Koneessa aika ajoittain suoritinkäyttö 100%...

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi Xfect 27.08.2008.

  1. Xfect

    Xfect Member

    Liittynyt:
    27.08.2008
    Viestejä:
    5
    Kiitokset:
    0
    Pisteet:
    11
    eli tässä on hjt-logi

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:30:57, on 27.8.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Program Files\Logitech\SetPoint\MediaPlayerMgr.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Live TV Toolbar - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - C:\Program Files\Live_TV\tbLive.dll
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1C1B8A44-61FE-411E-8F33-813A4E2E2984} - (no file)
    O2 - BHO: (no name) - {6584C510-924B-486A-A1A0-E380DE08C2DB} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Live TV Toolbar - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - C:\Program Files\Live_TV\tbLive.dll
    O3 - Toolbar: Live TV Toolbar - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - C:\Program Files\Live_TV\tbLive.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O20 - Winlogon Notify: ljJCsrRJ - ljJCsrRJ.dll (file missing)
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 5831 bytes
     
    Xfect, 27.08.2008
    #1
  2.  
  3. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    O2 - BHO: (no name) - {1C1B8A44-61FE-411E-8F33-813A4E2E2984} - (no file)
    O2 - BHO: (no name) - {6584C510-924B-486A-A1A0-E380DE08C2DB} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O20 - Winlogon Notify: ljJCsrRJ - ljJCsrRJ.dll (file missing)

    =================

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen

    =============

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.

    ==============

    Lataa Tästä Ccleaner
    CCleaner v2.05.555- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
    Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
    Asennuksen jälkeen aukaise CCleaner.
    Valitse vasemmalta pystyrivistä Options.
    Valitse viereisestä pystyrivistä Settings.
    Language kohtaan valitse Suomi.

    Puhdistaja
    Valitse vasemmalta pystyrivistä Puhdistaja.
    Paina alhaalta Tutki.
    Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
    Kun tutkiminen on valmis, paina Aja CCleaner.
    Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.

    Rekisterin virheiden korjaus
    Valitse vasemmalta pystyrivistä Rekisteri.
    Paina alhaalta Etsi rekisterin virheitä.
    Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
    Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
    Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
    Saat vielä varmistus kysymyksen, paina Ok.
    Kun virheet on korjattu, paina Sulje.
    Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
     
    Hujo, 27.08.2008
    #2
  4. Xfect

    Xfect Member

    Liittynyt:
    27.08.2008
    Viestejä:
    5
    Kiitokset:
    0
    Pisteet:
    11
    ComboFix 08-08-26.03 - Toni 2008-08-27 16:04:30.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.658 [GMT 3:00]
    Running from: C:\Documents and Settings\Toni.HOME-50943DEFA3\Työpöytä\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\#SharedObjects\9PSDZMKP\bin.clearspring.com
    C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\#SharedObjects\9PSDZMKP\bin.clearspring.com\clearspring.sol
    C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\#SharedObjects\9PSDZMKP\static.youku.com
    C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\#SharedObjects\9PSDZMKP\static.youku.com\v\swf\qplayer.swf\youku.sol
    C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
    C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
    C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com
    C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\settings.sol
    C:\Documents and Settings\User\Suosikit\Error Cleaner.url
    C:\Documents and Settings\User\Suosikit\Privacy Protector.url
    C:\Documents and Settings\User\Suosikit\Spyware&Malware Protection.url
    C:\Documents and Settings\User\Työpöytä\Privacy Protector.url
    C:\WINDOWS\msvrc20.dll
    C:\WINDOWS\privacy_danger

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-07-27 to 2008-08-27 )))))))))))))))))
    .

    2008-08-27 15:57 . 2008-08-27 15:57 <KANSIO> d-------- C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\MetaProducts
    2008-08-27 15:46 . 2008-08-27 15:46 <KANSIO> d-------- C:\Program Files\TweakNow WinSecret
    2008-08-27 15:46 . 2008-08-27 15:46 <KANSIO> d-------- C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\TweakNow WinSecret
    2008-08-27 15:24 . 2008-08-27 15:24 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-08-26 21:45 . 2008-08-26 21:45 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-08-26 21:45 . 2008-08-26 21:45 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-08-26 00:15 . 2008-08-26 00:15 <KANSIO> d-------- C:\Program Files\Yahoo!
    2008-08-23 13:27 . 2008-08-24 12:31 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\FLEXnet
    2008-08-23 13:05 . 2008-08-23 13:05 <KANSIO> d-------- C:\Program Files\Common Files\Macrovision Shared
    2008-08-23 11:53 . 2008-08-24 06:25 <KANSIO> d-------- C:\WINDOWS\system32\CatRoot_bak
    2008-08-10 20:16 . 2005-05-23 09:27 137,884 -ra------ C:\WINDOWS\system32\drivers\sscdmdm.sys
    2008-08-10 20:16 . 2005-05-23 09:27 80,272 -ra------ C:\WINDOWS\system32\drivers\sscdbus.sys
    2008-08-10 20:16 . 2005-05-23 09:27 11,877 -ra------ C:\WINDOWS\system32\drivers\sscdcmnt.sys
    2008-08-10 20:16 . 2005-05-23 09:27 11,877 -ra------ C:\WINDOWS\system32\drivers\sscdcm.sys
    2008-08-10 20:16 . 2005-05-23 09:27 11,188 -ra------ C:\WINDOWS\system32\drivers\sscdwhnt.sys
    2008-08-10 20:16 . 2005-05-23 09:27 11,188 -ra------ C:\WINDOWS\system32\drivers\sscdwh.sys
    2008-08-10 20:16 . 2005-05-23 09:27 10,864 -ra------ C:\WINDOWS\system32\drivers\sscdmdfl.sys
    2008-08-10 20:10 . 2008-08-10 20:14 <KANSIO> d-------- C:\Program Files\Samsung
    2008-08-10 20:10 . 2008-08-10 20:11 <KANSIO> d-------- C:\Hermes
    2008-08-10 20:10 . 2008-08-10 20:10 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Samsung
    2008-07-28 21:26 . 2008-07-28 21:26 287 --a------ C:\WINDOWS\game.ini
    2008-07-28 16:05 . 2008-07-28 16:05 <KANSIO> d-------- C:\Program Files\Live_TV

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-26 19:36 --------- d-----w C:\Program Files\mIRC
    2008-08-26 19:26 --------- d-----w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\HLSW
    2008-08-26 18:40 --------- d-----w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\uTorrent
    2008-08-26 11:14 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-08-26 11:14 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    2008-08-25 21:15 --------- d-----w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\AVG7
    2008-08-25 20:20 --------- d-----w C:\Program Files\DC++
    2008-08-23 10:22 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-08-16 13:32 --------- d-----w C:\Program Files\Steam
    2008-07-30 20:24 --------- d-----w C:\Program Files\VentSrv
    2008-07-30 20:24 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-07-28 23:29 --------- d-----w C:\Program Files\Java
    2008-07-28 18:26 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-07-25 21:45 20,481 ----a-w C:\WINDOWS\system32\SystemHook.dll
    2008-07-25 16:47 --------- d-----w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\Ahead
    2008-07-25 16:45 --------- d-----w C:\Program Files\Ahead
    2008-07-25 13:43 --------- d-----w C:\Program Files\Common Files\eSellerate
    2008-07-22 17:26 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
    2008-07-15 01:10 --------- d-----w C:\Program Files\GoldWave
    2008-07-13 15:40 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
    2008-07-12 01:31 --------- d-----w C:\Program Files\Microsoft Windows OneCare Live
    2008-07-09 23:30 --------- d-----w C:\Program Files\Webteh
    2008-07-09 13:44 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
    2008-07-07 20:43 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
    2008-07-07 20:42 --------- d-----w C:\Program Files\Lavasoft
    2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
    2008-07-06 19:48 --------- d-----w C:\Program Files\Wolfenstein - Enemy Territory
    2008-07-06 12:32 --------- d-----w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\ATI
    2008-07-04 22:29 --------- d--h--w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\ijjigame
    2008-07-03 11:50 --------- d-s---w C:\Program Files\HLSW
    2008-07-03 11:49 --------- d-----w C:\Documents and Settings\Toni\Application Data\HLSW
    2008-06-30 17:34 --------- d-----w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\Locktime
    2008-06-30 17:32 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Locktime
    2008-06-30 12:34 --------- d-----w C:\Program Files\Common Files\INCA Shared
    2008-06-28 11:06 --------- d-----w C:\Program Files\Common Files\Stardock
    2008-06-27 23:43 --------- d-----w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\mIRC
    2008-06-27 23:42 --------- d-----w C:\Program Files\nbs-irc
    2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
    2008-06-23 16:29 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-06-20 17:41 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-04-06 16:55 1,599,488 --sh--w C:\Documents and Settings\Toni\Omat tiedostotOca0Mx_cfdg.exe
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
    "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-05-13 23:10 219136]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoResolveSearch"= 1 (0x1)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "MaxRecentDocs"= 11 (0xb)
    "NoStartMenuMFUprogramsList"= 1 (0x1)

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Käynnistä-valikko^Ohjelmat^Käynnistys^Logitech SetPoint.lnk]
    path=C:\Documents and Settings\All Users.WINDOWS\Käynnistä-valikko\Ohjelmat\Käynnistys\Logitech SetPoint.lnk
    backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
    --a------ 2008-05-15 12:28 579584 C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    --a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
    --a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]
    --a------ 2005-02-25 14:26 589824 C:\Program Files\VIA\RAID\raid_tool.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
    --a------ 2008-07-06 00:21 1271032 c:\Program Files\Steam\Steam.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
    --a------ 2005-03-18 15:35 98393 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
    --a------ 2004-10-21 14:28 29696 C:\WINDOWS\KHALMNPR.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "WMPNetworkSvc"=3 (0x3)
    "WLSetupSvc"=3 (0x3)
    "usnjsvc"=3 (0x3)
    "iPod Service"=3 (0x3)
    "Bonjour Service"=2 (0x2)
    "Ati HotKey Poller"=2 (0x2)
    "Apple Mobile Device"=2 (0x2)
    "aawservice"=2 (0x2)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\mIRC\\mirc.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\HLSW\\hlsw.exe"=
    "C:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=

    S3 DMSKSSRh;DMSKSSRh;C:\DOCUME~1\TONI~1.HOM\LOCALS~1\Temp\DMSKSSRh.sys []

    *Newly Created Service* - CATCHME
    *Newly Created Service* - PROCEXP90
    .
    - - - - ORPHANS REMOVED - - - -

    MSConfigStartUp-CTFMON - (no file)


    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\Mozilla\Firefox\Profiles\ywizwioi.default\
    FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
    FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-08-27 16:09:43
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-08-27 16:10:27
    ComboFix-quarantined-files.txt 2008-08-27 13:10:23

    Pre-Run: 27,799,044,096 tavua vapaana
    Post-Run: 31,135,518,720 tavua vapaana

    179 --- E O F --- 2008-08-23 18:55:04
     
    Xfect, 27.08.2008
    #3
  5. Hujo

    Hujo Guest

    Lataa SmitfraudFix (c) S!Ri
    Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

    Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita ponnahtava rapport – muistion sisältö viestiketjuusi.
    Löytyy myös C:\rapport.txt

    Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
    (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
    A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
    silloin ne saattavat varoittaa käyttäjää.
     
    Moderaattorin viimeksi muokkaama: 27.08.2008
    Hujo, 27.08.2008
    #4
  6. Xfect

    Xfect Member

    Liittynyt:
    27.08.2008
    Viestejä:
    5
    Kiitokset:
    0
    Pisteet:
    11
    Malwarebytes' Anti-Malware 1.25
    Tietokantaversio: 1062
    Windows 5.1.2600 Service Pack 2

    17:29:41 27.8.2008
    mbam-log-08-27-2008 (17-29-36).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|)
    Tarkistetut kohteet: 155726
    Kulunut aika: 1 hour(s), 14 minute(s), 17 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 6
    Saastuneita rekisteriarvoja: 3
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 5
    Saastuneita tiedostoja: 53

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    HKEY_CLASSES_ROOT\CLSID\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} (Adware.Agent) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Live_TV (Adware.Agent) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Live_TV (Adware.Agent) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live_TV Toolbar (Adware.Agent) -> No action taken.

    Saastuneita rekisteriarvoja:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> No action taken.

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    C:\Program Files\Live_TV (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\RadioPlayer (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss (Adware.Agent) -> No action taken.

    Saastuneita tiedostoja:
    C:\Program Files\Live_TV\tbLive.dll (Adware.Agent) -> No action taken.
    C:\System Volume Information\_restore{0FE560B8-F38C-49FB-A1D5-7841E13F43F7}\RP36\A0007933.exe (BHO.Baidu) -> No action taken.
    C:\System Volume Information\_restore{0FE560B8-F38C-49FB-A1D5-7841E13F43F7}\RP45\A0014932.exe (Trojan.FakeAlert) -> No action taken.
    C:\Program Files\Live_TV\INSTALL.LOG (Adware.Agent) -> No action taken.
    C:\Program Files\Live_TV\toolbar.cfg (Adware.Agent) -> No action taken.
    C:\Program Files\Live_TV\UNWISE.EXE (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\LanguagePack.xml (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\LocalSettings.txt (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\ThirdPartyComponents.xml (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\update.xml (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_63_136_CT1360763_Images_1256613422_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_-1611650343_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_-1616510062_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_1256574750_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_1256594985_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_1477248454_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633211004690737500_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633323304820925000_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633323304996393750_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633323305088425000_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633323305474518750_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633341279781868750_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633403616553356250_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633463264160275000_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_735535110_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_999644891_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_Email-04orange_gif-Colorized-633323306911237500_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_PopUpBlocker-21_gif-comic02-633323306370612500_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___weather_conduit_com_images_weather_Default_drizzle_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___weather_conduit_com_images_weather_Default_partly_cloudy_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___weather_conduit_com_images_weather_Default_sunny_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___weather_conduit_com_images_weather_Default_sunny_night_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_bankimages_commandcomps_block_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_BankImages_CommandComps_highlighter_dis_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_BankImages_CommandComps_highlighter_icon_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_ClientImages_radio_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_rssImages_rrs16Images_rss01x16green_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_rssImages_rrs16Images_rss01x16red_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_rssImages_rrs16Images_rss01x16_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_rssImages_rrs16Images_rss03x16blue_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_SearchEngines_images_search_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_SearchEngines_news_search_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_SearchEngines_site_search_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_SearchEngines_weather_search_gif.gif (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\RadioPlayer\Predefined_Media_List.xml (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\http___feeds_feedburner_com_metacafe_TYps.xml (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\http___feeds_feedburner_com_metacafe_TYps_history.xml (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\http___feeds_feedburner_com_metacafe_TYps_structured.xml (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\http___video_google_com_videofeed_type=top100new&num=20&output=rss.xml (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\http___video_google_com_videofeed_type=top100new&num=20&output=rss_structured.xml (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\http___youtube_com_rss_global_top_viewed_today_rss.xml (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\http___youtube_com_rss_global_top_viewed_today_rss_structured.xml (Adware.Agent) -> No action taken.
    C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\sabfmts=2&saprclo=150&sascs=2&saprchi=550&saaff=afepn&ftrv=8&fbfmt=1&ftrt=1&fcl=3&ft=1&frpp=50&customid=&nojspr=y&satitle=new&afmp=&sacat=293&saslop=1&fss=0.xml (Adware.Agent) -> No action taken.
     
    Xfect, 27.08.2008
    #5
  7. Xfect

    Xfect Member

    Liittynyt:
    27.08.2008
    Viestejä:
    5
    Kiitokset:
    0
    Pisteet:
    11
    SmitFraudFix v2.339

    Scan done at 17:37:50,17, ke 27.08.2008
    Run from C:\Documents and Settings\Toni.HOME-50943DEFA3\Ty”p”yt„\SmitfraudFix\SmitfraudFix
    OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Toni.HOME-50943DEFA3


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\TONI~1.HOM\Suosikit


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="Nykyinen kotisivu"


    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, following keys are not inevitably infected!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri



    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, following keys are not inevitably infected!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
    !!!Attention, following keys are not inevitably infected!!!

    404Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
    !!!Attention, following keys are not inevitably infected!!!

    AntiXPVSTFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri



    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» RK



    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Realtek RTL8169/8110 Family Gigabit Ethernet NIC - Paketinajoituksen miniportti
    DNS Server Search Order: ***.***.*.*

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{672B33B8-69DE-4455-B12C-41A2F2C80371}: DhcpNameServer=***.***.*.*
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{672B33B8-69DE-4455-B12C-41A2F2C80371}: DhcpNameServer=***.***.*.*
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{672B33B8-69DE-4455-B12C-41A2F2C80371}: DhcpNameServer=***.***.*.*
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=***.***.*.*
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=***.***.*.*
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=***.***.*.*


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End

     
    Xfect, 27.08.2008
    #6
  8. Hujo

    Hujo Guest

    sitten vain listaa alas päin

    ===============

    Malwarebytes' Anti-Malware

    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.

    tuossa tuo kohta meni vikaan
     
    Moderaattorin viimeksi muokkaama: 27.08.2008
    Hujo, 27.08.2008
    #7

Jaa tämä sivu