1. Tämä sivusto käyttää keksejä (cookie). Jatkamalla sivuston käyttämistä hyväksyt keksien käyttämisen. Lue lisää.

Trojan.Vundot palailee kokoajan takaisin

Viestiketju Virukset ja haittaohjelmat -osiossa. Ketjun avasi TuPP3 18.10.2008.

  1. TuPP3

    TuPP3 Member

    Liittynyt:
    08.06.2007
    Viestejä:
    66
    Kiitokset:
    0
    Pisteet:
    16
    Aloin vasta saamaan hieman pikkuongelmia koneen kanssa, popup mainoksia jotka avautuvat uuteen firefox ikkunaan ja explorerin hyytimistä muutaman kerran päivässä. Ajoin Malwarebytes' Anti-Malwarella läpi, löysin alkuun muistaakseni 12 tartuntaa System32 kansiosta, poistin ne, käynnistin uudelleen, ajoin uudelleen läpi eikä niitä enää löytynyt. Mutta muutaman tunnin kuluttua alkaa taas mainoksia näkymään ja kun tarkastan MAMilla niin löytyy 6-12 tartuntaa. Poistelen vähän väliä mutta aina hyppää takaisin, mistä mahtaa ilmestyä? Kokeilin myös Vundo Fix 6.5, joka ei löytänyt mitään. Kaikki MAMilla löytyneet olivat Trojan.Vuondoja, myös Bitdefender löysi niitä. Esim. saastuneita olivat:
    C:\WINDOWS\system32\axlyrnmf.dll
    C:\WINDOWS\system32\fmnrylxa.ini
    C:\WINDOWS\system32\pmnoMgeF.dll
    C:\WINDOWS\system32\FegMonmp.ini
    C:\WINDOWS\system32\FegMonmp.ini2

    (Voin laittaa HijackThis login jos tarpeen)
     
  2.  
  3. yaht

    yaht Regular member

    Liittynyt:
    07.12.2005
    Viestejä:
    2,261
    Kiitokset:
    0
    Pisteet:
    46
    Pistäppä tuleen hijackthis lokia niin katsotaan.
     
  4. TuPP3

    TuPP3 Member

    Liittynyt:
    08.06.2007
    Viestejä:
    66
    Kiitokset:
    0
    Pisteet:
    16
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 23:16:05, on 18.10.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    F:\Asennetut Ohjelmat\Ad-Aware 2008\aawservice.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\ATKKBService.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Softwin\BitDefender10\bdagent.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    F:\Asennetut Ohjelmat\3ds Max Design 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
    F:\Asennetut Ohjelmat\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\PnkBstrB.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    F:\Asennetut Ohjelmat\DAEMON Tools Lite\daemon.exe
    C:\Program Files\Softwin\BitDefender10\vsserv.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Microsoft IntelliPoint\Point32.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\Explorer.EXE
    F:\Asennetut Ohjelmat\Firefox 2.0\firefox.exe
    F:\Asennetut Ohjelmat\Advanced System Optimizer\aso.exe
    C:\WINDOWS\system32\mmc.exe
    C:\WINDOWS\system32\DfrgNtfs.exe
    F:\Asennetut Ohjelmat\Advanced System Optimizer\sysclean.exe
    F:\Asennetut Ohjelmat\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: (no name) - {066A7EED-426E-4738-92AF-59E650687697} - C:\WINDOWS\system32\wprjhfwu.dll
    O2 - BHO: (no name) - {1429EC0B-CA39-42BF-86F4-3ECA2A906210} - (no file)
    O2 - BHO: (no name) - {19A9FBB5-426E-4738-92AF-59E650687697} - C:\WINDOWS\system32\wprjhfwu.dll
    O2 - BHO: (no name) - {1A75F101-126E-46A3-97B1-91A96D161C15} - C:\WINDOWS\system32\khfExYqp.dll
    O2 - BHO: (no name) - {2ED197C3-1F6F-41D2-A438-E1A615AA8CB9} - (no file)
    O2 - BHO: (no name) - {2FE5FE65-FBCA-493F-B420-866D75789A5F} - (no file)
    O2 - BHO: (no name) - {32827B07-2CF1-4065-A6E0-3A1D7C6860DF} - (no file)
    O2 - BHO: (no name) - {61CA7F0F-BD33-4ADF-A421-3AEF6758E071} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7FD78DE6-7D75-4151-8F0B-21A964DFCDBA} - (no file)
    O2 - BHO: {66405f49-25bc-aaab-6524-dba7d11b6b38} - {83b6b11d-7abd-4256-baaa-cb5294f50466} - C:\WINDOWS\system32\wefayf.dll
    O2 - BHO: (no name) - {86744BC0-1AEF-4AB0-BFD0-1E886FD7D61D} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {934B3948-B405-4757-A1CC-EE421B856EAF} - (no file)
    O2 - BHO: (no name) - {BC600171-B581-4BAD-8FBB-B158C5726F8B} - (no file)
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] "F:\ASENNE~1\NOKIAP~1\NOKIAP~1\LAUNCH~1.EXE" -startup
    O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "D:\Tuomas\Ohjelmat\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware Reboot] "F:\Asennetut Ohjelmat\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O4 - HKLM\..\Run: [0c9cd2e0] rundll32.exe "C:\WINDOWS\system32\axlyrnmf.dll",b
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "F:\Asennetut Ohjelmat\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Mouse.lnk = C:\Program Files\Microsoft IntelliPoint\dplaunch.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\ASENNE~1\MICROS~1\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://F:\ASENNE~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\ASENNE~1\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O20 - Winlogon Notify: khfExYqp - C:\WINDOWS\SYSTEM32\khfExYqp.dll
    O20 - Winlogon Notify: xxyyXQGX - xxyyXQGX.dll (file missing)
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - F:\Asennetut Ohjelmat\Ad-Aware 2008\aawservice.exe
    O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit (mi-raysat_3dsMax2009_32) - Unknown owner - F:\Asennetut Ohjelmat\3ds Max Design 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
    O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - F:\Asennetut Ohjelmat\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
    O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

    --
    End of file - 10417 bytes
     
  5. yaht

    yaht Regular member

    Liittynyt:
    07.12.2005
    Viestejä:
    2,261
    Kiitokset:
    0
    Pisteet:
    46
    1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä:
    Combofix.exe
    Combofix.exe

    Avaa Combofix.exe ja seuraa näyttöön tulevia ohjeita

    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
    Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.

    Sammuta selain ja muut ohjelmat Fixin ajaksi. (ei virustorjuntaa)
    Käynnistä HijackThis:ja Scan ja ruksaa seuraavat punaisella listatut tiedostot sekä poista ne.(fix Chekked)


    O2 - BHO: (no name) - {066A7EED-426E-4738-92AF-59E650687697} - C:\WINDOWS\system32\wprjhfwu.dll
    O2 - BHO: (no name) - {1429EC0B-CA39-42BF-86F4-3ECA2A906210} - (no file)
    O2 - BHO: (no name) - {19A9FBB5-426E-4738-92AF-59E650687697} - C:\WINDOWS\system32\wprjhfwu.dll
    O2 - BHO: (no name) - {1A75F101-126E-46A3-97B1-91A96D161C15} - C:\WINDOWS\system32\khfExYqp.dll
    O2 - BHO: (no name) - {2ED197C3-1F6F-41D2-A438-E1A615AA8CB9} - (no file)
    O2 - BHO: (no name) - {2FE5FE65-FBCA-493F-B420-866D75789A5F} - (no file)
    O2 - BHO: (no name) - {32827B07-2CF1-4065-A6E0-3A1D7C6860DF} - (no file)
    O2 - BHO: (no name) - {61CA7F0F-BD33-4ADF-A421-3AEF6758E071} - (no file)
    O2 - BHO: (no name) - {7FD78DE6-7D75-4151-8F0B-21A964DFCDBA} - (no file)
    O2 - BHO: {66405f49-25bc-aaab-6524-dba7d11b6b38} - {83b6b11d-7abd-4256-baaa-cb5294f50466} - C:\WINDOWS\system32\wefayf.dll
    O2 - BHO: (no name) - {86744BC0-1AEF-4AB0-BFD0-1E886FD7D61D} - (no file)
    O2 - BHO: (no name) - {934B3948-B405-4757-A1CC-EE421B856EAF} - (no file)
    O2 - BHO: (no name) - {BC600171-B581-4BAD-8FBB-B158C5726F8B} - (no file)
    O4 - HKLM\..\Run: [0c9cd2e0] rundll32.exe "C:\WINDOWS\system32\axlyrnmf.dll",b
    O20 - Winlogon Notify: khfExYqp - C:\WINDOWS\SYSTEM32\khfExYqp.dll
    O20 - Winlogon Notify: xxyyXQGX - xxyyXQGX.dll (file missing)


    Tyhjennä roskakori ja käynnistä koneesi uudelleen.

    Postita tänne seuraavat lokit:
    * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
    * (C:\ComboFix.txt) raportti
    *


    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    * Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    * Lopuksi varmistu, että seuraavat on valittu: Päivitä Malwarebytes' Anti-Malware ja Käynnistä Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Lopeta.
    * Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    * Kun ohjelma on latautunut, valitse Suorita täysi tarkistus ja klikkaa Tarkista.
    * Kun skanni on valmis, klikkaa OK ja sitten Näytä tulokset nähdäksesi tulokset.
    * Varmistu, että kaikki on merkitty ja klikkaa Poista valitut.
    * Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös
    täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    * Lähetä lokin sisältö seuraavassa viestissäsi + uusi hjt-loki.
     
  6. TuPP3

    TuPP3 Member

    Liittynyt:
    08.06.2007
    Viestejä:
    66
    Kiitokset:
    0
    Pisteet:
    16
    ComboFix logi:

    ComboFix 08-10-19.04 - Omistaja 2008-10-20 12:28:27.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1478 [GMT 3:00]
    Sijainti: F:\Setupit\Computer Protection\ComboFix.exe
    * Uusi palautuspiste luotu
    * Resident AV is active

    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Omistaja\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\system32\aaseirgs.dll
    C:\WINDOWS\system32\amilsmrh.dll
    C:\WINDOWS\system32\avtgrf.dll
    C:\WINDOWS\system32\bhxmjlve.exe
    C:\WINDOWS\system32\bulyimpk.dll
    C:\WINDOWS\system32\bxjomkde.ini
    C:\WINDOWS\system32\byXqQJdb.dll
    C:\WINDOWS\system32\cblagbul.exe
    C:\WINDOWS\system32\ckvrnh.dll
    C:\WINDOWS\system32\cokeycyy.exe
    C:\WINDOWS\system32\dnugypff.dll
    C:\WINDOWS\system32\dpjducji.dll
    C:\WINDOWS\system32\drtarolw.exe
    C:\WINDOWS\system32\eagxtk.dll
    C:\WINDOWS\system32\edtpjlud.dll
    C:\WINDOWS\system32\eglefsgr.dll
    C:\WINDOWS\system32\ejxecxyu.exe
    C:\WINDOWS\system32\eMWvvGgh.ini
    C:\WINDOWS\system32\eMWvvGgh.ini2
    C:\WINDOWS\system32\favnyg.dll
    C:\WINDOWS\system32\fiQXayay.ini
    C:\WINDOWS\system32\fiQXayay.ini2
    C:\WINDOWS\system32\fOruEMoq.ini
    C:\WINDOWS\system32\fOruEMoq.ini2
    C:\WINDOWS\system32\fphstvpr.dll
    C:\WINDOWS\system32\ghsgwolh.dll
    C:\WINDOWS\system32\gidoasbp.dll
    C:\WINDOWS\system32\gjqnckmr.dll
    C:\WINDOWS\system32\gunbwcxs.exe
    C:\WINDOWS\system32\hjtyhlvv.dll
    C:\WINDOWS\system32\hrxgywge.exe
    C:\WINDOWS\system32\ibkfmrsv.dll
    C:\WINDOWS\system32\ienbtjhx.ini
    C:\WINDOWS\system32\ixdvndyw.dll
    C:\WINDOWS\system32\ixkcprqy.exe
    C:\WINDOWS\system32\ixvutods.dll
    C:\WINDOWS\system32\jkblbipk.exe
    C:\WINDOWS\system32\kedatb.dll
    C:\WINDOWS\system32\kgpytafj.ini
    C:\WINDOWS\system32\khfExYqp.dll
    C:\WINDOWS\system32\KSvvvGgh.ini
    C:\WINDOWS\system32\KSvvvGgh.ini2
    C:\WINDOWS\system32\laehuapr.exe
    C:\WINDOWS\system32\LnXIhkkj.ini
    C:\WINDOWS\system32\LnXIhkkj.ini2
    C:\WINDOWS\system32\minohgqk.dll
    C:\WINDOWS\system32\mofaexfq.dll
    C:\WINDOWS\system32\mqeyvqfx.dll
    C:\WINDOWS\system32\mUxayyay.ini
    C:\WINDOWS\system32\mUxayyay.ini2
    C:\WINDOWS\system32\mvolbsga.exe
    C:\WINDOWS\system32\ndypasqm.exe
    C:\WINDOWS\system32\nywdfs.dll
    C:\WINDOWS\system32\ocgvoy.dll
    C:\WINDOWS\system32\ozhhqe.dll
    C:\WINDOWS\system32\pmibohhu.dll
    C:\WINDOWS\system32\pmnoMgeF.dll
    C:\WINDOWS\system32\pxaipm.dll
    C:\WINDOWS\system32\qcxudwvp.exe
    C:\WINDOWS\system32\qdivdrlu.ini
    C:\WINDOWS\system32\qlkkajks.ini
    C:\WINDOWS\system32\qwjtbo.dll
    C:\WINDOWS\system32\rhhadofn.ini
    C:\WINDOWS\system32\rhkqxska.dll
    C:\WINDOWS\system32\rlntgdug.dll
    C:\WINDOWS\system32\rsqbsf.dll
    C:\WINDOWS\system32\sclkel.dll
    C:\WINDOWS\system32\setup.ini
    C:\WINDOWS\system32\skhfzu.dll
    C:\WINDOWS\system32\snsfigsu.dll
    C:\WINDOWS\system32\tmp89.tmp
    C:\WINDOWS\system32\tpniulvs.dll
    C:\WINDOWS\system32\tukgcwlb.dll
    C:\WINDOWS\system32\uqiiiptr.dll
    C:\WINDOWS\system32\wbqiln.dll
    C:\WINDOWS\system32\vcpfmalt.dll
    C:\WINDOWS\system32\wefayf.dll
    C:\WINDOWS\system32\veilkd.dll
    C:\WINDOWS\system32\vjoqiejx.dll
    C:\WINDOWS\system32\vmuyqkht.dll
    C:\WINDOWS\system32\voriwifn.ini
    C:\WINDOWS\system32\wprjhfwu.dll
    C:\WINDOWS\system32\wqnxcrvi.exe
    C:\WINDOWS\system32\wtieeehw.ini
    C:\WINDOWS\system32\vyeupqxv.ini
    C:\WINDOWS\system32\vylkgdma.exe
    C:\WINDOWS\system32\xigavqir.exe
    C:\WINDOWS\system32\yatfrnrx.exe
    C:\WINDOWS\system32\yjddtmah.dll
    C:\WINDOWS\system32\ynglwqxh.dll
    C:\WINDOWS\system32\yxsacfdr.exe
    C:\WINDOWS\system32\zcqlan.dll

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-09-20 to 2008-10-20 )))))))))))))))))
    .

    2008-10-20 12:20 . 2008-10-20 12:20 165 --a------ C:\WINDOWS\startUp manager.INI
    2008-10-20 11:54 . 2008-10-20 11:54 <KANSIO> d-------- C:\Documents and Settings\Manninen\Application Data\Malwarebytes
    2008-10-19 00:26 . 2008-10-19 00:26 607 --a------ C:\WINDOWS\Uninstall Manager.INI
    2008-10-18 23:14 . 2008-10-18 23:14 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-10-18 22:45 . 2008-10-18 22:45 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Systweak
    2008-10-18 21:34 . 2008-10-18 21:34 <KANSIO> d-------- C:\VundoFix Backups
    2008-10-18 19:35 . 2001-03-26 13:51 921,872 --a------ C:\WINDOWS\system\MFC40.DLL
    2008-10-18 19:35 . 2001-03-26 13:51 326,656 --a------ C:\WINDOWS\system\Msvcrt40.dll
    2008-10-18 19:26 . 1996-01-09 10:38 283,648 --a------ C:\WINDOWS\uninst.exe
    2008-10-18 19:24 . 2008-10-18 19:24 0 --a------ C:\WINDOWS\odbctst.INI
    2008-10-18 18:03 . 1998-10-29 15:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
    2008-10-18 18:01 . 2008-10-18 18:01 <KANSIO> d-------- C:\cm75f
    2008-10-18 16:31 . 2008-10-18 16:41 <KANSIO> d-------- C:\WINDOWS\SHELLNEW
    2008-10-18 16:31 . 2008-10-18 16:31 <KANSIO> d-------- C:\Program Files\Microsoft.NET
    2008-10-15 21:48 . 2008-10-15 21:48 389,120 --------- C:\WINDOWS\Setup1.exe
    2008-10-15 21:48 . 2008-10-15 21:48 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
    2008-10-14 18:21 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
    2008-10-14 16:23 . 2008-10-18 15:35 <KANSIO> d-------- C:\Program Files\Microsoft Works
    2008-10-14 16:12 . 2008-10-18 15:35 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-10-14 15:53 . 2008-10-14 15:54 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Autodesk
    2008-10-14 15:41 . 2008-10-14 15:41 <KANSIO> d-------- C:\Program Files\Turbo Squid Tentacles
    2008-10-14 15:41 . 2008-10-14 15:41 <KANSIO> d-------- C:\Program Files\Microsoft WSE
    2008-10-13 23:58 . 2008-10-13 23:58 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Trymedia
    2008-10-13 22:10 . 2008-10-13 22:10 268 --ah----- C:\sqmdata19.sqm
    2008-10-13 22:10 . 2008-10-13 22:10 244 --ah----- C:\sqmnoopt19.sqm
    2008-10-12 14:49 . 2008-10-15 21:48 397 --a------ C:\WINDOWS\EWGIGA.ini
    2008-10-10 22:14 . 2008-10-10 22:14 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\ATI
    2008-10-10 20:28 . 2008-10-10 20:28 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Ubisoft
    2008-10-10 17:29 . 2008-10-10 17:29 268 --ah----- C:\sqmdata18.sqm
    2008-10-10 17:29 . 2008-10-10 17:29 244 --ah----- C:\sqmnoopt18.sqm
    2008-10-09 22:41 . 2008-10-13 18:10 4,096 --a------ C:\WINDOWS\system32\crash
    2008-10-09 19:52 . 2008-10-09 19:52 268 --ah----- C:\sqmdata17.sqm
    2008-10-09 19:52 . 2008-10-09 19:52 244 --ah----- C:\sqmnoopt17.sqm
    2008-10-08 21:11 . 2008-10-08 21:11 <KANSIO> d-------- C:\WINDOWS\system32\AGEIA
    2008-10-08 21:11 . 2008-10-08 21:12 <KANSIO> d-------- C:\Program Files\AGEIA Technologies
    2008-10-06 21:06 . 2008-10-06 21:06 268 --ah----- C:\sqmdata16.sqm
    2008-10-06 21:06 . 2008-10-06 21:06 244 --ah----- C:\sqmnoopt16.sqm
    2008-10-06 21:03 . 2008-10-06 21:03 <KANSIO> d-------- C:\Documents and Settings\Manninen\Application Data\Nokia Multimedia Player
    2008-10-06 20:54 . 2008-10-06 20:54 151 --a------ C:\WINDOWS\PhotoSnapViewer.INI
    2008-10-06 20:48 . 2008-10-06 20:48 <KANSIO> d-------- C:\Documents and Settings\Manninen\Phone Browser
    2008-10-06 20:48 . 2008-10-06 20:48 <KANSIO> d-------- C:\Documents and Settings\Manninen\Application Data\Datalayer
    2008-10-02 18:24 . 2008-10-02 18:24 <KANSIO> d-------- C:\FormOver
    2008-10-02 15:40 . 2008-10-02 15:40 <KANSIO> d-------- C:\WINDOWS\Samsung
    2008-10-02 15:40 . 2008-02-24 05:37 479,232 --a------ C:\WINDOWS\ssndii.exe
    2008-10-02 15:40 . 2008-03-17 04:10 57,344 --a------ C:\WINDOWS\system32\ssdevm.dll
    2008-10-02 15:40 . 2007-08-13 09:26 49,152 --a------ C:\WINDOWS\system32\ssusbpn.dll
    2008-10-02 15:40 . 2007-08-13 09:26 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
    2008-10-02 15:40 . 2007-08-13 09:26 21,776 --a------ C:\WINDOWS\system32\msxml2a.dll
    2008-10-02 15:39 . 2007-10-10 03:57 172,032 --a------ C:\WINDOWS\system32\SecSNMP.dll
    2008-10-02 15:39 . 2007-08-13 12:39 151,552 --a------ C:\WINDOWS\system32\cl31cci.exe
    2008-10-02 15:39 . 2007-08-13 12:39 65,536 --a------ C:\WINDOWS\system32\cl31cci.dll
    2008-10-02 15:39 . 2007-08-13 12:39 22,723 --a------ C:\WINDOWS\system32\cl31cl3.dll
    2008-10-02 15:39 . 2007-08-13 05:47 11,502 --------- C:\WINDOWS\Dr. Printer Icon.ico
    2008-10-02 15:39 . 2007-08-13 12:39 361 --a------ C:\WINDOWS\system32\cl31cl3.smt
    2008-10-02 15:23 . 2008-10-02 15:23 <KANSIO> d-------- C:\WINDOWS\system32\drivers\Samsung
    2008-10-02 15:23 . 2008-10-02 15:23 <KANSIO> d-------- C:\Program Files\Samsung
    2008-10-02 15:23 . 2007-08-13 05:48 41,984 --------- C:\WINDOWS\system32\drivers\DGIVECP.SYS
    2008-10-02 00:55 . 2008-10-02 00:55 <KANSIO> d-------- C:\Program Files\AviSynth 2.5
    2008-09-26 19:28 . 2008-09-26 19:28 268 --ah----- C:\sqmdata15.sqm
    2008-09-26 19:28 . 2008-09-26 19:28 244 --ah----- C:\sqmnoopt15.sqm
    2008-09-26 14:56 . 2008-09-26 14:56 <KANSIO> d-------- C:\Program Files\Pyro Studios
    2008-09-25 15:14 . 2008-09-25 15:14 268 --ah----- C:\sqmdata14.sqm
    2008-09-25 15:14 . 2008-09-25 15:14 244 --ah----- C:\sqmnoopt14.sqm
    2008-09-20 17:54 . 2008-09-20 17:54 1,848 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-10-20 08:57 --------- d-----w C:\Program Files\Lexmark X1100 Series
    2008-10-18 19:28 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Azureus
    2008-10-18 13:11 196,608 ----a-w C:\WINDOWS\system32\drivers\nStandard.bin
    2008-10-18 12:34 --------- d-----w C:\Program Files\MSBuild
    2008-10-14 12:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
    2008-10-14 12:38 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
    2008-10-14 12:36 --------- d-----w C:\Program Files\Autodesk
    2008-10-13 20:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-10-10 19:11 --------- d-----w C:\Program Files\ATI Technologies
    2008-10-08 18:11 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-09-30 16:43 --------- d-----w C:\Program Files\Windows Live Safety Center
    2008-09-26 10:35 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-09-19 19:51 --------- d-----w C:\Program Files\Microsoft Games
    2008-09-19 19:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Applications
    2008-09-19 18:50 --------- d-----w C:\Program Files\MSXML 4.0
    2008-09-17 14:23 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
    2008-09-17 14:23 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
    2008-09-17 14:17 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Logitech
    2008-09-17 14:16 127,034 ------r C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
    2008-09-17 14:16 --------- d-----w C:\Program Files\Logitech
    2008-09-17 14:15 --------- d-----w C:\Program Files\Common Files\Logitech
    2008-09-17 14:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
    2008-09-16 16:24 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\XRay Engine
    2008-09-16 15:31 2,915,944 ----a-w C:\WINDOWS\system32\drivers\appdrv01.sys
    2008-09-13 12:35 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Dev-Cpp
    2008-09-06 17:36 --------- d-----w C:\Documents and Settings\Manninen\Application Data\Winamp
    2008-09-02 21:17 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Bioshock
    2008-09-01 14:35 --------- d-----w C:\Program Files\Winamp
    2008-09-01 14:22 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Winamp
    2008-08-31 13:03 24 ----a-w C:\Documents and Settings\Omistaja\jagex_runescape_preferences.dat
    2008-08-27 05:28 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Apple Computer
    2008-08-27 05:27 --------- d-----w C:\Program Files\iTunes
    2008-08-27 05:27 --------- d-----w C:\Program Files\iPod
    2008-08-27 05:27 --------- d-----w C:\Program Files\Bonjour
    2008-08-27 05:27 --------- d-----w C:\Program Files\Apple Software Update
    2008-08-27 05:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-08-27 05:26 --------- d-----w C:\Program Files\Common Files\Apple
    2008-08-27 05:20 --------- d-----w C:\Program Files\Safari
    2008-08-24 19:37 --------- d-----w C:\Program Files\OpenAL
    2008-08-21 04:52 3,299,840 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
    2008-08-21 01:17 53,248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
    2008-08-20 13:38 --------- d-----w C:\Program Files\Reference Assemblies
    2008-08-09 16:07 22,328 ----a-w C:\Documents and Settings\Omistaja\Application Data\PnkBstrK.sys
    2008-08-08 11:12 319,488 ----a-w C:\WINDOWS\HideWin.exe
    2008-08-08 10:04 274,763 ----a-w C:\WINDOWS\Fast Video to GIF SWF Converter Uninstaller.exe
    2008-07-23 13:51 16,804,864 ----a-w C:\WINDOWS\RTHDCPL.EXE
    2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
    2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
    2008-03-16 12:30 216,064 --sh--r C:\WINDOWS\system32\nbDX.dll
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
    "DAEMON Tools Lite"="F:\Asennetut Ohjelmat\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 69632]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
    "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
    "Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344]
    "PCSuiteTrayApplication"="F:\ASENNE~1\NOKIAP~1\NOKIAP~1\LAUNCH~1.EXE" [2006-06-15 229376]
    "BDMCon"="C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe" [2007-03-22 290816]
    "QuickTime Task"="D:\Tuomas\Ohjelmat\QuickTime\qttask.exe" [2008-05-27 413696]
    "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
    "Samsung PanelMgr"="C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe" [2008-05-07 524288]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
    "RTHDCPL"="RTHDCPL.EXE" [2008-07-23 C:\WINDOWS\RTHDCPL.EXE]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 15360]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Microsoft Mouse.lnk - C:\Program Files\Microsoft IntelliPoint\dplaunch.exe [2005-06-10 106496]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoFavoritesMenu"= 1 (0x1)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "F:\Asennetut Ohjelmat\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
    2008-05-06 21:46 210168 D:\Tuomas\Ohjelmat\WindowBlinds\WbSrv.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=sockspy.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.I420"= i420vfw.dll
    "vidc.asv2"= asusasv2.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS SmartDoctor]
    --a------ 2008-06-18 15:51 1150976 C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUSGamerOSD]
    --a------ 2008-05-28 15:36 380928 C:\Program Files\ASUS\GamerOSD\GamerOSD.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
    --a------ 2007-01-23 15:44 101136 C:\WINDOWS\KHALMNPR.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "D:\\Tuomas\\Ohjelmat\\RevConnect\\DCPlusPlus.exe"=
    "D:\\Tuomas\\Ohjelmat\\Azureus\\Azureus.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\MessengerDiscovery\\MessengerDiscovery Live.exe"=
    "F:\\Asennetut Ohjelmat\\3ds Max 9\\3dsmax.exe"=
    "F:\\Asennetut Ohjelmat\\Backburner\\monitor.exe"=
    "F:\\Asennetut Ohjelmat\\Backburner\\manager.exe"=
    "F:\\Asennetut Ohjelmat\\Backburner\\server.exe"=
    "C:\\Program Files\\U-ABIT\\FlashMenu\\flashmenu.exe"=
    "F:\\Asennetut Pelit\\F.E.A.R. Perseus Mandate\\FEARXP2.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "D:\\Tuomas\\Pelit\\Pikkupelit\\Action Quake 2\\aq2.exe"=
    "D:\\Tuomas\\Pelit\\Medal Of Honor Pacific Assault\\mohpa.exe"=
    "F:\\Asennetut Pelit\\Battlefield 2\\BF2.exe"=
    "F:\\Asennetut Pelit\\Kane and Lynch Dead Men\\kaneandlynch.exe"=
    "F:\\Asennetut Pelit\\BlackSite Area 51\\Binaries\\BlackSite.exe"=
    "F:\\Asennetut Pelit\\Crysis\\Bin32\\Crysis.exe"=
    "F:\\Asennetut Pelit\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "F:\\Asennetut Pelit\\Conflict Denied Ops\\ConflictDeniedOps.exe"=
    "F:\\Asennetut Pelit\\AITD\\Alone.exe"=
    "F:\\Asennetut Pelit\\Call Of Duty 4 Modern Warfare\\iw3mp.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "F:\\Asennetut Pelit\\SWAT 4\\ContentExpansion\\System\\Swat4X.exe"=
    "F:\\Asennetut Pelit\\SWAT 4\\ContentExpansion\\System\\Swat4XDedicatedServer.exe"=
    "F:\\Asennetut Pelit\\FlatOut Ultimate Carnage\\Fouc.exe"=
    "F:\\Asennetut Pelit\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe"=
    "F:\\Asennetut Pelit\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe"=
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "F:\\Asennetut Ohjelmat\\3ds Max Design 2009\\3dsmax.exe"=
    "C:\\WINDOWS\\system32\\LEXPPS.EXE"=

    R0 SSFS0BB8;Spy Sweeper File System Filer Driver: 0BB8;C:\WINDOWS\system32\Drivers\SSFS0BB8.SYS [2007-06-15 20544]
    R1 appdrv01;Application Driver (01);C:\WINDOWS\system32\Drivers\appdrv01.sys [2008-09-16 2915944]
    R1 EIO_XP;EIO_XP;C:\WINDOWS\system32\drivers\EIO_XP.sys [2006-06-14 12288]
    R2 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit;F:\Asennetut Ohjelmat\3ds Max Design 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [2008-03-10 65536]
    R3 AtiHdmiService;ATI Function Driver for HDMI Service;C:\WINDOWS\system32\drivers\AtiHdmi.sys [2008-05-20 93696]
    R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [2008-05-28 10752]
    S2 appdrvrem01;Application Driver Auto Removal Service (01);C:\WINDOWS\System32\appdrvrem01.exe svc [ ]
    S2 SSPORT;SSPORT;C:\WINDOWS\system32\Drivers\SSPORT.sys [ ]
    S3 ABIT-IO;ABIT-IO;C:\Program Files\U-ABIT\abitEQ\ABIT-IO.sys [2005-12-08 4608]
    S3 ALLOW-IO;ALLOW-IO;E:\ALLOW-IO.sys [ ]
    S3 Memctl;Memctl;C:\Program Files\U-ABIT\FlashMenu\Memctl.sys [2006-04-18 4047]
    S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 138112]
    S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 8320]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5ac61375-1b4e-11dd-a7b3-0040f438d11c}]
    \Shell\AutoRun\command - G:\setupSNK.exe
    .
    'Ajoitetut tehtävät'-kansion sisältö

    2008-08-27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
    .
    - - - - POISTETUT JÄMÄRIVIT - - - -

    BHO-{066A7EED-426E-4738-92AF-59E650687697} - C:\WINDOWS\system32\wprjhfwu.dll
    BHO-{1429EC0B-CA39-42BF-86F4-3ECA2A906210} - (no file)
    BHO-{19A9FBB5-426E-4738-92AF-59E650687697} - C:\WINDOWS\system32\wprjhfwu.dll
    BHO-{2ED197C3-1F6F-41D2-A438-E1A615AA8CB9} - (no file)
    BHO-{2FE5FE65-FBCA-493F-B420-866D75789A5F} - (no file)
    BHO-{32827B07-2CF1-4065-A6E0-3A1D7C6860DF} - (no file)
    BHO-{61CA7F0F-BD33-4ADF-A421-3AEF6758E071} - (no file)
    BHO-{7FD78DE6-7D75-4151-8F0B-21A964DFCDBA} - (no file)
    BHO-{83b6b11d-7abd-4256-baaa-cb5294f50466} - C:\WINDOWS\system32\wefayf.dll
    BHO-{86744BC0-1AEF-4AB0-BFD0-1E886FD7D61D} - (no file)
    BHO-{934B3948-B405-4757-A1CC-EE421B856EAF} - (no file)
    BHO-{BC600171-B581-4BAD-8FBB-B158C5726F8B} - (no file)
    Notify-WgaLogon - (no file)
    Notify-xxyyXQGX - xxyyXQGX.dll
    MSConfigStartUp-AdVantage Setup - C:\Program Files\Webteh\BSplayer\AdVantageSetup.exe


    .
    ------- Täydentävä tarkistus -------
    .
    FireFox -: Profile - C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\2aa1jge7.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.fi
    FF -: plugin - C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\2aa1jge7.default\extensions\yyginstantplay@yoyogames.com\plugins\NPYYGInstantPlay.dll
    FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
    FF -: plugin - D:\Tuomas\Ohjelmat\QuickTime\Plugins\npqtplugin.dll
    FF -: plugin - D:\Tuomas\Ohjelmat\QuickTime\Plugins\npqtplugin2.dll
    FF -: plugin - D:\Tuomas\Ohjelmat\QuickTime\Plugins\npqtplugin3.dll
    FF -: plugin - D:\Tuomas\Ohjelmat\QuickTime\Plugins\npqtplugin4.dll
    FF -: plugin - D:\Tuomas\Ohjelmat\QuickTime\Plugins\npqtplugin5.dll
    FF -: plugin - D:\Tuomas\Ohjelmat\QuickTime\Plugins\npqtplugin6.dll
    FF -: plugin - D:\Tuomas\Ohjelmat\QuickTime\Plugins\npqtplugin7.dll
    FF -: plugin - F:\Asennetut Ohjelmat\DivX\DivX Player\npDivxPlayerPlugin.dll
    FF -: plugin - F:\Asennetut Ohjelmat\DivX\DivX Web Player\npdivx32.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Firefox 2.0\plugins\np32dsw.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Firefox 2.0\plugins\npdivx32.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Firefox 2.0\plugins\npDivxPlayerPlugin.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Firefox 2.0\plugins\npnul32.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Firefox 2.0\plugins\NPOFFICE.DLL
    FF -: plugin - F:\Asennetut Ohjelmat\Firefox 2.0\plugins\npqtplugin.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Firefox 2.0\plugins\npqtplugin2.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Firefox 2.0\plugins\npqtplugin3.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Firefox 2.0\plugins\npqtplugin4.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Firefox 2.0\plugins\npqtplugin5.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Firefox 2.0\plugins\npqtplugin6.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Firefox 2.0\plugins\npqtplugin7.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Opera\program\plugins\npdsplay.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Opera\program\plugins\NPOFF12.DLL
    FF -: plugin - F:\Asennetut Ohjelmat\Opera\program\plugins\NPOFFICE.DLL
    FF -: plugin - F:\Asennetut Ohjelmat\Opera\program\plugins\npqtplugin.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Opera\program\plugins\npqtplugin2.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Opera\program\plugins\npqtplugin3.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Opera\program\plugins\npqtplugin4.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Opera\program\plugins\npqtplugin5.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Opera\program\plugins\npqtplugin6.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Opera\program\plugins\npqtplugin7.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Opera\program\plugins\NPSWF32.dll
    FF -: plugin - F:\Asennetut Ohjelmat\Opera\program\plugins\npwmsdrm.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-10-20 12:33:48
    Windows 5.1.2600 Service Pack 2 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    ------------------------ Muut prosessit ------------------------
    .
    C:\WINDOWS\system32\ati2evxx.exe
    C:\WINDOWS\system32\ati2evxx.exe
    F:\Asennetut Ohjelmat\Ad-Aware 2008\aawservice.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\ATKKBService.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    F:\Asennetut Ohjelmat\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PnkBstrB.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    C:\Program Files\Softwin\BitDefender10\vsserv.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    .
    **************************************************************************
    .
    Valmistumisajankohta: 2008-10-20 12:36:52 - kone käynnistettiin uudelleen
    ComboFix-quarantined-files.txt 2008-10-20 09:36:46

    Ennen ajoa: 5 398 487 040 tavua vapaana
    Ajon jälkeen: 5,753,020,416 tavua vapaana

    WindowsXP-KB310994-SP2-Pro-BootDisk-FIN.EXE
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
    [operating systems]
    D:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

    435 --- E O F --- 2008-05-13 11:58:00




    Malwarebytes' Anti-Malware logi:



    Malwarebytes' Anti-Malware 1.29
    Tietokantaversio: 1276
    Windows 5.1.2600 Service Pack 2

    20.10.2008 13:07:37
    mbam-log-2008-10-20 (13-07-37).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|)
    Tarkistetut kohteet: 124423
    Kulunut aika: 20 minute(s), 56 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 71

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    C:\Qoobox\Quarantine\C\WINDOWS\system32\aaseirgs.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\avtgrf.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\bulyimpk.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\byXqQJdb.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\dnugypff.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\eagxtk.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\edtpjlud.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\eglefsgr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\fphstvpr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\gjqnckmr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ibkfmrsv.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\kedatb.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\khfExYqp.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\minohgqk.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\mofaexfq.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\mqeyvqfx.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ozhhqe.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\qwjtbo.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rhkqxska.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\snsfigsu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\tpniulvs.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\tukgcwlb.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\vcpfmalt.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\vjoqiejx.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\vmuyqkht.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wbqiln.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wprjhfwu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\yjddtmah.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP251\A0044937.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP257\A0050440.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP257\A0050446.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP257\A0050450.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP257\A0050453.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP264\A0051751.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP264\A0051752.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP264\A0051753.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP264\A0052761.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP264\A0052762.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP264\A0052763.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP264\A0052764.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP264\A0052765.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP264\A0052766.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP264\A0051761.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056658.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056660.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056662.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056664.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056668.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056672.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056673.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056679.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056682.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056686.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056692.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056694.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056698.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056699.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056700.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056706.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056713.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056715.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056720.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056721.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056722.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056724.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056728.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056729.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056731.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056738.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056671.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{6F69AC5B-23DA-471B-8F51-B061DF969752}\RP277\A0056725.dll (Trojan.Vundo) -> Quarantined and deleted successfully.


    Viimeiseksi otettu HijackThis logi:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:10:41, on 20.10.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    F:\Asennetut Ohjelmat\Ad-Aware 2008\aawservice.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\ATKKBService.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    F:\Asennetut Ohjelmat\3ds Max Design 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
    F:\Asennetut Ohjelmat\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PnkBstrB.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    C:\Program Files\Softwin\BitDefender10\vsserv.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Softwin\BitDefender10\bdmcon.exe
    F:\Asennetut Ohjelmat\Firefox 2.0\firefox.exe
    D:\Tuomas\Ohjelmat\Azureus\Azureus.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    F:\Asennetut Ohjelmat\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [BDAgent] C:\Program Files\Softwin\BitDefender10\bdagent.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    O4 - HKLM\..\Run: [Lexmark X1100 Series] C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] "F:\ASENNE~1\NOKIAP~1\NOKIAP~1\LAUNCH~1.EXE" -startup
    O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "D:\Tuomas\Ohjelmat\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] F:\Asennetut Ohjelmat\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "F:\Asennetut Ohjelmat\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Mouse.lnk = C:\Program Files\Microsoft IntelliPoint\dplaunch.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\ASENNE~1\MICROS~1\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://F:\ASENNE~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\ASENNE~1\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - F:\Asennetut Ohjelmat\Ad-Aware 2008\aawservice.exe
    O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit (mi-raysat_3dsMax2009_32) - Unknown owner - F:\Asennetut Ohjelmat\3ds Max Design 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
    O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - F:\Asennetut Ohjelmat\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
    O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

    --
    End of file - 8969 bytes

    En löytänyt logista mainistsemiasi tiedostoja joita poista.
     
  7. yaht

    yaht Regular member

    Liittynyt:
    07.12.2005
    Viestejä:
    2,261
    Kiitokset:
    0
    Pisteet:
    46
    Lataa CCleaner tästä

    - Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
    - Asennuksen jälkeen aukaise CCleaner.
    - Valitse vasemmalta pystyrivistä Options.
    - Valitse viereisestä pystyrivistä Settings.
    - Language kohtaan valitse Suomi.

    - Käynnistä CCleaner.
    - Valitse Valinnat.
    - Paina Lisäasetukset.
    - Ota ruksi pois kohdasta "Poista vain yli 48 tuntia vanhat tiedostot Windowsin tilapäiskansioista".

    Puhdistaja

    - Valitse vasemmalta pystyrivistä Puhdistaja.
    - Paina alhaalta Tutki.
    Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
    - Kun tutkiminen on valmis, paina Aja CCleaner.
    Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.

    Rekisterin virheiden korjaus

    - Valitse vasemmalta pystyrivistä Rekisteri.
    - Paina alhaalta Etsi rekisterin virheitä.
    - Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
    - Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
    - Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
    - Saat vielä varmistus kysymyksen, paina Ok.
    - Kun virheet on korjattu, paina Sulje.

    Nyt voit suljea CCleanerin painamalla oikealta ylhäältä punaista rastia.

    Järjestelmän palauttamisen poistaminen käytöstä
    Voit poistaa järjestelmän palauttamisen käytöstä seuraavasti:

    1.Napsauta Käynnistä-painiketta, napsauta Oma tietokone -kuvaketta hiiren kakkospainikkeella ja valitse sitten Ominaisuudet.

    2.Valitse Järjestelmän palauttaminen -välilehti.

    3.Valitse Poista järjestelmän palauttaminen käytöstä -valintaruutu (tai Poista järjestelmän palauttaminen käytöstä kaikissa asemissa -valintaruutu) ja valitse sitten OK.

    4.Valitse Kyllä, kun näyttöön tulee kehote järjestelmän palauttamisen poistamisesta käytöstä.

    Skannaa koneesi Kaspersky Online Skannerilla

    * Lue läpi vaatimukset ja yksityisyyssäännökset ja klikkaa Accept.
    * Skannerin ja virustietokannan lataus alkaa. Sinulta kysytään sallitko Kasperskyltä tulevan ohjelman asentamisen. Klikkaa Aja/Run.
    * Kun lataus on valmis, klikkaa Settings.
    * Varmistu, että seuraavat kohdat on valittu. Jos ne eivät ole, valitse ne ja klikkaa Save:
    Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases

    * Klikkaa Oma Tietokone, My Computer Scan-kohdan alapuolelta.
    * Kun tarkistus on valmis, tulokset näytetään. Klikkaa View Scan Report.
    * Näet listan saastuneista kohteista. Klikkaa Save Report As....
    * Tallenna tiedosto työpöydällesi. Muuta Tiedostotyyppi/Files of type muotoon Tekstitiedosto/Text file(.txt) ennen kuin klikkaat Save.
    * Kopioi ja liitä tiedoston sisältö seuraavaan vastaukseesi uuden HijackThis-lokin kera
     
  8. TuPP3

    TuPP3 Member

    Liittynyt:
    08.06.2007
    Viestejä:
    66
    Kiitokset:
    0
    Pisteet:
    16
    Meni varsin pitkään scannata 800gigan verran tiedostoja :/
    --------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER 7 REPORT
    Tuesday, October 21, 2008
    Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Monday, October 20, 2008 22:06:26
    Records in database: 1328736
    --------------------------------------------------------------------------------

    Scan settings:
    Scan using the following database: extended
    Scan archives: yes
    Scan mail databases: yes

    Scan area - My Computer:
    A:\
    C:\
    D:\
    E:\
    F:\
    G:\
    H:\
    I:\

    Scan statistics:
    Files scanned: 571103
    Threat name: 10
    Infected objects: 30
    Suspicious objects: 0
    Duration of the scan: 05:16:00


    File name / Threat name / Threats count
    C:\Program Files\Webteh\BSplayer\URL2\MEADInst.exe Infected: not-a-virus:WebToolbar.Win32.WhenU.t 1
    C:\Program Files\Webteh\BSplayer\URL2\MEADInst.exe Infected: not-a-virus:AdTool.Win32.WhenU.r 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\amilsmrh.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.elt 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ckvrnh.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.eli 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\dpjducji.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.eli 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\favnyg.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.eli 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ghsgwolh.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.eli 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\gidoasbp.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.elt 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\hjtyhlvv.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.eli 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ixdvndyw.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.elt 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ixvutods.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.elt 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\nywdfs.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.elt 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ocgvoy.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.eli 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\pmibohhu.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.eli 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\pxaipm.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.elt 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rlntgdug.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.elt 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rsqbsf.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.elt 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\sclkel.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.eli 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\skhfzu.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.elt 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\uqiiiptr.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.elt 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\veilkd.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.elt 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wefayf.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.elt 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ynglwqxh.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.elt 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\zcqlan.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.elt 1
    D:\Tuomas\Ohjelmat\mIRC\backup\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1
    D:\Tuomas\Ohjelmat\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 1
    F:\Asennetut Ohjelmat\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.632 1
    F:\Asennetut Ohjelmat\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
    F:\Setupit\Computer Protection\SmitfraudFix\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
    F:\Setupit\mirc632.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.632 1

    The selected area was scanned.


    HijackThis logi:


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:56:02, on 21.10.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    F:\Asennetut Ohjelmat\Ad-Aware 2008\aawservice.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\ATKKBService.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    F:\Asennetut Ohjelmat\3ds Max Design 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
    F:\Asennetut Ohjelmat\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    C:\Program Files\Softwin\BitDefender10\vsserv.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    F:\Asennetut Ohjelmat\Firefox 2.0\firefox.exe
    C:\WINDOWS\Explorer.EXE
    F:\Asennetut Ohjelmat\DAEMON Tools Lite\daemon.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Softwin\BitDefender10\bdmcon.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    F:\Asennetut Ohjelmat\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [BDAgent] C:\Program Files\Softwin\BitDefender10\bdagent.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    O4 - HKLM\..\Run: [Lexmark X1100 Series] C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] "F:\ASENNE~1\NOKIAP~1\NOKIAP~1\LAUNCH~1.EXE" -startup
    O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "D:\Tuomas\Ohjelmat\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "F:\Asennetut Ohjelmat\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Mouse.lnk = C:\Program Files\Microsoft IntelliPoint\dplaunch.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\ASENNE~1\MICROS~1\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://F:\ASENNE~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\ASENNE~1\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - F:\Asennetut Ohjelmat\Ad-Aware 2008\aawservice.exe
    O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit (mi-raysat_3dsMax2009_32) - Unknown owner - F:\Asennetut Ohjelmat\3ds Max Design 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
    O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - F:\Asennetut Ohjelmat\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
    O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

    --
    End of file - 8374 bytes
     
  9. yaht

    yaht Regular member

    Liittynyt:
    07.12.2005
    Viestejä:
    2,261
    Kiitokset:
    0
    Pisteet:
    46
    Heheh kyllähän siinä vähän aikaa kestää skannailla :D

    Poista seuraava tiedosto.

    C:\Program Files\Webteh\BSplayer\URL2\MEADInst.exe

    Tyhjennä roskakori.

    Kirjoita windowsin käynnistävalikon suorita-kenttään ComboFix.exe /u paina OK

    Mites kone nytten toimii?
     
  10. TuPP3

    TuPP3 Member

    Liittynyt:
    08.06.2007
    Viestejä:
    66
    Kiitokset:
    0
    Pisteet:
    16
    Poistin. BSPlayerillä on siis näemmä lisääkin haittaohjelmaa, AdVantagen lisäksi jonka poistin heti asennuksen jälkeen...
    Kone on toiminut hyvin jo ensimmäisen tarkastuksen jälkeen, ei mainoksia eikä mitään :) Kiitoksia avusta. Laitan tuon järjestelmän palautuksen takaisin päälle?
     
  11. yaht

    yaht Regular member

    Liittynyt:
    07.12.2005
    Viestejä:
    2,261
    Kiitokset:
    0
    Pisteet:
    46
    Laita päälle vaan :D
     

Jaa tämä sivu