Hjt-logi tarkistettavaksi

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:11:44, on 22.11.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Radio Finland Toolbar - {8b8428dc-00f3-409f-9e8c-bfec3a863db9} - C:\Program Files\Radio_Finland\tbRad1.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: Radio Finland Toolbar - {8b8428dc-00f3-409f-9e8c-bfec3a863db9} - C:\Program Files\Radio_Finland\tbRad1.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {076169AA-8C3D-4CFC-AC23-3ACA88FC21B5} (F-Secure Online Scanner Launcher) - http://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1250692263375
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://www.myapplecam.com/activex/AMC.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CF8F411-B5EC-4475-AB11-7F862942C16B}: NameServer = 193.210.18.18,193.210.19.19
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Google-päivityspalvelu (gupdate1ca26486bfa0f32) (gupdate1ca26486bfa0f32) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 8901 bytes

Tässäpä tämä. Jos joku viittis vilkasta.

 

Mikäs sulla toimii virustorjuntana

 

Comodo internet security. Siinä on virustorjunta sekä palomuuri.

 

Ok tulipahan varmistettua hyvältähän tuo loki näyttää.

 

Joo, ei ongelmia muuten ollutkaan, nämä olisi silti hyvä saada jotenkin pois:

SandBox ohjelman jämät("Avaa hiekkalaatikossa" vaihtoehdot pois)
Yahoo search(Tyrkyttää itseään oletushakukoneeksi)
Wuala niminen ohjelma jota joskus käytin.(sen poisto vaihtoehtoa ei lyödy edes Lisää ja poista sovelluksia listasta)

 

ajas tuo ccleaner

tuo oletus hakukoneen voit muuttaa toiseksi muutamalla oletusta

 

Ajoin Ccleanerin Puhdistajan oletusvalinnoilla sekä korjasin kaikki rekisterivirheet mitä se löysi. Edelleenkin tuolla on tuo avaa hiekkalaatokossa vaihtoehto. Se ei muuten haittaisi mutta jos joskus vahingossa tuota painan kone meneekin sitten ihan jumiin ja virrat pitää katkaista virtanapista. Yahoo search puolestaan yrittää muuttaa itsensä päivittäin oletushakukoneeksi ja siitä seuraa aina Googlen ilmoitus. Wuala ei vieläkään poistunut.

 

• Avaa HiJackThis
• Klikkaa "Configure" valintaa oikealla alhaalla
• Klikkaa "Misc Tools"
• Klikkaa boxia joka sanoo "Uninstall Manager"
• Klikkaa valintaa "Save list"
• Kopioi ja liitä kyseinen lista muistiosta ketjuusi


Niin tuo jarruttaa muutoksia

Klikkaa hiiren oikella winpatrol-kuvaketta tehtäväpalkissa ja valitse exit. Ohjelma käynnistyy seuraavan käynnistyksen yhteydessä
uudelleen automaattisesti

 

Yahoo haun sain pois kun menin : Työkalut --> Internet-asetukset --> ohjelmat --> Lisäosien hallinta --> hakupalvelut --> Yahoo search --> poista.

Ainiin, luin jostakin että tuon Winpatrol ohjelman saa myös suomenkielisenä kielipaketin avulla. Onko se totta?

Olen tätä aikaisemminkin jossain kysynyt. Varmaa vastausta en ole koskaan saanut. Eli siis kun tuossa listassa näkyy kohteita joissa lukee Suojauspäivitys Windows Internet Explorer 7:lle. Voiko ne poistaa?

Tässä vielä tämä:

7-Zip 9.07 beta
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.1.3 - Suomi
Adobe Shockwave Player 11.5
Advanced SystemCare 3
Age of Empires II & The Conquerors Expansion
Agere Systems AC'97 Modem
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AXIS Media Control Embedded
Bonjour
Broadcom 440x 10/100 Integrated Controller
Broadcom 802.11 Control Panel
Broadcom 802.11 Driver
CCleaner
COMODO Internet Security
Google Earth
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
HijackThis 2.0.2
HostsMan 3.2.71 Beta7
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows XP (KB915800-v4)
Hotfix-korjauspäivitys Windows Media Player 11:lle (KB939683)
Hotfix-päivitys Windows Internet Explorer 7:lle (KB947864)
Hotfix-päivitys Windows XP:lle (KB952287)
Hotfix-päivitys Windows XP:lle (KB961118)
Hotfix-päivitys Windows XP:lle (KB970653-v3)
HP Accessories Product Tour
HP BIOS Configuration for ProtectTools 1.00 B7
HP Help and Support
HP ProtectTools Security Manager 1.00 C3
Intel(R) Graphics Media Accelerator Driver for Mobile
InterActual Player
InterVideo DVD Check
InterVideo WinDVD
iTunes
J2SE Runtime Environment 5.0 Update 6
Java(TM) 6 Update 17
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Finnish Language Pack
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FIN
Microsoft .NET Framework 3.0 Finnish Language Pack
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FIN
Microsoft .NET Framework 3.0:n suomen kielipaketti
Microsoft .NET Framework 3.5 Language Pack SP1 - fin
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1:n kielitukipaketti - FI
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office PowerPoint Viewer 2003
Microsoft Office XP Media Content
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Works 7.0
MSVCRT
MSXML 6 Service Pack 2 (KB954459)
pc_screen_nesquik2 Screen Saver
Päivitys Windows Internet Explorer 8:lle (KB972636)
Päivitys Windows Internet Explorer 8:lle (KB973874)
Päivitys Windows Internet Explorer 8:lle (KB975364)
Päivitys Windows Internet Explorer 8:lle (KB976749)
Päivitys Windows XP:lle (KB951072-v2)
Päivitys Windows XP:lle (KB951978)
Päivitys Windows XP:lle (KB955839)
Päivitys Windows XP:lle (KB961503)
Päivitys Windows XP:lle (KB967715)
Päivitys Windows XP:lle (KB968389)
Päivitys Windows XP:lle (KB973815)
QuickTime
Radio_Finland Toolbar
RealPlayer
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Windows Search 4 - KB963093
Segoe UI
Sonic DLA
Sonic RecordNow!
Sonic Update Manager
SoundMAX
SpeedFan (remove only)
Storm Chasers Screensaver by Chasers.Mobilicious.com
Suojauspäivitys ohjelmistolle Windows XP (KB941569)
Suojauspäivitys Windows Internet Explorer 7:lle (KB928090)
Suojauspäivitys Windows Internet Explorer 7:lle (KB929969)
Suojauspäivitys Windows Internet Explorer 7:lle (KB931768)
Suojauspäivitys Windows Internet Explorer 7:lle (KB933566)
Suojauspäivitys Windows Internet Explorer 7:lle (KB937143)
Suojauspäivitys Windows Internet Explorer 7:lle (KB938127)
Suojauspäivitys Windows Internet Explorer 7:lle (KB939653)
Suojauspäivitys Windows Internet Explorer 7:lle (KB942615)
Suojauspäivitys Windows Internet Explorer 7:lle (KB944533)
Suojauspäivitys Windows Internet Explorer 7:lle (KB950759)
Suojauspäivitys Windows Internet Explorer 7:lle (KB953838)
Suojauspäivitys Windows Internet Explorer 7:lle (KB958215)
Suojauspäivitys Windows Internet Explorer 7:lle (KB961260)
Suojauspäivitys Windows Internet Explorer 7:lle (KB972260)
Suojauspäivitys Windows Internet Explorer 8:lle (KB971961)
Suojauspäivitys Windows Internet Explorer 8:lle (KB972260)
Suojauspäivitys Windows Internet Explorer 8:lle (KB974455)
Suojauspäivitys Windows Media Player 10:lle (KB911565)
Suojauspäivitys Windows Media Player 10:lle (KB917734)
Suojauspäivitys Windows Media Player 10:lle (KB936782)
Suojauspäivitys Windows Media Player 11:lle (KB936782)
Suojauspäivitys Windows Media Player 11:lle (KB954154)
Suojauspäivitys Windows Media Playerille (KB952069)
Suojauspäivitys Windows Media Playerille (KB954155)
Suojauspäivitys Windows Media Playerille (KB968816)
Suojauspäivitys Windows Media Playerille (KB973540)
Suojauspäivitys Windows XP:lle (KB923561)
Suojauspäivitys Windows XP:lle (KB923789)
Suojauspäivitys Windows XP:lle (KB938464)
Suojauspäivitys Windows XP:lle (KB938464-v2)
Suojauspäivitys Windows XP:lle (KB946648)
Suojauspäivitys Windows XP:lle (KB950760)
Suojauspäivitys Windows XP:lle (KB950762)
Suojauspäivitys Windows XP:lle (KB950974)
Suojauspäivitys Windows XP:lle (KB951066)
Suojauspäivitys Windows XP:lle (KB951376-v2)
Suojauspäivitys Windows XP:lle (KB951698)
Suojauspäivitys Windows XP:lle (KB951748)
Suojauspäivitys Windows XP:lle (KB952004)
Suojauspäivitys Windows XP:lle (KB952954)
Suojauspäivitys Windows XP:lle (KB953839)
Suojauspäivitys Windows XP:lle (KB954211)
Suojauspäivitys Windows XP:lle (KB954600)
Suojauspäivitys Windows XP:lle (KB955069)
Suojauspäivitys Windows XP:lle (KB956391)
Suojauspäivitys Windows XP:lle (KB956572)
Suojauspäivitys Windows XP:lle (KB956744)
Suojauspäivitys Windows XP:lle (KB956802)
Suojauspäivitys Windows XP:lle (KB956803)
Suojauspäivitys Windows XP:lle (KB956841)
Suojauspäivitys Windows XP:lle (KB956844)
Suojauspäivitys Windows XP:lle (KB957095)
Suojauspäivitys Windows XP:lle (KB957097)
Suojauspäivitys Windows XP:lle (KB958644)
Suojauspäivitys Windows XP:lle (KB958687)
Suojauspäivitys Windows XP:lle (KB958690)
Suojauspäivitys Windows XP:lle (KB958869)
Suojauspäivitys Windows XP:lle (KB959426)
Suojauspäivitys Windows XP:lle (KB960225)
Suojauspäivitys Windows XP:lle (KB960715)
Suojauspäivitys Windows XP:lle (KB960803)
Suojauspäivitys Windows XP:lle (KB960859)
Suojauspäivitys Windows XP:lle (KB961371-v2)
Suojauspäivitys Windows XP:lle (KB961501)
Suojauspäivitys Windows XP:lle (KB968537)
Suojauspäivitys Windows XP:lle (KB969059)
Suojauspäivitys Windows XP:lle (KB969947)
Suojauspäivitys Windows XP:lle (KB970238)
Suojauspäivitys Windows XP:lle (KB971486)
Suojauspäivitys Windows XP:lle (KB971557)
Suojauspäivitys Windows XP:lle (KB971633)
Suojauspäivitys Windows XP:lle (KB971657)
Suojauspäivitys Windows XP:lle (KB973346)
Suojauspäivitys Windows XP:lle (KB973354)
Suojauspäivitys Windows XP:lle (KB973507)
Suojauspäivitys Windows XP:lle (KB973525)
Suojauspäivitys Windows XP:lle (KB973869)
Suojauspäivitys Windows XP:lle (KB974112)
Suojauspäivitys Windows XP:lle (KB974571)
Suojauspäivitys Windows XP:lle (KB975025)
Suojauspäivitys Windows XP:lle (KB975467)
Synaptics Pointing Device Driver
Texas Instruments PCIxx21/x515 drivers.
Tärkeä päivitys Windows Media Player 11:lle (KB959772)
Unlocker 1.8.7
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
USB downloader
VC 9.0 Runtime
Videora iPod Converter 5.03
Windows Imaging Component
Windows Live Call
Windows Live Communications Platform
Windows Live Messenger
Windows Liven asennustyökalu
Windows Liven asennustyökalu
Windows Liven kirjautumisavustaja
Windows Liven lataustyökalu
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Media Player 11
Windows Presentation Foundation
Windows Presentation Foundation Language Pack (FIN)
Windows Search 4.0
Windows XP Service Pack 3
WinPatrol 2009
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WOT for Internet Explorer
XML Paper Specification Shared Components Language Pack 1.0

Tossa ei varmasti ole sitä wualaa

 

Poista lisää poista sovelutuksesta

Java(TM) 6 Update 3
Java(TM) 6 Update 5
J2SE Runtime Environment 5.0 Update 6

 

Tämän poistossa onnistuin: J2SE Runtime Environment 5.0 Update 6

Java(TM) 6 Update 3
Java(TM) 6 Update 5

Näitä kahta en onnistunut poistamaan. Kun painan poista nappia aukeaa ikkuna jossa lukee(englanniksi): Tervetualoa Java(TM) 6 Update 5 asennukseen. Painoin Next nappia. Sitten tuli valintaikkuna: Valitse mitkä komponentit haluat asentaa. Silloin painoin peruuta.

Että silleen...

 

jaa vai niin kertoi. ei kertonut kohtaa remove

Lataa JavaRa ja pura se työpöydällesi.

***Sulje kaikki päällä olevat Internet Explorerin ikkunat ennen jatkamista!***

* Tuplaklikkaa JavaRa.exeä käynnistääksesi ohjelma.
* Valitse English pudotusvalikosta valitaksesi kieleksi englannin ja klikkaa Select.
* Klikkaa Remove Older Versions poistaaksesi vanhat Java-versiot koneeltasi.
* Klikkaa Yes kun pyydetään. Kun JavaRa on valmis, se ilmoittaa, että lokitiedosto on luotu. Klikkaa OK.
* Lokitiedosto avautuu. Lähetä sen sisältö seuraavassa viestissäsi.

-----

Etsi toiminolla hajet missä wualaa lymyää

 

Tässä tämä:

JavaRa 1.15 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Mon Nov 23 15:17:22 2009

Found and removed: C:\Program Files\Java\jre1.6.0_03

Found and removed: C:\Program Files\Java\jre1.6.0_05

Found and removed: C:\Documents and Settings\mie\Application Data\Sun\Java\jre1.6.0_11

Found and removed: C:\Documents and Settings\mie\Application Data\Sun\Java\jre1.6.0_15

Found and removed: Software\JavaSoft\Java2D\1.5.0_06

Found and removed: SOFTWARE\Classes\JavaPlugin.150_06

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610005

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610005

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610005

Found and removed: SOFTWARE\Classes\JavaPlugin.160_03

Found and removed: SOFTWARE\Classes\JavaPlugin.160_05

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_03

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_05

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_03

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_05

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610005

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610003

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610005

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610005

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160030}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160050}

Found and removed: Software\Classes\JavaPlugin.160_03

Found and removed: Software\Classes\JavaPlugin.160_05

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_05

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_03\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_05\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_03\bin\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_05\bin\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_03.b05\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_05.b13\

------------------------------------

Finished reporting.

Hakusanalla Wuala lyötyy nämä hakutulokset:
C:\documents and settings\käyttäjänimi\Käynnistä-valikko\ohjelmat\wuala.ink
------------------Sama-----------------------------\Application Data\Wuala\Wuala.cfg
----------------Sama-------------------------------------------\Roaming\Wuala.ink
-------------Sama----------------------------------------------\Program0\Wuala.250
C:\Program files\Java\jre6\launc4j-tmp

 

1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
Combofix1
Combofix2

2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

älä asenna palautuskonsolia

 

ComboFix 09-11-22.06 - mie 23.11.2009 18:09.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.358.1035.18.1015.620 [GMT 2:00]
Sijainti: c:\documents and settings\mie\Työpöytä\ComboFix.exe
AV: COMODO Antivirus *On-access scanning disabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !!
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\install.exe
c:\windows\system32\drivers\etc\lmhosts

.
((((((((((((((((((((((((((((((((((((((( Ajurit/Palvelut )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_HDUSB


((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-10-23 to 2009-11-23 )))))))))))))))))
.

2009-11-20 17:46 . 2009-11-20 17:46 -------- d-----w- c:\documents and settings\mie\Application Data\Template
2009-11-20 15:34 . 2009-11-20 15:34 -------- d-----w- c:\program files\Disney Interactive
2009-11-20 15:32 . 2009-11-20 15:32 -------- d-----w- c:\documents and settings\mie\Local Settings\Application Data\Help
2009-11-16 17:10 . 2009-11-16 17:10 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2009-11-16 13:01 . 2009-11-16 13:02 -------- d-----w- c:\documents and settings\mie\Local Settings\Application Data\Radio_Finland
2009-11-16 13:01 . 2009-11-16 13:01 -------- d-----w- c:\program files\Conduit
2009-11-16 13:01 . 2009-11-16 13:01 -------- d-----w- c:\documents and settings\mie\Local Settings\Application Data\Conduit
2009-11-16 13:01 . 2009-11-16 13:02 -------- d-----w- c:\program files\Radio_Finland
2009-11-06 17:19 . 2009-11-06 17:19 -------- d-----w- c:\program files\iPod
2009-11-06 17:19 . 2009-11-06 17:21 -------- d-----w- c:\program files\iTunes
2009-11-06 17:09 . 2009-11-06 17:09 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-06 17:04 . 2009-11-06 17:04 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-11-04 17:08 . 2009-11-04 17:08 -------- d-----w- c:\documents and settings\mie\Application Data\Malwarebytes
2009-11-04 17:07 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-04 17:07 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-04 17:07 . 2009-11-04 17:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-04 10:53 . 2009-11-04 10:53 152576 ----a-w- c:\documents and settings\mie\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-03 12:51 . 2009-10-22 09:17 5939712 -c----w- c:\windows\system32\dllcache\mshtml.dll
2009-11-03 12:07 . 2009-11-03 12:06 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-11-01 18:10 . 2009-11-06 14:24 -------- d-----w- c:\program files\Gabest
2009-10-31 12:53 . 2009-10-31 12:53 -------- d-----w- c:\program files\HANDAN
2009-10-25 13:10 . 2009-11-01 17:01 -------- d-----w- c:\program files\Age of Empires II

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-23 16:01 . 2009-10-17 13:55 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2009-11-23 13:18 . 2006-04-26 13:04 -------- d-----w- c:\program files\Java
2009-11-22 15:49 . 2009-09-24 16:30 -------- d-----w- c:\program files\HJT
2009-11-20 15:36 . 2006-04-26 12:43 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-18 11:34 . 2009-10-17 13:49 171552 ----a-w- c:\windows\system32\guard32.dll
2009-11-18 11:34 . 2009-10-17 13:49 87104 ----a-w- c:\windows\system32\drivers\inspect.sys
2009-11-18 11:34 . 2009-10-17 13:49 25160 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2009-11-18 11:34 . 2009-10-17 13:49 132808 ----a-w- c:\windows\system32\drivers\cmdguard.sys
2009-11-14 16:24 . 2009-07-13 14:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-11-13 16:25 . 2009-09-25 14:35 -------- d-----w- c:\program files\SpeedFan
2009-11-10 18:28 . 2009-08-05 15:48 -------- d-----w- c:\program files\CCleaner
2009-11-06 17:19 . 2009-07-13 14:55 -------- d-----w- c:\program files\Common Files\Apple
2009-11-06 11:44 . 2009-09-18 15:06 -------- d-----w- c:\documents and settings\mie\Application Data\IObit
2009-11-06 11:40 . 2009-10-20 14:30 -------- d-----w- c:\documents and settings\All Users\Application Data\VMware
2009-11-06 11:40 . 2009-08-07 06:21 -------- d-----w- c:\program files\Microsoft Works
2009-11-06 11:40 . 2007-01-12 10:08 -------- d-----w- c:\documents and settings\All Users\Application Data\fssg
2009-11-06 11:40 . 2006-04-26 13:29 -------- d-----w- c:\documents and settings\All Users\Application Data\hpqwmi
2009-11-06 11:40 . 2006-04-26 12:50 -------- d-----w- c:\program files\Altiris
2009-11-04 17:28 . 2009-10-18 16:43 -------- d-----w- c:\program files\Sandboxie
2009-11-04 10:58 . 2004-09-15 12:00 99042 ----a-w- c:\windows\system32\perfc00B.dat
2009-11-04 10:58 . 2004-09-15 12:00 446450 ----a-w- c:\windows\system32\perfh00B.dat
2009-11-03 16:31 . 2009-09-08 13:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-10-31 12:56 . 2001-12-06 12:16 16908 ----a-w- c:\windows\system32\drivers\HDUSB_XP.sys
2009-10-20 17:00 . 2009-10-20 15:03 -------- d-----w- c:\documents and settings\mie\Application Data\VMware
2009-10-20 15:49 . 2009-10-03 13:40 -------- d-----w- c:\documents and settings\mie\Application Data\Wuala
2009-10-20 14:53 . 2009-10-20 14:35 -------- d-----w- c:\documents and settings\LocalService\Application Data\VMware
2009-10-20 14:27 . 2009-10-20 11:26 -------- d-----w- c:\documents and settings\mie\Application Data\Download Manager
2009-10-19 13:01 . 2006-04-27 09:25 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-18 13:20 . 2009-10-18 13:20 -------- d-----w- c:\program files\WOT
2009-10-18 07:53 . 2009-10-18 07:53 -------- d-----w- c:\program files\Axis Communications
2009-10-17 13:56 . 2009-10-17 13:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo
2009-10-17 13:49 . 2009-10-17 13:49 -------- d-----w- c:\program files\COMODO
2009-10-16 15:38 . 2009-10-03 13:40 253952 ----a-w- c:\documents and settings\mie\Application Data\Wuala\Roaming\Wuala.exe
2009-10-16 15:30 . 2009-10-16 15:30 -------- d-----w- c:\documents and settings\mie\Application Data\WinPatrol
2009-10-16 15:30 . 2009-10-16 15:30 -------- d-----w- c:\program files\BillP Studios
2009-10-11 02:17 . 2008-12-16 12:41 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-08 13:02 . 2009-10-08 13:02 520192 ----a-w- c:\windows\system32\pc_screen_nesquik2.scr
2009-10-08 12:32 . 2009-10-08 12:32 -------- d-----w- c:\documents and settings\mie\Application Data\Red Kawa
2009-10-08 12:31 . 2009-10-08 12:27 -------- d-----w- c:\program files\AviSynth 2.5
2009-10-08 12:27 . 2009-10-08 12:27 -------- d-----w- c:\program files\Red Kawa
2009-10-07 07:03 . 2009-10-19 12:47 94992 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
2009-10-07 07:03 . 2009-10-19 12:46 41424 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2009-10-07 07:02 . 2009-10-19 12:47 115856 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2009-10-05 16:12 . 2009-10-05 16:12 -------- d-----w- c:\program files\TGTSoft
2009-10-03 16:46 . 2009-07-13 15:01 -------- d-----w- c:\documents and settings\mie\Application Data\Apple Computer
2009-10-03 15:49 . 2009-10-03 15:49 348160 ------w- c:\documents and settings\mie\Application Data\Wuala\Program0\swt-win32-3550.dll
2009-10-03 15:48 . 2009-09-26 07:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-10-03 15:45 . 2009-09-26 07:44 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-10-03 14:10 . 2009-10-03 14:10 -------- d-----w- c:\documents and settings\mie\Application Data\Windows Search
2009-10-03 13:51 . 2009-10-03 13:51 53248 ----a-w- c:\documents and settings\mie\Application Data\Wuala\Program0\Win32Utils.dll
2009-10-03 13:46 . 2009-10-03 13:46 52356 ----a-w- c:\documents and settings\mie\Application Data\Wuala\Program0\fec16.dll
2009-10-03 13:40 . 2009-10-03 13:40 592175 ----a-w- c:\documents and settings\mie\Application Data\Wuala\Program0\orangevolt-4n-1.0.7.dll
2009-10-03 13:38 . 2009-10-03 13:38 69632 ----a-w- c:\documents and settings\mie\Application Data\Wuala\Program0\Win32NetBIOS.dll
2009-10-02 14:16 . 2009-10-01 17:03 -------- d-----w- c:\program files\Windows Desktop Search
2009-10-01 17:05 . 2009-10-01 17:05 -------- d-----w- c:\documents and settings\mie\Application Data\Windows Desktop Search
2009-10-01 10:54 . 2009-10-01 10:54 -------- d-----w- c:\program files\Microsoft
2009-09-29 16:39 . 2009-09-29 16:39 -------- d-----w- c:\documents and settings\mie\Application Data\abelhadigital.com
2009-09-29 16:39 . 2009-09-29 16:39 -------- d-----w- c:\documents and settings\All Users\Application Data\abelhadigital.com
2009-09-29 16:38 . 2009-09-29 16:38 -------- d-----w- c:\program files\HostsMan
2009-09-29 14:19 . 2009-07-17 14:31 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-28 16:12 . 2009-09-28 16:12 4096 ----a-w- c:\windows\d3dx.dat
2009-09-28 11:40 . 2009-09-28 11:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-26 07:39 . 2006-04-26 13:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-09-26 07:38 . 2009-09-26 07:38 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-09-11 14:18 . 2004-09-15 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:04 . 2004-09-15 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-03 15:53 . 2009-09-03 15:41 133168 ----a-w- c:\windows\INSTALL.scr
2009-09-01 17:08 . 2009-09-01 17:08 29184 ----a-w- c:\windows\system32\ssunstl.exe
2009-08-29 07:58 . 2004-09-15 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-28 16:42 . 2009-07-13 14:55 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-28 16:42 . 2009-07-13 14:55 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-26 08:01 . 2004-09-15 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8b8428dc-00f3-409f-9e8c-bfec3a863db9}]
2009-11-16 13:02 2166296 ----a-w- c:\program files\Radio_Finland\tbRad1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{8b8428dc-00f3-409f-9e8c-bfec3a863db9}"= "c:\program files\Radio_Finland\tbRad1.dll" [2009-11-16 2166296]

[HKEY_CLASSES_ROOT\clsid\{8b8428dc-00f3-409f-9e8c-bfec3a863db9}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{8B8428DC-00F3-409F-9E8C-BFEC3A863DB9}"= "c:\program files\Radio_Finland\tbRad1.dll" [2009-11-16 2166296]

[HKEY_CLASSES_ROOT\clsid\{8b8428dc-00f3-409f-9e8c-bfec3a863db9}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-08-26 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-14 1015808]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-09-07 213054]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-02 122939]
"snp2std"="c:\windows\vsnp2std.exe" [2006-11-25 675840]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-14 102400]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-11-18 1800464]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-04-13 88209]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SbieSvc"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [17.10.2009 15:49 132808]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [17.10.2009 15:49 25160]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S2 gupdate1ca26486bfa0f32;Google-päivityspalvelu (gupdate1ca26486bfa0f32);c:\program files\Google\Update\GoogleUpdate.exe [26.8.2009 14:26 133104]
S3 getPlusHelper;getPlus(R) Helper;c:\windows\System32\svchost.exe -k getPlusHelper [15.9.2004 14:00 14336]
S3 SbieDrv;SbieDrv;\??\c:\program files\Sandboxie\SbieDrv.sys --> c:\program files\Sandboxie\SbieDrv.sys [?]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [19.10.2009 14:47 94992]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys --> c:\windows\system32\DRIVERS\VBoxNetFlt.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
'Ajoitetut tehtävät'-kansion sisältö

2009-11-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]

2009-11-23 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-08-26 12:24]

2009-11-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 12:25]

2009-11-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 12:25]

2009-11-23 c:\windows\Tasks\User_Feed_Synchronization-{33735EFF-B80D-4B9D-A06B-CDD68FEE0D7A}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 01:31]
.
.
------- Täydentävä tarkistus -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
TCP: {0CF8F411-B5EC-4475-AB11-7F862942C16B} = 193.210.18.18,193.210.19.19
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://www.myapplecam.com/activex/AMC.cab
.
- - - - POISTETUT JÄMÄRIVIT - - - -

Toolbar-Locked - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-23 18:24
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

tarkistaa piilotettuja prosesseja ...

tarkistaa piilotettuja käynnistysarvoja ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????0?6?2?0??????? ???B???????????????B? ??????

tarkistaa piilotettuja tiedostoja ...

tarkistus on valmis
piilotetut tiedostot: 0

**************************************************************************
.
--------------------- LUKITUT REKISTERIAVAIMET ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\�•€|ÿÿÿÿ"•€|þ»Ów*]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\PUBPLACE.HTT"
.
--------------------- Prosesseihin ladatut DLLt ---------------------

- - - - - - - > 'winlogon.exe'(1700)
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'explorer.exe'(3576)
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Muut prosessit ------------------------
.
c:\program files\COMODO\COMODO Internet Security\cmdagent.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\System32\bcmwltry.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\program files\Windows Live\Contacts\wlcomm.exe
.
**************************************************************************
.
Valmistumisajankohta: 2009-11-23 18:38 - kone käynnistettiin uudelleen
ComboFix-quarantined-files.txt 2009-11-23 16:38

Ennen ajoa: 16 513 880 064 tavua vapaana
Ajon jälkeen: 16 462 471 168 tavua vapaana

- - End Of File - - 1170EB4155ECDC2B4B4CB2A9BEF25FDE

 

Nyt tuon punaisella merkityn Kopioit / liität Tyhjään muistioon
käynnistä nappi >apuohjelmat > muistio

Folder::
c:\documents and settings\mie\Application Data\Wuala

sittten vasemmasta ylä reunasta tiedosto > tallenna nimellä

Kohde: työpöytä

Tiedostonimi: CFScript.txt

Tallennusmuoto: kaikki tiedostot

sitten raahaat sen kuvan osoittamalla tavalla. Työpöydällä Combofix.exe:een ja pudotat sen sinne.



combofix työstää tulee sininen taulu paina numeroa 1 ja enter

Laita tuleva loki tänne.

Sammutat ja käynnistät koneen

 

Homma meni muuten nappiin en vain missään vaiheessa kerennyt painamaan 1 näppäintä. Kun olin vetänyt CFScript.txt tiedoston Combofix kuvakkeen päälle,sininen ruutu aukesi mutta tarkistus alkoi heti ja siihen alkoi tulla niitä Valmis osio1, valmis osio 2...
Ohjelma kyllä poisti Wualaan liittyviä tiedostoja ja eikä wuala enää auennut Kaikki-ohjelmat valikon kautta, joten poistin Wuala pikakuvakkeen sieltä. Koneen ainoan käyttäjätilin nimi oli ENNEN mie. Vaihdoin sen jo aikoja sitten mutta edelleen monissa paikoissa lukee \Documents and settings\mie\... Miksi?

ComboFix 09-11-23.04 - mie 24.11.2009 15:42.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.358.1035.18.1015.645 [GMT 2:00]
Sijainti: c:\documents and settings\mie\Omat tiedostot\ComboFix.exe
Käytetyt komentorivivalitsimet :: c:\documents and settings\mie\Työpöytä\CFScript.txt
AV: COMODO Antivirus *On-access scanning disabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !!
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\mie\Application Data\Wuala
c:\documents and settings\mie\Application Data\Wuala\Data\Local2\Large\A63652D58CDA0843FC015FE03C0F33E9F8B34670
c:\documents and settings\mie\Application Data\Wuala\Data\Local2\Large\AA19E0F0DFA0DA9433AF93BA3AC55C250D5D6C32
c:\documents and settings\mie\Application Data\Wuala\Data\Local2\Large\CF10D984F81EAB8E4C54B41DC11096082035DBC5
c:\documents and settings\mie\Application Data\Wuala\Data\Local2\Large\F86FF086F98DEC139568ACDAF886492DF4510189
c:\documents and settings\mie\Application Data\Wuala\Data\Local2\Map\Map.index
c:\documents and settings\mie\Application Data\Wuala\Data\Local2\Map\Map0.db
c:\documents and settings\mie\Application Data\Wuala\Data\Local2\Map\PendingTransfers.index
c:\documents and settings\mie\Application Data\Wuala\Data\Local2\Map\PendingTransfers0.db
c:\documents and settings\mie\Application Data\Wuala\Data\Local2\Small\Small.index
c:\documents and settings\mie\Application Data\Wuala\Data\Local2\Small\Small0.db
c:\documents and settings\mie\Application Data\Wuala\Data\Machine.dat
c:\documents and settings\mie\Application Data\Wuala\Data\Meta\MetaB.index
c:\documents and settings\mie\Application Data\Wuala\Data\Meta\MetaB0.db
c:\documents and settings\mie\Application Data\Wuala\Data\Meta\PendingTransactions.index
c:\documents and settings\mie\Application Data\Wuala\Data\Meta\PendingTransactions0.db
c:\documents and settings\mie\Application Data\Wuala\Data\Meta\Stamps.index
c:\documents and settings\mie\Application Data\Wuala\Data\Meta\Stamps0.db
c:\documents and settings\mie\Application Data\Wuala\Data\Meta\Users.index
c:\documents and settings\mie\Application Data\Wuala\Data\Meta\Users0.db
c:\documents and settings\mie\Application Data\Wuala\Data\NodeTable.ctm
c:\documents and settings\mie\Application Data\Wuala\Prefs.index
c:\documents and settings\mie\Application Data\Wuala\Prefs0.db
c:\documents and settings\mie\Application Data\Wuala\Program0\fec16.dll
c:\documents and settings\mie\Application Data\Wuala\Program0\orangevolt-4n-1.0.7.dll
c:\documents and settings\mie\Application Data\Wuala\Program0\swt-win32-3550.dll
c:\documents and settings\mie\Application Data\Wuala\Program0\Win32NetBIOS.dll
c:\documents and settings\mie\Application Data\Wuala\Program0\Win32Utils.dll
c:\documents and settings\mie\Application Data\Wuala\Program0\Wuala.250
c:\documents and settings\mie\Application Data\Wuala\Roaming\defaultUser
c:\documents and settings\mie\Application Data\Wuala\Roaming\Wuala.exe
c:\documents and settings\mie\Application Data\Wuala\Wuala.cfg

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-10-24 to 2009-11-24 )))))))))))))))))
.

2009-11-20 17:46 . 2009-11-20 17:46 -------- d-----w- c:\documents and settings\mie\Application Data\Template
2009-11-20 15:34 . 2009-11-20 15:34 -------- d-----w- c:\program files\Disney Interactive
2009-11-20 15:32 . 2009-11-20 15:32 -------- d-----w- c:\documents and settings\mie\Local Settings\Application Data\Help
2009-11-16 17:10 . 2009-11-16 17:10 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2009-11-16 13:01 . 2009-11-16 13:02 -------- d-----w- c:\documents and settings\mie\Local Settings\Application Data\Radio_Finland
2009-11-16 13:01 . 2009-11-16 13:01 -------- d-----w- c:\program files\Conduit
2009-11-16 13:01 . 2009-11-16 13:01 -------- d-----w- c:\documents and settings\mie\Local Settings\Application Data\Conduit
2009-11-16 13:01 . 2009-11-16 13:02 -------- d-----w- c:\program files\Radio_Finland
2009-11-06 17:19 . 2009-11-06 17:19 -------- d-----w- c:\program files\iPod
2009-11-06 17:19 . 2009-11-06 17:21 -------- d-----w- c:\program files\iTunes
2009-11-06 17:09 . 2009-11-06 17:09 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-06 17:04 . 2009-11-06 17:04 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-11-04 17:08 . 2009-11-04 17:08 -------- d-----w- c:\documents and settings\mie\Application Data\Malwarebytes
2009-11-04 17:07 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-04 17:07 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-04 17:07 . 2009-11-04 17:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-04 10:53 . 2009-11-04 10:53 152576 ----a-w- c:\documents and settings\mie\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-03 12:51 . 2009-10-22 09:17 5939712 -c----w- c:\windows\system32\dllcache\mshtml.dll
2009-11-03 12:07 . 2009-11-03 12:06 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-11-01 18:10 . 2009-11-06 14:24 -------- d-----w- c:\program files\Gabest
2009-10-31 12:53 . 2009-10-31 12:53 -------- d-----w- c:\program files\HANDAN

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-24 13:34 . 2009-10-17 13:55 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2009-11-23 13:18 . 2006-04-26 13:04 -------- d-----w- c:\program files\Java
2009-11-22 15:49 . 2009-09-24 16:30 -------- d-----w- c:\program files\HJT
2009-11-20 15:36 . 2006-04-26 12:43 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-18 11:34 . 2009-10-17 13:49 171552 ----a-w- c:\windows\system32\guard32.dll
2009-11-18 11:34 . 2009-10-17 13:49 87104 ----a-w- c:\windows\system32\drivers\inspect.sys
2009-11-18 11:34 . 2009-10-17 13:49 25160 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2009-11-18 11:34 . 2009-10-17 13:49 132808 ----a-w- c:\windows\system32\drivers\cmdguard.sys
2009-11-14 16:24 . 2009-07-13 14:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-11-13 16:25 . 2009-09-25 14:35 -------- d-----w- c:\program files\SpeedFan
2009-11-10 18:28 . 2009-08-05 15:48 -------- d-----w- c:\program files\CCleaner
2009-11-06 17:19 . 2009-07-13 14:55 -------- d-----w- c:\program files\Common Files\Apple
2009-11-06 11:44 . 2009-09-18 15:06 -------- d-----w- c:\documents and settings\mie\Application Data\IObit
2009-11-06 11:40 . 2009-10-20 14:30 -------- d-----w- c:\documents and settings\All Users\Application Data\VMware
2009-11-06 11:40 . 2009-08-07 06:21 -------- d-----w- c:\program files\Microsoft Works
2009-11-06 11:40 . 2007-01-12 10:08 -------- d-----w- c:\documents and settings\All Users\Application Data\fssg
2009-11-06 11:40 . 2006-04-26 13:29 -------- d-----w- c:\documents and settings\All Users\Application Data\hpqwmi
2009-11-06 11:40 . 2006-04-26 12:50 -------- d-----w- c:\program files\Altiris
2009-11-04 17:28 . 2009-10-18 16:43 -------- d-----w- c:\program files\Sandboxie
2009-11-04 10:58 . 2004-09-15 12:00 99042 ----a-w- c:\windows\system32\perfc00B.dat
2009-11-04 10:58 . 2004-09-15 12:00 446450 ----a-w- c:\windows\system32\perfh00B.dat
2009-11-03 16:31 . 2009-09-08 13:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-11-01 17:01 . 2009-10-25 13:10 -------- d-----w- c:\program files\Age of Empires II
2009-10-31 12:56 . 2001-12-06 12:16 16908 ----a-w- c:\windows\system32\drivers\HDUSB_XP.sys
2009-10-20 17:00 . 2009-10-20 15:03 -------- d-----w- c:\documents and settings\mie\Application Data\VMware
2009-10-20 14:53 . 2009-10-20 14:35 -------- d-----w- c:\documents and settings\LocalService\Application Data\VMware
2009-10-20 14:27 . 2009-10-20 11:26 -------- d-----w- c:\documents and settings\mie\Application Data\Download Manager
2009-10-19 13:01 . 2006-04-27 09:25 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-18 13:20 . 2009-10-18 13:20 -------- d-----w- c:\program files\WOT
2009-10-18 07:53 . 2009-10-18 07:53 -------- d-----w- c:\program files\Axis Communications
2009-10-17 13:56 . 2009-10-17 13:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo
2009-10-17 13:49 . 2009-10-17 13:49 -------- d-----w- c:\program files\COMODO
2009-10-16 15:30 . 2009-10-16 15:30 -------- d-----w- c:\documents and settings\mie\Application Data\WinPatrol
2009-10-16 15:30 . 2009-10-16 15:30 -------- d-----w- c:\program files\BillP Studios
2009-10-11 02:17 . 2008-12-16 12:41 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-08 13:02 . 2009-10-08 13:02 520192 ----a-w- c:\windows\system32\pc_screen_nesquik2.scr
2009-10-08 12:32 . 2009-10-08 12:32 -------- d-----w- c:\documents and settings\mie\Application Data\Red Kawa
2009-10-08 12:31 . 2009-10-08 12:27 -------- d-----w- c:\program files\AviSynth 2.5
2009-10-08 12:27 . 2009-10-08 12:27 -------- d-----w- c:\program files\Red Kawa
2009-10-07 07:03 . 2009-10-19 12:47 94992 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
2009-10-07 07:03 . 2009-10-19 12:46 41424 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2009-10-07 07:02 . 2009-10-19 12:47 115856 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2009-10-05 16:12 . 2009-10-05 16:12 -------- d-----w- c:\program files\TGTSoft
2009-10-03 16:46 . 2009-07-13 15:01 -------- d-----w- c:\documents and settings\mie\Application Data\Apple Computer
2009-10-03 15:48 . 2009-09-26 07:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-10-03 15:45 . 2009-09-26 07:44 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-10-03 14:10 . 2009-10-03 14:10 -------- d-----w- c:\documents and settings\mie\Application Data\Windows Search
2009-10-02 14:16 . 2009-10-01 17:03 -------- d-----w- c:\program files\Windows Desktop Search
2009-10-01 17:05 . 2009-10-01 17:05 -------- d-----w- c:\documents and settings\mie\Application Data\Windows Desktop Search
2009-10-01 10:54 . 2009-10-01 10:54 -------- d-----w- c:\program files\Microsoft
2009-09-29 16:39 . 2009-09-29 16:39 -------- d-----w- c:\documents and settings\mie\Application Data\abelhadigital.com
2009-09-29 16:39 . 2009-09-29 16:39 -------- d-----w- c:\documents and settings\All Users\Application Data\abelhadigital.com
2009-09-29 16:38 . 2009-09-29 16:38 -------- d-----w- c:\program files\HostsMan
2009-09-29 14:19 . 2009-07-17 14:31 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-28 16:12 . 2009-09-28 16:12 4096 ----a-w- c:\windows\d3dx.dat
2009-09-28 11:40 . 2009-09-28 11:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-26 07:39 . 2006-04-26 13:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-09-26 07:38 . 2009-09-26 07:38 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-09-11 14:18 . 2004-09-15 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:04 . 2004-09-15 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-03 15:53 . 2009-09-03 15:41 133168 ----a-w- c:\windows\INSTALL.scr
2009-09-01 17:08 . 2009-09-01 17:08 29184 ----a-w- c:\windows\system32\ssunstl.exe
2009-08-29 07:58 . 2004-09-15 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-08-28 16:42 . 2009-07-13 14:55 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-28 16:42 . 2009-07-13 14:55 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-11-23_16.24.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-24 12:35 . 2009-11-24 12:35 16384 c:\windows\Temp\Perflib_Perfdata_71c.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8b8428dc-00f3-409f-9e8c-bfec3a863db9}]
2009-11-16 13:02 2166296 ----a-w- c:\program files\Radio_Finland\tbRad1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{8b8428dc-00f3-409f-9e8c-bfec3a863db9}"= "c:\program files\Radio_Finland\tbRad1.dll" [2009-11-16 2166296]

[HKEY_CLASSES_ROOT\clsid\{8b8428dc-00f3-409f-9e8c-bfec3a863db9}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{8B8428DC-00F3-409F-9E8C-BFEC3A863DB9}"= "c:\program files\Radio_Finland\tbRad1.dll" [2009-11-16 2166296]

[HKEY_CLASSES_ROOT\clsid\{8b8428dc-00f3-409f-9e8c-bfec3a863db9}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-08-26 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-14 1015808]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-09-07 213054]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-02 122939]
"snp2std"="c:\windows\vsnp2std.exe" [2006-11-25 675840]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-14 102400]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-11-18 1800464]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-04-13 88209]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SbieSvc"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [17.10.2009 15:49 132808]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [17.10.2009 15:49 25160]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S2 gupdate1ca26486bfa0f32;Google-päivityspalvelu (gupdate1ca26486bfa0f32);c:\program files\Google\Update\GoogleUpdate.exe [26.8.2009 14:26 133104]
S3 getPlusHelper;getPlus(R) Helper;c:\windows\System32\svchost.exe -k getPlusHelper [15.9.2004 14:00 14336]
S3 SbieDrv;SbieDrv;\??\c:\program files\Sandboxie\SbieDrv.sys --> c:\program files\Sandboxie\SbieDrv.sys [?]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [19.10.2009 14:47 94992]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys --> c:\windows\system32\DRIVERS\VBoxNetFlt.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
'Ajoitetut tehtävät'-kansion sisältö

2009-11-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]

2009-11-24 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-08-26 12:24]

2009-11-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 12:25]

2009-11-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 12:25]

2009-11-24 c:\windows\Tasks\User_Feed_Synchronization-{33735EFF-B80D-4B9D-A06B-CDD68FEE0D7A}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 01:31]
.
.
------- Täydentävä tarkistus -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
TCP: {0CF8F411-B5EC-4475-AB11-7F862942C16B} = 193.210.18.18,193.210.19.19
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://www.myapplecam.com/activex/AMC.cab
.
- - - - POISTETUT JÄMÄRIVIT - - - -

AddRemove-AXIS Media Control Embedded - c:\program files\Axis Communications\AXIS Media Control Embedded\setup.exe setup.rem remove
AddRemove-Broadcom 802.11 Application - c:\windows\system32\BCMWLU00.exe verbose
AddRemove-Broadcom 802.11b Network Adapter - c:\windows\system32\BCMWLU00.exe verbose
AddRemove-RealPlayer 12.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|12.0
AddRemove-Storm Chasers - c:\windows\system32\ssunstl.exe Storm Chasers
AddRemove-{91810AFC-A4F8-4EBA-A5AA-B198BBC81144} - c:\program files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe REMOVEALL



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-24 15:53
Windows 5.1.2600 Service Pack 3 NTFS

tarkistaa piilotettuja prosesseja ...

tarkistaa piilotettuja käynnistysarvoja ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????0?6?2?0??????? ???B???????????????B? ??????

tarkistaa piilotettuja tiedostoja ...

tarkistus on valmis
piilotetut tiedostot: 0

**************************************************************************
.
--------------------- LUKITUT REKISTERIAVAIMET ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\�•€|ÿÿÿÿ"•€|þ»Ów*]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\PUBPLACE.HTT"
.
--------------------- Prosesseihin ladatut DLLt ---------------------

- - - - - - - > 'winlogon.exe'(1452)
c:\windows\system32\guard32.dll
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'lsass.exe'(1560)
c:\windows\system32\guard32.dll
.
Valmistumisajankohta: 2009-11-24 15:58
ComboFix-quarantined-files.txt 2009-11-24 13:57

Ennen ajoa: 16 424 124 416 tavua vapaana
Ajon jälkeen: 16 423 145 472 tavua vapaana

- - End Of File - - CCA664A0A7462DA1050C24BB603F6A5A

 

Kirjoita suorita luukkuun

ComboFix.exe /u

Klikkaa OK

-----

Ccleaner Puhdistaja ja rekisteri siivous

 

Kun syötin tuon komennon Suorita ikkunaan siihen tuli se vihreä palkki, mutta se jumittui puoleenväliin. n. 15 minuutin päästä suljin sen tehtävähallinnasta, koska kone ei selvästikkään tehnyt mitään(suoritinkäyttö alle 10 %). Kokeilin uudelleen edelleen sama tulos. Kun etsin rekisterivirheitä Ccleanerillä suurin osa tuloksista liittyi jotenkin Combofixiin.

 

Ok poista se combofix resussinhallinasta ja Qoobox
Työpöydältä se combofix kuvake

----

Lataa OTMoveIt
OTMoveIt ja tallenna se työpöydällesi.

Tuplaklikkaa OTMoveIt.exe.
Klikkaa CleanUp!.
Valitse Yes kun kysytään "Begin cleanup Process?".
Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.

HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.