Käynnistys ongelma

Viestiketju Virukset ja haittaohjelmat -osiossa. Ketjun avasi anninam 17.09.2008.

Sivu 1 / 2
  1. anninam

    anninam Member

    Liittynyt:
    17.09.2008
    Viestejä:
    20
    Kiitokset:
    0
    Pisteet:
    11
    Kun avaan koneen työkalurivi ja kuvakkeet puuttuvat työpöydältä. Olen scannaillut konetta eri ohjelmilla , mutta ongelma ei ole hävinnyt. Neuvoja?
     
    anninam, 17.09.2008
    #1
  2.  
  3. Hujo

    Hujo Guest

    Lataa TÄSTÄ HJTInstall.exe

    * Tallenna HJTInstall.exe työpöydällesi.
    * Tuplaklikkaa HJTInstall.exe-kuvaketta työpöydälläsi.
    * Oletuksena se asentaa itsensä hakemistoon C:\Program Files\Trend Micro\HijackThis.
    * Klikkaa Install.
    * Asennusohjelma luo HijackThis-kuvakkeen työpöydälle.
    * Kun asennus on valmis, se käynnistää HijackThisin.
    * Klikkaa Do a system scan and save a logfile-painiketta. Ohjelma aloittaa skannauksen ja lokin pitäisi avautua Muistioon.
    * Klikkaa ensin "Muokkaa > Valitse kaikki" sitten "Muokkaa > Kopioi" kopioidaksesi koko lokin sisällön.
    * Liitä lokin sisältö seuraavaan vastaukseesi.
    * ÄLÄ käytä Analyse This-nappulaa, sen löydöt ovat vaarallisia väärinymmärrettyinä.
    * ÄLÄ fixaa HijackThis-ohjelmalla vielä mitään. Suurin osa sen löydöistä ovat joko harmittomia tai jopa tarpeellisia.
     
    Hujo, 18.09.2008
    #2
  4. anninam

    anninam Member

    Liittynyt:
    17.09.2008
    Viestejä:
    20
    Kiitokset:
    0
    Pisteet:
    11
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:03:56, on 18.9.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\a-squared Anti-Malware\a2service.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\WgaTray.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/fi/index.php?rvs=hompag&d=79919171
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: (no name) - {2BF5DB8F-1DB2-48DD-A1CE-C24C6178C4CD} - C:\WINDOWS\system32\dpwsoc.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Perheturva\fssbho.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Perheturva\fssui.exe" -autorun
    O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe" /d=60
    O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
    O4 - HKLM\..\RunOnce: [Trojan Remover] "C:\Program Files\Trojan Remover\RMVTRJAN.EXE" /restart
    O4 - HKLM\..\RunOnce: [SpybotDeletingA4736] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome.manifest"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC2843] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome.manifest"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA5727] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC746] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA8670] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC274] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA9726] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC1835] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA5718] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC8693] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA3188] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC5382] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
    O4 - HKCU\..\Run: [Picasa Media Detector] E:\Picasa2\PicasaMediaDetector.exe
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [realup] C:\DOCUME~1\Noora\APPLIC~1\DENTFI~1\hide comp.exe
    O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
    O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
    O4 - HKCU\..\Run: [No! Flash] C:\Program Files\NoFlash\NoFlash.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
    O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
    O4 - HKCU\..\Run: [Vista Rainbar] C:\Program Files\Vista Rainbar\Rainmeter.exe
    O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?16c732d24798413dba02e2739565bd6f
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?16c732d24798413dba02e2739565bd6f
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 10646 bytes
     
    anninam, 18.09.2008
    #3
  5. Hujo

    Hujo Guest

    Poista lisää poista sovelutuksesta

    a-squared Anti-Malware
    AdVantage
    Spybot - Search & Destroy
    Trojan Remover

    ===============

    Poista kansiot vikasiedossa.

    C:\Program Files\a-squared Anti-Malware
    C:\Program Files\AdVantage
    C:\Program Files\Spybot - Search & Destroy
    C:\Program Files\Trojan Remover

    ================

    Scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA4736] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome.manifest"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC2843] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome.manifest"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA5727] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC746] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA8670] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC274] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA9726] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC1835] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA5718] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC8693] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA3188] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC5382] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll"
    O4 - HKCU\..\Run: [realup] C:\DOCUME~1\Noora\APPLIC~1\DENTFI~1\hide comp.exe


    =============

    Kumpi virustorjunta on käytössä Avasti vai avg8:n

    =============

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    =============

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi
     
    Moderaattorin viimeksi muokkaama: 18.09.2008
    Hujo, 18.09.2008
    #4
  6. anninam

    anninam Member

    Liittynyt:
    17.09.2008
    Viestejä:
    20
    Kiitokset:
    0
    Pisteet:
    11
    Avast käytössä poistin avg
     
    anninam, 18.09.2008
    #5
  7. anninam

    anninam Member

    Liittynyt:
    17.09.2008
    Viestejä:
    20
    Kiitokset:
    0
    Pisteet:
    11
    En pääse vikasietotilaan vaikka kokeilin rmpyttää F8 nappia käynnistyksen yhteydessä.
     
    anninam, 18.09.2008
    #6
  8. Hujo

    Hujo Guest

    sitten F5
     
    Hujo, 18.09.2008
    #7
  9. anninam

    anninam Member

    Liittynyt:
    17.09.2008
    Viestejä:
    20
    Kiitokset:
    0
    Pisteet:
    11
    ei toimi myöskään F5
     
    anninam, 18.09.2008
    #8
  10. Hujo

    Hujo Guest

    aja tuo combofix normaalissa tilassa
     
    Hujo, 18.09.2008
    #9
  11. anninam

    anninam Member

    Liittynyt:
    17.09.2008
    Viestejä:
    20
    Kiitokset:
    0
    Pisteet:
    11
    ComboFix 08-09-19.09 - Perhe 2008-09-20 14:53:07.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1035.18.227 [GMT 3:00]
    Sijainti: C:\Documents and Settings\Perhe\Ty”p”yt„\ComboFix.exe
    * Uusi palautuspiste luotu

    VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\All Users\Application Data\salesmonitor

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-08-20 to 2008-09-20 )))))))))))))))))
    .

    2008-09-18 22:07 . 2008-09-18 22:07 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
    2008-09-18 17:02 . 2008-09-18 17:02 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-09-13 20:32 . 2008-09-13 20:32 <KANSIO> d-------- C:\Program Files\AVG
    2008-09-13 18:00 . 2008-09-13 18:13 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-09-13 15:40 . 2008-09-13 15:40 764 --a------ C:\WINDOWS\wininit.ini
    2008-09-11 23:47 . 2008-09-11 23:47 <KANSIO> d-------- C:\Documents and Settings\Perhe\Application Data\Simply Super Software
    2008-09-11 22:09 . 2008-09-18 22:08 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-09-11 22:09 . 2008-09-18 22:08 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-09-11 22:06 . 2008-09-11 22:53 <KANSIO> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2008-09-11 21:49 . 2008-09-11 21:49 5,632 --ahs---- C:\WINDOWS\system32\Thumbs.db
    2008-09-11 21:04 . 2008-09-11 21:05 <KANSIO> d-------- C:\VTPFiles
    2008-09-10 20:47 . 2008-04-14 19:11 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
    2008-09-10 20:47 . 2008-04-14 18:46 14,720 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
    2008-09-10 20:46 . 2008-04-13 21:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
    2008-09-10 18:01 . 2008-09-18 22:11 <KANSIO> d-------- C:\Program Files\Common Files\Symantec Shared
    2008-09-09 15:06 . 2008-09-09 18:40 <KANSIO> d-------- C:\WINDOWS\system32\Adobe
    2008-09-01 07:17 . 2008-09-01 07:17 <KANSIO> d-------- C:\WINDOWS\system32\fi
    2008-09-01 07:17 . 2008-09-01 07:17 <KANSIO> d-------- C:\WINDOWS\system32\bits
    2008-09-01 07:17 . 2008-09-01 07:17 <KANSIO> d-------- C:\WINDOWS\l2schemas
    2008-09-01 07:14 . 2008-09-01 07:17 <KANSIO> d-------- C:\WINDOWS\ServicePackFiles
    2008-08-28 21:21 . 2008-08-28 21:22 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
    2008-08-28 21:21 . 2008-08-28 21:21 <KANSIO> d-------- C:\Program Files\Common Files\Nokia
    2008-08-28 21:20 . 2008-08-28 21:20 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
    2008-08-28 21:20 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
    2008-08-28 21:19 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
    2008-08-28 21:19 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
    2008-08-28 21:19 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
    2008-08-28 21:19 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
    2008-08-28 21:19 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
    2008-08-27 09:52 . 2004-09-14 16:06 701,440 --------- C:\WINDOWS\system32\drivers\ati2mtag.sys

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-13 17:26 --------- d-----w C:\Program Files\Google
    2008-09-13 17:20 --------- d-----w C:\Program Files\IrfanView
    2008-09-13 17:18 --------- d-----w C:\Program Files\GIMP-2.0
    2008-09-13 17:17 --------- d-----w C:\Program Files\Image-Line
    2008-09-11 18:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-09-11 16:46 --------- d-----w C:\Program Files\Stardock
    2008-08-30 13:21 --------- d-----w C:\Documents and Settings\Perhe\Application Data\Winamp
    2008-08-28 18:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
    2008-08-28 18:21 --------- d-----w C:\Program Files\Nokia
    2008-08-25 13:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Open Ante Anti Dog
    2008-08-19 13:25 5,632 ----a-w C:\WINDOWS\system32\drivers\StarOpen.sys
    2008-08-01 19:25 --------- d-----w C:\Program Files\Continuum
    2008-07-20 18:13 --------- d-----w C:\Documents and Settings\Perhe\Application Data\TransRender
    2008-07-20 18:13 --------- d-----w C:\Documents and Settings\Perhe\Application Data\Temporary
    2008-07-20 18:13 --------- d-----w C:\Documents and Settings\Perhe\Application Data\Samsung
    2008-07-20 18:13 --------- d-----w C:\Documents and Settings\Perhe\Application Data\ConvertTemp
    2008-07-20 18:05 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-07-20 18:05 --------- d-----w C:\Program Files\Samsung
    2008-07-20 18:04 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
    2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
    2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
    2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
    2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
    2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
    2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2008-07-18 19:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
    2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
    2008-07-18 18:39 586,752 ----a-w C:\WINDOWS\WLXPGSS.SCR
    2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
    2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
    2008-06-24 15:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
    2008-06-23 15:10 666,112 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-06-20 17:47 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-10 21:28 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "SpybotDeletingB8162"="command" [X]
    "SpybotDeletingD1406"="del" [X]
    "SpybotDeletingB8299"="command" [X]
    "SpybotDeletingD3598"="del" [X]
    "SpybotDeletingB637"="command" [X]
    "SpybotDeletingD4035"="del" [X]
    "SpybotDeletingB9011"="command" [X]
    "SpybotDeletingD6478"="del" [X]
    "SpybotDeletingB9570"="command" [X]
    "SpybotDeletingD3832"="del" [X]
    "SpybotDeletingB3016"="command" [X]
    "SpybotDeletingD4426"="del" [X]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-12-14 221184]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
    "fssui"="C:\Program Files\Windows Live\Perheturva\fssui.exe" [2007-12-17 243240]
    "avast!"="C:\Program Files\Alwil Software\Avast4\ashDisp.exe" [2008-07-19 78008]
    "SoundMan"="SOUNDMAN.EXE" [2004-02-26 C:\WINDOWS\SOUNDMAN.EXE]
    "VTTimer"="VTTimer.exe" [2004-01-15 C:\WINDOWS\system32\VTTimer.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoResolveSearch"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.divxa32"= msaud32_divx.acm

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\LimeWire\\LimeWire.exe"=
    "C:\\WINDOWS\\system32\\dpvsetup.exe"=
    "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
    "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
    "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
    "C:\\Program Files\\FrostWire\\FrostWire.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
    R2 fssfltr;FssFltr;C:\WINDOWS\system32\DRIVERS\fssfltr.sys [2007-10-17 43816]
    R2 fsssvc;Windows Live OneCare – perheturva;C:\Program Files\Windows Live\Perheturva\fsssvc.exe [2007-12-17 523816]
    S0 lkinguri;lkinguri;C:\WINDOWS\system32\drivers\zprouvju.dat [ ]
    S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 58320]
    S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304]
    S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f0b14b2-e46d-11dc-8a5d-0004616c5faa}]
    \Shell\AutoRun\command - G:\setupSNK.exe

    *Newly Created Service* - PROCEXP90
    .
    'Ajoitetut tehtävät'-kansion sisältö
    .
    - - - - POISTETUT JÄMÄRIVIT - - - -

    HKCU-Run-Nokia.PCSync - C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
    HKCU-Run-PC Suite Tray - C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe


    .
    ------- Täydentävä tarkistus -------
    .
    FireFox -: Profile - C:\Documents and Settings\Perhe\Application Data\Mozilla\Firefox\Profiles\cnddenfj.default\
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
    FF -: plugin - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-20 14:54:30
    Windows 5.1.2600 Service Pack 3 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\lkinguri]
    "ImagePath"="system32\drivers\zprouvju.dat"
    .
    Valmistumisajankohta: 2008-09-20 14:55:08
    ComboFix-quarantined-files.txt 2008-09-20 11:55:05

    Ennen ajoa: 2ÿ233ÿ016ÿ320 tavua vapaana
    Ajon jälkeen: 2,332,438,528 tavua vapaana

    169 --- E O F --- 2008-09-10 07:26:14
     
    anninam, 20.09.2008
    #10
  12. anninam

    anninam Member

    Liittynyt:
    17.09.2008
    Viestejä:
    20
    Kiitokset:
    0
    Pisteet:
    11
    Malwarebytes' Anti-Malware 1.28
    Tietokantaversio: 1180
    Windows 5.1.2600 Service Pack 3

    20.9.2008 15:31:25
    mbam-log-2008-09-20 (15-31-25).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|)
    Tarkistetut kohteet: 104383
    Kulunut aika: 24 minute(s), 46 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 2
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 11
    Saastuneita tiedostoja: 13

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2bf5db8f-1db2-48dd-a1ce-c24c6178c4cd} (Trojan.BHO.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{2bf5db8f-1db2-48dd-a1ce-c24c6178c4cd} (Trojan.BHO.H) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    C:\Documents and Settings\All Users\Application Data\SecurePCCleaner (Rogue.PCCleaner) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\systemerrorfixer (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\systemerrorfixer\Data (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Vieras\Application Data\SecurePCCleaner (Rogue.PCCleaner) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Vieras\Application Data\SecurePCCleaner\Logs (Rogue.PCCleaner) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Noora\Application Data\SecurePCCleaner (Rogue.PCCleaner) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Noora\Application Data\SecurePCCleaner\Logs (Rogue.PCCleaner) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Vieras\Application Data\systemerrorfixer (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Vieras\Application Data\systemerrorfixer\Logs (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Noora\Application Data\systemerrorfixer (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Noora\Application Data\systemerrorfixer\Logs (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.

    Saastuneita tiedostoja:
    C:\WINDOWS\system32\dpwsoc.dll (Trojan.BHO.H) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{B049256E-FAA6-4501-A15C-851C63C5D249}\RP145\A0119770.exe (Rogue.Errclean) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{B049256E-FAA6-4501-A15C-851C63C5D249}\RP148\A0120574.exe (Adware.Zango) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\SecurePCCleaner\Abbr (Rogue.PCCleaner) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\SecurePCCleaner\ProdCode (Rogue.PCCleaner) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\systemerrorfixer\Data\ac (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\systemerrorfixer\Data\em (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\systemerrorfixer\Data\oid (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\systemerrorfixer\Data\user (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Vieras\Application Data\SecurePCCleaner\Logs\update.log (Rogue.PCCleaner) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Vieras\Application Data\systemerrorfixer\Logs\update.log (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
    C:\Documents and Settings\homo\Local Settings\Temp\jrelog.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
    C:\WINDOWS\explorer.vbk (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
     
    anninam, 20.09.2008
    #11
  13. Hujo

    Hujo Guest

    scannaa uusi hjtn loki
     
    Hujo, 21.09.2008
    #12
  14. anninam

    anninam Member

    Liittynyt:
    17.09.2008
    Viestejä:
    20
    Kiitokset:
    0
    Pisteet:
    11
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:12:46, on 21.9.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\WgaTray.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
    O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Perheturva\fssbho.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Perheturva\fssui.exe" -autorun
    O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\RunOnce: [SpybotDeletingB8162] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome.manifest"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD1406] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome.manifest"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB8299] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD3598] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB637] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD4035] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB9011] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD6478] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB9570] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD3832] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB3016] command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD4426] cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?d54eec78f8c2441eaaf69ce4a2c51a50
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?d54eec78f8c2441eaaf69ce4a2c51a50
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 7931 bytes
     
    anninam, 21.09.2008
    #13
  15. Hujo

    Hujo Guest

    Lataa Tästä Ccleaner
    CCleaner v 2.11.636.- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
    Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
    Asennuksen jälkeen aukaise CCleaner.
    Valitse vasemmalta pystyrivistä Options.
    Valitse viereisestä pystyrivistä Settings.
    Language kohtaan valitse Suomi.

    Puhdistaja
    Valitse vasemmalta pystyrivistä Puhdistaja.
    Paina alhaalta Tutki.
    Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
    Kun tutkiminen on valmis, paina Aja CCleaner.
    Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.

    Rekisterin virheiden korjaus
    Valitse vasemmalta pystyrivistä Rekisteri.
    Paina alhaalta Etsi rekisterin virheitä.
    Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
    Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
    Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
    Saat vielä varmistus kysymyksen, paina Ok.
    Kun virheet on korjattu, paina Sulje.
    Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.

    ===============

    scannaa uusi combofix loki
     
    Hujo, 21.09.2008
    #14
  16. anninam

    anninam Member

    Liittynyt:
    17.09.2008
    Viestejä:
    20
    Kiitokset:
    0
    Pisteet:
    11
    ComboFix 08-09-20.05 - Noora 2008-09-23 17:24:30.3 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1035.18.216 [GMT 3:00]
    Sijainti: C:\Documents and Settings\Noora\Ty”p”yt„\ComboFix.exe

    VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !!
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-08-23 to 2008-09-23 )))))))))))))))))
    .

    2008-09-20 15:01 . 2008-09-20 15:02 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-20 15:01 . 2008-09-20 15:01 <KANSIO> d-------- C:\Documents and Settings\Perhe\Application Data\Malwarebytes
    2008-09-20 15:01 . 2008-09-20 15:01 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-20 15:01 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-09-20 15:01 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-09-18 22:07 . 2008-09-18 22:07 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
    2008-09-18 17:02 . 2008-09-18 17:02 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-09-13 20:32 . 2008-09-13 20:32 <KANSIO> d-------- C:\Program Files\AVG
    2008-09-13 18:00 . 2008-09-13 18:13 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-09-13 15:40 . 2008-09-13 15:40 764 --a------ C:\WINDOWS\wininit.ini
    2008-09-11 23:47 . 2008-09-11 23:47 <KANSIO> d-------- C:\Documents and Settings\Perhe\Application Data\Simply Super Software
    2008-09-11 22:09 . 2008-09-18 22:08 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-09-11 22:09 . 2008-09-18 22:08 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-09-11 22:06 . 2008-09-11 22:53 <KANSIO> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2008-09-11 21:49 . 2008-09-11 21:49 5,632 --ahs---- C:\WINDOWS\system32\Thumbs.db
    2008-09-11 21:04 . 2008-09-11 21:05 <KANSIO> d-------- C:\VTPFiles
    2008-09-10 20:47 . 2008-04-14 19:11 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
    2008-09-10 20:47 . 2008-04-14 18:46 14,720 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
    2008-09-10 20:46 . 2008-04-13 21:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
    2008-09-10 18:01 . 2008-09-18 22:11 <KANSIO> d-------- C:\Program Files\Common Files\Symantec Shared
    2008-09-09 15:06 . 2008-09-09 18:40 <KANSIO> d-------- C:\WINDOWS\system32\Adobe
    2008-09-01 07:26 . 2008-09-01 07:26 <KANSIO> d--h----- C:\Documents and Settings\Noora\Verkkoymp„rist”
    2008-09-01 07:17 . 2008-09-01 07:17 <KANSIO> d-------- C:\WINDOWS\system32\fi
    2008-09-01 07:17 . 2008-09-01 07:17 <KANSIO> d-------- C:\WINDOWS\system32\bits
    2008-09-01 07:17 . 2008-09-01 07:17 <KANSIO> d-------- C:\WINDOWS\l2schemas
    2008-09-01 07:14 . 2008-09-01 07:17 <KANSIO> d-------- C:\WINDOWS\ServicePackFiles
    2008-08-28 21:21 . 2008-08-28 21:22 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
    2008-08-28 21:21 . 2008-08-28 21:21 <KANSIO> d-------- C:\Program Files\Common Files\Nokia
    2008-08-28 21:20 . 2008-08-28 21:20 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
    2008-08-28 21:20 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
    2008-08-28 21:19 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
    2008-08-28 21:19 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
    2008-08-28 21:19 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
    2008-08-28 21:19 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
    2008-08-28 21:19 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
    2008-08-27 09:52 . 2004-09-14 16:06 701,440 --------- C:\WINDOWS\system32\drivers\ati2mtag.sys

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-13 17:26 --------- d-----w C:\Program Files\Google
    2008-09-13 17:20 --------- d-----w C:\Program Files\IrfanView
    2008-09-13 17:18 --------- d-----w C:\Program Files\GIMP-2.0
    2008-09-13 17:17 --------- d-----w C:\Program Files\Image-Line
    2008-09-11 18:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-09-11 16:46 --------- d-----w C:\Program Files\Stardock
    2008-08-30 13:21 --------- d-----w C:\Documents and Settings\Perhe\Application Data\Winamp
    2008-08-28 18:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
    2008-08-28 18:21 --------- d-----w C:\Program Files\Nokia
    2008-08-25 13:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Open Ante Anti Dog
    2008-08-19 13:25 5,632 ----a-w C:\WINDOWS\system32\drivers\StarOpen.sys
    2008-08-01 19:25 --------- d-----w C:\Program Files\Continuum
    2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
    2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
    2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
    2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
    2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
    2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
    2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2008-07-18 19:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
    2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
    2008-07-18 18:39 586,752 ----a-w C:\WINDOWS\WLXPGSS.SCR
    2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
    2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
    2008-06-24 15:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
    2008-06-23 15:10 666,112 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-06-10 21:28 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
    .

    ((((((((((((((((((((((((((((( snapshot@2008-09-20_14.54.50.81 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-09-23 11:50:27 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5b0.dat
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
    "Picasa Media Detector"="E:\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]
    "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
    "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 495616]
    "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-08-11 1124352]
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-12-14 221184]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
    "fssui"="C:\Program Files\Windows Live\Perheturva\fssui.exe" [2007-12-17 243240]
    "avast!"="C:\Program Files\Alwil Software\Avast4\ashDisp.exe" [2008-07-19 78008]
    "SoundMan"="SOUNDMAN.EXE" [2004-02-26 C:\WINDOWS\SOUNDMAN.EXE]
    "VTTimer"="VTTimer.exe" [2004-01-15 C:\WINDOWS\system32\VTTimer.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoResolveSearch"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.divxa32"= msaud32_divx.acm

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\LimeWire\\LimeWire.exe"=
    "C:\\WINDOWS\\system32\\dpvsetup.exe"=
    "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
    "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
    "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
    "C:\\Program Files\\FrostWire\\FrostWire.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
    R2 fssfltr;FssFltr;C:\WINDOWS\system32\DRIVERS\fssfltr.sys [2007-10-17 43816]
    R2 fsssvc;Windows Live OneCare – perheturva;C:\Program Files\Windows Live\Perheturva\fsssvc.exe [2007-12-17 523816]
    S0 lkinguri;lkinguri;C:\WINDOWS\system32\drivers\zprouvju.dat [ ]
    S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 58320]
    S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304]
    S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000]
    .
    'Ajoitetut tehtävät'-kansion sisältö
    .
    - - - - POISTETUT JÄMÄRIVIT - - - -

    HKCU-Run-OM2_Monitor - C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe
    HKCU-Run-ares - C:\Program Files\Ares\Ares.exe
    HKCU-Run-realup - C:\DOCUME~1\Noora\APPLIC~1\DENTFI~1\hide comp.exe
    HKCU-Run-AdVantage - C:\Program Files\AdVantage\AdVantage.exe
    HKCU-Run-No! Flash - C:\Program Files\NoFlash\NoFlash.exe
    HKCU-Run-swg - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    HKCU-Run-Vista Rainbar - C:\Program Files\Vista Rainbar\Rainmeter.exe
    HKCU-Run-RegistryMechanic - C:\Program Files\Registry Mechanic\RegMech.exe


    .
    ------- Täydentävä tarkistus -------
    .
    FireFox -: Profile - C:\Documents and Settings\Noora\Application Data\Mozilla\Firefox\Profiles\a69pahy6.default\
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
    FF -: plugin - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-23 17:25:56
    Windows 5.1.2600 Service Pack 3 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\lkinguri]
    "ImagePath"="system32\drivers\zprouvju.dat"
    .
    Valmistumisajankohta: 2008-09-23 17:26:36
    ComboFix-quarantined-files.txt 2008-09-23 14:26:33
    ComboFix2.txt 2008-09-21 19:30:38
    ComboFix3.txt 2008-09-20 11:57:18

    Ennen ajoa: 2ÿ253ÿ393ÿ920 tavua vapaana
    Ajon jälkeen: 2,322,165,760 tavua vapaana

    163 --- E O F --- 2008-09-10 07:26:14
     
    anninam, 23.09.2008
    #15
  17. Hujo

    Hujo Guest

    scannaas uusi hjt:n loki
    ========================

    Luo poistolista:
    • Avaa HiJackThis
    • Klikkaa "Configure" valintaa oikealla alhaalla
    • Klikkaa "Misc Tools"
    • Klikkaa boxia joka sanoo "Uninstall Manager"
    • Klikkaa valintaa "Save list"
    • Kopioi ja liitä kyseinen lista muistiosta ketjuusi
     
    Hujo, 23.09.2008
    #16
  18. anninam

    anninam Member

    Liittynyt:
    17.09.2008
    Viestejä:
    20
    Kiitokset:
    0
    Pisteet:
    11
    7-Zip 4.56
    Adobe Bridge 1.0
    Adobe Help Center 1.0
    Adobe Photoshop CS2
    Adobe Shockwave Player
    Adobe Stock Photos 1.0
    Advanced WindowsCare Personal
    AMIP (remove only)
    Automaattiset valikot (Windows Live Toolbar)
    avast! Antivirus
    CCleaner (remove only)
    CodeRED - Alien Arena
    Continuum 0.40
    Dcads Games Collection
    DivX Converter
    EasyCleaner
    FrostWire 4.13.5
    Global Operations Public Beta
    GOM Player
    HijackThis 2.0.2
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix-korjauspäivitys Windows Media Player 11:lle (KB939683)
    Hotfix-päivitys Windows XP:lle (KB952287)
    Java(TM) 6 Update 3
    Java(TM) 6 Update 5
    Labtec® Camera -ohjain
    LimeWire 4.17.10
    Malwarebytes' Anti-Malware
    McDonald's Dragons
    McDonald's Fairies
    Messenger Plus! Live & Sponsor (CiD)
    Microsoft .NET Framework 2.0 Language Pack - FIN
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft .NET Framework 3.0
    Microsoft .NET Framework 3.0 Finnish Language Pack
    Microsoft .NET Framework 3.0:n suomen kielipaketti
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft Office PowerPoint Viewer 2003
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft User-Mode Driver Framework Feature Pack 1.5
    Microsoft Visual C++ 2005 Redistributable
    Mozilla Firefox (3.0.2)
    MSVC80_x86
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 Parser and SDK
    MSXML 6.0 Parser (KB933579)
    NHL Eastside Hockey Manager 2007
    Nokia Connectivity Cable Driver
    Nokia PC Suite
    Nokia PC Suite
    OneCare Advisor (Windows Live Toolbar)
    Outlook-työkalurivi (Windows Live Toolbar)
    PC Connectivity Solution
    Picasa 2
    Ponnahdusikkunoiden esto (Windows Live Toolbar)
    Päivitys Windows XP:lle (KB951072-v2)
    Päivitys Windows XP:lle (KB951978)
    QuickTime
    RealPlayer
    Realtek AC'97 Audio
    Rhapsody Player Engine
    S3 S3Display
    S3 S3Gamma2
    S3 S3Info2
    S3 S3Overlay
    SAMSUNG CDMA Modem Driver Set
    SAMSUNG Mobile Composite Device Software
    Samsung Mobile phone USB driver Software
    SAMSUNG Mobile USB Modem 1.0 Software
    SAMSUNG Mobile USB Modem Software
    Samsung PC Studio
    Security Update for CAPICOM (KB931906)
    Security Update for CAPICOM (KB931906)
    Selaus välilehtiä käyttäen (Windows Live Toolbar)
    Suojauspäivitys ohjelmistolle Windows XP (KB941569)
    Suojauspäivitys Windows Media Player 11:lle (KB936782)
    Suojauspäivitys Windows Media Player 11:lle (KB954154)
    Suojauspäivitys Windows Media Player 9:lle (KB917734)
    Suojauspäivitys Windows XP:lle (KB923789)
    Suojauspäivitys Windows XP:lle (KB938464)
    Suojauspäivitys Windows XP:lle (KB946648)
    Suojauspäivitys Windows XP:lle (KB950759)
    Suojauspäivitys Windows XP:lle (KB950760)
    Suojauspäivitys Windows XP:lle (KB950762)
    Suojauspäivitys Windows XP:lle (KB950974)
    Suojauspäivitys Windows XP:lle (KB951066)
    Suojauspäivitys Windows XP:lle (KB951376)
    Suojauspäivitys Windows XP:lle (KB951376-v2)
    Suojauspäivitys Windows XP:lle (KB951698)
    Suojauspäivitys Windows XP:lle (KB951748)
    Suojauspäivitys Windows XP:lle (KB952954)
    Suojauspäivitys Windows XP:lle (KB953838)
    Suojauspäivitys Windows XP:lle (KB953839)
    Syötteen tunnistus (Windows Live Toolbar)
    UniChrome IGP Driver and Utilities
    URUSoft ViPlay
    Ventrilo Client
    Ventrilo Server
    Winamp
    Winamp Remote
    WinCustomize Browser
    Windows Communication Foundation
    Windows Imaging Component
    Windows Live installer
    Windows Live Messenger
    Windows Live OneCare – perheturva
    Windows Live Toolbar
    Windows Live Toolbar
    Windows Live Toolbarin laajennus (Windows Live Toolbar)
    Windows Live Writer
    Windows Liven kirjautumisavustaja
    Windows Liven sähköposti
    Windows Liven valokuvavalikoima
    Windows Media Format 11 runtime
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Media Player 11
    Windows Presentation Foundation
    Windows Presentation Foundation Language Pack (FIN)
    Windows Workflow Foundation
    Windows Workflow Foundation FI Language Pack
    Windows XP Service Pack 3
    Windowsin ohjainpaketti - Nokia Modem (02/15/2007 3.1)
    Windowsin ohjainpaketti - Nokia Modem (02/15/2007 3.1)
    Windowsin ohjainpaketti - Nokia Modem (03/05/2008 3.7)
    Windowsin ohjainpaketti - Nokia Modem (03/13/2008 6.86.0.1)
    Windowsin ohjainpaketti - Nokia Modem (05/22/2008 3.8)
    Windowsin ohjainpaketti - Nokia Modem (05/22/2008 7.00.0.1)
    Windowsin ohjainpaketti - Nokia pccsmcfd (10/12/2007 6.85.4.0)
    WinRAR-pakkausohjelma
    XML Paper Specification Shared Components Language Pack 1.0

     
    anninam, 29.09.2008
    #17
  19. anninam

    anninam Member

    Liittynyt:
    17.09.2008
    Viestejä:
    20
    Kiitokset:
    0
    Pisteet:
    11
    bumb
     
    anninam, 20.10.2008
    #18
  20. MSJD

    MSJD Member

    Liittynyt:
    04.10.2008
    Viestejä:
    36
    Kiitokset:
    0
    Pisteet:
    16
    MSJD, 21.10.2008
    #19
  21. anninam

    anninam Member

    Liittynyt:
    17.09.2008
    Viestejä:
    20
    Kiitokset:
    0
    Pisteet:
    11
    ei tapahtunut mitää em. toimenpiteiden jälkee
     
    anninam, 21.10.2008
    #20
Sivu 1 / 2

Jaa tämä sivu