1. Tämä sivusto käyttää keksejä (cookie). Jatkamalla sivuston käyttämistä hyväksyt keksien käyttämisen. Lue lisää.

HijackThis kanssa tyttö pulassa

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi nyks 10.04.2008.

Sivu 2 / 2
  1. Hujo

    Hujo Guest

    Mä laitan sulle vähän ohjelmaa lisää hetken päästä tähän samaan
    seuraa se tarkaan lävitse.

    ===============

    Käynnistä > suorita kirjoita msconfig > paina ok >
    Käynnistys välilehti

    Ota alla olevien edestä ruksi pois

    hpsysdrv
    hphmon05
    KBD
    NvCpl.dll
    nwiz
    UpdReg
    ps2
    CTHELPER
    Reader_sl
    jusched

    käytä ja ok
    Käynnistä kone uudelleen ja laita pikkuseen neliöön ruksi ja paina sitten vasta ok


    ================
    lataa koneelle EVEREST Free Edition 2.20
    täältä

    asenna ja sitten käynnistä se klikkaa emolevy sitten muisti
    paljon on koneessa keskusmuistia:

    yhteensä
    käytössä
    vapaana
    Käyttö aste
     
    Moderaattorin viimeksi muokkaama: 12.04.2008
    Hujo, 12.04.2008
    #21
  2.  
  3. nyks

    nyks Member

    Liittynyt:
    14.01.2008
    Viestejä:
    26
    Kiitokset:
    0
    Pisteet:
    11
    Keskusmuistia:

    yhteensä: 511 MB
    käytössä: 320 MB
    vapaana: 190 MB
    Käyttö aste: 63 %


     
    nyks, 12.04.2008
    #22
  4. Hujo

    Hujo Guest

    Tota se mun uneni tiesi kun mä sen hereillä näin.

    no niin tuo käyttöjärjestelmä Windows XP SP2 vie tuosta muistista tuon
    256MB sitten kun siihen tulee tuo Elisa Tietoturvapalvelu F-secure
    niin sulla on hidaskone. Sitten kun rupeet vielä käyttämään jotakin ohjelmaa niin hidasta on.
    Sen koneen hitauden takia se kaveri halus et pistät Hjt:n lokin

    mutta onkos sulla koneella vielä Tuo combofix
    näkyykö työpöydällä punanen pallo missä on valkonen X

    Jos löytyy niin tuplalikkaa sitä kun sininen taulu avautuu niin paina 1 ja enter näkyy jonkun ajan kuluttua valmis osio ja numeroita
    sitten kun se on homman tehnyt niin ponahtaa Log muistio
    Klikkaa sen päällä hiiren oikeen puoleisella valitse kaikki
    uudelleen oikean puoleisella ja sitten Kopioi ja liität sen tänne vastaus ketjuusi.
     
    Moderaattorin viimeksi muokkaama: 12.04.2008
    Hujo, 12.04.2008
    #23
  5. nyks

    nyks Member

    Liittynyt:
    14.01.2008
    Viestejä:
    26
    Kiitokset:
    0
    Pisteet:
    11
    Tässä tulee:

    ComboFix 08-04-11.8 - Omistaja 2008-04-12 20:38:57.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.101 [GMT 3:00]
    Running from: C:\nesto\ComboFix.exe
    * Created a new restore point
    * Resident AV is active

    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\Downloaded Program Files\setup.inf
    D:\Autorun.inf

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-03-12 to 2008-04-12 )))))))))))))))))
    .

    2008-04-12 19:49 . 2008-04-12 19:49 <KANSIO> d-------- C:\Program Files\Lavalys
    2008-04-12 16:04 . 2008-04-12 16:05 <KANSIO> d-------- C:\WINDOWS\ERUNT
    2008-04-12 14:39 . 2008-04-12 14:39 0 --a------ C:\23990098.$$$
    2008-04-12 11:26 . 2008-04-12 11:31 <KANSIO> d-------- C:\nesto2
    2008-04-12 11:23 . 2008-04-12 11:31 <KANSIO> d-------- C:\Kaspersky
    2008-04-12 10:45 . 2008-04-12 10:45 <KANSIO> d-------- C:\Program Files\CCleaner
    2008-04-12 10:37 . 2008-04-12 10:37 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-04-12 01:41 . 2008-04-12 01:41 <KANSIO> d-------- C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\Grisoft
    2008-04-12 01:40 . 2008-04-12 01:40 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-04-12 01:40 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-04-12 00:56 . 2008-04-12 20:36 <KANSIO> d-------- C:\nesto
    2008-04-05 21:46 . 2008-04-05 21:46 <KANSIO> d-------- C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\Nokia Multimedia Player
    2008-04-04 16:13 . 2008-04-04 16:13 51,712 --a------ C:\WINDOWS\wc98pp.dll
    2008-03-28 12:28 . 2008-03-28 12:41 51,072 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
    2008-03-28 12:28 . 2008-03-28 12:41 30,016 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
    2008-03-28 12:27 . 2008-03-28 12:48 <KANSIO> d-------- C:\Program Files\Elisa Tietoturvapalvelu
    2008-03-26 12:08 . 2008-04-07 10:42 <KANSIO> d-------- C:\Documents and Settings\Omistaja.BANJALUKA.000\e-Safekey

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-05 18:44 --------- d-----w C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\Nokia
    2008-03-28 09:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\F-Secure
    2008-03-28 09:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\fssg
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-07 06:29 --------- d-----w C:\Program Files\Java
    2008-03-04 22:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Emotum
    2008-03-04 22:25 --------- d-----w C:\Program Files\Elisa
    2008-03-04 22:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Elisa
    2008-03-04 15:21 --------- d-----w C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\ispnews
    2008-03-01 13:01 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-02-28 07:38 34,360 ----a-w C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\GDIPFONTCACHEV1.DAT
    2008-02-26 19:49 --------- d-----w C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\Media Player Classic
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
    2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
    2008-02-19 11:35 --------- d-----w C:\Program Files\Common Files\Logitech
    2008-02-19 11:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-02-19 11:34 --------- d-----w C:\Program Files\Logitech
    2008-02-19 11:08 --------- d-----w C:\Program Files\WMV9_VCM
    2008-02-19 11:00 --------- d-----w C:\Program Files\Empire Interactive
    2008-02-16 16:07 --------- d-----w C:\Program Files\BitTornado
    2008-02-14 22:07 --------- d-----w C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\.BitTornado
    2008-02-14 19:31 --------- d-----w C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\uTorrent
    2008-01-18 10:50 25,754,696 ----a-w C:\Program Files\wmp11-windowsxp-x86-FI-FI.exe
    2008-01-18 09:06 86,162,136 ----a-w C:\Program Files\PC-Protection-Plus7.exe
    2007-10-18 21:45 8,454,584 ----a-w C:\Program Files\winamp55_full_emusic-7plus_en-us.exe
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
    "NVIEW"="nview.dll" [2003-05-02 23:19 835654 C:\WINDOWS\system32\nview.dll]
    "BackupNotify"="c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" [2003-06-22 21:25 24576]
    "MSMSGS"="C:\Program Files\Messenger\MSMSGS.exe" [2004-10-13 19:24 1694208]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-31 20:37 68856]
    "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 11:12 695808]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 07:07 114688]
    "CamMonitor"="c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 07:23 90112]
    "HPHUPD05"="c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 03:03 49152]
    "WinCinemaMgr"="C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe" [2003-08-08 02:57 159744]
    "Home Theater SchSvr"="C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe" [2003-08-08 15:51 155648]
    "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 21:42 212992]
    "ATIModeChange"="Ati2mdxx.exe" [2001-09-05 00:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-19 22:10 335872]
    "Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-09 12:27 139264]
    "CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2002-10-29 10:18 49152]
    "CTDVDDet"="C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2002-09-30 02:00 45056]
    "Reminder"="C:\Windows\Creator\Remind_XP.exe" [2003-06-17 18:13 118784]
    "Elisa Avustaja"="C:\Program Files\Elisa\Avustaja\Elisa.exe" [2007-10-22 16:15 189768]
    "F-Secure Manager"="C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.exe" [2008-02-13 13:38 184800]
    "F-Secure TNB"="C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\TNBUtil.exe" [2008-02-13 13:38 741800]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 02:12 15360]
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 18:35 1294336]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "CMSRegOW.exe"="C:\Program Files\InstallShield Installation Information\{56F3E1FF-54FE-4384-A153-6CCABA097814}\CMSRegOW.exe" [2003-06-16 02:00 57344]

    C:\Documents and Settings\Default User\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    AutoTBar.exe [2003-06-20 18:08:00 53248]
    mod_sm.lnk - C:\hp\bin\cloaker.exe [1999-11-07 07:11:14 27136]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2003-06-13 04:08:16 233472]
    Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-12-28 21:26:19 450560]
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-12-28 21:23:23 450560]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
    --a------ 2003-05-28 19:59 28672 C:\WINDOWS\system32\cthelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
    --a------ 2003-05-23 02:56 483328 C:\WINDOWS\System32\hphmon05.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
    --a------ 1998-05-07 16:04 52736 c:\windows\system\hpsysdrv.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
    --a------ 2003-02-11 20:02 61440 C:\HP\KBD\KBD.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    --a------ 2003-05-02 23:19 4640768 C:\WINDOWS\System32\NvCpl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    --a------ 2003-05-02 23:19 323584 C:\WINDOWS\system32\nwiz.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
    --a------ 2002-10-16 16:57 81920 C:\WINDOWS\system32\ps2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2008-02-22 05:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
    --------- 2000-05-11 02:00 90112 C:\WINDOWS\UpdReg.EXE

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "18648:TCP"= 18648:TCP:BitComet 18648 TCP
    "18648:UDP"= 18648:UDP:BitComet 18648 UDP

    R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-28 12:41]
    R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Elisa Tietoturvapalvelu\HIPS\fshs.sys [2008-03-28 12:41]
    R3 Cap7134;ASUS TV7134 WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2003-05-09 10:16]
    R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\minifilter\fsgk.sys [2008-02-13 13:38]
    R3 PhTVTune;ASUS WDM TV Tuner;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2003-04-28 22:33]
    S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\Win2K\FSfilter.sys [2008-02-13 13:38]
    S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\Win2K\FSrec.sys [2008-02-13 13:38]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
    \Shell\AutoRun\command - D:\Info.exe folder.htt 480 480

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bd1b4d7a-c598-11dc-8a70-806d6172696f}]
    \Shell\AutoRun\command - D:\Info.exe folder.htt 480 480

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-04-12 17:22:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    "2008-04-12 07:24:51 C:\WINDOWS\Tasks\Scheduled scanning task.job"
    - C:\PROGRA~1\ELISAT~1\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\ELISAT~1\ANTI-V~1\report.txt
    "2008-01-18 08:50:11 C:\WINDOWS\Tasks\Symantec NetDetect.job"
    - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
    .
    **************************************************************************

    catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-12 20:42:49
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-04-12 20:43:44
    ComboFix-quarantined-files.txt 2008-04-12 17:43:31
    Pre-Run: 86,599,041,024 tavua vapaana
    Post-Run: 86,586,363,904 tavua vapaana
    .
    2008-04-09 05:17:20 --- E O F ---


    Muuten kun toi hoiti hommaa niin F-Secure ilmoitti että tuli joku virus, yritti poistaa eikä onnistunut. Tämä ei ole enää kivaa :(

     
    nyks, 12.04.2008
    #24
  6. nyks

    nyks Member

    Liittynyt:
    14.01.2008
    Viestejä:
    26
    Kiitokset:
    0
    Pisteet:
    11
    No ei se ollutkaan virus..
     
    nyks, 12.04.2008
    #25
  7. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, 12.04.2008
    #26
  8. nyks

    nyks Member

    Liittynyt:
    14.01.2008
    Viestejä:
    26
    Kiitokset:
    0
    Pisteet:
    11
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:57:52, on 12.4.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe
    C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
    C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
    C:\Program Files\Elisa\Avustaja\Elisa.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\MSMSGS.EXE
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
    C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\System32\CTSvcCDA.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMB32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FCH32.EXE
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FAMEH32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsqh.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\fsguidll.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fssm32.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsaua.exe
    C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
    C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsus.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsav32.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://thepiratebay.org/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
    O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [WinCinemaMgr] "C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe"
    O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
    O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
    O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
    O4 - HKLM\..\Run: [Elisa Avustaja] "C:\Program Files\Elisa\Avustaja\Elisa.exe"
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
    O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [CMSRegOW.exe] "C:\Program Files\InstallShield Installation Information\{56F3E1FF-54FE-4384-A153-6CCABA097814}\CMSRegOW.exe" /r (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [CMSRegOW.exe] "C:\Program Files\InstallShield Installation Information\{56F3E1FF-54FE-4384-A153-6CCABA097814}\CMSRegOW.exe" /r (User 'Default user')
    O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
    O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1200645140109
    O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 10857 bytes
     
    nyks, 12.04.2008
    #27
  9. Hujo

    Hujo Guest

    Poista koneelta

    C:\SDfix
    AVG:n Anti-Spyware 7.5:n
    CCleaner
    StartUpLite
    C:\Kaspersky

    Käynnistä > suorita

    käynnistä ja suorita alla oleva siihen

    Combofix /u

    ja ok

    ===========

    Lataa OTMoveIt
    OTMoveIt ja tallenna se työpöydällesi.

    Tuplaklikkaa OTMoveIt.exe.
    Klikkaa CleanUp!.
    Valitse Yes kun kysytään "Begin cleanup Process?".
    Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.

    HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.
     
    Moderaattorin viimeksi muokkaama: 12.04.2008
    Hujo, 12.04.2008
    #28
  10. nyks

    nyks Member

    Liittynyt:
    14.01.2008
    Viestejä:
    26
    Kiitokset:
    0
    Pisteet:
    11
    ComboFix 08-04-11.8 - Omistaja 2008-04-12 22:51:56.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.147 [GMT 3:00]
    Running from: C:\nesto\ComboFix.exe
    * Resident AV is active

    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-03-12 to 2008-04-12 )))))))))))))))))
    .

    2008-04-12 21:26 . 2004-08-04 08:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys
    2008-04-12 21:26 . 2004-08-04 08:08 25,600 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys
    2008-04-12 21:26 . 2008-04-12 21:26 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
    2008-04-12 21:26 . 2008-04-12 21:26 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
    2008-04-12 21:25 . 2008-04-12 21:25 <KANSIO> d-------- C:\WINDOWS\LastGood
    2008-04-12 21:15 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
    2008-04-12 21:14 . 2007-11-29 10:33 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
    2008-04-12 21:14 . 2007-11-29 10:39 95,744 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
    2008-04-12 21:14 . 2007-11-29 10:39 19,328 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
    2008-04-12 21:14 . 2007-11-29 10:39 16,896 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
    2008-04-12 21:14 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
    2008-04-12 21:14 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
    2008-04-12 19:49 . 2008-04-12 19:49 <KANSIO> d-------- C:\Program Files\Lavalys
    2008-04-12 16:04 . 2008-04-12 16:05 <KANSIO> d-------- C:\WINDOWS\ERUNT
    2008-04-12 14:39 . 2008-04-12 14:39 0 --a------ C:\23990098.$$$
    2008-04-12 11:26 . 2008-04-12 11:31 <KANSIO> d-------- C:\nesto2
    2008-04-12 10:37 . 2008-04-12 10:37 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-04-12 01:40 . 2008-04-12 01:40 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-04-12 00:56 . 2008-04-12 22:45 <KANSIO> d-------- C:\nesto
    2008-04-05 21:46 . 2008-04-05 21:46 <KANSIO> d-------- C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\Nokia Multimedia Player
    2008-04-04 16:13 . 2008-04-04 16:13 51,712 --a------ C:\WINDOWS\wc98pp.dll
    2008-03-28 12:28 . 2008-03-28 12:41 51,072 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
    2008-03-28 12:28 . 2008-03-28 12:41 30,016 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
    2008-03-28 12:27 . 2008-03-28 12:48 <KANSIO> d-------- C:\Program Files\Elisa Tietoturvapalvelu
    2008-03-26 12:08 . 2008-04-07 10:42 <KANSIO> d-------- C:\Documents and Settings\Omistaja.BANJALUKA.000\e-Safekey

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-12 18:27 --------- d-----w C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\PC Suite
    2008-04-12 18:26 --------- d-----w C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\Nokia
    2008-04-12 18:15 --------- d-----w C:\Program Files\PC Connectivity Solution
    2008-04-12 18:14 --------- d-----w C:\Program Files\Nokia
    2008-04-12 18:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
    2008-03-28 09:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\F-Secure
    2008-03-28 09:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\fssg
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-07 06:29 --------- d-----w C:\Program Files\Java
    2008-03-06 08:14 831,048 ----a-w C:\WINDOWS\system32\WudfUpdate_01005.dll
    2008-03-04 22:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Emotum
    2008-03-04 22:25 --------- d-----w C:\Program Files\Elisa
    2008-03-04 22:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Elisa
    2008-03-04 15:21 --------- d-----w C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\ispnews
    2008-03-01 13:01 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-02-28 07:38 34,360 ----a-w C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\GDIPFONTCACHEV1.DAT
    2008-02-26 19:49 --------- d-----w C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\Media Player Classic
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
    2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
    2008-02-19 11:35 --------- d-----w C:\Program Files\Common Files\Logitech
    2008-02-19 11:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-02-19 11:34 --------- d-----w C:\Program Files\Logitech
    2008-02-19 11:08 --------- d-----w C:\Program Files\WMV9_VCM
    2008-02-19 11:00 --------- d-----w C:\Program Files\Empire Interactive
    2008-02-16 16:07 --------- d-----w C:\Program Files\BitTornado
    2008-02-14 22:07 --------- d-----w C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\.BitTornado
    2008-02-14 19:31 --------- d-----w C:\Documents and Settings\Omistaja.BANJALUKA.000\Application Data\uTorrent
    2008-01-18 10:50 25,754,696 ----a-w C:\Program Files\wmp11-windowsxp-x86-FI-FI.exe
    2008-01-18 09:06 86,162,136 ----a-w C:\Program Files\PC-Protection-Plus7.exe
    2007-10-18 21:45 8,454,584 ----a-w C:\Program Files\winamp55_full_emusic-7plus_en-us.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-04-12_20.43.11.46 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-04-12 18:18:05 15,086 ----a-r C:\WINDOWS\Installer\{0FC76B71-2534-4354-B255-3468578E3F47}\ARPPRODUCTICON.exe
    + 2008-04-12 18:14:36 3,262 ----a-r C:\WINDOWS\Installer\{4F1DCA42-2030-437C-A94E-736692A499C1}\ARPPRODUCTICON.exe
    + 2008-04-12 18:15:41 10,134 ----a-r C:\WINDOWS\Installer\{AC599724-5755-48C1-ABE7-ABB857652930}\ARPPRODUCTICON.exe
    - 2007-11-06 07:26:20 535,040 ----a-w C:\WINDOWS\system32\drivers\UMDF\PCCSWpdDriver.dll
    + 2008-03-06 08:19:36 534,016 ----a-w C:\WINDOWS\system32\drivers\UMDF\PCCSWpdDriver.dll
    + 2006-11-02 04:22:54 492,000 ------w C:\WINDOWS\system32\drivers\wdf01000.sys
    + 2006-11-02 04:22:52 32,224 ------w C:\WINDOWS\system32\drivers\wdfldr.sys
    + 2007-11-29 07:39:42 16,896 -c--a-w C:\WINDOWS\system32\DRVSTORE\ccdcmb_B642931F7B28F01BE617200298CCA42B44AAC343\ccdcmb.sys
    + 2007-11-29 07:32:38 48,128 -c--a-w C:\WINDOWS\system32\DRVSTORE\ccdcmb_B642931F7B28F01BE617200298CCA42B44AAC343\nmwcdcls.dll
    + 2007-11-29 07:39:44 95,744 -c--a-w C:\WINDOWS\system32\DRVSTORE\ccdcmb_B642931F7B28F01BE617200298CCA42B44AAC343\nmwcdcocls.dll
    + 2007-11-29 07:33:04 1,419,232 -c--a-w C:\WINDOWS\system32\DRVSTORE\ccdcmb_B642931F7B28F01BE617200298CCA42B44AAC343\wdfcoinstaller01005.dll
    + 2007-11-29 07:39:52 8,064 -c--a-w C:\WINDOWS\system32\DRVSTORE\ccdcmbcj_B642931F7B28F01BE617200298CCA42B44AAC343\usbser_lowerfltj.sys
    + 2007-11-29 07:39:42 8,064 -c--a-w C:\WINDOWS\system32\DRVSTORE\ccdcmbm_B642931F7B28F01BE617200298CCA42B44AAC343\usbser_lowerflt.sys
    + 2007-11-29 07:39:40 19,328 -c--a-w C:\WINDOWS\system32\DRVSTORE\ccdcmbo_B642931F7B28F01BE617200298CCA42B44AAC343\ccdcmbo.sys
    + 2007-09-17 12:53:26 21,632 -c--a-w C:\WINDOWS\system32\DRVSTORE\pccsmcfd_4A1E30386F4D0DEC8F5DF262CFBD8845EEBAB175\pccsmcfd.sys
    + 2008-03-06 08:19:36 534,016 -c--a-w C:\WINDOWS\system32\DRVSTORE\pccswpddri_CAEB6BB34654D5A4CAB32D7967078BA417F01F05\PCCSWpdDriver.dll
    + 2008-03-06 08:14:58 831,048 -c--a-w C:\WINDOWS\system32\DRVSTORE\pccswpddri_CAEB6BB34654D5A4CAB32D7967078BA417F01F05\WudfUpdate_01005.dll
    - 2007-02-22 08:15:12 90,624 ----a-w C:\WINDOWS\system32\nmwcdcls.dll
    + 2007-11-29 07:32:38 48,128 ----a-w C:\WINDOWS\system32\nmwcdcls.dll
    - 2006-09-16 00:02:34 14,640 ------w C:\WINDOWS\system32\spmsg.dll
    + 2006-10-08 18:51:14 14,640 ------w C:\WINDOWS\system32\spmsg.dll
    - 2006-09-16 00:02:34 23,856 ----a-w C:\WINDOWS\system32\spupdsvc.exe
    + 2006-10-08 18:51:14 23,856 ----a-w C:\WINDOWS\system32\spupdsvc.exe
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
    "NVIEW"="nview.dll" [2003-05-02 23:19 835654 C:\WINDOWS\system32\nview.dll]
    "BackupNotify"="c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" [2003-06-22 21:25 24576]
    "MSMSGS"="C:\Program Files\Messenger\MSMSGS.exe" [2004-10-13 19:24 1694208]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-31 20:37 68856]
    "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 07:07 114688]
    "CamMonitor"="c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 07:23 90112]
    "HPHUPD05"="c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 03:03 49152]
    "WinCinemaMgr"="C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe" [2003-08-08 02:57 159744]
    "Home Theater SchSvr"="C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe" [2003-08-08 15:51 155648]
    "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 21:42 212992]
    "ATIModeChange"="Ati2mdxx.exe" [2001-09-05 00:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-19 22:10 335872]
    "Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-09 12:27 139264]
    "CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2002-10-29 10:18 49152]
    "CTDVDDet"="C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2002-09-30 02:00 45056]
    "Reminder"="C:\Windows\Creator\Remind_XP.exe" [2003-06-17 18:13 118784]
    "Elisa Avustaja"="C:\Program Files\Elisa\Avustaja\Elisa.exe" [2007-10-22 16:15 189768]
    "F-Secure Manager"="C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.exe" [2008-02-13 13:38 184800]
    "F-Secure TNB"="C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\TNBUtil.exe" [2008-02-13 13:38 741800]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 02:12 15360]
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "CMSRegOW.exe"="C:\Program Files\InstallShield Installation Information\{56F3E1FF-54FE-4384-A153-6CCABA097814}\CMSRegOW.exe" [2003-06-16 02:00 57344]

    C:\Documents and Settings\Default User\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    AutoTBar.exe [2003-06-20 18:08:00 53248]
    mod_sm.lnk - C:\hp\bin\cloaker.exe [1999-11-07 07:11:14 27136]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2003-06-13 04:08:16 233472]
    Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-12-28 21:26:19 450560]
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-12-28 21:23:23 450560]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
    --a------ 2003-05-28 19:59 28672 C:\WINDOWS\system32\cthelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
    --a------ 2003-05-23 02:56 483328 C:\WINDOWS\System32\hphmon05.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
    --a------ 1998-05-07 16:04 52736 c:\windows\system\hpsysdrv.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
    --a------ 2003-02-11 20:02 61440 C:\HP\KBD\KBD.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    --a------ 2003-05-02 23:19 4640768 C:\WINDOWS\System32\NvCpl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    --a------ 2003-05-02 23:19 323584 C:\WINDOWS\system32\nwiz.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
    --a------ 2002-10-16 16:57 81920 C:\WINDOWS\system32\ps2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2008-02-22 05:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
    --------- 2000-05-11 02:00 90112 C:\WINDOWS\UpdReg.EXE

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "18648:TCP"= 18648:TCP:BitComet 18648 TCP
    "18648:UDP"= 18648:UDP:BitComet 18648 UDP

    R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-28 12:41]
    R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Elisa Tietoturvapalvelu\HIPS\fshs.sys [2008-03-28 12:41]
    R3 Cap7134;ASUS TV7134 WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2003-05-09 10:16]
    R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\minifilter\fsgk.sys [2008-02-13 13:38]
    R3 PhTVTune;ASUS WDM TV Tuner;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2003-04-28 22:33]
    S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
    S3 upperdev;upperdev;C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2007-11-29 10:39]
    S3 UsbserFilt;UsbserFilt;C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2007-11-29 10:39]
    S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\Win2K\FSfilter.sys [2008-02-13 13:38]
    S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\Win2K\FSrec.sys [2008-02-13 13:38]

    *Newly Created Service* - SERVICELAYER
    *Newly Created Service* - WDF01000
    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-04-12 19:22:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    "2008-04-12 07:24:51 C:\WINDOWS\Tasks\Scheduled scanning task.job"
    - C:\PROGRA~1\ELISAT~1\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\ELISAT~1\ANTI-V~1\report.txt
    "2008-01-18 08:50:11 C:\WINDOWS\Tasks\Symantec NetDetect.job"
    - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
    .
    **************************************************************************

    catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-12 22:55:54
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-04-12 22:57:12
    ComboFix-quarantined-files.txt 2008-04-12 19:56:56
    Pre-Run: 86,437,265,408 tavua vapaana
    Post-Run: 86,425,825,280 tavua vapaana
    .
    2008-04-09 05:17:20 --- E O F ---


    Entäs nyt?
     
    nyks, 12.04.2008
    #29
  11. Hujo

    Hujo Guest

    käynnistä ja suorita alla oleva siihen

    Combofix /u

    ja ok


    tuolla kyllä piti lähtee se combofix pois ;)
     
    Moderaattorin viimeksi muokkaama: 12.04.2008
    Hujo, 12.04.2008
    #30
  12. nyks

    nyks Member

    Liittynyt:
    14.01.2008
    Viestejä:
    26
    Kiitokset:
    0
    Pisteet:
    11
    Ei se lähde noin. Ei löydy. Voinko poistaa jollain toisella tavalla?
     
    nyks, 12.04.2008
    #31
  13. Hujo

    Hujo Guest

    juu työ pöydältä roskiin

    Käynnistä napin päällä hiren oikeen puoleisella napilla > resussinhallinta

    sieltä C:\ComboFix kansio roskiin

     
    Hujo, 12.04.2008
    #32
  14. nyks

    nyks Member

    Liittynyt:
    14.01.2008
    Viestejä:
    26
    Kiitokset:
    0
    Pisteet:
    11
    Ajattelin vaan kysyä, oliko tässä kaikki?

    Sori niistä tyhmistä kysymyksistä!
    Ja KIITOS oikein paljon..
    Ps. Jos joskus nähdään, tarjoan kahvit ;)
     
    nyks, 13.04.2008
    #33
  15. Hujo

    Hujo Guest

    siihen koneeseen tuota keskusmuistia lisää ja vaihda tuo F-secure kevyempään virustorjuntaan. sillä saat koneeseen lisää eloa.

    joku noita

    avast täytyy myös rekisteröidä
    antivir
    avg

    noi tarvii sen palomuurin

     
    Moderaattorin viimeksi muokkaama: 13.04.2008
    Hujo, 13.04.2008
    #34
Sivu 2 / 2

Jaa tämä sivu