|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Isass...
|
|
|
Ticsi
Junior Member
|
17. helmikuuta 2009 @ 11:38 |
Linkki tähän viestiin
|
Tällänen löyty ja tein topicin ja neuvottiin postaamaan tälle alueelle muutamies lokien kera. Täs "alkuperäinen" topic: http://keskustelu.afterdawn.com/thread_view.cfm/749621
Lokit:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:06:01, on 17.2.2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16809)
Boot mode: Normal
Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\LEXBCES.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\System32\LEXPPS.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\svchost.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Norman\Npm\Bin\Zlh.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\PixArt\Pac207\Monitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Users\Käyttäjä\Program Files\DNA\btdna.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Norman\nse\bin\NSESVC.EXE
C:\Program Files\Launch Manager\WisLMSvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Program Files\Norman\Nvc\bin\nvcoas.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\mIRC\mirc.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\SwiftKit\SwiftKit.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [HotkeyApp] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [services] C:\WINDOWS\Microsoft\services.exe
O4 - HKLM\..\Run: [lsass] C:\Program Files\lsass.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Käyttäjä\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Sol...wn.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Avira AntiVir Personal ? Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal ? Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\Windows\System32\LEXBCES.EXE
O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: WisLMSvc - Wistron Corp. - C:\Program Files\Launch Manager\WisLMSvc.exe
--
End of file - 9887 bytes
Malwarebytes' Anti-Malware 1.34
Tietokantaversio: 1768
Windows 6.0.6000
17.2.2009 10:36:01
mbam-log-2009-02-17 (10-36-01).txt
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
Tarkistetut kohteet: 136684
Kulunut aika: 1 hour(s), 30 minute(s), 31 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 1
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services (Trojan.Agent) -> Quarantined and deleted successfully.
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)
|
|
Hujo
Suspended permanently
|
17. helmikuuta 2009 @ 11:56 |
Linkki tähän viestiin
|
1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
Combofix1
Combofix2
älä asenna palutus consolia
2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
================
näyttää olevan avira ja norman koneella
yksi virustorjunta pisaaa.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 17. helmikuuta 2009 @ 12:00
|
|
Ticsi
Junior Member
|
17. helmikuuta 2009 @ 14:53 |
Linkki tähän viestiin
|
ComboFix 09-02-15.01 - Käyttäjä 2009-02-17 14:30:51.1 - NTFSx86
Microsoft® Windows Vista? Home Premium 6.0.6000.0.1252.1.1035.18.2038.881 [GMT 2:00]
Sijainti: c:\users\Käyttäjä\Downloads\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
AV: Norman Virus Control ver. 5.99 *On-access scanning enabled* (Updated)
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\x64
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-17 to 2009-02-17 )))))))))))))))))
.
2009-02-17 09:05 . 2009-02-17 09:05 <KANSIO> d-------- c:\program files\Trend Micro
2009-02-17 09:02 . 2009-02-17 09:02 <KANSIO> d-------- c:\users\Käyttäjä\AppData\Roaming\Malwarebytes
2009-02-17 09:02 . 2009-02-17 09:02 <KANSIO> d-------- c:\users\All Users\Malwarebytes
2009-02-17 09:02 . 2009-02-17 09:02 <KANSIO> d-------- c:\programdata\Malwarebytes
2009-02-17 09:02 . 2009-02-17 09:02 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-17 09:02 . 2009-02-11 10:19 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2009-02-17 09:02 . 2009-02-11 10:19 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2009-02-15 02:00 . 2008-12-05 06:29 1,244,672 --a------ c:\windows\System32\mcmde.dll
2009-02-15 02:00 . 2008-12-05 06:29 428,032 --a------ c:\windows\System32\EncDec.dll
2009-02-15 02:00 . 2008-12-05 06:29 292,352 --a------ c:\windows\System32\psisdecd.dll
2009-02-15 02:00 . 2008-12-05 06:29 217,088 --a------ c:\windows\System32\psisrndr.ax
2009-02-15 02:00 . 2008-12-05 06:29 177,152 --a------ c:\windows\System32\mpg2splt.ax
2009-02-15 02:00 . 2008-12-05 06:29 80,896 --a------ c:\windows\System32\MSNP.ax
2009-02-15 02:00 . 2008-12-05 06:29 68,608 --a------ c:\windows\System32\Mpeg2Data.ax
2009-02-15 02:00 . 2008-12-05 06:29 57,856 --a------ c:\windows\System32\MSDvbNP.ax
2009-02-13 09:38 . 2009-02-13 09:38 <KANSIO> d-------- c:\users\Käyttäjä\AppData\Roaming\NCH Software
2009-02-13 09:37 . 2009-02-13 09:37 <KANSIO> d-------- c:\users\All Users\NCH Software
2009-02-13 09:37 . 2009-02-13 09:37 <KANSIO> d-------- c:\programdata\NCH Software
2009-02-13 09:37 . 2009-02-13 09:37 <KANSIO> d-------- c:\program files\NCH Software
2009-02-08 17:16 . 2009-02-08 17:16 <KANSIO> d-------- c:\program files\Axife Mouse Recorder DEMO
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-17 12:35 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\mIRC
2009-02-17 12:34 4,456,448 --sha-w c:\users\Käyttäjä\NTUSER.DAT
2009-02-17 12:34 4,456,448 --sha-w c:\users\Käyttäjä\NTUSER.DAT
2009-02-17 12:30 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\BitTorrent
2009-02-17 12:28 34 ----a-w c:\users\Käyttäjä\jagex_runescape_preferences.dat
2009-02-17 12:28 34 ----a-w c:\users\Käyttäjä\jagex_runescape_preferences.dat
2009-02-17 12:27 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\DNA
2009-02-17 12:26 --------- d-----w c:\program files\SwiftKit
2009-02-17 07:02 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\Malwarebytes
2009-02-17 06:56 --------- d-----w c:\program files\Norman
2009-02-14 22:30 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\Ventrilo
2009-02-14 12:16 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\LimeWire
2009-02-13 07:38 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\NCH Software
2009-02-13 04:37 --------- d-----w c:\programdata\Microsoft Help
2009-02-13 04:36 --------- d-----w c:\program files\Windows Mail
2009-01-15 04:16 826,368 ----a-w c:\windows\System32\wininet.dll
2009-01-15 04:16 56,320 ----a-w c:\windows\System32\iesetup.dll
2009-01-15 04:16 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2009-01-15 04:15 26,624 ----a-w c:\windows\System32\ieUnatt.exe
2009-01-14 11:12 --------- d-----w c:\program files\Steam
2009-01-08 15:21 --------- d-----w c:\users\Käyttäjä\AppData\Roaming\DivX
2009-01-08 09:36 --------- d-----w c:\program files\DivX
2009-01-08 09:36 --------- d-----w c:\program files\Common Files\PX Storage Engine
2009-01-07 18:41 --------- d-----w c:\program files\BitTorrent
2009-01-02 17:52 --------- d-----w c:\program files\Bonjour
2009-01-02 15:08 410,984 ----a-w c:\windows\System32\deploytk.dll
2009-01-02 15:08 --------- d-----w c:\program files\Java
2008-12-27 10:44 --------- d-----w c:\program files\Warcraft III
2008-12-26 19:16 --------- d-----w c:\program files\Counter-Strike 1.6
2008-12-26 18:57 --------- d-----w c:\program files\Intel
2008-12-17 13:00 --------- d-----w c:\program files\ATI
2008-12-17 12:56 --------- d-----w c:\program files\ATI Technologies
2008-12-12 09:18 87,336 ----a-w c:\windows\System32\dns-sd.exe
2008-12-12 09:11 61,440 ----a-w c:\windows\System32\dnssd.dll
2008-12-11 13:31 174 --sha-w c:\program files\desktop.ini
2008-12-11 00:33 86,016 ----a-w c:\windows\System32\dpl100.dll
2008-12-11 00:33 200,704 ----a-w c:\windows\System32\dtu100.dll
2008-12-09 14:04 8,198,680 ----a-w c:\windows\System32\TVWSetup.exe
2008-12-09 14:04 150,552 ----a-w c:\windows\System32\igfxpers.exe
2008-12-09 14:04 141,848 ----a-w c:\windows\System32\igfxtray.exe
2008-12-09 14:03 993,816 ----a-w c:\windows\System32\igxpun.exe
2008-12-09 14:03 668,696 ----a-w c:\windows\System32\igfxcfg.exe
2008-12-09 14:03 173,592 ----a-w c:\windows\System32\hkcmd.exe
2008-12-09 14:03 172,568 ----a-w c:\windows\System32\igfxext.exe
2008-12-09 02:28 593,920 ----a-w c:\windows\System32\dpuGUI11.dll
2008-12-09 02:28 57,344 ----a-w c:\windows\System32\dpv11.dll
2008-12-09 02:28 344,064 ----a-w c:\windows\System32\dpus11.dll
2008-12-09 02:28 294,912 ----a-w c:\windows\System32\dpu11.dll
2008-12-02 10:49 252,952 ----a-w c:\windows\System32\igfxsrvc.exe
2008-12-02 10:40 155,648 ----a-w c:\windows\System32\igfxCoIn_v1608.dll
2008-12-02 10:33 3,821,568 ----a-w c:\windows\System32\igdumd32.dll
2008-12-02 10:31 1,498,564 ----a-w c:\windows\System32\igkrng400.bin
2008-12-02 10:27 536,576 ----a-w c:\windows\System32\igdumdx32.dll
2008-12-02 10:22 2,580,480 ----a-w c:\windows\System32\igd10umd32.dll
2008-12-02 10:13 4,112,384 ----a-w c:\windows\System32\ig4icd32.dll
2008-12-02 10:13 2,674,688 ----a-w c:\windows\System32\ig4dev32.dll
2008-12-02 10:04 398,336 ----a-w c:\windows\System32\TVWizudlg.exe
2008-12-02 10:03 59,392 ----a-w c:\windows\System32\oemdspif.dll
2008-12-02 10:03 257,536 ----a-w c:\windows\System32\igfxTMM.dll
2008-12-02 10:03 23,552 ----a-w c:\windows\System32\igfxexps.dll
2008-12-02 10:03 200,192 ----a-w c:\windows\System32\igfxpph.dll
2008-12-02 10:03 140,288 ----a-w c:\windows\System32\igfxtvcx.dll
2008-12-02 10:02 94,208 ----a-w c:\windows\System32\hccutils.dll
2008-12-02 10:02 51,712 ----a-w c:\windows\System32\igfxsrvc.dll
2008-12-02 10:02 5,702,656 ----a-w c:\windows\System32\igfxress.dll
2008-12-02 10:02 210,432 ----a-w c:\windows\System32\igfxdev.dll
2008-12-02 10:02 130,048 ----a-w c:\windows\System32\igfxdo.dll
2008-12-02 10:00 319,456 ----a-w c:\windows\System32\difxapi.dll
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-06-23 1232896]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"BitTorrent DNA"="c:\users\Käyttäjä\Program Files\DNA\btdna.exe" [2008-12-16 342848]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2007-07-26 192512]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-08-17 102400]
"Norman ZANDA"="c:\program files\Norman\Npm\bin\ZLH.EXE" [2008-06-02 273520]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-07-09 36352]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-12-09 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-12-09 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-12-09 150552]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-02 136600]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 c:\windows\RtHDVCpl.exe]
"Skytel"="Skytel.exe" [2007-06-15 c:\windows\SkyTel.exe]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{65C14AE8-94D2-4788-812C-CA7BA2526EA9}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{600E0CEB-1CF1-422A-9434-EF09862092DF}c:\\program files\\b2bpoker\\pokerihuone\\jre\\bin\\javaw.exe"= UDP:c:\program files\b2bpoker\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"UDP Query User{352AE621-DEC2-4333-9BC8-3BF4A0D7D911}c:\\program files\\b2bpoker\\pokerihuone\\jre\\bin\\javaw.exe"= TCP:c:\program files\b2bpoker\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"{829E3431-F9AE-4A36-B45E-467457E94154}"= UDP:c:\limewire\LimeWire.exe:LimeWire
"{2A2EB5E3-0BA4-421F-9072-E1C747537D21}"= TCP:c:\limewire\LimeWire.exe:LimeWire
"TCP Query User{67B52A71-777E-4C68-BEA9-3F80EA0D1742}c:\\program files\\mirc\\mirc.exe"= UDP:c:\program files\mirc\mirc.exe:mIRC
"UDP Query User{A8EBC4C1-B5B6-4912-BBD0-8D3C18593CE5}c:\\program files\\mirc\\mirc.exe"= TCP:c:\program files\mirc\mirc.exe:mIRC
"TCP Query User{115D2CDE-8EC8-403E-85B7-8BA2066AEB48}c:\\program files\\mirc\\mirc.exe"= UDP:c:\program files\mirc\mirc.exe:mIRC
"UDP Query User{316606A1-0180-43CD-AC33-D86B78A39065}c:\\program files\\mirc\\mirc.exe"= TCP:c:\program files\mirc\mirc.exe:mIRC
"TCP Query User{3FD6E4AE-1F56-4E70-8330-2D3E953F70C8}c:\\program files\\steam\\steamapps\\tic_o\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\tic_o\counter-strike source\hl2.exe:hl2
"UDP Query User{069C6CCD-001B-479F-B068-B49F973F8C6E}c:\\program files\\steam\\steamapps\\tic_o\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\tic_o\counter-strike source\hl2.exe:hl2
"{11B10A16-0029-47DB-9C72-667FE43BF6A9}"= UDP:c:\program files\Warcraft III\Frozen Throne.exe:Warcraft III - The Frozen Throne
"{763CAC73-13BF-46A3-B810-D658D44E01FE}"= TCP:c:\program files\Warcraft III\Frozen Throne.exe:Warcraft III - The Frozen Throne
"TCP Query User{C4309C57-6847-492C-9220-6EAE809493CC}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{AB1C09FC-357B-4C74-9E86-2894208EE9D2}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III
"{D8A5DFCF-92B6-4E0C-89C5-242D4E240B1F}"= UDP:c:\program files\WC3Banlist\WC3Banlist.exe:WC3Banlist
"{D6AE6F46-3D43-46BC-981E-6D411C825DA4}"= TCP:c:\program files\WC3Banlist\WC3Banlist.exe:WC3Banlist
"{0CBE05B6-F90B-486C-ACF7-C106C6767229}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{C1FCCD91-759A-45EB-975B-007CBF7E865F}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{FA6B7E74-C112-404C-AFBC-1C2FA03C5746}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{1FFAF5F3-CF4B-41C6-B339-B0A0CF62D77B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{CA88F19D-90F9-4C0E-ACF0-A0E1CE6552B7}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{386DAB8F-C755-4A23-9D0D-7D14AEAA9F2B}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{4B2AAFC5-8F05-40EA-8F7F-764F4EE21509}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III
"TCP Query User{FC615E60-9448-4607-830C-A152DA05F736}c:\\program files\\steam\\steamapps\\tic_o\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\tic_o\counter-strike source\hl2.exe:hl2
"UDP Query User{6C7BAC35-6419-4369-9921-F7010CBDA965}c:\\program files\\steam\\steamapps\\tic_o\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\tic_o\counter-strike source\hl2.exe:hl2
"TCP Query User{5CFCB65E-08DA-40FC-BC6C-61883A0173EB}c:\\program files\\electronic arts\\eadm\\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"UDP Query User{BF30914F-AD99-4008-93CE-573805B03ECB}c:\\program files\\electronic arts\\eadm\\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"TCP Query User{521395ED-3891-4460-9EC6-0FF7FB5C16C4}c:\\program files\\electronic arts\\eadm\\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"UDP Query User{9F3CB65D-1A1C-4D28-A8DB-FA9EC28A3D69}c:\\program files\\electronic arts\\eadm\\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"TCP Query User{02FE0278-3B44-4329-A6DE-72DA698BAF9D}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{0EB75EEF-4DE6-41C8-9804-CF01797719B9}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"{8EC18954-105E-4418-8116-957E2B88FF25}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)
"{1CE39CCA-ED87-437E-985D-C65C2D1E3A7A}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)
"TCP Query User{5A1E1327-A2D5-4A0C-B654-98AA37629841}c:\\users\\käyttäjä\\program files\\dna\\btdna.exe"= UDP:c:\users\käyttäjä\program files\dna\btdna.exe:btdna.exe
"UDP Query User{6165EE58-FB7D-4BA2-9CB6-CD9E8AFB1B50}c:\\users\\käyttäjä\\program files\\dna\\btdna.exe"= TCP:c:\users\käyttäjä\program files\dna\btdna.exe:btdna.exe
"TCP Query User{6A6E4FD6-7713-44A4-9580-70FBEEF3FBF1}c:\\program files\\counter-strike 1.6\\hl.exe"= UDP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"UDP Query User{B98D11D3-02A5-4395-AB27-F3CDCEF9BD3D}c:\\program files\\counter-strike 1.6\\hl.exe"= TCP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"{72EB78AB-B188-42F4-8599-427653F7DBF5}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{CA956F39-7D4B-4A82-9B6F-EC421E7D2670}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{D27BE586-EE22-456F-9861-72B524D85D3C}c:\\users\\käyttäjä\\desktop\\fiaryhookv1.0.exe"= UDP:c:\users\käyttäjä\desktop\fiaryhookv1.0.exe:fiaryhookv1.0.exe
"UDP Query User{E653C2F8-0787-4BF5-A3DC-BBC1B2B059DD}c:\\users\\käyttäjä\\desktop\\fiaryhookv1.0.exe"= TCP:c:\users\käyttäjä\desktop\fiaryhookv1.0.exe:fiaryhookv1.0.exe
"TCP Query User{1A874D3B-429C-4F91-A118-9EB87122340E}c:\\program files\\valve\\counter-strike source\\hl2.exe"= UDP:c:\program files\valve\counter-strike source\hl2.exe:hl2
"UDP Query User{A9C7CE42-8E50-4A33-B902-5F498A7D8CCD}c:\\program files\\valve\\counter-strike source\\hl2.exe"= TCP:c:\program files\valve\counter-strike source\hl2.exe:hl2
"TCP Query User{5DBDF36A-1E95-4FA7-ABF6-1F86E7E1B805}c:\\program files\\steam\\steamapps\\fly_guy\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\fly_guy\counter-strike source\hl2.exe:hl2
"UDP Query User{2711B1FD-40CF-4636-A04E-9AE451578882}c:\\program files\\steam\\steamapps\\fly_guy\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\fly_guy\counter-strike source\hl2.exe:hl2
"TCP Query User{0834001E-CEE4-4BBF-A632-DA7BA6011847}c:\\program files\\counter-strike 1.6\\hl.exe"= UDP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"UDP Query User{0B6CE34A-1FFE-4563-A888-E8376441D953}c:\\program files\\counter-strike 1.6\\hl.exe"= TCP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"{CC615E33-9D73-416D-9AA0-EFFF3EA91409}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{DBE9AEA1-323A-4E38-BD05-2D87EC152490}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"TCP Query User{BD9D567C-828D-49C5-8308-5A168F6F5740}c:\\program files\\bittorrent\\bittorrent.exe"= UDP:c:\program files\bittorrent\bittorrent.exe:BitTorrent
"UDP Query User{4BAADB90-AD46-436F-A9EF-9092C097FAA2}c:\\program files\\bittorrent\\bittorrent.exe"= TCP:c:\program files\bittorrent\bittorrent.exe:BitTorrent
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
R1 Hotkey;Hotkey;c:\windows\System32\drivers\HOTKEY.sys [2008-06-23 9867]
R2 Ndiskio;Ndiskio;c:\program files\Norman\nse\bin\Ndiskio.sys [2008-09-16 20448]
R3 nsesvc;Norman Scanner Engine Service;c:\program files\Norman\nse\bin\Nsesvc.exe [2009-02-02 183352]
R3 NvcMFlt;NvcMFlt;c:\windows\System32\drivers\nvcv32mf.sys [2008-09-16 19512]
R3 nvcoas;Norman Virus Control on-access component;c:\program files\Norman\NVC\bin\Nvcoas.exe [2008-09-16 183352]
R3 NVCScheduler;Norman Virus Control Scheduler;c:\program files\Norman\NVC\bin\Nvcsched.exe [2008-09-16 146488]
R3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2008-06-23 118784]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [2005-08-02 32512]
S3 PAC207;SoC PC-Camera;c:\windows\System32\drivers\PFC027.SYS [2006-12-05 507136]
--- Muut muistissa olevat ajurit/palvelut ---
*Deregistered* - mchInjDrv
.
.
------- Täydentävä tarkistus -------
.
uInternet Settings,ProxyOverride = *.local
IE: V&ie Microsoft Exceliin - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Käyttäjä\AppData\Roaming\Mozilla\Firefox\Profiles\v5kfzyxc.default\
FF - prefs.js: browser.search.selectedEngine - GoogleCOM
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fi/
FF - prefs.js: keyword.URL - hxxp://www.google-searchbar.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
1 tiedosto(a) on siirretty.
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
---- FIREFOXIN KÄYTÄNNÖT ----
FF - user.js: browser.search.selectedEngine - GoogleCOM
FF - user.js: keyword.URL - hxxp://www.google-searchbar.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-17 14:34:49
Windows 6.0.6000 NTFS
tarkistaa piilotettuja prosesseja ...
tarkistaa piilotettuja käynnistysarvoja ...
tarkistaa piilotettuja tiedostoja ...
**************************************************************************
.
--------------------- Prosesseihin ladatut DLLt ---------------------
- - - - - - - > 'Explorer.exe'(684)
c:\program files\Norman\nvc\bin\Niphk.dll
.
Valmistumisajankohta: 2009-02-17 14:38:59
ComboFix-quarantined-files.txt 2009-02-17 12:37:38
Ennen ajoa: 100 380 381 184 tavua vapaana
Ajon jälkeen: 100,541,747,200 tavua vapaana
231 --- E O F --- 2009-02-17 07:01:43
|
|
Hujo
Suspended permanently
|
17. helmikuuta 2009 @ 21:55 |
Linkki tähän viestiin
|
|
scannaa uusi hjt:n loki
Voiko tietsikka koskaan toimia?
|
|
Ticsi
Junior Member
|
18. helmikuuta 2009 @ 11:34 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:33:42, on 18.2.2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16809)
Boot mode: Normal
Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\LEXBCES.EXE
C:\Windows\System32\LEXPPS.EXE
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Norman\Npm\Bin\Zlh.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\PixArt\Pac207\Monitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Users\Käyttäjä\Program Files\DNA\btdna.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norman\nse\bin\NSESVC.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Launch Manager\WisLMSvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Norman\Nvc\bin\nvcoas.exe
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\SwiftKit\SwiftKit.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [HotkeyApp] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Käyttäjä\Program Files\DNA\btdna.exe"
O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Sol...wn.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Avira AntiVir Personal ? Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal ? Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\Windows\System32\LEXBCES.EXE
O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: WisLMSvc - Wistron Corp. - C:\Program Files\Launch Manager\WisLMSvc.exe
--
End of file - 8759 bytes
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
18. helmikuuta 2009 @ 11:50 |
Linkki tähän viestiin
|
|
eli järjestelmän valvojan oikeudet käyttöön ja poista avira koneelta
Voiko tietsikka koskaan toimia?
|
|
