Kone sekasin viruksesta...HJT ja smitfraud logit

Elikkäs tämmönen tuli eilen enkä ole päässyt kuin vikasieto tilaan jossa palautin järjsetelmän joka ei auttanut....ainoa joka auttoi (normaaliin winukkaan) oli että valitsin sen "viimeisin kokoonpano jolla tietokone toimi" Eikä vielä toimi kuitenkaan täydellisesti...

Jooh Avastin viruskaranteenissa infektoituneina on

0.exe kansiosta: C:\Program Files\PCHealthCenter Virus:Win32:Trojan-gen {Other}

1.exe samasta kansiosta Virus:Sama kuin edellisessä

3.exe sama kansio Virus: Win32:Spyware-gen [Trj]

7.exe sama kansio Virus:Sama kuin 0 ja 1

dtseqrxk.dll kansiosta C:\DOCUME~1\Omistaja\LOCALS~1\Temp\ac8zt2 Virus:Win32:Agent-LTS [Trj]

install-privacy-danger.bat kansiosta C:\Docume~1\Omistaja\LOCALS~1\Temp Virus:BV:Malware-gen

tdssserv.sys kansiosta C:WINDOWS\system32\drivers Virus:Win32:Rootkit-gen [Rtk]


Tollasta Sitten vielä mitäs tässä kirjottelun aikana tapahtui...Kone availee(windows?)ittekseen Firefoxin sivua joka on tyhjä.

Ja sitten vielä.. Taustakuva on vaihtunut pelkäksi valkoiseksi...

Tämmonen tulee ku koitan laittaa uudelleen (koneen käynnistyessäkin tuli) http://img393.imageshack.us/img393/4530/perhanaix0.jpg

HTJ Logi

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:07:22, on 13.9.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\sm56hlpr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashChest.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O3 - Toolbar: fqbewlna - {1168DA87-BCFC-45D2-B251-94013EAD38FF} - C:\WINDOWS\fqbewlna.dll (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [144d1d63] rundll32.exe "C:\WINDOWS\system32\vmspxfiq.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [msoffice] C:\DOCUME~1\Omistaja\LOCALS~1\Temp\scvhost.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1214576998694
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1216128469000
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O20 - AppInit_DLLs: zgihlu.dll
O21 - SSODL: dtseqrxk - {731AF885-E395-487D-8F4C-1CCDC5C267FA} - C:\WINDOWS\dtseqrxk.dll (file missing)
O21 - SSODL: mgxfebsq - {9983B277-7483-4F5B-85FD-CAA56744AA5D} - C:\WINDOWS\mgxfebsq.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 6260 bytes


Smitfraud Logi

SmitFraudFix v2.349

Scan done at 12:10:09,62, la 13.09.2008
Run from C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\sm56hlpr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashChest.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\tdssservers.dat detected, use a Rootkit scanner
C:\WINDOWS\system32\tdssadw.dll detected, use a Rootkit scanner
C:\WINDOWS\system32\tdssinit.dll detected, use a Rootkit scanner
C:\WINDOWS\system32\tdssl.dll detected, use a Rootkit scanner
C:\WINDOWS\system32\tdsslog.dll detected, use a Rootkit scanner
C:\WINDOWS\system32\tdssmain.dll detected, use a Rootkit scanner

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Omistaja


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Omistaja\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Omistaja\Suosikit


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\PCHealthCenter\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="file:///C:\\WINDOWS\\privacy_danger\\index.htm"
"SubscribedURL"=""
"FriendlyName"="Privacy Protection"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="zgihlu.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Atheros AR5005G Wireless Network Adapter - Paketinajoituksen miniportti
DNS Server Search Order: 192.168.0.254

HKLM\SYSTEM\CCS\Services\Tcpip\..\{82D7569F-04F8-4BEF-A6E8-EC1DE6D68C0C}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{82D7569F-04F8-4BEF-A6E8-EC1DE6D68C0C}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS2\Services\Tcpip\..\{82D7569F-04F8-4BEF-A6E8-EC1DE6D68C0C}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS3\Services\Tcpip\..\{82D7569F-04F8-4BEF-A6E8-EC1DE6D68C0C}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

 

1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

==============

Printtaa ohjeet ulos

Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.

Vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.

Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.

Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".

Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.

Varoitus : Ajamalla optio 2:n EI-tarttuneessa tietokoneessa, poistaa sinun työpöytäsi taustakuvan.

==============

Lataa Malwarebytes' Anti-Malware työpöydällesi.

1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.

======================

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

==================

Lataa Tästä Ccleaner
CCleaner v2.05.555- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
Asennuksen jälkeen aukaise CCleaner.
Valitse vasemmalta pystyrivistä Options.
Valitse viereisestä pystyrivistä Settings.
Language kohtaan valitse Suomi.

Puhdistaja
Valitse vasemmalta pystyrivistä Puhdistaja.
Paina alhaalta Tutki.
Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
Kun tutkiminen on valmis, paina Aja CCleaner.
Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.

Rekisterin virheiden korjaus
Valitse vasemmalta pystyrivistä Rekisteri.
Paina alhaalta Etsi rekisterin virheitä.
Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
Saat vielä varmistus kysymyksen, paina Ok.
Kun virheet on korjattu, paina Sulje.
Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.

 

ComboFix Log

ComboFix 08-09-12.06 - Omistaja 2008-09-13 12:51:03.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.480 [GMT 3:00]
Sijainti: C:\Documents and Settings\Omistaja\Työpöytä\ComboFix.exe
* Uusi palautuspiste luotu

VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !!
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\ki20twsq.mlr
C:\Program Files\PCHealthCenter\0.gif
C:\Program Files\PCHealthCenter\1.gif
C:\Program Files\PCHealthCenter\2.gif
C:\Program Files\PCHealthCenter\3.gif
C:\Program Files\PCHealthCenter\5.exe
C:\Program Files\PCHealthCenter\sc.html
C:\WINDOWS\system32\ddcBSJdE.dll
C:\WINDOWS\system32\diuyjoth.dll
C:\WINDOWS\system32\fcccdeFx.dll
C:\WINDOWS\system32\kcggjyxn.dll
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\nibizi.dll
C:\WINDOWS\system32\qifxpsmv.ini
C:\WINDOWS\system32\qwnesfdt.ini
C:\WINDOWS\system32\tdfsenwq.dll
C:\WINDOWS\system32\tdssadw.dll
C:\WINDOWS\system32\tdssinit.dll
C:\WINDOWS\system32\tdssl.dll
C:\WINDOWS\system32\tdsslog.dll
C:\WINDOWS\system32\tdssmain.dll
C:\WINDOWS\system32\tdsspopup.dll
C:\WINDOWS\system32\tdsspopup1.url
C:\WINDOWS\system32\tdsspopup2.url
C:\WINDOWS\system32\tdsspopup3.url
C:\WINDOWS\system32\tdssservers.dat
C:\WINDOWS\system32\vmspxfiq.dll
C:\WINDOWS\system32\xFedcccf.ini
C:\WINDOWS\system32\xFedcccf.ini2
C:\WINDOWS\system32\zgihlu.dll

.
((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-08-13 to 2008-09-13 )))))))))))))))))
.

2008-09-13 12:57 . 2006-08-29 19:43 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2008-09-13 12:57 . 2006-12-01 06:20 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe
2008-09-13 12:57 . 2006-01-09 10:36 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2008-09-13 12:41 . 2008-09-12 02:36 <KANSIO> d-------- C:\SDFix
2008-09-13 12:41 . 2008-09-13 12:41 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-13 12:41 . 2008-09-13 12:41 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Malwarebytes
2008-09-13 12:41 . 2008-09-13 12:41 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-13 12:41 . 2008-09-08 00:11 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-13 12:41 . 2008-09-08 00:11 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-13 12:10 . 2008-09-13 12:10 1,788 --a------ C:\WINDOWS\system32\tmp.reg
2008-09-13 12:09 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-09-13 12:09 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-09-13 12:09 . 2008-09-08 23:38 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-09-13 12:09 . 2008-09-02 16:51 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-09-13 12:09 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-09-13 12:09 . 2008-09-12 12:53 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-09-13 12:09 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
2008-09-13 12:09 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-09-13 12:09 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-09-13 12:09 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-09-13 12:07 . 2008-09-13 12:07 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-09-13 11:57 . 2008-09-13 11:57 (2) -rahs-ot- C:\WINDOWS\winstart.bat
2008-09-13 11:56 . 2008-09-13 11:56 <KANSIO> d-------- C:\Program Files\Greatis
2008-09-13 11:56 . 2008-09-13 11:56 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Regrun
2008-09-13 11:56 . 2008-09-13 11:56 <KANSIO> d-------- C:\backreg
2008-09-13 11:56 . 2003-09-06 16:55 57,556 --a------ C:\WINDOWS\guard.bmp
2008-09-13 10:37 . 2008-09-13 10:37 <KANSIO> d-------- C:\Program Files\TrackMania Original
2008-09-13 10:36 . 2008-09-13 10:36 88,878 --a------ C:\WINDOWS\system32\casino3.ico
2008-09-13 10:36 . 2008-09-13 10:36 88,878 --a------ C:\WINDOWS\system32\casino2.ico
2008-09-13 10:36 . 2008-09-13 10:36 88,878 --a------ C:\WINDOWS\system32\casino1.ico
2008-09-12 20:40 . 2008-09-12 20:40 <KANSIO> d-------- C:\Documents and Settings\J„rjestelm„nvalvoja
2008-09-12 20:24 . 2008-09-13 13:00 <KANSIO> d-------- C:\Program Files\PCHealthCenter
2008-09-12 18:52 . 2008-09-12 18:52 <KANSIO> d-------- C:\WINDOWS\CtDrvInstall
2008-09-12 18:52 . 2008-09-12 18:52 <KANSIO> d-------- C:\WebCam
2008-09-12 18:52 . 2004-10-19 01:00 5,140 --a------ C:\WINDOWS\VF0090.uns
2008-09-12 14:31 . 2008-09-12 14:31 <KANSIO> d-------- C:\Program Files\EA GAMES
2008-09-12 14:10 . 2008-09-12 14:10 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll
2008-09-12 14:10 . 2008-09-12 14:10 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll
2008-09-12 14:10 . 2008-09-12 14:10 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll
2008-09-12 14:05 . 2008-09-13 10:37 <KANSIO> d-------- C:\Program Files\Diablo II
2008-09-10 14:35 . 2008-09-10 14:35 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-09-04 17:28 . 2008-09-04 17:28 <KANSIO> d-------- C:\Program Files\Codemasters
2008-09-04 14:08 . 2008-09-04 14:08 27 --a------ C:\WINDOWS\ic.ini
2008-09-04 14:00 . 2008-09-04 14:00 <KANSIO> d-------- C:\Program Files\Microsoft Games
2008-09-03 18:21 . 2008-09-03 18:21 <KANSIO> d-------- C:\Logs
2008-09-03 14:51 . 2008-09-03 15:47 137 --a------ C:\WINDOWS\wowCP.ini
2008-09-03 14:39 . 2008-09-03 14:39 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
2008-09-01 21:01 . 2008-09-01 21:01 <KANSIO> d-------- C:\Program Files\FDRLab
2008-08-30 18:18 . 2003-11-17 11:49 154,624 --a------ C:\WINDOWS\system32\fmod.dll
2008-08-30 18:18 . 1998-08-09 12:07 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2008-08-29 20:05 . 2008-08-29 20:05 0 -ra------ C:\logwmemory.bin
2008-08-29 20:04 . 2008-08-29 20:04 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Soldat
2008-08-29 14:04 . 2008-09-01 16:53 <KANSIO> d-------- C:\Program Files\Age of Empires II
2008-08-28 22:00 . 2008-08-28 22:00 23 --a------ C:\Documents and Settings\Omistaja\Duck Doom Deluxe.dat
2008-08-27 21:43 . 2008-08-27 21:43 <KANSIO> d-------- C:\Program Files\metal oxide software
2008-08-27 21:43 . 2008-08-27 21:43 <KANSIO> d-------- C:\Documents and Settings\Omistaja\WINDOWS
2008-08-27 20:57 . 2008-09-09 16:32 270,336 --------- C:\WINDOWS\Setup1.exe
2008-08-27 20:57 . 2008-09-09 16:32 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2008-08-27 18:19 . 1998-06-24 01:00 115,016 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-08-27 18:19 . 1998-06-18 01:00 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL
2008-08-27 18:19 . 2000-03-17 09:21 69,632 --a------ C:\WINDOWS\system32\xmltok.dll
2008-08-27 18:19 . 2000-03-17 09:21 36,864 --a------ C:\WINDOWS\system32\xmlparse.dll
2008-08-27 18:19 . 2002-04-24 13:43 35,840 --a------ C:\WINDOWS\system32\comdlg32.oca
2008-08-27 18:19 . 2002-06-17 08:25 26,088 --a------ C:\WINDOWS\system32\xmlinst.exe
2008-08-27 18:16 . 2008-08-28 08:17 <KANSIO> d-------- C:\Program Files\Ubi Soft
2008-08-27 17:43 . 2008-08-27 17:43 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Souptoys
2008-08-27 17:39 . 2008-08-27 17:39 <KANSIO> d-------- C:\Program Files\Oberon Media
2008-08-27 17:39 . 2008-08-27 17:39 <KANSIO> d-------- C:\Program Files\Common Files\Oberon Media
2008-08-27 17:23 . 2008-08-27 17:24 <KANSIO> d-------- C:\WINDOWS\.mpr_file_store_32
2008-08-27 15:44 . 1997-01-16 00:00 71,680 --a------ C:\WINDOWS\ST5UNST.EXE
2008-08-27 15:44 . 1997-01-16 00:00 29,696 --a------ C:\WINDOWS\system32\VB5StKit.dll
2008-08-26 21:36 . 2008-08-26 21:36 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
2008-08-26 21:35 . 2008-08-26 21:35 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\NCH Swift Sound
2008-08-26 07:44 . 2008-08-27 19:11 <KANSIO> d-------- C:\Program Files\Postal2STP
2008-08-22 17:52 . 2008-08-25 21:14 <KANSIO> d-------- C:\Tekstipeli MAKER
2008-08-22 15:28 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-08-22 15:27 . 2008-08-22 15:27 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
2008-08-22 15:19 . 2008-09-01 21:18 <KANSIO> d-------- C:\Program Files\Nokia
2008-08-22 15:19 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-08-22 15:19 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-08-22 15:19 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-08-22 15:19 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-08-22 15:19 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-08-22 14:45 . 2008-09-01 21:18 <KANSIO> d-------- C:\Program Files\Common Files\Nokia
2008-08-22 14:45 . 2008-08-22 14:45 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Phone Browser
2008-08-22 08:15 . 2008-04-13 21:45 26,112 --a------ C:\WINDOWS\system32\drivers\usbser.sys
2008-08-22 08:15 . 2008-04-13 21:45 26,112 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys
2008-08-22 08:14 . 2008-08-22 08:14 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-08-22 08:14 . 2008-08-22 08:14 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-08-21 22:31 . 2008-08-22 08:15 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\PC Suite
2008-08-21 22:31 . 2008-08-22 13:07 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Nokia
2008-08-21 22:31 . 2008-08-22 08:15 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2008-08-21 22:30 . 2008-08-21 22:30 <KANSIO> d-------- C:\Program Files\DIFX
2008-08-21 22:30 . 2008-05-07 07:38 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-08-21 22:29 . 2008-09-01 21:06 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Installations
2008-08-21 17:37 . 2008-08-21 17:37 <KANSIO> d-------- C:\Program Files\Common Files\Thraex Software
2008-08-21 16:52 . 2008-08-21 19:36 <KANSIO> d-------- C:\Program Files\Counter-Strike Source
2008-08-20 14:35 . 2008-08-20 14:35 <KANSIO> d-------- C:\Program Files\aMSN
2008-08-18 18:49 . 2008-08-18 19:16 <KANSIO> d-------- C:\Program Files\Magic Video Converter
2008-08-16 17:37 . 2008-08-16 17:37 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-08-16 15:35 . 2008-08-16 15:35 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Trymedia
2008-08-15 23:47 . 2008-08-15 23:47 <KANSIO> d-------- C:\Documents and Settings\Esa\Application Data\X-Chat 2
2008-08-15 23:46 . 2008-08-15 23:46 <KANSIO> d-------- C:\Documents and Settings\Esa\Application Data\ATI
2008-08-15 20:06 . 2008-08-21 18:31 <KANSIO> d-------- C:\Program Files\VS Revo Group
2008-08-15 14:57 . 2008-08-15 14:58 <KANSIO> d-------- C:\Program Files\Masker
2008-08-14 13:44 . 2008-08-14 13:44 <KANSIO> d-------- C:\Documents and Settings\Jani\Application Data\Winamp
2008-08-14 08:42 . 2008-04-11 22:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-08-14 08:42 . 2008-05-01 17:35 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-12 17:25 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\uTorrent
2008-09-12 11:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-11 14:05 --------- d-----w C:\Program Files\Warcraft III
2008-09-11 13:04 4,224 ----a-w C:\WINDOWS\system32\drivers\beep.sys
2008-09-11 05:46 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\X-Chat 2
2008-09-10 12:41 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Hamachi
2008-09-08 15:16 --------- d-----w C:\Program Files\Cheat Engine
2008-09-03 11:48 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Audacity
2008-09-02 18:51 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\gtk-2.0
2008-09-02 13:16 --------- d-----w C:\Program Files\Steam
2008-09-01 18:07 --------- d-----w C:\Program Files\vixy.net
2008-09-01 16:22 --------- d-----w C:\Program Files\Google
2008-08-31 16:54 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-30 15:24 --------- d-----w C:\Program Files\Counter-Strike 1.6 V35
2008-08-30 10:45 24 ----a-w C:\Documents and Settings\Omistaja\jagex_runescape_preferences.dat
2008-08-21 15:31 --------- d-----w C:\Program Files\VS Revo Group
2008-08-15 18:28 --------- d-----w C:\Program Files\Half Life Player
2008-08-12 18:24 --------- d-----w C:\Program Files\Yahoo!
2008-08-12 18:24 --------- d-----w C:\Program Files\Electronic Arts
2008-08-08 07:48 --------- d-----w C:\Documents and Settings\Jani\Application Data\ATI
2008-08-07 10:44 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\ATI
2008-08-07 10:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\ATI
2008-08-07 10:39 --------- d-----w C:\Program Files\ATI Technologies
2008-08-05 16:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-08-05 16:01 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\skypePM
2008-08-05 15:07 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\AdobeUM
2008-08-04 01:02 --------- d-----w C:\Program Files\HyCam2
2008-08-03 21:59 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Winamp
2008-08-03 21:35 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-08-03 21:34 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\DAEMON Tools
2008-08-03 18:29 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Xfire
2008-08-02 12:42 --------- d-----w C:\Program Files\xchat
2008-08-02 12:35 --------- d-----w C:\Program Files\X-Chat 2
2008-08-01 21:09 --------- d--h--w C:\Documents and Settings\Omistaja\Application Data\ijjigame
2008-08-01 20:43 --------- d-----w C:\Program Files\Hamachi
2008-08-01 20:40 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-08-01 17:32 --------- d-----w C:\Program Files\Common Files\Futuremark Shared
2008-08-01 16:39 --------- d-----w C:\Program Files\Xfire
2008-08-01 11:53 --------- d-----w C:\Documents and Settings\Jani\Application Data\Yahoo!
2008-07-31 13:41 --------- d-----w C:\Program Files\Ahead
2008-07-31 13:40 --------- d-----w C:\Program Files\Common Files\Nero
2008-07-31 13:39 --------- d-----w C:\Program Files\Common Files\Ahead
2008-07-31 13:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
2008-07-30 20:16 --------- d-----w C:\Program Files\Common Files\Adobe
2008-07-30 14:49 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-07-30 14:49 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\SystemRequirementsLab
2008-07-30 11:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pinnacle
2008-07-30 11:12 --------- d-----w C:\Program Files\GVC
2008-07-29 20:39 --------- d-----w C:\Program Files\HooTech
2008-07-29 19:29 --------- d-----w C:\Program Files\IVCsoft
2008-07-29 19:21 --------- d-----w C:\Program Files\AviSynth 2.5
2008-07-29 10:05 --------- d-----w C:\Program Files\Ubisoft
2008-07-28 21:05 --------- d-----w C:\Program Files\Audacity 1.3 Beta (Unicode)
2008-07-28 03:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-07-27 22:04 --------- d-----w C:\Program Files\Any Video Converter
2008-07-27 22:04 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Any Video Converter
2008-07-22 14:09 --------- d-----w C:\Program Files\Pivot Stickfigure Animator
2008-07-22 13:01 --------- d-----w C:\Program Files\WikiGame
2008-07-22 12:10 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\STOIK
2008-07-22 11:55 --------- d-----w C:\Program Files\DebugMode
2008-07-22 11:54 --------- d-----w C:\Program Files\Sonic Foundry
2008-07-22 11:54 --------- d-----w C:\Program Files\Pure Motion
2008-07-22 11:54 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\GetRightToGo
2008-07-22 11:35 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-07-22 11:35 --------- d-----w C:\Program Files\AVS4YOU
2008-07-22 10:58 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\AVS4YOU
2008-07-22 10:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-07-22 00:42 42,320 ----a-w C:\WINDOWS\system32\xfcodec.dll
2008-07-21 13:34 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\Canon
2008-07-20 22:07 --------- d-----w C:\Program Files\Java
2008-07-20 21:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-07-20 21:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-20 21:50 --------- d-----w C:\Program Files\Lavasoft
2008-07-20 19:40 --------- d-----w C:\Program Files\Flash Movie Player
2008-07-20 16:06 --------- d-----w C:\Program Files\MSXML 4.0
2008-07-20 16:06 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-07-20 14:04 --------- d-----w C:\Program Files\Canon
2008-07-20 14:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM
2008-07-20 14:00 --------- d-----w C:\Program Files\Common Files\ScanSoft Shared
2008-07-20 14:00 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-20 14:00 --------- d-----w C:\Documents and Settings\Omistaja\Application Data\ScanSoft
2008-07-20 14:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\ScanSoft
2008-07-20 14:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\InstallShield
2008-07-20 13:59 --------- d-----w C:\Program Files\ScanSoft
2008-07-20 13:58 --------- d-----w C:\Program Files\Common Files\CANON
2008-07-20 13:55 --------- d--h--w C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-07-20 13:54 --------- d--h--w C:\Program Files\CanonBJ
2008-07-18 22:42 --------- d-----w C:\Program Files\Red Kawa
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 19:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-18 16:51 --------- d-----w C:\Program Files\GIMP-2.0
2008-07-17 23:36 --------- d-----w C:\Program Files\Common Files\INCA Shared
.

(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=zgihlu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"vidc.yv12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Steam\\SteamApps\\sakado95\\source sdk base\\hl2.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\X-Chat 2\\xchat.exe"=
"C:\\ijji\\ENGLISH\\u_gunz.exe"=
"C:\\ijji\\ENGLISH\\Gunz\\Gunz.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Counter-Strike 1.6 V35\\hl.exe"=
"C:\\ijji\\ENGLISH\\u_sf.exe"=
"C:\\ijji\\ENGLISH\\u_sf\\soldierfront.exe"=
"C:\\Program Files\\xchat\\xchat.exe"=
"C:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"C:\\Program Files\\Age of Empires II\\age2_x1\\age2_x1.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Steam\\SteamApps\\sakado95\\half-life 2 deathmatch\\hl2.exe"=
"C:\\Program Files\\Microsoft Games\\Impossible Creatures\\IC.exe"=
"C:\\Program Files\\TrackMania Original\\TmOriginal.exe"=

R0 O2MDRDR;O2MDRDR;C:\WINDOWS\system32\DRIVERS\o2media.sys [2008-07-08 34880]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 63352]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 101528]
S0 Partizan;Partizan;C:\WINDOWS\system32\drivers\Partizan.sys [ ]
S2 RPCH;Remote Procedure Call (HPM);C:\Program Files\NetMeeting\nmwb.exe [2007-08-25 454656]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);C:\WINDOWS\system32\DRIVERS\vrtaucbl.sys [ ]
S3 XDva120;XDva120;C:\WINDOWS\system32\XDva120.sys [ ]
.
'Ajoitetut teht„v„t'-kansion sis„lt”
.
- - - - POISTETUT JŽMŽRIVIT - - - -

BHO-{1755AAE6-24A3-4E1D-B899-5AB088B2695C} - (no file)
BHO-{74633F37-CF9D-4EFD-B548-D847566866FC} - C:\WINDOWS\system32\ddcBSJdE.dll
BHO-{eef59054-e034-4fcc-8c4f-c746718592a4} - C:\WINDOWS\system32\zgihlu.dll
BHO-{FBF6DC13-CB48-4FEF-8D9D-50C8BFACDB3C} - C:\WINDOWS\vmgspntbsak.dll
Toolbar-{1168DA87-BCFC-45D2-B251-94013EAD38FF} - C:\WINDOWS\fqbewlna.dll
HKLM-Explorer_Run-msoffice - C:\DOCUME~1\Omistaja\LOCALS~1\Temp\scvhost.exe
ShellExecuteHooks-{74633F37-CF9D-4EFD-B548-D847566866FC} - C:\WINDOWS\system32\ddcBSJdE.dll
SSODL-dtseqrxk-{731AF885-E395-487D-8F4C-1CCDC5C267FA} - C:\WINDOWS\dtseqrxk.dll
SSODL-mgxfebsq-{9983B277-7483-4F5B-85FD-CAA56744AA5D} - C:\WINDOWS\mgxfebsq.dll


.
------- T„ydent„v„ tarkistus -------
.
FireFox -: Profile - C:\Documents and Settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\cjp35e2o.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.youtube.com
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-13 13:01:17
Windows 5.1.2600 Service Pack 3 NTFS

tarkistaa piilotettuja prosesseja ...

tarkistaa piilotettuja k„ynnistysarvoja ...

tarkistaa piilotettuja tiedostoja ...

tarkistus on valmis
piilotetut tiedostot: 0

**************************************************************************
.
------------------------ Muut prosessit ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Valmistumisajankohta: 2008-09-13 13:06:45 - kone k„ynnistettiin uudelleen [Omistaja]
ComboFix-quarantined-files.txt 2008-09-13 10:06:41

Pre-Run: 64,189,816,832 tavua vapaana
Post-Run: 64,171,720,704 tavua vapaana

344 --- E O F --- 2008-09-10 11:37:01

 

jatka vain listaa alas päin

 

SmitFraudFix v2.349

Scan done at 13:34:28,21, la 13.09.2008
Run from C:\Documents and Settings\Omistaja\Ty”p”yt„\Stuff\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\Program Files\PCHealthCenter\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{82D7569F-04F8-4BEF-A6E8-EC1DE6D68C0C}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{82D7569F-04F8-4BEF-A6E8-EC1DE6D68C0C}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS2\Services\Tcpip\..\{82D7569F-04F8-4BEF-A6E8-EC1DE6D68C0C}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS3\Services\Tcpip\..\{82D7569F-04F8-4BEF-A6E8-EC1DE6D68C0C}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

 

Malwarebytes' Anti-Malware 1.28
Tietokantaversio: 1144
Windows 5.1.2600 Service Pack 3

13.9.2008 15:50:12
mbam-log-2008-09-13 (15-50-12).txt

Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 183386
Kulunut aika: 2 hour(s), 5 minute(s), 58 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 2
Saastuneita rekisteriarvoja: 1
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 35

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
HKEY_CLASSES_ROOT\fqbewlna.bewo (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\fqbewlna.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Saastuneita rekisteriarvoja:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Somefox (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
C:\Documents and Settings\Omistaja\Local Settings\Application Data\Mozilla\Firefox\Profiles\cjp35e2o.default\Cache\FC397792d01 (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\temp\30.tmp (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Program Files\SAV\sav.cpl (Rogue.SystemAntiVirus2008) -> Quarantined and deleted successfully.
C:\Program Files\SAV\sav.exe (Rogue.SystemAntiVirus2008) -> Delete on reboot.
C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\5.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ddcBSJdE.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\diuyjoth.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\fcccdeFx.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\kcggjyxn.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\nibizi.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\tdfsenwq.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\vmspxfiq.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\zgihlu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BD1EBB9F-39E9-488C-9E9D-8E6540FA07F1}\RP109\A0017854.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BD1EBB9F-39E9-488C-9E9D-8E6540FA07F1}\RP111\A0019731.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BD1EBB9F-39E9-488C-9E9D-8E6540FA07F1}\RP111\A0019739.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BD1EBB9F-39E9-488C-9E9D-8E6540FA07F1}\RP111\A0019740.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BD1EBB9F-39E9-488C-9E9D-8E6540FA07F1}\RP111\A0019741.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BD1EBB9F-39E9-488C-9E9D-8E6540FA07F1}\RP111\A0019742.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BD1EBB9F-39E9-488C-9E9D-8E6540FA07F1}\RP111\A0019743.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BD1EBB9F-39E9-488C-9E9D-8E6540FA07F1}\RP111\A0019744.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BD1EBB9F-39E9-488C-9E9D-8E6540FA07F1}\RP111\A0019746.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BD1EBB9F-39E9-488C-9E9D-8E6540FA07F1}\RP111\A0019745.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\casino1.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\casino2.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\casino3.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\Program Files\SAV\sav0.dat (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\SAV\sav1.dat (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\SAV\sav.ooo (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msxml71.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Omistaja\Local Settings\temp\2F.tmp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jesse\Työpöytä\antivirus-2008pro.lnk (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jesse\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jesse\Local Settings\Temp\b590_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jesse\Local Settings\Temp\dssc32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

 

siten sdfix ja uusi hjt:n loki scannaten

 

SDFix: Version 1.224
Run by Omistaja on la 13.09.2008 at 16:03

Microsoft Windows XP [versio 5.1.2600]
Running From: C:\Documents and Settings\Omistaja\Ty”p”yt„\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\DOCUME~1\Omistaja\LOCALS~1\Temp\a.exe - Deleted
C:\DOCUME~1\Omistaja\LOCALS~1\Temp\b.exe - Deleted
C:\DOCUME~1\Omistaja\LOCALS~1\Temp\c.exe - Deleted



Folder C:\Documents and Settings\Omistaja\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#w*w.redtube.com - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-13 16:25:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:c0,1c,f7,c6,4a,a4,53,98,3a,85,ec,6e,43,c1,3a,9d,bc,21,38,6d,be,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,cf,6a,43,1f,75,da,4f,7a,6b,de,9b,3b,31,34,8d,95,11,..
"khjeh"=hex:2d,f3,c0,12,e3,7a,6e,6e,f0,f3,ef,ed,ca,db,42,5a,57,a6,8d,65,1a,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:51,74,a4,05,2f,c2,7f,13,9c,20,d6,66,50,d0,cc,81,17,b5,93,a8,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:8f,21,3d,ba,be,d8,b1,0f,ec,ba,86,e2,7b,4b,d6,39,11,ac,c9,73,2f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:8f,21,3d,ba,be,d8,b1,0f,ec,ba,86,e2,7b,4b,d6,39,11,ac,c9,73,2f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:8f,21,3d,ba,be,d8,b1,0f,ec,ba,86,e2,7b,4b,d6,39,11,ac,c9,73,2f,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv]
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:c0,1c,f7,c6,4a,a4,53,98,3a,85,ec,6e,43,c1,3a,9d,bc,21,38,6d,be,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,cf,6a,43,1f,75,da,4f,7a,6b,de,9b,3b,31,34,8d,95,11,..
"khjeh"=hex:2d,f3,c0,12,e3,7a,6e,6e,f0,f3,ef,ed,ca,db,42,5a,57,a6,8d,65,1a,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:51,74,a4,05,2f,c2,7f,13,9c,20,d6,66,50,d0,cc,81,17,b5,93,a8,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:8f,21,3d,ba,be,d8,b1,0f,ec,ba,86,e2,7b,4b,d6,39,11,ac,c9,73,2f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:8f,21,3d,ba,be,d8,b1,0f,ec,ba,86,e2,7b,4b,d6,39,11,ac,c9,73,2f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:8f,21,3d,ba,be,d8,b1,0f,ec,ba,86,e2,7b,4b,d6,39,11,ac,c9,73,2f,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:c0,1c,f7,c6,4a,a4,53,98,3a,85,ec,6e,43,c1,3a,9d,bc,21,38,6d,be,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,cf,6a,43,1f,75,da,4f,7a,6b,de,9b,3b,31,34,8d,95,11,..
"khjeh"=hex:2d,f3,c0,12,e3,7a,6e,6e,f0,f3,ef,ed,ca,db,42,5a,57,a6,8d,65,1a,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:51,74,a4,05,2f,c2,7f,13,9c,20,d6,66,50,d0,cc,81,17,b5,93,a8,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:8f,21,3d,ba,be,d8,b1,0f,ec,ba,86,e2,7b,4b,d6,39,11,ac,c9,73,2f,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:8f,21,3d,ba,be,d8,b1,0f,ec,ba,86,e2,7b,4b,d6,39,11,ac,c9,73,2f,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:8f,21,3d,ba,be,d8,b1,0f,ec,ba,86,e2,7b,4b,d6,39,11,ac,c9,73,2f,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000003b
"TracesSuccessful"=dword:00000007

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Xfire\\xfire.exe"="C:\\Program Files\\Xfire\\xfire.exe:*:Enabled:Xfire"
"C:\\Program Files\\Steam\\SteamApps\\sakado95\\source sdk base\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\sakado95\\source sdk base\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\X-Chat 2\\xchat.exe"="C:\\Program Files\\X-Chat 2\\xchat.exe:*:Enabled:X-Chat IRC Client"
"C:\\ijji\\ENGLISH\\u_gunz.exe"="C:\\ijji\\ENGLISH\\u_gunz.exe:*:Enabled:<ijji Downloader>"
"C:\\ijji\\ENGLISH\\Gunz\\Gunz.exe"="C:\\ijji\\ENGLISH\\Gunz\\Gunz.exe:*:Enabled:Gunz"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\Program Files\\Counter-Strike 1.6 V35\\hl.exe"="C:\\Program Files\\Counter-Strike 1.6 V35\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\ijji\\ENGLISH\\u_sf.exe"="C:\\ijji\\ENGLISH\\u_sf.exe:*:Enabled:<ijji Downloader>"
"C:\\ijji\\ENGLISH\\u_sf\\soldierfront.exe"="C:\\ijji\\ENGLISH\\u_sf\\soldierfront.exe:*:Enabled:soldierfront"
"C:\\Program Files\\xchat\\xchat.exe"="C:\\Program Files\\xchat\\xchat.exe:*:Enabled:XChat IRC Client"
"C:\\Program Files\\Counter-Strike Source\\hl2.exe"="C:\\Program Files\\Counter-Strike Source\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Age of Empires II\\age2_x1\\age2_x1.exe"="C:\\Program Files\\Age of Empires II\\age2_x1\\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\Steam\\SteamApps\\sakado95\\half-life 2 deathmatch\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\sakado95\\half-life 2 deathmatch\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Microsoft Games\\Impossible Creatures\\IC.exe"="C:\\Program Files\\Microsoft Games\\Impossible Creatures\\IC.exe:*:Enabled:IC"
"C:\\Program Files\\TrackMania Original\\TmOriginal.exe"="C:\\Program Files\\TrackMania Original\\TmOriginal.exe:*:Enabled:TmOriginal"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :


File Backups: - C:\DOCUME~1\Omistaja\TYPYT~1\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sat 25 Aug 2007 454,656 ..SHR --- "C:\Program Files\NetMeeting\nmwb.exe"
Tue 1 Jul 2008 14,243,082 A.SH. --- "C:\Program Files\vixy.net\conv.exe"
Sat 16 Aug 2008 1,599,488 ..SH. --- "C:\Documents and Settings\Omistaja\Omat tiedostot\AoO8Y9_cfdg.exe"
Fri 18 Jul 2008 2,451,968 ..SH. --- "C:\Documents and Settings\Omistaja\Omat tiedostot\MdK487_cfdg.exe"
Fri 18 Jul 2008 2,451,968 ..SH. --- "C:\Documents and Settings\Omistaja\Omat tiedostot\Ysg3Np_cfdg.exe"
Thu 15 Feb 2007 308,832 A..H. --- "C:\Program Files\Canon\MP Navigator EX 1.0\Maint.exe"
Thu 26 Jan 2006 61,440 A..H. --- "C:\Program Files\Canon\MP Navigator EX 1.0\uinstrsc.dll"
Fri 27 Jun 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 4 Sep 2008 2,451,968 ..SH. --- "C:\Documents and Settings\Omistaja\Ty”p”yt„\Stuff\ChX5Fy_cfdg.exe"
Fri 5 Sep 2008 2,451,968 ..SH. --- "C:\Documents and Settings\Omistaja\Ty”p”yt„\Stuff\DgN5Wt_cfdg.exe"
Thu 4 Sep 2008 2,451,968 ..SH. --- "C:\Documents and Settings\Omistaja\Ty”p”yt„\Stuff\EhU44d_cfdg.exe"
Sat 16 Aug 2008 2,451,968 ..SH. --- "C:\Documents and Settings\Omistaja\Ty”p”yt„\Stuff\IeJ26j_cfdg.exe"
Tue 5 Aug 2008 2,451,968 ..SH. --- "C:\Documents and Settings\Omistaja\Ty”p”yt„\Stuff\Iih4Co_cfdg.exe"
Thu 4 Sep 2008 2,451,968 ..SH. --- "C:\Documents and Settings\Omistaja\Ty”p”yt„\Stuff\JyN8Qi_cfdg.exe"
Thu 4 Sep 2008 2,451,968 ..SH. --- "C:\Documents and Settings\Omistaja\Ty”p”yt„\Stuff\PxV4Fn_cfdg.exe"
Fri 5 Sep 2008 2,451,968 ..SH. --- "C:\Documents and Settings\Omistaja\Ty”p”yt„\Stuff\RwK6Mt_cfdg.exe"
Fri 5 Sep 2008 2,451,968 ..SH. --- "C:\Documents and Settings\Omistaja\Ty”p”yt„\Stuff\SbM4Lf_cfdg.exe"
Fri 5 Sep 2008 2,451,968 ..SH. --- "C:\Documents and Settings\Omistaja\Ty”p”yt„\Stuff\Slr0Q4_cfdg.exe"
Thu 4 Sep 2008 2,451,968 ..SH. --- "C:\Documents and Settings\Omistaja\Ty”p”yt„\Stuff\Swa45j_cfdg.exe"
Thu 4 Sep 2008 2,451,968 ..SH. --- "C:\Documents and Settings\Omistaja\Ty”p”yt„\Stuff\YfF3Jk_cfdg.exe"
Mon 25 Aug 2008 31,487 A..H. --- "C:\Documents and Settings\Omistaja\Omat tiedostot\Omat kuvatiedostot\piip\Hentai\LoL\Hentai\Other hentai\R-05-V01.ZIP"
Mon 25 Aug 2008 113,000 A..H. --- "C:\Documents and Settings\Omistaja\Omat tiedostot\Omat kuvatiedostot\piip\Hentai\LoL\Hentai\Other hentai\R-05-V02.ZIP"
Mon 25 Aug 2008 99,312 A..H. --- "C:\Documents and Settings\Omistaja\Omat tiedostot\Omat kuvatiedostot\piip\Hentai\LoL\Hentai\Other hentai\R-05-V03.ZIP"

Finished!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:28:11, on 13.9.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1214576998694
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1216128469000
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O20 - AppInit_DLLs: zgihlu.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 4031 bytes

 

laitas avastin taustasuojaus päälle

=============

ota uusi hjt:n loki

Lisäksi ota koneelle palomuuri softa
ja windowsin palomuuri pois päältä

 

Miten saan avastin taustasuojauksen automaattisesti menemään päälle käynnistyksen yhteydessä?

Ei mene enään...joudun käynnistämään manuaalisesti avastin kansiosta...

 

Klikkatta hiiren oikeanpuoleisella napilla
sinisen A pallon päällä kellon vieressä
alin kohta tai jos ei pysy suoraan päällä niin asenna avast uudelleen

 

Noniin... nyt kun on päästy koneelle ja on aikaa postataanpa se hjt logi

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:39:24, on 18.9.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\FDRLab\save2pc\save2pc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1214576998694
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1216128469000
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O20 - AppInit_DLLs: zgihlu.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: Remote Procedure Call (HPM) (RPCH) - Unknown owner - C:\Program Files\NetMeeting\nmwb.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 4204 bytes

 

asenna avast uudelleen

=================

Mitäas noille 04 riveille on tapahtunut?
et kai ole mennyt fixsaamaan.

 

Mitään en ole poistanut tai fixannut..

Ainoat mitä olen tehnyt on että oon scannannu malwarebytellä ja poistanut...en mitään hjt:llä...avat! löysi webmeetingistä viruksen ja laitoin karanteeniin..(ja nyt asensin avastin uudelleen)


Uusi htj logi uudelleen asennuksen jälkeen

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:38, on 2008-09-18
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1214576998694
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1216128469000
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 4212 bytes

 

wiintoosan palomuuri on kai käytössä.

===================

katos mitä tuolta löytyy Älä tee mitään muuta

• Avaa HiJackThis
• Klikkaa "Configure" valintaa oikealla alhaalla
• Klikkaa valintaa "BackUps"

 

Ihan tyhjä :S

Mitäs sieltä poistunut?

Siis nelosen kohalta?

 

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

===================

Sulla on tommonen sanonta

tuo ohjelma kyllä poistaa

Mites nuo on onnistuttu hävittämään

Mites se kone toimii onkos siinä toiminassa jotain ongelmaa

 

Normaalisti tuntuu toimivan...

Asensin Javan uudelleen joten jusched tuli takas..(ilmeisesti)

 

niin ja saathan ne pois lentäneet ohjelmat takaisin uudelleen asentamalla.
esim jos ei toimi
Canon

kun ei noita örkkejä lataa uudelleen

 

Joo ei niillä oo väliä koska se toimii

Scannaus ja tulostus ainakin..ja cd on lähettyvillä

(Ei just nyt koska oon eri koneella )

Muttas muttas tässä koneessa sellanen vittumainen ongelma

Menen pelaamaan ja tietokone sammuu ja käynnistää itsensä uudelleen "Windows on juuri palautunut vakavasta virheestä" Tai jotain tuollaista...ei ole ollut ennen..tänään vaan huomasin sellasen tulleen :S