HTJ-logi (Taustakuvaa ei voi vaihtaa)

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi WespaFIN 24.08.2008.

  1. WespaFIN

    WespaFIN Member

    Liittynyt:
    24.08.2008
    Viestejä:
    20
    Kiitokset:
    1
    Pisteet:
    13
    Sain koneelta poistettua jotain viruksia, mutta taustakuvaa en voi vaihtaa ja siinä näkyy vain joku sininen tausta.

    Tässä hijackthis -logi:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 23:06:31, on 24.8.2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16711)
    Boot mode: Normal

    Running processes:
    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\COMODO\Firewall\cmdagent.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Spyware Doctor\pctsAuxs.exe
    C:\Program Files\Spyware Doctor\pctsSvc.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Spyware Doctor\pctsTray.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\explorer.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Windows\System32\CTHELPER.EXE
    C:\Windows\System32\CTXFIHLP.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\COMODO\Firewall\cfp.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\AVG\AVG8\avgtray.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\RocketDock\RocketDock.exe
    C:\Windows\System32\CTXFISPI.EXE
    C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\PeerGuardian2\pg2.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\PROGRA~2\Stardock\XGF\XGFRuntimeServer.exe
    C:\Windows\TEMP\{DB12740C-CDBA-4CC2-8912-EDF13317341F}\Sidebar Clock.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\msiexec.exe
    C:\Windows\system32\vssvc.exe
    C:\Windows\System32\svchost.exe
    C:\Nettilataukset\jre-6u7-windows-i586-p.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\msiexec.exe
    C:\Windows\system32\MsiExec.exe
    C:\Windows\system32\MsiExec.exe
    C:\Windows\system32\MsiExec.exe
    C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_07.b06\patchjre.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\lsass.exe
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\PROGRA~1\STARDO~1\SDIEInt.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [BVRPLiveUpdate] C:\Program Files\Avanquest update\Engine\Setup.exe -s /PATCH,/SRCUPDATEC:\PROGRA~2\SONYER~1\SONYER~1\LIVEUP~1\LISTOF~1.DAT
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
    O4 - HKCU\..\Run: [PC Digital Safe] "C:\Program Files\PC Digital Safe\PcDigitalSafe.exe" -mini
    O4 - HKCU\..\Run: [SpeedItUpEX] C:\Program Files\Speeditup Free\SpeedItUp.exe -MINI
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
    O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [Somefox] C:\Users\ESIASE~1\AppData\Local\Temp\9DD5.tmp.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Download with Star Downloader - C:\Program Files\Star Downloader\sdie.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (file missing)
    O13 - Gopher Prefix:
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll,avgrsstx.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
    O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

    --
    End of file - 11835 bytes
     
    WespaFIN, 24.08.2008
    #1
  2.  
  3. WespaFIN

    WespaFIN Member

    Liittynyt:
    24.08.2008
    Viestejä:
    20
    Kiitokset:
    1
    Pisteet:
    13
    http://virusscan.jotti.org/ Sivusto antaa tällaisia tietoja viruksista.

    Scanner Malware name
    AntiVir TR/Dldr.Zlob.Gen
    ArcaVir X
    Avast X
    AVG Antivirus X
    BitDefender X
    ClamAV X
    CPsecure X
    Dr.Web X
    F-Prot Antivirus X
    F-Secure Anti-Virus X
    Fortinet X
    Ikarus Trojan-Downloader.Zlob
    Kaspersky Anti-Virus X
    NOD32 X
    Norman Virus Control X
    Panda Antivirus X
    Sophos Antivirus X
    VirusBuster X
    VBA32 X

    Eli tällaiset virukset näyttäisi olevan:
    TR/Dldr.Zlob.Gen
    Trojan-Downloader.Zlob

    Apuja virusten poistoon ja siihen, että saisin taustakuvan pelittämään...

    EDIT:

    Nyt se näyttää ihan eri settiä?

    Scanner Malware name
    AntiVir TR/Autorun.acl
    ArcaVir W32.Tuvir.A
    Avast INF:DiskKnight
    AVG Antivirus Win32/Virut
    BitDefender Win32.Worm.DiskKnight.A
    ClamAV W32.Virut.sa
    CPsecure W32.Net.W.Mytob.ca
    Dr.Web Win32.Virut.5
    F-Prot Antivirus W32/Virut.9264
    F-Secure Anti-Virus Virus.Win32.Virut.n
    Fortinet W32/Metacrypt.9
    Ikarus Virus.Win32.Virut.d
    Kaspersky Anti-Virus Virus.Win32.Virut.n
    NOD32 Win32/Virut.E
    Norman Virus Control W32/Virut.D
    Panda Antivirus W32/Virutas.gen
    Sophos Antivirus W32/Virut-L
    VirusBuster Win32.Virut.Gen
    VBA32 Virus.Win32.Virut.3

    Nuo tiedot se siis näyttää tuolla alhaalla... Vai olenko tehnyt jotain väärin? Pitääkö siihen ladata ensiksi jotain?
     
    Viimeksi muokattu: 24.08.2008
    WespaFIN, 24.08.2008
    #2
  4. WespaFIN

    WespaFIN Member

    Liittynyt:
    24.08.2008
    Viestejä:
    20
    Kiitokset:
    1
    Pisteet:
    13
    Oliskos apuja tähän?
     
    WespaFIN, 25.08.2008
    #3
  5. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    ============

    Lataa SmitfraudFix (c) S!Ri
    Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

    Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita ponnahtava rapport – muistion sisältö viestiketjuusi.
    Löytyy myös C:\rapport.txt

    Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
    (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
    A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
    silloin ne saattavat varoittaa käyttäjää.

    ============

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
     
    Hujo, 25.08.2008
    #4
  6. WespaFIN

    WespaFIN Member

    Liittynyt:
    24.08.2008
    Viestejä:
    20
    Kiitokset:
    1
    Pisteet:
    13
    SmitfraudFix:

    SmitFraudFix v2.339

    Scan done at 23:12:36,11, ma 25.08.2008
    Run from C:\Users\esiasennettu\Desktop\SmitfraudFix
    OS: Microsoft Windows [versio 6.0.6000] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\COMODO\Firewall\cmdagent.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Spyware Doctor\pctsAuxs.exe
    C:\Program Files\Spyware Doctor\pctsSvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Spyware Doctor\pctsTray.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\explorer.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Windows\System32\CTHELPER.EXE
    C:\Windows\System32\CTXFIHLP.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\COMODO\Firewall\cfp.exe
    C:\Windows\System32\CTXFISPI.EXE
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Windows\ehome\ehtray.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\RocketDock\RocketDock.exe
    C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\PeerGuardian2\pg2.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\mIRC\mirc.exe
    C:\PROGRA~2\Stardock\XGF\XGFRuntimeServer.exe
    C:\Windows\TEMP\{DB12740C-CDBA-4CC2-8912-EDF13317341F}\Sidebar Clock.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Azureus\Azureus.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\conime.exe
    C:\Windows\system32\Taskmgr.exe
    C:\Program Files\WinRAR\WinRAR.exe
    C:\Windows\system32\cmd.exe
    C:\Windows\system32\SearchFilterHost.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\esiasennettu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\esiasennettu\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\ESIASE~1\FAVORI~1


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, following keys are not inevitably infected!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri



    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, following keys are not inevitably infected!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
    !!!Attention, following keys are not inevitably infected!!!

    404Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!



    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Userinit"="C:\\Windows\\system32\\userinit.exe,"


    »»»»»»»»»»»»»»»»»»»»»»»» RK



    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Intel(R) 82566DC Gigabit Network Connection
    DNS Server Search Order: 10.0.0.2

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{D1D1FD5A-4F81-4943-A365-41AAD4CB638E}: DhcpNameServer=10.0.0.2
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{D1D1FD5A-4F81-4943-A365-41AAD4CB638E}: DhcpNameServer=10.0.0.2
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{D1D1FD5A-4F81-4943-A365-41AAD4CB638E}: DhcpNameServer=10.0.0.2
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End

    Teen vielä noi loput bootin jälkeen.



     
    WespaFIN, 25.08.2008
    #5
  7. WespaFIN

    WespaFIN Member

    Liittynyt:
    24.08.2008
    Viestejä:
    20
    Kiitokset:
    1
    Pisteet:
    13
    ComboFix 08-08-24.03 - esiasennettu 2008-08-25 23:24:24.1 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1035.18.2115 [GMT 3:00]
    Running from: C:\Nettilataukset\ComboFix.exe
    * Created a new restore point
    .
    The following files were disabled during the run:
    C:\Windows\system32\guard32.dll


    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Users\esiasennettu\AppData\Roaming\macromedia\Flash Player\#SharedObjects\BCBJS6UC\interclick.com
    C:\Users\esiasennettu\AppData\Roaming\macromedia\Flash Player\#SharedObjects\BCBJS6UC\interclick.com\ud.sol
    C:\Users\esiasennettu\AppData\Roaming\macromedia\Flash Player\#SharedObjects\BCBJS6UC\v.youku.com
    C:\Users\esiasennettu\AppData\Roaming\macromedia\Flash Player\#SharedObjects\BCBJS6UC\v.youku.com\v1.0.0158\v\swf\qplayer.swf\youku.sol
    C:\Users\esiasennettu\AppData\Roaming\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
    C:\Users\esiasennettu\AppData\Roaming\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
    C:\Users\esiasennettu\AppData\Roaming\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#v.youku.com
    C:\Users\esiasennettu\AppData\Roaming\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#v.youku.com\settings.sol

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-07-25 to 2008-08-25 )))))))))))))))))
    .

    Tiedostoja ei ole luotu tällä aikavälillä

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-25 20:19 --------- d-----w C:\Users\esiasennettu\AppData\Roaming\OpenOffice.org2
    2008-08-25 20:18 --------- d---a-w C:\ProgramData\TEMP
    2008-08-25 20:16 --------- d-----w C:\Users\esiasennettu\AppData\Roaming\mIRC
    2008-08-25 20:16 --------- d-----w C:\Users\esiasennettu\AppData\Roaming\Azureus
    2008-08-25 20:12 4,410 ----a-w C:\Windows\System32\tmp.reg
    2008-08-25 20:05 --------- d-----w C:\Program Files\Spyware Doctor
    2008-08-25 19:03 --------- d-----w C:\Program Files\mIRC
    2008-08-24 22:03 --------- d-----w C:\ProgramData\f-secure
    2008-08-24 20:07 --------- d-----w C:\Program Files\Java
    2008-08-24 20:05 --------- d-----w C:\Program Files\Common Files\Java
    2008-08-24 19:53 --------- d-----w C:\Program Files\Trend Micro
    2008-08-24 19:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-08-24 19:33 --------- d-----w C:\Program Files\Avanquest update
    2008-08-24 15:09 --------- d-----w C:\ProgramData\Avira
    2008-08-24 15:09 --------- d-----w C:\Program Files\Avira
    2008-08-24 13:39 --------- d-----w C:\Program Files\Steam
    2008-08-24 13:38 --------- d-----w C:\Program Files\Common Files\Steam
    2008-08-23 15:30 --------- d-----w C:\Users\esiasennettu\AppData\Roaming\SPORE Creature Creator
    2008-08-23 14:32 --------- d-----w C:\Users\esiasennettu\AppData\Roaming\PC Tools
    2008-08-21 10:46 174 --sha-w C:\Program Files\desktop.ini
    2008-08-21 03:08 --------- d-----w C:\ProgramData\Microsoft Help
    2008-08-21 02:58 --------- d-----w C:\Program Files\Windows Mail
    2008-08-21 02:56 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-08-20 23:28 96,520 ----a-w C:\Windows\system32\drivers\avgldx86.sys
    2008-08-20 23:28 10,520 ----a-w C:\Windows\System32\avgrsstx.dll
    2008-08-20 18:14 --------- d-----w C:\Users\esiasennettu\AppData\Roaming\Winamp
    2008-08-20 18:14 --------- d-----w C:\Program Files\Winamp
    2008-08-20 16:20 --------- d-----w C:\ProgramData\avg8
    2008-08-20 15:54 --------- d-----w C:\Program Files\SpywareBlaster
    2008-08-20 15:41 --------- d-----w C:\Program Files\Azureus
    2008-08-20 12:38 2,516 --sha-w C:\Windows\System32\KGyGaAvL.sys
    2008-08-20 12:19 --------- d-----w C:\ProgramData\BVRP Software
    2008-08-18 09:19 82,432 ----a-w C:\Windows\System32\404Fix.exe
    2008-08-14 18:52 82,432 ----a-w C:\Windows\System32\IEDFix.C.exe
    2008-08-11 22:52 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-07-15 23:48 2,048 ----a-w C:\Windows\System32\tzres.dll
    2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll
    2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll
    2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
    2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
    2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
    2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
    2008-06-22 17:23 444,952 ----a-w C:\Windows\System32\wrap_oal.dll
    2008-06-22 17:23 109,080 ----a-w C:\Windows\System32\OpenAL32.dll
    2008-06-19 03:25 61,440 ----a-w C:\Windows\System32\winipsec.dll
    2008-06-19 03:25 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL
    2008-06-19 03:25 28,672 ----a-w C:\Windows\System32\FwRemoteSvr.dll
    2008-06-19 03:25 272,896 ----a-w C:\Windows\System32\polstore.dll
    2008-06-15 20:48 107,888 ----a-w C:\Windows\System32\CmdLineExt.dll
    2008-06-08 13:01 143,104 ----a-w C:\Windows\System32\guard32.dll.vir
    2008-05-30 23:22 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
    2008-05-30 23:22 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
    2008-05-30 23:22 815,104 ----a-w C:\Windows\System32\divx_xx0a.dll
    2008-05-30 23:22 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
    2008-05-30 23:22 683,520 ----a-w C:\Windows\System32\DivX.dll
    2008-05-30 23:22 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
    2008-05-30 23:22 57,344 ----a-w C:\Windows\System32\dpv11.dll
    2008-05-30 23:22 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
    2008-05-30 23:22 344,064 ----a-w C:\Windows\System32\dpus11.dll
    2008-05-30 23:22 294,912 ----a-w C:\Windows\System32\dpu11.dll
    2008-05-30 23:22 294,912 ----a-w C:\Windows\System32\dpu10.dll
    2008-05-29 06:35 86,528 ----a-w C:\Windows\System32\VACFix.exe
    2008-04-18 15:23 22,328 ----a-w C:\Users\esiasennettu\AppData\Roaming\PnkBstrK.sys
    2003-04-22 18:02 135,168 ----a-w C:\Program Files\AVIPreview.exe
    2006-05-03 09:06 163,328 --sh--r C:\Windows\System32\flvDX.dll
    2007-02-21 10:47 31,232 --sh--r C:\Windows\System32\msfDX.dll
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 15:35 125440]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 17:02 1232896]
    "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 16:30 249856]
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 17:16 171464]
    "RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 13:58 495616]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 12:51 202024]
    "PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2007-06-02 16:59 1457152]
    "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 17:19 356352]
    "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 15:36 201728]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 08:00 33648]
    "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-04 02:02 36352]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42 267064]
    "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25 1828136]
    "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 18:06 86016]
    "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 18:06 8530464]
    "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 18:06 81920]
    "COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-06-08 15:58 1655552]
    "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-21 02:28 1232152]
    "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-07-16 09:16 1166216]
    "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
    "CTHelper"="CTHELPER.EXE" [2007-05-10 16:51 19456 C:\Windows\System32\CTHELPER.EXE]
    "CTxfiHlp"="CTXFIHLP.EXE" [2007-05-10 16:52 19968 C:\Windows\System32\CTXFIHLP.EXE]

    C:\Users\esiasennettu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
    OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-09-11 06:43:54 393216]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.i420"= i420vfw.dll
    "vidc.yv12"= yv12vfw.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    --a------ 2007-03-01 15:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2007-06-29 06:24 286720 C:\Program Files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
    --a------ 2006-11-22 14:56 303104 C:\Windows\sttray.exe

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "TCP Query User{259DE626-EEC0-4546-AD81-DF73B3491164}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
    "UDP Query User{7A5B92EB-7CC3-4C68-BF40-8D6D0B918079}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
    "TCP Query User{7EC1B129-65E6-4D01-80AA-52758A02BBFE}C:\\program files\\steam\\steamapps\\perttu123\\counter-strike\\hl.exe"= UDP:C:\program files\steam\steamapps\perttu123\counter-strike\hl.exe:Half-Life Launcher
    "UDP Query User{08337410-C2BE-41FE-8562-4F29B02CE453}C:\\program files\\steam\\steamapps\\perttu123\\counter-strike\\hl.exe"= TCP:C:\program files\steam\steamapps\perttu123\counter-strike\hl.exe:Half-Life Launcher
    "{283DFC6D-945D-4C3B-B5BD-7A813889E925}"= UDP:C:\Program Files\EA GAMES\Battlefield 2 Demo\BF2.exe:Battlefield 2
    "{4B1BC7BB-8205-46DA-A851-E00ABA0B8A16}"= TCP:C:\Program Files\EA GAMES\Battlefield 2 Demo\BF2.exe:Battlefield 2
    "TCP Query User{FF4CD2E8-3484-46FB-9091-1767E07AE4AF}C:\\program files\\dc++\\dcplusplus.exe"= UDP:C:\program files\dc++\dcplusplus.exe:DC++
    "UDP Query User{69AEDD2A-079A-49EA-A4A2-500184FD4E68}C:\\program files\\dc++\\dcplusplus.exe"= TCP:C:\program files\dc++\dcplusplus.exe:DC++
    "TCP Query User{9023DAA8-6B24-42B5-9A3E-5083F9E44AF9}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
    "UDP Query User{F52A1C12-E388-4D27-82B9-214F540973DD}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
    "TCP Query User{1B068B43-F206-4FFC-B4DB-6ABCE14F5FF3}C:\\program files\\mirc\\mirc.exe"= UDP:C:\program files\mirc\mirc.exe:mIRC
    "UDP Query User{120DC8EE-7E69-4CC3-BE22-F71F7FCDEF6A}C:\\program files\\mirc\\mirc.exe"= TCP:C:\program files\mirc\mirc.exe:mIRC
    "TCP Query User{8064EADD-DCCE-4789-A467-46BA8D5B2149}C:\\program files\\steam\\steamapps\\jarkko93\\day of defeat source\\hl2.exe"= UDP:C:\program files\steam\steamapps\jarkko93\day of defeat source\hl2.exe:hl2
    "UDP Query User{96D8D669-6054-423E-B49E-D49639F13BF4}C:\\program files\\steam\\steamapps\\jarkko93\\day of defeat source\\hl2.exe"= TCP:C:\program files\steam\steamapps\jarkko93\day of defeat source\hl2.exe:hl2
    "TCP Query User{6D05141F-EAF4-4276-B4D7-24D7B6A9A223}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus
    "UDP Query User{BCB28960-D22E-483F-BAC1-CC60B9827555}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus
    "TCP Query User{B38B0469-154C-4397-8B74-571964E5EB78}C:\\users\\esiasennettu\\desktop\\dcplusplus.exe"= Disabled:UDP:C:\users\esiasennettu\desktop\dcplusplus.exe:dcplusplus.exe
    "UDP Query User{34B794CD-11EF-4CBB-B71F-1FB64A3AB46A}C:\\users\\esiasennettu\\desktop\\dcplusplus.exe"= Disabled:TCP:C:\users\esiasennettu\desktop\dcplusplus.exe:dcplusplus.exe
    "TCP Query User{E414DDFA-8713-4428-B4AB-80089539D666}C:\\pelit\\colin mcrae dirt\\dirt.exe"= UDP:C:\pelit\colin mcrae dirt\dirt.exe:DiRT Executable
    "UDP Query User{B21719EB-2D0D-42BB-A238-A07FAE5D3A95}C:\\pelit\\colin mcrae dirt\\dirt.exe"= TCP:C:\pelit\colin mcrae dirt\dirt.exe:DiRT Executable
    "TCP Query User{F6294687-CAFE-4D65-A9BA-6E968D7D292F}C:\\program files\\last.fm\\lastfm.exe"= UDP:C:\program files\last.fm\lastfm.exe:Last.fm
    "UDP Query User{7F37298D-CF19-40FA-8EDD-34A803D68726}C:\\program files\\last.fm\\lastfm.exe"= TCP:C:\program files\last.fm\lastfm.exe:Last.fm
    "TCP Query User{93AA737B-08DC-48AD-8365-FF470D5C2E89}C:\\program files\\winscp\\winscp.exe"= UDP:C:\program files\winscp\winscp.exe:Windows SFTP, FTP and SCP client
    "UDP Query User{F2DECB3A-4B3F-4283-8500-40E267EC5B1B}C:\\program files\\winscp\\winscp.exe"= TCP:C:\program files\winscp\winscp.exe:Windows SFTP, FTP and SCP client
    "TCP Query User{6F9D43FE-9DD7-45FE-B76B-506EBC783702}C:\\asennukset\\fraps 2.8.1 cracked.exe"= UDP:C:\asennukset\fraps 2.8.1 cracked.exe:Fraps 2.8.1 Cracked
    "UDP Query User{9BCAF018-A4F7-4792-A875-0A440AFBBEE0}C:\\asennukset\\fraps 2.8.1 cracked.exe"= TCP:C:\asennukset\fraps 2.8.1 cracked.exe:Fraps 2.8.1 Cracked
    "{B266C2FD-71EA-4049-9CEF-CD42CB90BBF5}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "{E73B0F59-FB94-4B41-8B3D-D3B951410C8D}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{AC8F4918-51E2-46B1-819F-90496A0FF149}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{6903D33B-4D09-4B2E-BA0F-0278C47718E7}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{AE749519-5D7A-4573-8231-224AACFAF3FE}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "TCP Query User{4DBB1FF7-CBDA-4829-9790-27F365F45AD1}C:\\users\\esiasennettu\\desktop\\strong dc\\strongdc.exe"= UDP:C:\users\esiasennettu\desktop\strong dc\strongdc.exe:strongdc.exe
    "UDP Query User{48DCF79E-EE23-4055-AA49-DA6F240C7C6B}C:\\users\\esiasennettu\\desktop\\strong dc\\strongdc.exe"= TCP:C:\users\esiasennettu\desktop\strong dc\strongdc.exe:strongdc.exe
    "TCP Query User{C28D3825-406A-4E3C-94E8-6FB6037F9F3A}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus
    "UDP Query User{E9BBE079-B13C-4D9C-8225-C2167E067BD2}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus
    "TCP Query User{FBFAF657-110E-4465-BD0A-488D66C41262}C:\\program files\\steam\\steamapps\\djwespa\\counter-strike source\\hl2.exe"= UDP:C:\program files\steam\steamapps\djwespa\counter-strike source\hl2.exe:hl2
    "UDP Query User{7D315D7A-0BA7-416B-A3FE-DC97ECE85036}C:\\program files\\steam\\steamapps\\djwespa\\counter-strike source\\hl2.exe"= TCP:C:\program files\steam\steamapps\djwespa\counter-strike source\hl2.exe:hl2
    "{E2239A85-86BB-4AA2-812B-612CBA66CF27}"= UDP:C:\Pelit\Sega Rally Evo\SEGA Rally.exe:SEGA Rally
    "{330EE36B-9404-4927-B7C5-0D4B08094DD0}"= TCP:C:\Pelit\Sega Rally Evo\SEGA Rally.exe:SEGA Rally
    "{E93ECAA8-371D-4206-B91D-41626C31F1D3}"= UDP:C:\Pelit\Sega Rally Evo\SEGA Rally_SSE1.exe:SEGA Rally
    "{A258E24B-2FF4-428D-8EE5-81312FB5A394}"= TCP:C:\Pelit\Sega Rally Evo\SEGA Rally_SSE1.exe:SEGA Rally
    "{F8A53305-5179-4E40-8C93-797D606306D2}"= UDP:C:\Pelit\SEGA Rally Revo\SEGA Rally.exe:SEGA Rally
    "{7D95508D-C967-454E-82F9-2AC763B6EE30}"= TCP:C:\Pelit\SEGA Rally Revo\SEGA Rally.exe:SEGA Rally
    "{C94722A0-01A6-4587-B613-DCE0432126BD}"= UDP:C:\Pelit\SEGA Rally Revo\SEGA Rally_SSE1.exe:SEGA Rally
    "{652ABCFF-6E44-4AF8-BCCB-C35E3859981B}"= TCP:C:\Pelit\SEGA Rally Revo\SEGA Rally_SSE1.exe:SEGA Rally
    "TCP Query User{0178736A-DEA2-4A06-B359-3FA3D84D94D3}C:\\program files\\steam\\steam.exe"= UDP:C:\program files\steam\steam.exe:Steam
    "UDP Query User{EBF7ADBB-2EC2-4C52-A1DD-BFBBD12FB2E1}C:\\program files\\steam\\steam.exe"= TCP:C:\program files\steam\steam.exe:Steam
    "TCP Query User{B0754588-C165-43F7-9FCC-A563B3E31745}C:\\program files\\strong dc\\strongdc.exe"= UDP:C:\program files\strong dc\strongdc.exe:StrongDC++
    "UDP Query User{57711734-01F3-431D-A8E0-AC560F635355}C:\\program files\\strong dc\\strongdc.exe"= TCP:C:\program files\strong dc\strongdc.exe:StrongDC++
    "{AA3E1ADB-22DB-4D2B-9AAB-65CC3DA03494}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
    "{184D71E2-FB35-4C36-B51C-CB587E327C8A}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
    "TCP Query User{B1B4F190-A916-4D16-9BA2-732DBC61C852}C:\\program files\\livevideo\\xpress.exe"= UDP:C:\program files\livevideo\xpress.exe:LiveVideo.com stand-alone upload manager application.
    "UDP Query User{D22835FE-0B3D-49F0-A006-1CFB40486D95}C:\\program files\\livevideo\\xpress.exe"= TCP:C:\program files\livevideo\xpress.exe:LiveVideo.com stand-alone upload manager application.
    "TCP Query User{20128C71-2919-4565-8636-F6A1A61B7AAC}C:\\pelit\\sof payback\\sof3.exe"= UDP:C:\pelit\sof payback\sof3.exe:sof3
    "UDP Query User{7961621E-CF1D-43A3-9F4C-88EF699581BE}C:\\pelit\\sof payback\\sof3.exe"= TCP:C:\pelit\sof payback\sof3.exe:sof3
    "TCP Query User{E2036144-DF38-4643-A421-3E0866D19D2E}C:\\program files\\mirc\\mirc.exe"= UDP:C:\program files\mirc\mirc.exe:mIRC
    "UDP Query User{1CD359DF-D2C0-4297-82C2-8BDF736ED618}C:\\program files\\mirc\\mirc.exe"= TCP:C:\program files\mirc\mirc.exe:mIRC
    "{A22F1585-1CB9-4270-BEA0-C846C15FD5DC}"= UDP:9000:mirc-portti
    "{6C995EE6-AC7D-4FC7-9031-9D3F977F37DD}"= TCP:9000:mirc-portti
    "{F0E8995A-65B3-4005-A840-1AF4F9466208}"= UDP:C:\Pelit\Crysis\Bin32\Crysis.exe:Crysis_32
    "{654336E6-1D14-4D8C-AEFC-02201FF7D3BF}"= TCP:C:\Pelit\Crysis\Bin32\Crysis.exe:Crysis_32
    "{873CC4CD-B6F2-4E88-B573-BA045C4B114A}"= UDP:C:\Pelit\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
    "{A7D53921-F111-470C-8DBA-A75032AFD101}"= TCP:C:\Pelit\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
    "{B56FDD13-F5B2-42E7-8FAC-EDB45EC87764}"= UDP:C:\Windows\System32\PnkBstrA.exe:pnkBstrA
    "{862E54CC-435E-4EFD-8B05-B0523AF4FDCA}"= TCP:C:\Windows\System32\PnkBstrA.exe:pnkBstrA
    "{E09CDFB1-7F46-4726-8C36-BEBBBA0ED8DB}"= UDP:C:\Windows\System32\PnkBstrB.exe:pnkBstrB
    "{2E8EC7AD-394E-4F91-80DF-6F0D1E0D7D5B}"= TCP:C:\Windows\System32\PnkBstrB.exe:pnkBstrB
    "TCP Query User{3E0EDAD9-2ABB-4BA4-8CEA-A0360BAA0DD8}C:\\program files\\mirc2\\mirc.exe"= UDP:C:\program files\mirc2\mirc.exe:mIRC
    "UDP Query User{8B1043C1-807E-4203-9BE0-6FA8157001FC}C:\\program files\\mirc2\\mirc.exe"= TCP:C:\program files\mirc2\mirc.exe:mIRC
    "{49CB29D4-030F-46DA-BA8F-5D1D41D289B4}"= UDP:7000:Mirc2
    "{0068B92A-8289-44FD-A7D0-93DFF0C909CC}"= TCP:7000:Mirc2
    "TCP Query User{6D1194DC-4E7A-4AD6-879C-A66EA50AF5C7}C:\\program files\\icechat7\\icechat7.exe"= UDP:C:\program files\icechat7\icechat7.exe:Internet Relay Chat Client
    "UDP Query User{16559984-9DE2-453A-BBC7-ABA75E43EB44}C:\\program files\\icechat7\\icechat7.exe"= TCP:C:\program files\icechat7\icechat7.exe:Internet Relay Chat Client
    "TCP Query User{5EB202CA-3EB6-4B02-962F-DD8135B47F59}C:\\program files\\steam\\steamapps\\djwespa\\team fortress 2\\hl2.exe"= UDP:C:\program files\steam\steamapps\djwespa\team fortress 2\hl2.exe:hl2
    "UDP Query User{8F3D0298-7AAA-4BE8-A6ED-7FFA01A88F4F}C:\\program files\\steam\\steamapps\\djwespa\\team fortress 2\\hl2.exe"= TCP:C:\program files\steam\steamapps\djwespa\team fortress 2\hl2.exe:hl2
    "{B35682B9-AD0E-48DB-803E-3A1415214C98}"= UDP:6668:6668
    "{0A677871-D9A3-441E-9BE9-0C7EC95EFCF4}"= TCP:6668:6668
    "TCP Query User{CCBA316D-268A-4997-8F51-04253EBAB1DD}C:\\program files\\teamspeak2_rc2\\server_windows.exe"= UDP:C:\program files\teamspeak2_rc2\server_windows.exe:Server
    "UDP Query User{4E0FC874-F7F5-4229-995D-190F9DB6A3A1}C:\\program files\\teamspeak2_rc2\\server_windows.exe"= TCP:C:\program files\teamspeak2_rc2\server_windows.exe:Server
    "TCP Query User{D7AD2220-A224-4D5B-8758-594E93503A2C}C:\\program files\\ventsrv\\ventrilo_srv.exe"= UDP:C:\program files\ventsrv\ventrilo_srv.exe:ventrilo_srv
    "UDP Query User{F9C4F144-1E4B-4D4B-AF54-7C5739B9CDE1}C:\\program files\\ventsrv\\ventrilo_srv.exe"= TCP:C:\program files\ventsrv\ventrilo_srv.exe:ventrilo_srv
    "{002EF179-3A08-44A0-A239-FD662712BB41}"= UDP:C:\Program Files\Ventrilo\Ventrilo.exe:Ventrilo
    "{310987B0-9DAD-4D91-BECD-2FAC7092C5AA}"= TCP:C:\Program Files\Ventrilo\Ventrilo.exe:Ventrilo
    "{4FC9AB11-1AAE-47F6-A30F-D55EA673CB1E}"= UDP:C:\Program Files\VentriloMIX\VentriloMIX.exe:VentriloMIX
    "{B9EE552D-7F7E-4365-964E-36519B7A6674}"= TCP:C:\Program Files\VentriloMIX\VentriloMIX.exe:VentriloMIX
    "TCP Query User{2C4943A3-9050-468A-AD7B-4BDCF4776FF9}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
    "UDP Query User{AC65D28E-1E13-444F-8D4D-D1104470CEC1}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
    "TCP Query User{75E2EB1A-4157-4D64-93BF-2E0C5BCCBE1D}C:\\program files\\globalscape\\cuteftp 8 home\\ftpte.exe"= UDP:C:\program files\globalscape\cuteftp 8 home\ftpte.exe:FTP Transfer Engine
    "UDP Query User{979A1A3E-3EBA-43EE-B3BD-6FC5D92F4AD6}C:\\program files\\globalscape\\cuteftp 8 home\\ftpte.exe"= TCP:C:\program files\globalscape\cuteftp 8 home\ftpte.exe:FTP Transfer Engine
    "{5EEA8C08-6D2E-413A-83D8-B68D05EFD81E}"= UDP:C:\Program Files\GlobalSCAPE\CuteFTP 8 Home\cuteftp.exe:CuteFTP 8 Home
    "{3C192EDB-B4A5-403B-BABF-D6F44E0555D4}"= TCP:C:\Program Files\GlobalSCAPE\CuteFTP 8 Home\cuteftp.exe:CuteFTP 8 Home
    "{6BC48926-39B4-4800-A999-085ACCAE37E6}"= UDP:C:\Pelit\Call Of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
    "{852EBB74-207B-4EB8-B0B4-2E0CB3D76498}"= TCP:C:\Pelit\Call Of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
    "{DE987D84-2E42-446E-AB7E-256C88E73A81}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
    "{A283102E-3719-42D0-BDC8-64F3F7E15FBC}"= UDP:C:\Program Files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe:Sony Ericsson Media Manager 1.1
    "{79A7A1A2-E048-4176-8575-A59678ACB55A}"= TCP:C:\Program Files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe:Sony Ericsson Media Manager 1.1
    "{942CDFE8-00B0-46B5-AA89-FBA737DF357A}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe
    "{49DD0DEF-045C-4D0F-B162-89F22CBD7128}"= UDP:C:\Pelit\GRID\GRID.exe:GRID
    "{15FB54AB-6000-4B42-A006-87DEAD5DD0B8}"= TCP:C:\Pelit\GRID\GRID.exe:GRID

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
    "EnableFirewall"= 0 (0x0)

    R1 AvgLdx86;AVG AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-08-21 02:28]
    R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\Windows\system32\DRIVERS\cmdguard.sys [2008-06-08 16:01]
    R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\Windows\system32\DRIVERS\cmdhlp.sys [2008-06-08 16:01]
    R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-21 02:28]
    R3 ha20x2k;Creative 20X HAL Driver;C:\Windows\system32\drivers\ha20x2k.sys [2007-05-11 11:28]
    S3 SE30bus;Sony Ericsson Device 048 Driver driver (WDM);C:\Windows\system32\DRIVERS\SE30bus.sys [2006-05-15 16:45]
    S3 SE30mdfl;Sony Ericsson Device 048 USB WMC Modem Filter;C:\Windows\system32\DRIVERS\SE30mdfl.sys [2006-05-15 16:45]
    S3 SE30mdm;Sony Ericsson Device 048 USB WMC Modem Driver;C:\Windows\system32\DRIVERS\SE30mdm.sys [2006-05-15 16:45]
    S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-08-23 21:28]

    *Newly Created Service* - CATCHME
    *Newly Created Service* - PROCEXP90
    .
    'Ajoitetut tehtävät'-kansion sisältö
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-PC Digital Safe - C:\Program Files\PC Digital Safe\PcDigitalSafe.exe
    HKCU-Run-SpeedItUpEX - C:\Program Files\Speeditup Free\SpeedItUp.exe
    HKCU-Run-Somefox - C:\Users\ESIASE~1\AppData\Local\Temp\9DD5.tmp.exe
    HKLM-Run-BVRPLiveUpdate - C:\Program Files\Avanquest update\Engine\Setup.exe
    MSConfigStartUp-SunJavaUpdateSched - C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe


    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Users\esiasennettu\AppData\Roaming\Mozilla\Firefox\Profiles\2ore4jvg.default\
    FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.fi
    FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npOGAPlugin.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-08-25 23:30:50
    Windows 6.0.6000 NTFS

    detected NTDLL code modification:
    ZwClose

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-08-25 23:33:14
    ComboFix-quarantined-files.txt 2008-08-25 20:33:07

    Pre-Run: Järjestelmä ei löydä sanomaa numerolle 0x2379 ohjelman Application sanomatiedostossa.
    Post-Run: 34,144,100,352 tavua vapaana

    291 --- E O F --- 2008-08-21 03:09:19
     
    WespaFIN, 25.08.2008
    #6
  8. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, 26.08.2008
    #7
  9. WespaFIN

    WespaFIN Member

    Liittynyt:
    24.08.2008
    Viestejä:
    20
    Kiitokset:
    1
    Pisteet:
    13
    Tässä HJT-logi: (Malwarebytes on nyt skannaamassa ja tiedot siitä kun se on valmis)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:34:57, on 26.8.2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16711)
    Boot mode: Normal

    Running processes:
    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Windows\System32\CTHELPER.EXE
    C:\Windows\System32\CTXFIHLP.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Windows\System32\CTXFISPI.EXE
    C:\Windows\System32\rundll32.exe
    C:\Program Files\COMODO\Firewall\cfp.exe
    C:\Program Files\AVG\AVG8\avgtray.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\RocketDock\RocketDock.exe
    C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\PeerGuardian2\pg2.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\COMODO\Firewall\cmdagent.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
    C:\Windows\system32\svchost.exe
    C:\Program Files\Spyware Doctor\pctsAuxs.exe
    C:\Program Files\Spyware Doctor\pctsSvc.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Program Files\Spyware Doctor\pctsTray.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    C:\PROGRA~2\Stardock\XGF\XGFRuntimeServer.exe
    C:\Windows\TEMP\{DB12740C-CDBA-4CC2-8912-EDF13317341F}\Sidebar Clock.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Program Files\Azureus\Azureus.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\ehome\mcupdate.EXE
    C:\Program Files\mIRC\mirc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\PROGRA~1\STARDO~1\SDIEInt.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
    O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Download with Star Downloader - C:\Program Files\Star Downloader\sdie.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (file missing)
    O13 - Gopher Prefix:
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll,avgrsstx.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
    O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

    --
    End of file - 11318 bytes
     
    WespaFIN, 26.08.2008
    #8
  10. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
     
    Hujo, 26.08.2008
    #9
  11. WespaFIN

    WespaFIN Member

    Liittynyt:
    24.08.2008
    Viestejä:
    20
    Kiitokset:
    1
    Pisteet:
    13
    Tein tuon, sekä ajoin Malwarebytesin.

    Tässä Malwarebytesin logi:

    Malwarebytes' Anti-Malware 1.25
    Tietokantaversio: 1087
    Windows 6.0.6000

    12:27:26 26.8.2008
    mbam-log-08-26-2008 (12-27-26).txt

    Tarkistustyyppi: Pikatarkistus
    Tarkistetut kohteet: 46967
    Kulunut aika: 4 minute(s), 55 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 2
    Saastuneita rekisteriarvoja: 3
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 2
    Saastuneita tiedostoja: 5

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    HKEY_CLASSES_ROOT\AppID\{127df9b4-d75d-44a6-af78-8c3a8ceb03db} (Adware.WhenUSave) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\ACM.DLL (Adware.WhenUSave) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhenU (Adware.WhenUSave) -> Quarantined and deleted successfully.
    C:\Users\esiasennettu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhenU (Adware.WhenUSave) -> Quarantined and deleted successfully.

    Saastuneita tiedostoja:
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhenU\Customer Support.lnk (Adware.WhenUSave) -> Quarantined and deleted successfully.
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhenU\Uninstall Instructions.lnk (Adware.WhenUSave) -> Quarantined and deleted successfully.
    C:\Users\esiasennettu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhenU\Learn More About WhenU Save.url (Adware.WhenUSave) -> Quarantined and deleted successfully.
    C:\Users\esiasennettu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhenU\Learn More About WhenU SaveNow.url (Adware.WhenUSave) -> Quarantined and deleted successfully.
    C:\Users\esiasennettu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhenU\WhenU.com Website.url (Adware.WhenUSave) -> Quarantined and deleted successfully.

    Malwarebytes korjasi taustakuvaongelman ja nyt toimii.

    Tässä vielä uusi HJT-logi:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:33:24, on 26.8.2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16711)
    Boot mode: Normal

    Running processes:
    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\COMODO\Firewall\cmdagent.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Spyware Doctor\pctsAuxs.exe
    C:\Program Files\Spyware Doctor\pctsSvc.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Windows\System32\CTHELPER.EXE
    C:\Windows\System32\CTXFIHLP.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\COMODO\Firewall\cfp.exe
    C:\Program Files\AVG\AVG8\avgtray.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\RocketDock\RocketDock.exe
    C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\PeerGuardian2\pg2.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Spyware Doctor\pctsTray.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
    C:\Windows\System32\CTXFISPI.EXE
    C:\Windows\ehome\ehmsas.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    C:\PROGRA~2\Stardock\XGF\XGFRuntimeServer.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\TEMP\{DB12740C-CDBA-4CC2-8912-EDF13317341F}\Sidebar Clock.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\Program Files\mIRC\mirc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\PROGRA~1\STARDO~1\SDIEInt.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
    O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Download with Star Downloader - C:\Program Files\Star Downloader\sdie.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (file missing)
    O13 - Gopher Prefix:
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: C:\Windows\system32\guard32.dllavgrsstx.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
    O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

    --
    End of file - 10583 bytes

     
    WespaFIN, 26.08.2008
    #10
  12. Hujo

    Hujo Guest

    mites kone toimii
     
    Hujo, 26.08.2008
    #11
  13. WespaFIN

    WespaFIN Member

    Liittynyt:
    24.08.2008
    Viestejä:
    20
    Kiitokset:
    1
    Pisteet:
    13
    Taustakuvan sain vaihdettua ja suurimmaksi osaksi toimii normaalisti, mutta välillä kone tilttaa ihan kokonaan.

    Nyt viimeksi ilmeisesti Firefox tilttautti koko koneen, eikä CTRL + ALT + DELETE:kään toiminut, joten piti painaa koneesta restarttia...
     
    Viimeksi muokattu: 26.08.2008
    WespaFIN, 26.08.2008
    #12
  14. Hujo

    Hujo Guest

    Lataa Tästä Ccleaner
    CCleaner v2.05.555- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
    Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
    Asennuksen jälkeen aukaise CCleaner.
    Valitse vasemmalta pystyrivistä Options.
    Valitse viereisestä pystyrivistä Settings.
    Language kohtaan valitse Suomi.

    Puhdistaja
    Valitse vasemmalta pystyrivistä Puhdistaja.
    Paina alhaalta Tutki.
    Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
    Kun tutkiminen on valmis, paina Aja CCleaner.
    Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.

    Rekisterin virheiden korjaus
    Valitse vasemmalta pystyrivistä Rekisteri.
    Paina alhaalta Etsi rekisterin virheitä.
    Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
    Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
    Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
    Saat vielä varmistus kysymyksen, paina Ok.
    Kun virheet on korjattu, paina Sulje.
    Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
     
    Hujo, 26.08.2008
    #13
  15. WespaFIN

    WespaFIN Member

    Liittynyt:
    24.08.2008
    Viestejä:
    20
    Kiitokset:
    1
    Pisteet:
    13
    Tehty. Täytyy nyt testailla miten kone toimii. Toivottavasti ei tilttaile enää.
     
    WespaFIN, 26.08.2008
    #14
  16. Hujo

    Hujo Guest

    se tiltaillu voi johtua lämmöstä
     
    Hujo, 26.08.2008
    #15
  17. WespaFIN

    WespaFIN Member

    Liittynyt:
    24.08.2008
    Viestejä:
    20
    Kiitokset:
    1
    Pisteet:
    13
    Lämmöt pitäis olla ihan ok (ollut ennen ainakin) ja tilttailu alko ton viruksen jälkeen, mutta nyt ei ole enää tiltannunt, jotenka sekin ongelma on taitanut korjautua.

    Iso kiitos Hujo avustuksesta. :)
     
    Viimeksi muokattu: 27.08.2008
    WespaFIN, 27.08.2008
    #16

Jaa tämä sivu