|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
apua pmropn.exe poistamiseen
|
|
Member
|
18. huhtikuuta 2009 @ 15:36 |
Linkki tähän viestiin
|
|
Mo
Löysin koneelta pmropn.exe nimisen troijalaisen, joka häiritsee netin käyttöä. Nyt tarvitsisin apua tämän poistamiseen. kiitos.
|
Member
|
18. huhtikuuta 2009 @ 16:24 |
Linkki tähän viestiin
|
tässä Compofixin ekemä logi
ComboFix 09-04-18.05 - Ville & Kati 18.04.2009 16:14.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.358.1035.18.3326.2776 [GMT 3:00]
Sijainti: c:\documents and settings\Ville & Kati\Työpöytä\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090417-0] *On-access scanning disabled* (Updated)
* Uusi palautuspiste luotu
.
Error: Cfolders.dat
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Ville & Kati\Application Data\inst.exe
c:\windows\system32\edahfsyk.ini
c:\windows\system32\ewisdyfe.ini
c:\windows\system32\mmnUBcdd.ini
c:\windows\system32\mmnUBcdd.ini2
c:\windows\system32\mymirwsu.ini
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-03-18 to 2009-04-18 )))))))))))))))))
.
2009-04-18 12:29 . 2009-04-18 12:29 -------- d-----w c:\program files\Trend Micro
2009-04-18 10:05 . 2009-04-18 10:07 34 ----a-w c:\documents and settings\Ville & Kati\jagex_runescape_preferences.dat
2009-04-18 10:05 . 2009-04-18 10:05 -------- d-----w c:\windows\.jagex_cache_32
2009-04-17 20:02 . 2009-04-17 20:02 -------- d-----w c:\documents and settings\Ville & Kati\Application Data\Locktime
2009-04-17 20:01 . 2009-04-17 20:01 -------- d-----w c:\documents and settings\All Users\Application Data\Locktime
2009-04-17 20:01 . 2009-04-17 20:01 -------- d-----w c:\program files\NetLimiter 2 Pro
2009-04-17 14:47 . 2009-04-18 12:08 -------- d-----w c:\documents and settings\Ville & Kati\Application Data\mIRC
2009-04-17 14:47 . 2009-04-18 10:02 -------- d-----w c:\program files\mIRC
2009-04-17 14:46 . 2009-04-17 14:46 -------- d-----w c:\documents and settings\Ville & Kati\Application Data\Ventrilo
2009-04-17 14:46 . 2009-04-17 14:46 262 ----a-w c:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2009-04-17 14:46 . 2009-04-17 14:46 -------- d-----w c:\program files\Ventrilo
2009-04-17 14:44 . 2009-04-17 14:44 -------- d-----w c:\program files\VentriloMIX
2009-04-16 19:33 . 2009-04-18 13:17 -------- d-----w c:\program files\Steam
2009-04-07 14:44 . 2009-04-07 15:00 -------- d-----w c:\documents and settings\Ville & Kati\Local Settings\Application Data\WMTools Downloaded Files
2009-04-07 14:18 . 2005-07-30 18:14 86016 ----a-w c:\windows\system32\STRDEVAPI.dll
2009-04-07 14:18 . 2005-07-30 18:00 114688 ----a-w c:\windows\system32\OdiOlDVR.dll
2009-04-07 14:18 . 2004-06-21 07:14 53248 ----a-w c:\windows\system32\OdiAPI.dll
2009-04-07 03:32 . 2009-04-07 14:18 -------- d-----w c:\program files\Olympus
2009-04-07 03:32 . 2006-04-07 14:06 38496 ----a-w c:\windows\system32\drivers\VNUSB.sys
2009-04-07 03:32 . 2001-04-09 16:17 39096 ----a-w c:\windows\system32\drivers\DW90USB.SYS
2009-04-07 03:32 . 2006-04-07 14:05 73728 ----a-w c:\windows\system32\VNUSB.dll
2009-04-07 03:32 . 2003-06-13 14:49 73728 ----a-w c:\windows\system32\DW90USB.DLL
2009-03-28 12:25 . 2009-03-28 12:25 -------- d-----w c:\program files\iPod
2009-03-28 12:25 . 2009-03-28 12:26 -------- d-----w c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-28 12:25 . 2009-03-28 12:25 -------- d-----w c:\program files\QuickTime
2009-03-23 06:59 . 2009-03-23 06:59 194560 ----a-w c:\windows\Yule Log.scr
2009-03-23 06:59 . 2009-03-23 07:00 -------- d-----w c:\windows\Yule Log dir
2009-03-23 06:54 . 2009-04-18 13:16 -------- d-----w c:\program files\PremierOpinion
2009-03-23 06:54 . 2009-03-23 06:54 503808 ----a-w c:\windows\Tranquil - Waterfalls.scr
2009-03-23 06:54 . 2009-03-23 06:59 606848 ----a-w c:\windows\flashax.exe
2009-03-23 06:54 . 2009-03-23 06:59 12288 ----a-w c:\windows\impborl.dll
2009-03-23 06:54 . 2009-03-23 06:54 -------- d-----w c:\windows\Tranquil - Waterfalls dir
2009-03-23 06:54 . 2009-03-23 07:01 -------- d-----w c:\program files\www_screensavers_com
2009-03-23 06:53 . 2009-03-23 06:59 -------- d-----w C:\näytönsäästäjä
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-18 00:45 . 2008-11-30 18:14 -------- d-----w c:\documents and settings\Ville & Kati\Application Data\uTorrent
2009-04-18 00:08 . 2009-01-27 14:07 -------- d-----w c:\program files\LogMeIn
2009-04-17 14:45 . 2008-11-27 12:58 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-04-17 00:12 . 2008-04-15 12:00 81434 ----a-w c:\windows\system32\perfc00B.dat
2009-04-17 00:12 . 2008-04-15 12:00 409844 ----a-w c:\windows\system32\perfh00B.dat
2009-04-17 00:00 . 2008-11-29 12:35 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-04-16 09:22 . 2008-11-30 15:01 -------- d-----w c:\documents and settings\Ville & Kati\Application Data\Juniper Networks
2009-04-07 15:32 . 2008-12-15 07:16 34304 ----a-w c:\windows\system32\drivers\CO_Mon.sys
2009-04-07 14:18 . 2008-11-26 17:36 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-07 14:17 . 2008-11-26 17:36 -------- d-----w c:\program files\Common Files\InstallShield
2009-03-28 12:25 . 2008-12-02 06:33 -------- d-----w c:\program files\Common Files\Apple
2009-03-27 05:06 . 2009-01-06 18:49 -------- d-----w c:\program files\SUPERAntiSpyware
2009-03-25 18:43 . 2008-11-27 12:25 -------- d-----w c:\program files\Common Files\Adobe
2009-03-06 14:21 . 2008-04-15 12:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:14 . 2008-04-15 12:00 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 17:16 . 2008-04-15 12:00 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 14:07 . 2008-04-15 12:00 1847040 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:25 . 2008-04-14 08:49 2026496 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:25 . 2008-04-15 12:00 2147840 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:25 . 2008-04-15 12:00 111104 ----a-w c:\windows\system32\services.exe
2009-02-09 10:54 . 2008-04-15 12:00 729600 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:54 . 2008-04-15 12:00 680448 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:54 . 2008-04-15 12:00 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:54 . 2008-04-15 12:00 708608 ----a-w c:\windows\system32\ntdll.dll
2009-02-06 16:52 . 2009-02-06 16:52 49504 ----a-w c:\windows\system32\sirenacm.dll
2009-02-06 10:39 . 2008-04-15 12:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:58 . 2008-04-15 12:00 56832 ----a-w c:\windows\system32\secur32.dll
2009-01-27 14:07 . 2009-01-27 14:07 1024 ----a-w C:\.rnd
2008-12-13 13:47 . 2008-12-13 13:47 47360 ----a-w c:\documents and settings\Ville & Kati\Application Data\pcouffin.sys
2008-12-13 13:43 . 2008-11-26 17:32 68456 ----a-w c:\documents and settings\Ville & Kati\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-12-01 18:03 . 2008-12-01 18:03 158528 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-03-27 1830128]
"PC Suite Tray"="c:\n95\pc suite\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-30 68856]
"Steam"="c:\program files\Steam\Steam.exe" [2009-04-16 1410296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-05-25 1957888]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"EzPrint"="c:\program files\Lexmark 6200 Series\ezprint.exe" [2004-09-17 61440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\ohjelmia\itunes\iTunesHelper.exe" [2009-03-12 342312]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-01-30 16116224]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-10-07 1630208]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]
c:\documents and settings\Ville & Kati\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
OneNote 2007 -n?ytt?leikkeet ja Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]
c:\documents and settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
Device Detector 3.lnk - c:\program files\Olympus\DeviceDetector\DevDtct2.exe [2009-4-7 118784]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 09:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-10-16 18:35 87352 ----a-w c:\windows\system32\LMIinit.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=jpkukm.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\dc++\\DCPlusPlus.exe"=
"c:\\torrents\\utorrent.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\ohjelmia\\itunes\\iTunes.exe"=
"c:\\Program Files\\Steam\\steamapps\\weetosmuro\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
R3 ALLOW-IO;ALLOW-IO; [x]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2008-02-01 138112]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2008-02-01 8320]
R4 LMIRfsClientNP;LMIRfsClientNP; [x]
S1 aswSP;avast! Self Protection; [x]
S1 nltdi;nltdi;c:\windows\system32\drivers\nltdi.sys [2007-04-23 82200]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-03-27 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-12-22 55024]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2008-07-24 12856]
S2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2008-07-24 47640]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b34161c1-bbee-11dd-918c-806d6172696f}]
\Shell\AutoRun\command - E:\Autorun.exe root.ini
.
'Ajoitetut tehtävät'-kansion sisältö
2009-04-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
- - - - POISTETUT JÄMÄRIVIT - - - -
HKLM-Run-lxbumon.exe - c:\program files\Lexmark 6200 Series\lxbumon.exe
HKLM-Run-148b6630 - c:\windows\system32\efydsiwe.dll
Notify-ljJYPgFU - ljJYPgFU.dll
.
------- Täydentävä tarkistus -------
.
uInternet Settings,ProxyOverride = *.local
IE: V&ie Microsoft Exceliin - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Ville & Kati\Application Data\Mozilla\Firefox\Profiles\gnmcjvol.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fi/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\n95\pc suite\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\documents and settings\Ville & Kati\Application Data\Mozilla\Firefox\Profiles\gnmcjvol.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll
FF - plugin: c:\ohjelmia\itunes\Mozilla Plugins\npitunes.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-18 16:17
Windows 5.1.2600 Service Pack 3 NTFS
tarkistaa piilotettuja prosesseja ...
tarkistaa piilotettuja käynnistysarvoja ...
tarkistaa piilotettuja tiedostoja ...
tarkistus on valmis
piilotetut tiedostot: 0
**************************************************************************
.
--------------------- LUKITUT REKISTERIAVAIMET ---------------------
[HKEY_USERS\S-1-5-21-1177238915-776561741-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BC940973-A5D0-2885-86B2-4316E0B06A25}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"ianmconcolcocpjnog"=hex:69,61,67,67,68,6a,6f,62,67,69,61,67,6e,64,67,6c,69,70,
00,00
"hadaijafjcglogfd"=hex:69,61,67,67,68,6a,6f,62,67,69,61,67,6e,64,67,6c,69,70,
00,00
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h??|˙˙˙˙¤??|ų?6~*]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\PUBPLACE.HTT"
.
--------------------- Prosesseihin ladatut DLLt ---------------------
- - - - - - - > 'winlogon.exe'(928)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
- - - - - - - > 'explorer.exe'(3976)
c:\windows\system32\WPDShServiceObj.dll
c:\n95\pc suite\Nokia PC Suite 7\PhoneBrowser.dll
c:\n95\pc suite\Nokia PC Suite 7\NGSCM.DLL
c:\n95\pc suite\Nokia PC Suite 7\Lang\PhoneBrowser_fin.nlr
c:\n95\pc suite\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Muut prosessit ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\rundll32.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\windows\ALCFDRTM.EXE
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\LogMeIn\x86\ramaint.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\program files\NetLimiter 2 Pro\nlsvc.exe
c:\ohjelmia\cd burner xp\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\NetLimiter 2 Pro\NLClient.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Valmistumisajankohta: 2009-04-18 16:18 - kone käynnistettiin uudelleen
ComboFix-quarantined-files.txt 2009-04-18 13:18
Ennen ajoa: 212 395 347 968 tavua vapaana
Ajon jälkeen: 212 642 725 888 tavua vapaana
WindowsXP-KB310994-SP2-Home-BootDisk-FIN.EXE
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
262 --- E O F --- 2009-04-17 00:02
|
Member
|
18. huhtikuuta 2009 @ 16:25 |
Linkki tähän viestiin
|
Ja tässä jack logi
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:29:29, on 18.4.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\ohjelmia\itunes\iTunesHelper.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\N95\pc suite\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\WINDOWS\ALCFDRTM.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\ohjelmia\cd burner xp\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\NetLimiter 2 Pro\NLClient.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\NetLimiter 2 Pro\NLClient.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [lxbumon.exe] "C:\Program Files\Lexmark 6200 Series\lxbumon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 6200 Series\ezprint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [148b6630] rundll32.exe "C:\WINDOWS\system32\efydsiwe.dll",b
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\ohjelmia\itunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\N95\pc suite\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 -näyttöleikkeet ja Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDown.../sysreqlab3.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDown...iaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: jpkukm.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: ljJYPgFU - ljJYPgFU.dll (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: lxbu_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbucoms.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: NMSAccessU - Unknown owner - C:\ohjelmia\cd burner xp\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 10662 bytes
|
|
