01-02 11:02 --------- d-----w c:\program files\Java
2009-01-02 10:58 --------- d-----w c:\program files\LimeWire
2009-01-02 09:05 174 --sha-w c:\program files\desktop.ini
2009-01-01 19:57 --------- d-----w c:\program files\Windows Sidebar
2009-01-01 19:57 --------- d-----w c:\program files\Windows Photo Gallery
2009-01-01 19:57 --------- d-----w c:\program files\Windows Journal
2009-01-01 19:57 --------- d-----w c:\program files\Windows Defender
2009-01-01 19:57 --------- d-----w c:\program files\Windows Collaboration
2009-01-01 19:57 --------- d-----w c:\program files\Windows Calendar
2009-01-01 19:12 82,432 ----a-w c:\windows\System32\axaltocm.dll
2009-01-01 19:12 101,888 ----a-w c:\windows\System32\ifxcardm.dll
2008-12-30 23:31 --------- d-----w c:\program files\uTorrent
2008-12-30 23:20 --------- d-----w c:\program files\VideoLAN
2008-12-30 11:34 --------- d-----w c:\programdata\Blizzard
2008-12-30 09:45 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2008-12-27 21:54 --------- d-----w c:\users\gigantti\AppData\Roaming\Creative
2008-12-27 21:54 --------- d-----w c:\programdata\Creative
2008-12-27 21:49 --------- d-----w c:\program files\Creative
2008-12-27 21:43 --------- d-----w c:\programdata\muvee Technologies
2008-12-27 20:32 --------- d-----w c:\programdata\NVIDIA
2008-12-27 19:37 269,312 ----a-w c:\windows\System32\es.dll
2008-12-27 18:51 --------- d-----w c:\program files\PhotoFiltre
2008-12-27 18:46 --------- d-----w c:\program files\B2BPOKER
2008-12-27 11:31 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-12-27 11:29 --------- d-----w c:\program files\Windows Live
2008-12-27 11:27 --------- d-----w c:\users\gigantti\AppData\Roaming\Apple Computer
2008-12-27 11:27 --------- d-----w c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-27 11:27 --------- d-----w c:\program files\iTunes
2008-12-27 11:26 --------- d-----w c:\programdata\Apple Computer
2008-12-27 11:26 --------- d-----w c:\program files\iPod
2008-12-27 11:26 --------- d-----w c:\program files\Common Files\Apple
2008-12-27 11:25 --------- d-----w c:\program files\QuickTime
2008-12-27 11:25 --------- d-----w c:\program files\Bonjour
2008-12-27 11:23 --------- d-----w c:\program files\Apple Software Update
2008-12-27 11:21 --------- d-----w c:\programdata\Apple
2008-12-27 11:14 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-12-27 11:10 --------- d-----w c:\programdata\WLInstaller
2008-12-27 09:10 61,440 ----a-w c:\windows\System32\winipsec.dll
2008-12-27 09:10 361,984 ----a-w c:\windows\System32\IPSECSVC.DLL
2008-12-27 09:10 28,672 ----a-w c:\windows\System32\FwRemoteSvr.dll
2008-12-27 09:10 272,896 ----a-w c:\windows\System32\polstore.dll
2008-12-27 09:08 94,720 ----a-w c:\windows\System32\PortableDeviceClassExtension.dll
2008-12-27 09:08 241,152 ----a-w c:\windows\System32\PortableDeviceApi.dll
2008-12-27 09:08 160,768 ----a-w c:\windows\System32\PortableDeviceTypes.dll
2008-12-27 09:03 428,544 ----a-w c:\windows\System32\EncDec.dll
2008-12-27 09:03 293,376 ----a-w c:\windows\System32\psisdecd.dll
2008-12-27 09:01 296,960 ----a-w c:\windows\System32\gdi32.dll
2008-12-27 08:58 212,480 ----a-w c:\windows\system32\drivers\mrxsmb10.sys
2008-12-27 08:56 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-12-27 08:56 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-12-27 08:56 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-12-27 08:56 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-12-27 08:56 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-12-27 08:56 2,560 ----a-w c:\windows\AppPatch\AcRes.dll
2008-12-27 08:56 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-12-27 08:56 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-12-27 08:56 1,695,744 ----a-w c:\windows\System32\gameux.dll
2008-12-27 08:55 303,616 ----a-w c:\windows\System32\wmpeffects.dll
2008-12-27 08:54 2,048 ----a-w c:\windows\System32\msxml3r.dll
2008-12-27 08:54 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-12-27 08:54 1,191,936 ----a-w c:\windows\System32\msxml3.dll
2008-12-27 08:50 2,048 ----a-w c:\windows\System32\tzres.dll
2008-12-27 08:45 2,927,104 ----a-w c:\windows\explorer.exe
2008-12-27 08:41 827,392 ----a-w c:\windows\System32\wininet.dll
2008-12-27 08:37 801,280 ----a-w c:\windows\System32\NaturalLanguage6.dll
2008-12-27 08:37 6,917,120 ----a-w c:\windows\System32\NlsLexicons0c1a.dll
2008-12-27 08:37 4,495,360 ----a-w c:\windows\System32\NlsData0816.dll
2008-12-27 08:37 4,495,360 ----a-w c:\windows\System32\NlsData0416.dll
2008-12-27 08:37 4,495,360 ----a-w c:\windows\System32\NlsData0414.dll
2008-12-27 08:37 2,342,912 ----a-w c:\windows\System32\NlsData000d.dll
2008-12-27 08:37 1,965,056 ----a-w c:\windows\System32\NlsData0c1a.dll
2008-12-27 08:37 1,965,056 ----a-w c:\windows\System32\NlsData081a.dll
2008-12-27 08:37 1,965,056 ----a-w c:\windows\System32\NlsData000f.dll
2008-12-27 08:35 988,216 ----a-w c:\windows\System32\winload.exe
2008-12-27 08:35 927,288 ----a-w c:\windows\System32\winresume.exe
2008-12-27 08:35 615,992 ----a-w c:\windows\System32\ci.dll
2008-12-27 08:35 6,656 ----a-w c:\windows\System32\kbd106n.dll
2008-12-27 08:35 46,592 ----a-w c:\windows\System32\setbcdlocale.dll
2008-12-27 08:35 40,960 ----a-w c:\windows\System32\srclient.dll
2008-12-27 08:35 378,368 ----a-w c:\windows\System32\srcore.dll
2008-12-27 08:35 318,464 ----a-w c:\windows\System32\rstrui.exe
2008-12-27 08:35 19,000 ----a-w c:\windows\System32\kd1394.dll
2008-12-27 08:35 14,848 ----a-w c:\windows\System32\srdelayed.exe
2008-12-27 08:32 712,704 ----a-w c:\windows\System32\WindowsCodecs.dll
2007-07-13 07:06 141,824 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"SmpcSys"="c:\program files\Packard Bell\SetUpMyPC\SmpSys.exe" [2007-05-03 1116728]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Creative Live! Cam Manager"="c:\program files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-05-02 151552]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Steam"="c:\program files\steam\steam.exe" [2009-01-15 1410296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 232184]
"toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13580832]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 92704]
"AVFX Engine"="c:\program files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2007-04-09 20480]
"V0350Mon.exe"="c:\windows\V0350Mon.exe" [2007-03-28 32768]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-02 136600]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-01 c:\windows\RtHDVCpl.exe]
c:\users\gigantti\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-10-04 393216]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{961656CC-7C8C-4F93-8147-C31E85AB6C8F}"= UDP:c:\program files\Skype\Phone\Skype.exe:Skype
"{FBF9AC3D-ADF0-4668-80F2-6A6460EF475A}"= TCP:c:\program files\Skype\Phone\Skype.exe:Skype
"{518374B7-6003-4526-94F3-BDC374C3486E}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{A84817C4-0FB6-4215-A31E-95D00BBEFBB9}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{8EDB7684-189E-474B-B2E0-BF9AC019BBB5}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{8F9D51FC-28C6-45EC-8D0B-476D96BC30D0}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{5E03385F-A84F-46B6-8D0F-8498B325DE53}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{C0A99A90-7B29-4CBB-90F2-813F9B328C19}c:\\program files\\b2bpoker\\pokerihuone\\jre\\bin\\javaw.exe"= UDP:c:\program files\b2bpoker\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"UDP Query User{98E14683-453E-42C2-8D48-17177512DE4E}c:\\program files\\b2bpoker\\pokerihuone\\jre\\bin\\javaw.exe"= TCP:c:\program files\b2bpoker\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"{90717786-729F-4940-BA94-3783CE1070A7}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{7DE88E92-FE46-4ADB-B7C9-41CB10961B36}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{954E3F98-C99C-4477-BB30-6FA810052257}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{1A4D98BB-8FE2-461F-A241-54A4C7FF702D}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{331B987E-79DC-4882-92B2-DE1D591F18A2}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2
"UDP Query User{0F820793-94FF-4A11-AA0C-4AACA2541582}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2
"TCP Query User{659D8150-8385-403B-A02A-FF0489EC40A2}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{7935285F-63E6-4AB4-99F7-FA4CDE2651FC}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"TCP Query User{84DEB74E-4D9D-4738-8030-D062E81665E2}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2
"UDP Query User{3DAD7939-CEC4-4AA5-968E-041429D7F844}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2
"TCP Query User{9363542A-D88A-41D6-A0B2-9614D0124141}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{9542653B-8E23-467C-96D2-531B18262489}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{6210DB8E-AFD0-43AF-9B44-2A2314A6B574}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"UDP Query User{4C664FB6-CAA3-4B47-9B8F-78CD4466B6CA}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"{2657FA41-61DC-4DCD-B3D6-3BEBE0993CF3}"= UDP:c:\program files\Steam\Steam.exe:Steam
"{7A7153E6-6965-469E-BF13-0BFFCBCAAE2D}"= TCP:c:\program files\Steam\Steam.exe:Steam
"{8DFFA929-5219-4BF8-AA37-CA652CF5F21D}"= UDP:c:\users\gigantti\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
"{CB4F9F34-FEFE-4FDF-9118-BECDC1E23A29}"= TCP:c:\users\gigantti\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
R2 SrvCDEject;SrvCDEject;c:\program files\Packard Bell\SrvCDEject.exe [2007-07-13 613376]
R3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\System32\drivers\3xHybrid.sys [2007-07-13 816512]
R3 FETND6V;VIA Rhine Family Fast Ethernet Adapter Driver;c:\windows\System32\drivers\fetnd6v.sys [2008-09-22 43520]
R3 X10Hid;X10 Hid Device;c:\windows\System32\drivers\x10hid.sys [2007-07-13 13976]
S2 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" --> c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [?]
S3 VF0350Afx;VF0350 Audio FX;c:\windows\System32\drivers\V0350Afx.sys [2008-12-27 143136]
S3 VF0350Vfx;VF0350 Video FX;c:\windows\System32\drivers\V0350Vfx.sys [2008-12-27 7424]
S3 VF0350Vid;Live! Cam Video IM (VF0350);c:\windows\System32\drivers\V0350Vid.sys [2008-12-27 170016]
.
'Ajoitetut tehtävät'-kansion sisältö
2009-02-08 c:\windows\Tasks\Laajennettu takuu.job
- c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2006-11-21 18:38]
2009-02-08 c:\windows\Tasks\User_Feed_Synchronization-{04AF7E74-8C43-412E-9533-DFB08147C7E3}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 09:33]
.
- - - - POISTETUT JÄMÄRIVIT - - - -
HKLM-Run-PSPVideo9 - c:\program files\pspvideo9\pspVideo9.exe
.
------- Täydentävä tarkistus -------
.
uStart Page = hxxp://www.google.fi/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-08 22:37:25
Windows 6.0.6001 Service Pack 1 NTFS
tarkistaa piilotettuja prosesseja ...
? [31676]
? [33448]
? [36368]
? [39996]
? [64156]
? [64172]
tarkistaa piilotettuja käynnistysarvoja ...
tarkistaa piilotettuja tiedostoja ...
tarkistus on valmis
piilotetut tiedostot: 0
**************************************************************************
.
Valmistumisajankohta: 2009-02-08 22:39:48
ComboFix-quarantined-files.txt 2009-02-08 20:39:43
Ennen ajoa: 217 202 823 168 tavua vapaana
Ajon jälkeen: 217,300,402,176 tavua vapaana
252 --- E O F --- 2009-02-05 16:28:09
Tälläistä tuli. Nyt on hjt logi tulossa uudestaan laitanko senkin tänne?
Tässä tää lista
Adobe Flash Player 10 ActiveX
Adobe Flash Player 9 ActiveX
Adobe Reader 8
Adobe Reader 8.1.3 - Suomi
Adobe Shockwave Player
Advanced Audio FX Engine
Advanced Video FX Engine
Apple Mobile Device Support
Apple Software Update
Avira AntiVir Personal - Free Antivirus
AviSynth 2.5
Bonjour
Counter-Strike: Source
Counter-Strike: Source
Creative Live! Cam Center
Creative Live! Cam FX Creator
Creative Live! Cam Manager
Creative Live! Cam User's Guide
Creative Live! Cam Video Chat or Video IM Driver (1.01.05.0000)
Creative Photo Calendar
Creative Photo Manager
Creative Software AutoUpdate
Creative System Information
Creator 9
Day of Defeat: Source
Firefox
Flash Player 9 Internet Explorer
Google Earth
Google Earth
Half-Life 2: Deathmatch
Half-Life 2: Lost Coast
HDRegFI
HijackThis 2.0.2
Infocentre Rev. 2.0
IsoBuster 2.5
iTunes
Java(TM) 6 Update 11
LimeWire 4.18.8
Malwarebytes' Anti-Malware
MCE Software Encoder 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB929729)
Microsoft Visual C++ 2005 Redistributable
MSXML 4.0 SP2 (KB954430)
NIS2007
NVIDIA Drivers
OpenOffice.org 3.0
Packard Bell ImageWriter
Packard Bell LCD Test
Packard Bell Updator
PhotoFiltre
Picasa 3
Picasa2
PSP Video 9 1.74
QuickTime
Realtek HD Audio V6.0.1.5377
Realtek High Definition Audio Driver
Roxio Creator 9 LE
SAMSUNG Mobile Modem Driver Set
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio 3
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
SetUp My PC
Shockwave player 10
Steam(TM)
Subtitle Workshop 2.51
TVTUNER TIGER V1.3.3.4a
VIA Rhine Family Fast Ethernet Adapter
Video NVIDIA v158.18
Windows Live Messenger
WinRAR archiver
VLC media player 0.9.8a
World of Warcraft
X10 Hardware(TM)
Kiitos ja anteeksi
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 8. helmikuuta 2009 @ 22:56
|
|
Hujo
Suspended permanently
|
8. helmikuuta 2009 @ 23:31 |
Linkki tähän viestiin
|
Nyt tuon alla olevan lainauksen sisällön Kopioit / liität Tyhjään muistioon
käynnistä nappi >apuohjelmat > muistio
Lainaus:
Folder::
c:\program files\Common Files\Symantec Shared
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
Tallenna se nimellä CFScript.txt työpöydälle
Sitten raahaa CFScript ComboFix.exeen kuten alla.
Laita tuleva loki tänne.
Sammutat ja käynnistät koneen
Voiko tietsikka koskaan toimia?
|
|
hac
Suspended due to non-functional email address
|
9. helmikuuta 2009 @ 16:02 |
Linkki tähän viestiin
|
ComboFix 09-02-08.02 - gigantti 2009-02-09 15:52:52.2 - NTFSx86
Microsoft® Windows Vista? Home Premium 6.0.6001.1.1252.1.1035.18.2046.1301 [GMT 2:00]
Sijainti: c:\users\gigantti\Desktop\ComboFix.exe
Käytetyt komentorivivalitsimet :: c:\users\gigantti\Desktop\CFScript.txt
* Uusi palautuspiste luotu
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Common Files\Symantec Shared
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-09 to 2009-02-09 )))))))))))))))))
.
2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\Malwarebytes
2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\users\All Users\Malwarebytes
2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\programdata\Malwarebytes
2009-02-08 16:18 . 2009-02-08 16:18 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-08 16:18 . 2009-01-14 16:11 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2009-02-08 16:18 . 2009-01-14 16:11 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2009-02-08 13:40 . 2009-02-08 13:40 <KANSIO> d-------- c:\program files\Trend Micro
2009-02-05 18:50 . 2009-02-05 18:50 <KANSIO> d-------- c:\windows\System32\IOSUBSYS
2009-01-27 12:02 . 2009-01-27 12:02 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\Samsung
2009-01-27 11:48 . 2007-07-03 16:58 106,792 --a------ c:\windows\System32\drivers\sscdmdm.sys
2009-01-27 11:48 . 2007-07-03 16:54 80,552 --a------ c:\windows\System32\drivers\sscdbus.sys
2009-01-27 11:48 . 2007-07-03 16:57 11,944 --a------ c:\windows\System32\drivers\sscdmdfl.sys
2009-01-27 11:48 . 2007-07-03 17:00 9,256 --a------ c:\windows\System32\drivers\sscdwhnt.sys
2009-01-27 11:48 . 2007-07-03 17:00 9,256 --a------ c:\windows\System32\drivers\sscdwh.sys
2009-01-27 11:48 . 2007-07-03 16:56 9,256 --a------ c:\windows\System32\drivers\sscdcmnt.sys
2009-01-27 11:48 . 2007-07-03 16:56 9,256 --a------ c:\windows\System32\drivers\sscdcm.sys
2009-01-27 11:45 . 2009-01-27 11:49 <KANSIO> d-------- c:\windows\System32\Samsung_USB_Drivers
2009-01-27 11:44 . 2009-01-27 11:44 <KANSIO> d-------- c:\program files\Samsung
2009-01-27 11:44 . 2009-01-27 12:00 5,632 --a------ c:\windows\System32\drivers\StarOpen.sys
2009-01-27 11:44 . 2005-08-28 20:51 766 --a------ c:\windows\System32\Uninstall.ico
2009-01-23 09:33 . 2009-01-23 09:33 <KANSIO> d-------- c:\program files\AviSynth 2.5
2009-01-22 08:52 . 2009-01-22 08:52 <KANSIO> d-------- c:\program files\Smart Projects
2009-01-18 21:26 . 2009-01-18 21:26 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\AdobeUM
2009-01-15 15:52 . 2009-02-04 22:11 <KANSIO> d-------- c:\program files\Common Files\Steam
2009-01-15 15:41 . 2009-02-09 15:47 <KANSIO> d-------- c:\program files\Steam
2009-01-15 15:40 . 2009-01-15 15:41 <KANSIO> d-------- c:\windows\048298C9A4D3490B9FF9AB023A9238F3.TMP
2009-01-14 23:27 . 2009-01-14 23:27 <KANSIO> d-------- c:\users\gigantti\AppData\Roaming\OpenOffice.org
2009-01-14 23:22 . 2009-01-14 23:22 <KANSIO> d-------- c:\program files\OpenOffice.org 3
2009-01-14 15:45 . 2009-01-14 15:45 <KANSIO> d-------- c:\users\All Users\Avira
2009-01-14 15:45 . 2009-01-14 15:45 <KANSIO> d-------- c:\programdata\Avira
2009-01-14 15:45 . 2009-01-14 15:45 <KANSIO> d-------- c:\program files\Avira
2009-01-14 08:27 . 2008-12-16 04:42 288,768 --a------ c:\windows\System32\drivers\srv.sys
2009-01-12 16:50 . 2009-01-12 16:50 <KANSIO> d-------- c:\program files\URUSoft
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-09 13:52 524,288 --sha-w c:\users\Järjestelmänvalvoja1\NTUSER.DAT
2009-02-07 19:34 --------- d-----w c:\users\gigantti\AppData\Roaming\uTorrent
2009-02-07 19:27 --------- d-----w c:\users\gigantti\AppData\Roaming\LimeWire
2009-02-05 16:50 --------- d-----w c:\program files\Google
2009-01-27 09:44 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-22 16:28 --------- d-----w c:\program files\World of Warcraft
2009-01-18 21:38 --------- d-----w c:\program files\Common Files\Adobe
2009-01-14 14:01 --------- d-----w c:\users\gigantti\AppData\Roaming\Packard Bell
2009-01-14 13:59 --------- d-----w c:\program files\Windows Mail
2009-01-10 20:01 --------- d-----w c:\programdata\Roxio
2009-01-09 17:24 --------- d-----w c:\users\gigantti\AppData\Roaming\Roxio
2009-01-06 08:21 --------- d-----w c:\users\gigantti\AppData\Roaming\PeerNetworking
2009-01-05 18:47 --------- d-----w c:\users\gigantti\AppData\Roaming\vlc
2009-01-02 12:11 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-01-02 11:03 410,984 ----a-w c:\windows\System32\deploytk.dll
2009-01-02 11:02 --------- d-----w c:\program files\Java
2009-01-02 10:58 --------- d-----w c:\program files\LimeWire
2009-01-02 09:05 174 --sha-w c:\program files\desktop.ini
2009-01-01 19:57 --------- d-----w c:\program files\Windows Sidebar
2009-01-01 19:57 --------- d-----w c:\program files\Windows Photo Gallery
2009-01-01 19:57 --------- d-----w c:\program files\Windows Journal
2009-01-01 19:57 --------- d-----w c:\program files\Windows Defender
2009-01-01 19:57 --------- d-----w c:\program files\Windows Collaboration
2009-01-01 19:57 --------- d-----w c:\program files\Windows Calendar
2009-01-01 19:12 82,432 ----a-w c:\windows\System32\axaltocm.dll
2009-01-01 19:12 101,888 ----a-w c:\windows\System32\ifxcardm.dll
2008-12-30 23:31 --------- d-----w c:\program files\uTorrent
2008-12-30 23:20 --------- d-----w c:\program files\VideoLAN
2008-12-30 11:34 --------- d-----w c:\programdata\Blizzard
2008-12-30 09:45 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2008-12-27 21:54 --------- d-----w c:\users\gigantti\AppData\Roaming\Creative
2008-12-27 21:54 --------- d-----w c:\programdata\Creative
2008-12-27 21:49 --------- d-----w c:\program files\Creative
2008-12-27 21:43 --------- d-----w c:\programdata\muvee Technologies
2008-12-27 20:32 --------- d-----w c:\programdata\NVIDIA
2008-12-27 19:37 269,312 ----a-w c:\windows\System32\es.dll
2008-12-27 18:51 --------- d-----w c:\program files\PhotoFiltre
2008-12-27 18:46 --------- d-----w c:\program files\B2BPOKER
2008-12-27 11:31 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-12-27 11:29 --------- d-----w c:\program files\Windows Live
2008-12-27 11:27 --------- d-----w c:\users\gigantti\AppData\Roaming\Apple Computer
2008-12-27 11:27 --------- d-----w c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-27 11:27 --------- d-----w c:\program files\iTunes
2008-12-27 11:26 --------- d-----w c:\programdata\Apple Computer
2008-12-27 11:26 --------- d-----w c:\program files\iPod
2008-12-27 11:26 --------- d-----w c:\program files\Common Files\Apple
2008-12-27 11:25 --------- d-----w c:\program files\QuickTime
2008-12-27 11:25 --------- d-----w c:\program files\Bonjour
2008-12-27 11:23 --------- d-----w c:\program files\Apple Software Update
2008-12-27 11:21 --------- d-----w c:\programdata\Apple
2008-12-27 11:14 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-12-27 11:10 --------- d-----w c:\programdata\WLInstaller
2008-12-27 09:10 61,440 ----a-w c:\windows\System32\winipsec.dll
2008-12-27 09:10 361,984 ----a-w c:\windows\System32\IPSECSVC.DLL
2008-12-27 09:10 28,672 ----a-w c:\windows\System32\FwRemoteSvr.dll
2008-12-27 09:10 272,896 ----a-w c:\windows\System32\polstore.dll
2008-12-27 09:08 94,720 ----a-w c:\windows\System32\PortableDeviceClassExtension.dll
2008-12-27 09:08 241,152 ----a-w c:\windows\System32\PortableDeviceApi.dll
2008-12-27 09:08 160,768 ----a-w c:\windows\System32\PortableDeviceTypes.dll
2008-12-27 09:03 428,544 ----a-w c:\windows\System32\EncDec.dll
2008-12-27 09:03 293,376 ----a-w c:\windows\System32\psisdecd.dll
2008-12-27 09:01 296,960 ----a-w c:\windows\System32\gdi32.dll
2008-12-27 08:58 212,480 ----a-w c:\windows\system32\drivers\mrxsmb10.sys
2008-12-27 08:56 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-12-27 08:56 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-12-27 08:56 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-12-27 08:56 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-12-27 08:56 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-12-27 08:56 2,560 ----a-w c:\windows\AppPatch\AcRes.dll
2008-12-27 08:56 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-12-27 08:56 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-12-27 08:56 1,695,744 ----a-w c:\windows\System32\gameux.dll
2008-12-27 08:55 303,616 ----a-w c:\windows\System32\wmpeffects.dll
2008-12-27 08:54 2,048 ----a-w c:\windows\System32\msxml3r.dll
2008-12-27 08:54 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-12-27 08:54 1,191,936 ----a-w c:\windows\System32\msxml3.dll
2008-12-27 08:50 2,048 ----a-w c:\windows\System32\tzres.dll
2008-12-27 08:45 2,927,104 ----a-w c:\windows\explorer.exe
2008-12-27 08:41 827,392 ----a-w c:\windows\System32\wininet.dll
2008-12-27 08:37 801,280 ----a-w c:\windows\System32\NaturalLanguage6.dll
2008-12-27 08:37 6,917,120 ----a-w c:\windows\System32\NlsLexicons0c1a.dll
2008-12-27 08:37 4,495,360 ----a-w c:\windows\System32\NlsData0816.dll
2008-12-27 08:37 4,495,360 ----a-w c:\windows\System32\NlsData0416.dll
2008-12-27 08:37 4,495,360 ----a-w c:\windows\System32\NlsData0414.dll
2008-12-27 08:37 2,342,912 ----a-w c:\windows\System32\NlsData000d.dll
2008-12-27 08:37 1,965,056 ----a-w c:\windows\System32\NlsData0c1a.dll
2008-12-27 08:37 1,965,056 ----a-w c:\windows\System32\NlsData081a.dll
2008-12-27 08:37 1,965,056 ----a-w c:\windows\System32\NlsData000f.dll
2008-12-27 08:35 988,216 ----a-w c:\windows\System32\winload.exe
2008-12-27 08:35 927,288 ----a-w c:\windows\System32\winresume.exe
2008-12-27 08:35 615,992 ----a-w c:\windows\System32\ci.dll
2008-12-27 08:35 6,656 ----a-w c:\windows\System32\kbd106n.dll
2008-12-27 08:35 46,592 ----a-w c:\windows\System32\setbcdlocale.dll
2008-12-27 08:35 40,960 ----a-w c:\windows\System32\srclient.dll
2008-12-27 08:35 378,368 ----a-w c:\windows\System32\srcore.dll
2008-12-27 08:35 318,464 ----a-w c:\windows\System32\rstrui.exe
2008-12-27 08:35 19,000 ----a-w c:\windows\System32\kd1394.dll
2008-12-27 08:35 14,848 ----a-w c:\windows\System32\srdelayed.exe
2008-12-27 08:32 712,704 ----a-w c:\windows\System32\WindowsCodecs.dll
2008-12-27 08:32 425,472 ----a-w c:\windows\System32\PhotoMetadataHandler.dll
2007-07-13 07:06 141,824 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-02-08_22.38.10,52 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-02-08 19:30:56 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-02-09 13:46:27 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-02-08 19:30:56 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-02-09 13:46:27 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-02-08 20:37:31 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat
+ 2009-02-09 13:48:01 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat
+ 2009-02-09 13:48:01 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2009-02-08 20:37:22 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2009-02-09 13:48:06 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2009-02-09 13:48:06 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2009-02-08 19:30:57 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-02-09 13:48:37 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-02-08 19:30:57 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-02-09 13:48:37 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-02-08 19:30:57 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-02-09 13:48:37 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-02-08 20:34:12 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat
+ 2009-02-09 13:52:20 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat
+ 2009-02-09 13:52:20 262,144 ---ha-w c:\windows\System32\config\systemprofile\ntuser.dat.LOG1
- 2009-02-08 19:38:26 104,742 ----a-w c:\windows\System32\perfc009.dat
+ 2009-02-09 13:54:03 104,742 ----a-w c:\windows\System32\perfc009.dat
- 2009-02-08 19:38:26 85,240 ----a-w c:\windows\System32\perfc00B.dat
+ 2009-02-09 13:54:03 85,240 ----a-w c:\windows\System32\perfc00B.dat
- 2009-02-08 19:38:26 595,308 ----a-w c:\windows\System32\perfh009.dat
+ 2009-02-09 13:54:03 595,308 ----a-w c:\windows\System32\perfh009.dat
- 2009-02-08 19:38:26 443,892 ----a-w c:\windows\System32\perfh00B.dat
+ 2009-02-09 13:54:03 443,892 ----a-w c:\windows\System32\perfh00B.dat
- 2009-02-08 19:34:22 6,316 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4036286748-1219283907-3130473445-1002_UserData.bin
+ 2009-02-09 13:48:26 6,332 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4036286748-1219283907-3130473445-1002_UserData.bin
- 2009-02-08 19:34:20 65,710 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2009-02-09 13:48:26 66,054 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2009-02-08 19:34:17 35,830 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-02-09 13:48:24 36,140 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
-- Snapshot nollattu tähän hetkeen --
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"SmpcSys"="c:\program files\Packard Bell\SetUpMyPC\SmpSys.exe" [2007-05-03 1116728]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Creative Live! Cam Manager"="c:\program files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-05-02 151552]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Steam"="c:\program files\steam\steam.exe" [2009-01-15 1410296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 232184]
"toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13580832]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 92704]
"AVFX Engine"="c:\program files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2007-04-09 20480]
"V0350Mon.exe"="c:\windows\V0350Mon.exe" [2007-03-28 32768]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-02 136600]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-01 c:\windows\RtHDVCpl.exe]
c:\users\gigantti\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-10-04 393216]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{961656CC-7C8C-4F93-8147-C31E85AB6C8F}"= UDP:c:\program files\Skype\Phone\Skype.exe:Skype
"{FBF9AC3D-ADF0-4668-80F2-6A6460EF475A}"= TCP:c:\program files\Skype\Phone\Skype.exe:Skype
"{518374B7-6003-4526-94F3-BDC374C3486E}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{A84817C4-0FB6-4215-A31E-95D00BBEFBB9}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{8EDB7684-189E-474B-B2E0-BF9AC019BBB5}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{8F9D51FC-28C6-45EC-8D0B-476D96BC30D0}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{5E03385F-A84F-46B6-8D0F-8498B325DE53}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{C0A99A90-7B29-4CBB-90F2-813F9B328C19}c:\\program files\\b2bpoker\\pokerihuone\\jre\\bin\\javaw.exe"= UDP:c:\program files\b2bpoker\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"UDP Query User{98E14683-453E-42C2-8D48-17177512DE4E}c:\\program files\\b2bpoker\\pokerihuone\\jre\\bin\\javaw.exe"= TCP:c:\program files\b2bpoker\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"{90717786-729F-4940-BA94-3783CE1070A7}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{7DE88E92-FE46-4ADB-B7C9-41CB10961B36}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{954E3F98-C99C-4477-BB30-6FA810052257}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{1A4D98BB-8FE2-461F-A241-54A4C7FF702D}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{331B987E-79DC-4882-92B2-DE1D591F18A2}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2
"UDP Query User{0F820793-94FF-4A11-AA0C-4AACA2541582}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2
"TCP Query User{659D8150-8385-403B-A02A-FF0489EC40A2}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{7935285F-63E6-4AB4-99F7-FA4CDE2651FC}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"TCP Query User{84DEB74E-4D9D-4738-8030-D062E81665E2}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2
"UDP Query User{3DAD7939-CEC4-4AA5-968E-041429D7F844}c:\\program files\\steam\\steamapps\\linec26\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\linec26\counter-strike source\hl2.exe:hl2
"TCP Query User{9363542A-D88A-41D6-A0B2-9614D0124141}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{9542653B-8E23-467C-96D2-531B18262489}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{6210DB8E-AFD0-43AF-9B44-2A2314A6B574}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"UDP Query User{4C664FB6-CAA3-4B47-9B8F-78CD4466B6CA}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"{2657FA41-61DC-4DCD-B3D6-3BEBE0993CF3}"= UDP:c:\program files\Steam\Steam.exe:Steam
"{7A7153E6-6965-469E-BF13-0BFFCBCAAE2D}"= TCP:c:\program files\Steam\Steam.exe:Steam
"{8DFFA929-5219-4BF8-AA37-CA652CF5F21D}"= UDP:c:\users\gigantti\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
"{CB4F9F34-FEFE-4FDF-9118-BECDC1E23A29}"= TCP:c:\users\gigantti\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
R2 SrvCDEject;SrvCDEject;c:\program files\Packard Bell\SrvCDEject.exe [2007-07-13 613376]
R3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\System32\drivers\3xHybrid.sys [2007-07-13 816512]
R3 FETND6V;VIA Rhine Family Fast Ethernet Adapter Driver;c:\windows\System32\drivers\fetnd6v.sys [2008-09-22 43520]
R3 X10Hid;X10 Hid Device;c:\windows\System32\drivers\x10hid.sys [2007-07-13 13976]
S2 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" --> c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [?]
S3 VF0350Afx;VF0350 Audio FX;c:\windows\System32\drivers\V0350Afx.sys [2008-12-27 143136]
S3 VF0350Vfx;VF0350 Video FX;c:\windows\System32\drivers\V0350Vfx.sys [2008-12-27 7424]
S3 VF0350Vid;Live! Cam Video IM (VF0350);c:\windows\System32\drivers\V0350Vid.sys [2008-12-27 170016]
.
'Ajoitetut tehtävät'-kansion sisältö
2009-02-08 c:\windows\Tasks\Laajennettu takuu.job
- c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2006-11-21 18:38]
2009-02-09 c:\windows\Tasks\User_Feed_Synchronization-{04AF7E74-8C43-412E-9533-DFB08147C7E3}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 09:33]
.
.
------- Täydentävä tarkistus -------
.
uStart Page = hxxp://www.google.fi/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-09 15:54:58
Windows 6.0.6001 Service Pack 1 NTFS
tarkistaa piilotettuja prosesseja ...
? [6632]
? [58756]
? [62388]
? [432]
? [26872]
? [26888]
tarkistaa piilotettuja käynnistysarvoja ...
tarkistaa piilotettuja tiedostoja ...
tarkistus on valmis
piilotetut tiedostot: 0
**************************************************************************
.
Valmistumisajankohta: 2009-02-09 15:57:09
ComboFix-quarantined-files.txt 2009-02-09 13:57:06
ComboFix2.txt 2009-02-08 20:39:50
Ennen ajoa: 214 405 091 328 tavua vapaana
Ajon jälkeen: 214,374,141,952 tavua vapaana
289 --- E O F --- 2009-02-05 16:28:09
Tollanen tuli
Kiitos ja anteeksi
|
|
Hujo
Suspended permanently
|
9. helmikuuta 2009 @ 16:14 |
Linkki tähän viestiin
|
|
Mikäs on koneen toiminta
Voiko tietsikka koskaan toimia?
|
|
hac
Suspended due to non-functional email address
|
10. helmikuuta 2009 @ 22:07 |
Linkki tähän viestiin
|
|
Nyt toimii KIITOS PALJO HUJO! parempaa ja NOPEAMPAA apua en olisi voinut edes toivoa! Todella nopeata toimintaa KIITOS!
Kiitos ja anteeksi
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 10. helmikuuta 2009 @ 22:08
|
|
Hujo
Suspended permanently
|
10. helmikuuta 2009 @ 22:30 |
Linkki tähän viestiin
|
Kirjoita suorita luukkuun
ComboFix /u
Klikkaa ok
==========
Lataa OTMoveIt
OTMoveIt ja tallenna se työpöydällesi.
Tuplaklikkaa OTMoveIt.exe.
Klikkaa CleanUp!.
Valitse Yes kun kysytään "Begin cleanup Process?".
Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.
HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.
=============
Lataa Tästä Ccleaner
CCleaner v 2.14.750.- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
Asennuksen jälkeen aukaise CCleaneri.
Valitse vasemmalta pystyrivistä Options.
Valitse viereisestä pystyrivistä Settings.
Language kohtaan valitse Suomi.
Puhdistaja
Valitse vasemmalta pystyrivistä Puhdistaja.
Paina alhaalta Tutki.
Nyt CCleaneri tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
Kun tutkiminen on valmis, paina Aja CCleaner.
Nyt CCleaneri poistaa löydetyt tempit, cookiessit jne.
Rekisterin virheiden korjaus
Valitse vasemmalta pystyrivistä Rekisteri.
Paina alhaalta Etsi rekisterin virheitä.
Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
Saat vielä varmistus kysymyksen, paina Ok.
Kun virheet on korjattu, paina Sulje.
Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
Voiko tietsikka koskaan toimia?
|
|
hac
Suspended due to non-functional email address
|
10. helmikuuta 2009 @ 23:38 |
Linkki tähän viestiin
|
|
Mistä tiedän mihin kannatta laitta rasti ja mistä jättää pois?
Kiitos ja anteeksi
|
|
Hujo
Suspended permanently
|
10. helmikuuta 2009 @ 23:51 |
Linkki tähän viestiin
|
|
Niin missä
Voiko tietsikka koskaan toimia?
|
|
hac
Suspended due to non-functional email address
|
18. helmikuuta 2009 @ 21:01 |
Linkki tähän viestiin
|
Lainaus, alkuperäisen viestin kirjoitti Hujo:
Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja
Lainaus:
Kiitos ja anteeksi
|
|
Hujo
Suspended permanently
|
18. helmikuuta 2009 @ 21:36 |
Linkki tähän viestiin
|
|
pistä kaikki pois mitä löytää.
Voiko tietsikka koskaan toimia?
|
|
hac
Suspended due to non-functional email address
|
19. helmikuuta 2009 @ 13:34 |
Linkki tähän viestiin
|
|
Pistetty joten mitäs sitten koska ram muisti täyttyy edelleen ja kone tilttaa
Kiitos ja anteeksi
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
19. helmikuuta 2009 @ 21:05 |
Linkki tähän viestiin
|
Scannaa koneesi Kaspersky Online Scannerin
Ohjelman käynnistyessä kysytään sallitaanko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
" Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
" Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
" Klikkaa nyt asetuksia, Scan Settings
" Tarkista asetuksista, että seuraavat ovat valittuina:
o Scan using the following Anti-Virus database:
+ Extended (Jos valittavissa, muuten valitse Standard)
o Scan Options:
+ Scan Archives
+ Scan Mail Bases
" Klikkaa OK
" Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
" Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
" Klikkaa nyt Save as Text-painiketta.
" Tallenna tiedosto työpöydällesi.
" Mikäli haluat jatkaa asian käsittelyä foorumissa niin kopioi tiedoston sisältö viestiisi.
Voiko tietsikka koskaan toimia?
|
|
