Kone "tahmaa" välillä tosi pahasti

Eli pahimmillaan kone saattaa toimia noin kaksi sekuntia ja pysähtyy sitten noin viideksi sekunniksi...Eli ei ole ihan normaalia käytöstä...
Tässä HijackThis-loki
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:03:56, on 27.8.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.17184)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Norman\Npm\bin\ELOGSVC.EXE
C:\Norman\Npm\Bin\Zanda.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Norman\Npm\bin\ZLH.EXE
C:\Program Files\COMODO\Firewall\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\o2flash.exe
C:\Norman\Npm\bin\NJEEVES.EXE
C:\WINDOWS\System32\alg.exe
C:\Norman\nse\bin\NSESVC.EXE
C:\Norman\Nvc\bin\nvcoas.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Norman\Nvc\BIN\NIP.EXE
C:\Norman\Nvc\bin\cclaw.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Spyware Doctor\sdloader.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Norman ZANDA] "C:\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1188223263453
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1193469310046
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {E1E73B44-2D20-47A9-9CA2-B534CEBBF856} (F-Secure Health Check 1.0) - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Norman\Npm\bin\ELOGSVC.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norman NJeeves - Norman ASA - C:\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - C:\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Norman\nse\bin\NSESVC.EXE
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 6454 bytes

 

1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

==============

Lataa Malwarebytes' Anti-Malware työpöydällesi.

1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.

==============

Lataa Tästä Ccleaner
CCleaner v2.05.555- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
Asennuksen jälkeen aukaise CCleaner.
Valitse vasemmalta pystyrivistä Options.
Valitse viereisestä pystyrivistä Settings.
Language kohtaan valitse Suomi.

Puhdistaja
Valitse vasemmalta pystyrivistä Puhdistaja.
Paina alhaalta Tutki.
Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
Kun tutkiminen on valmis, paina Aja CCleaner.
Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.

Rekisterin virheiden korjaus
Valitse vasemmalta pystyrivistä Rekisteri.
Paina alhaalta Etsi rekisterin virheitä.
Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
Saat vielä varmistus kysymyksen, paina Ok.
Kun virheet on korjattu, paina Sulje.
Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.

 

Tässä ComboFix...


ComboFix 08-08-26.03 - Henkka 2008-08-28 14:53:23.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.545 [GMT 3:00]
Running from: C:\Documents and Settings\Henkka\Työpöytä\ComboFix.exe
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\WINDOWS\system32\actskn43.ocx

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NSESVC
-------\Service_nsesvc


((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-07-28 to 2008-08-28 )))))))))))))))))
.

2008-08-26 18:06 . 2008-08-26 18:09 <KANSIO> d-------- C:\Documents and Settings\Henkka\Application Data\Any Video Converter
2008-08-26 14:15 . 2008-08-26 17:57 <KANSIO> d-------- C:\Program Files\Avast4
2008-08-22 16:38 . 2008-08-25 16:00 <KANSIO> d-------- C:\Program Files\Spyware Doctor
2008-08-22 16:38 . 2008-08-22 16:38 <KANSIO> d-------- C:\Documents and Settings\Henkka\Application Data\PC Tools
2008-08-22 16:38 . 2008-06-10 21:22 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-08-22 16:38 . 2008-06-02 15:19 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-08-22 16:38 . 2008-06-02 15:19 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-08-22 16:38 . 2008-06-02 15:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-08-21 14:20 . 2008-08-26 07:20 <KANSIO> d-------- C:\Program Files\Advanced WindowsCare 3
2008-08-20 16:52 . 2008-08-20 16:52 <KANSIO> d-------- C:\Program Files\Intel
2008-08-20 16:52 . 2008-05-01 16:35 53,248 --a------ C:\WINDOWS\system32\CSVer.dll
2008-08-20 16:48 . 2008-08-20 16:46 2,772,992 --a------ C:\WINDOWS\system32\NETw4r32.dll
2008-08-20 16:48 . 2008-08-20 16:46 2,530,176 --a------ C:\WINDOWS\system32\drivers\NETw4x32.sys
2008-08-20 16:48 . 2008-08-20 16:46 684,032 --a------ C:\WINDOWS\system32\NETw4c32.dll
2008-08-20 16:26 . 2008-08-21 14:20 <KANSIO> d-------- C:\Program Files\Advanced WindowsCare 3 Beta
2008-08-20 16:26 . 2008-04-17 16:19 90,668 --a------ C:\WINDOWS\system32\vobis32.dll
2008-08-20 16:17 . 2008-08-20 16:17 <KANSIO> d-------- C:\Documents and Settings\Henkka\Application Data\Uniblue
2008-08-16 20:32 . 2008-08-16 20:32 <KANSIO> d-------- C:\Program Files\uTorrent
2008-08-16 17:42 . 2008-08-16 17:42 <KANSIO> d-------- C:\Documents and Settings\LocalService\Ty”p”yt„
2008-08-15 15:23 . 2008-08-15 15:28 <KANSIO> d-------- C:\Program Files\Vuze
2008-08-15 15:23 . 2008-08-15 15:27 <KANSIO> d-------- C:\Documents and Settings\Henkka\Application Data\Azureus
2008-08-14 14:54 . 2008-08-15 09:03 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2008-08-14 14:54 . 2008-08-15 09:03 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb
2008-08-14 14:47 . 2008-08-14 14:47 <KANSIO> d-------- C:\Documents and Settings\Henkka\Application Data\Media Player Classic
2008-08-14 14:17 . 2008-04-11 22:05 691,712 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-08-12 19:45 . 2008-08-12 19:45 <KANSIO> d-------- C:\Documents and Settings\Henkka\Application Data\Windows Search
2008-08-12 19:43 . 2008-08-12 19:43 <KANSIO> d-------- C:\WINDOWS\system32\GroupPolicy
2008-08-12 19:41 . 2008-03-07 20:02 192,000 --------- C:\WINDOWS\system32\dllcache\offfilt.dll
2008-08-12 19:41 . 2008-03-07 20:02 98,304 --------- C:\WINDOWS\system32\dllcache\nlhtml.dll
2008-08-12 19:41 . 2008-03-07 20:02 29,696 --------- C:\WINDOWS\system32\dllcache\mimefilt.dll
2008-08-12 16:17 . 2008-08-12 16:22 <KANSIO> d-------- C:\Program Files\Common Files\Softwin
2008-08-12 14:10 . 2008-08-12 14:10 <KANSIO> d-------- C:\Documents and Settings\Henkka\Application Data\Apple Computer
2008-08-12 14:10 . 2008-08-12 14:10 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-08-08 07:38 . 2001-10-05 15:50 117,760 --a------ C:\WINDOWS\system32\dllcache\e100b325.sys
2008-08-08 07:38 . 2001-08-17 20:10 69,692 --a------ C:\WINDOWS\system32\dllcache\el575nd5.sys
2008-08-08 07:38 . 2001-08-17 20:10 55,999 --a------ C:\WINDOWS\system32\dllcache\el556nd5.sys
2008-08-08 07:38 . 2001-10-05 15:50 51,231 --a------ C:\WINDOWS\system32\dllcache\e1000nt5.sys
2008-08-08 07:38 . 2001-10-05 15:52 44,103 --a------ C:\WINDOWS\system32\dllcache\el515.sys
2008-08-08 07:38 . 2001-08-17 20:10 24,653 --a------ C:\WINDOWS\system32\dllcache\el574nd4.sys
2008-08-08 07:38 . 2001-08-17 20:12 19,594 --a------ C:\WINDOWS\system32\dllcache\e100isa4.sys
2008-08-08 07:36 . 2001-10-05 16:31 420,381 --a------ C:\WINDOWS\system32\dllcache\dgconfig.dll
2008-08-08 07:35 . 2004-09-15 15:00 1,677,824 --a------ C:\WINDOWS\system32\dllcache\chsbrkr.dll
2008-08-08 07:34 . 2001-08-17 21:28 871,388 --a------ C:\WINDOWS\system32\dllcache\bcmdm.sys
2008-08-08 07:33 . 2001-08-17 21:28 762,780 --a------ C:\WINDOWS\system32\dllcache\3cwmcru.sys
2008-08-08 07:32 . 2008-04-14 18:49 2,191,360 --a------ C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-08-08 07:32 . 2001-10-05 16:30 66,048 --a------ C:\WINDOWS\system32\dllcache\s3legacy.dll
2008-08-05 08:02 . 2008-08-05 08:02 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
2008-08-05 07:58 . 2008-08-05 07:58 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
2008-08-05 07:58 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-08-05 07:57 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-08-05 07:57 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-08-05 07:57 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-08-05 07:57 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-08-05 07:57 . 2008-05-07 07:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
2008-08-05 07:57 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-08-02 16:31 . 2008-08-02 16:31 <KANSIO> d-------- C:\Documents and Settings\Henkka\Application Data\SystemRequirementsLab
2008-08-02 16:22 . 2008-08-20 16:35 <KANSIO> d-------- C:\Documents and Settings\Henkka\Application Data\IObit
2008-07-30 14:29 . 2008-07-30 14:32 <KANSIO> d-------- C:\Documents and Settings\Henkka\SecurityScans
2008-07-28 07:25 . 2008-07-28 07:25 <KANSIO> d-------- C:\WINDOWS\Speeditup Free

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-27 17:13 --------- d-----w C:\Documents and Settings\Henkka\Application Data\uTorrent
2008-08-27 13:07 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-26 11:14 --------- d-----w C:\Documents and Settings\Henkka\Application Data\Skype
2008-08-26 11:10 --------- d-----w C:\Documents and Settings\Henkka\Application Data\skypePM
2008-08-23 17:22 --------- d-----w C:\Documents and Settings\Henkka\Application Data\OfficeUpdate12
2008-08-23 17:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-08-22 14:01 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-08-22 14:01 --------- d-----w C:\Documents and Settings\Henkka\Application Data\SUPERAntiSpyware.com
2008-08-21 11:49 --------- d-----w C:\Program Files\Nokia
2008-08-21 11:49 --------- d-----w C:\Program Files\Microsoft Works
2008-08-19 12:08 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-08-17 12:01 38,472 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-17 12:01 17,144 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-08-15 12:28 --------- d-----w C:\Program Files\Vuze
2008-08-15 11:17 --------- d-----w C:\Program Files\Windows Live
2008-08-15 06:22 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-14 12:24 --------- d-----w C:\Program Files\Google
2008-08-12 13:22 81,984 ----a-w C:\WINDOWS\system32\bdod.bin
2008-08-08 04:40 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-08-08 04:40 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-08-08 04:40 --------- d-----w C:\Program Files\Sovellusten pikakuvakkeet
2008-08-08 04:40 --------- d-----w C:\Program Files\OpenAL
2008-08-06 05:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-08-06 05:49 --------- d-----w C:\Program Files\Common Files\Nokia
2008-07-24 10:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\comodo
2008-07-24 10:33 87,056 ----a-w C:\WINDOWS\system32\drivers\cmdguard.sys
2008-07-24 10:33 24,208 ----a-w C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-07-24 10:33 143,104 ----a-w C:\WINDOWS\system32\guard32.dll
2008-07-24 04:19 --------- d-----w C:\Program Files\COMODO
2008-07-24 04:19 --------- d-----w C:\Documents and Settings\Henkka\Application Data\Comodo
2008-07-24 04:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-24 04:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\NPF
2008-07-23 04:55 5 ----a-w C:\NPF_USER.DAT
2008-07-22 05:37 --------- d-----w C:\Documents and Settings\Henkka\Application Data\WinPatrol
2008-07-16 18:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-16 18:12 --------- d-----w C:\Program Files\ProcessScanner
2008-07-15 07:38 --------- d-----w C:\Program Files\Java
2008-07-15 06:08 --------- d-----w C:\Program Files\Common Files\DeskShare Shared
2008-07-15 06:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Deskshare
2008-07-11 06:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-10 11:40 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-07-10 11:40 249,856 ------w C:\WINDOWS\Setup1.exe
2008-07-10 06:41 --------- d-----w C:\Program Files\Common Files\Skype
2008-07-10 06:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-07-10 06:41 --------- d-----r C:\Program Files\Skype
2008-07-09 04:04 --------- d-----w C:\Documents and Settings\Henkka\Application Data\Nokia
2008-07-09 04:03 --------- d-----w C:\Program Files\Canon
2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:28 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
2008-07-04 07:56 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-07-03 14:28 --------- d-----w C:\Program Files\bitRipper
2008-07-02 06:24 --------- d-----w C:\Documents and Settings\Henkka\Application Data\PC Suite
2008-07-01 04:36 --------- d-----w C:\Program Files\Miranda IM
2008-07-01 04:34 --------- d-----w C:\Documents and Settings\Henkka\Application Data\Miranda
2008-06-29 12:43 --------- d-----w C:\Program Files\anysee
2008-06-28 08:33 --------- d-----w C:\Program Files\Common Files\IviSDK
2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:44 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-20 17:47 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:47 246,784 ------w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:47 147,968 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 11:51 361,600 ------w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 11:08 225,856 ------w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-14 17:34 272,128 ----a-w C:\WINDOWS\system32\dllcache\bthport.sys
2008-05-04 09:08 47,360 ----a-w C:\Documents and Settings\Henkka\Application Data\pcouffin.sys
2008-03-25 16:09 716 ----a-w C:\Documents and Settings\Henkka\Application Data\wklnhst.dat
2007-12-25 07:41 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-05-08 12:51 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Sivuhistoria\History.IE5\MSHist012008050820080509\index.dat
.

(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 19:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Norman ZANDA"="C:\Norman\Npm\bin\ZLH.EXE" [2008-06-02 14:46 273520]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-07-24 13:33 1655552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 19:12 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@=""
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"sonera"="C:\Program Files\Sonera\InternetAvustaja\bin\sprtcmd.exe" /P Sonera

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Messenger\\Msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Kaspersky\\kavupd.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13503:TCP"= 13503:TCP:BitComet 13503 TCP
"13503:UDP"= 13503:UDP:BitComet 13503 UDP
"1:TCP"= 1:TCP:BitComet 1 TCP
"1:UDP"= 1:UDP:BitComet 1 UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 O2MDRDR;O2MDRDR;C:\WINDOWS\system32\DRIVERS\o2media.sys [2006-02-27 17:00]
R0 O2SDRDR;O2SDRDR;C:\WINDOWS\system32\DRIVERS\o2sd.sys [2006-02-20 18:01]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-07-24 13:33]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-07-24 13:33]
R1 papycpu;papycpu;C:\WINDOWS\system32\drivers\papycpu.sys [1998-10-06 14:36]
R2 Ndiskio;Ndiskio;C:\Norman\Nse\bin\NDISKIO.SYS [2007-01-02 10:55]
R3 NvcMFlt;NvcMFlt;C:\WINDOWS\system32\DRIVERS\nvcw32mf.sys [2008-02-11 15:56]
R3 nvcoas;Norman Virus Control on-access component;C:\Norman\Nvc\bin\nvcoas.exe [2008-04-29 10:58]
R3 NVCScheduler;Norman Virus Control Scheduler;C:\Norman\Nvc\BIN\NVCSCHED.EXE [2008-03-11 15:00]
S1 AMTBDA_P861F;anysee Capture Service;C:\WINDOWS\system32\DRIVERS\anyseeTU.SYS [2007-07-24 11:51]
S3 MR97310_VGA_DUAL_CAMERA;PRECISION 801;C:\WINDOWS\system32\DRIVERS\mr97310v.sys [2006-07-18 14:40]
S3 nvcfsr;nvcfsr;C:\Norman\Nvc\bin\nvcfsr.sys [2007-01-09 15:25]
S3 nvcoafl51;nvcoafl51;C:\Norman\Nvc\bin\nvcoafl51.sys [2007-01-09 15:25]
S3 nvcoaft51;nvcoaft51;C:\Norman\Nvc\bin\nvcoaft51.sys [2007-01-09 15:25]
S3 nvcoarc51;nvcoarc51;C:\Norman\Nvc\bin\nvcoarc51.sys [2007-01-09 15:25]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2004-05-17 09:15]
S3 ZSMC302;VIMICRO USB PC Camera;C:\WINDOWS\system32\Drivers\usbVM31b.sys [2004-08-17 12:44]
.
'Ajoitetut teht„v„t'-kansion sis„lt”

2008-08-27 C:\WINDOWS\Tasks\AWC Update.job
- C:\Program Files\Advanced WindowsCare 3\IObitUpdate.exe [2008-08-14 15:13]

2008-08-27 C:\WINDOWS\Tasks\AWC Update.job
- C:\Program Files\Advanced WindowsCare 3\ [2008-08-26 07:20]

2008-08-27 C:\WINDOWS\Tasks\User_Feed_Synchronization-{60867121-AE57-44AD-92B0-D95F9A39E218}.job
- C:\WINDOWS\system32\msfeedssync.exe [2008-03-03 19:50]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-Advanced WindowsCare 3 - C:\Program Files\Advanced WindowsCare 3 Beta\AWC.exe
MSConfigStartUp-CTFMON - (no file)


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Henkka\Application Data\Mozilla\Firefox\Profiles\hstdab1g.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://fi.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fifficial
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-28 14:58:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Norman\npm\bin\elogsvc.exe
C:\Norman\npm\bin\Zanda.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\o2flash.exe
C:\Norman\npm\bin\Njeeves.exe
C:\Norman\NVC\Bin\Nip.exe
C:\Norman\NVC\Bin\CClaw.exe
.
**************************************************************************
.
Completion time: 2008-08-28 15:05:42 - machine was rebooted [Henkka]
ComboFix-quarantined-files.txt 2008-08-28 12:05:36

Pre-Run: 103,688,331,264 tavua vapaana
Post-Run: 103,467,855,872 tavua vapaana

259

 

Malwarebytes' Anti-Malware ajoon

 

Malwarebytes' Anti-Malware 1.25
Tietokantaversio: 1090
Windows 5.1.2600 Service Pack 3

16:12:27 28.8.2008
mbam-log-08-28-2008 (16-12-27).txt

Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 88798
Kulunut aika: 38 minute(s), 15 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)

 

ccleaner ajoon

 

Mulla on jo ennestään Ccleaner,jota ajelen noin viiikon välein.Nyt lähti turhaa tavaraa noin 50 Mt ja 80 rekisterivirhettä.

 

mitäs se kone nyt tekee toimiiko

 

Nyt kone toimii ihan normaalisti.En vaan tiedä oikein mikä oli silloin....
No kiitokset kuitenkin avusta!!