1. Tämä sivusto käyttää keksejä (cookie). Jatkamalla sivuston käyttämistä hyväksyt keksien käyttämisen. Lue lisää.

Kierrätyskeskukseenko?

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi spiru4 13.03.2008.

Sivu 2 / 3
  1. spiru4

    spiru4 Member

    Liittynyt:
    08.11.2006
    Viestejä:
    94
    Kiitokset:
    0
    Pisteet:
    16
    Katselin vanhoja viestiketjuja täällä, ja joku oli ainakin mljji.dll:n fixannut ihan Hjt:lla...
     
    spiru4, 15.03.2008
    #21
  2.  
  3. rijkardo

    rijkardo Member

    Liittynyt:
    15.03.2008
    Viestejä:
    20
    Kiitokset:
    0
    Pisteet:
    11
    Moro!

    En mie tajua yhtään mittään:) sain tehtyä jonkun "skannauksen" tola Hijackthis ja tässä tulos.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:54:14, on 15.3.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\PC Tools Firewall Plus\FWService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Google\Gmail Notifier\gnotify.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\PC Tools AntiVirus\PCTAV.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\devldr32.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Hitware Popup Killer Lite 3\HitwarePKLite.exe
    C:\PROGRA~1\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://kingkongsearch.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mtv3.fi/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
    O2 - BHO: RUPK - {604B283A-4E26-4504-98E7-72859F949547} - C:\PROGRA~1\HITWAR~2\sypcms.dll
    O2 - BHO: Video - {6430CCA7-032A-4EB0-BCFF-838998E73EF5} - C:\WINDOWS\stream32a.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: CDLPObj Object - {BE2ED590-CA49-46B5-8CCE-244FB2E0D1AA} - C:\WINDOWS\IECodecPl.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\wianmpa.exe
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
    O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKCU\..\Run: [PopUpStopperProfessional] "C:\PROGRA~1\PANICW~1\POP-UP~2\POPUPS~1.EXE"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?cdf32ec92ff343feb49c382bfb29f526
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?cdf32ec92ff343feb49c382bfb29f526
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
    O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 7518 bytes


    Eli mitäs nyt sitten?
     
    rijkardo, 15.03.2008
    #22
  4. spiru4

    spiru4 Member

    Liittynyt:
    08.11.2006
    Viestejä:
    94
    Kiitokset:
    0
    Pisteet:
    16
    Muuten hyvä, mutta teepä oma viestiketju Hjt-logillesi! Se onnistuu tuolta oikealta.
     
    spiru4, 15.03.2008
    #23
  5. Hujo

    Hujo Guest

    spiru4

    scannaa uusi hjt:n loki

    Sammutiko ja käynnistit koneen killBoksin jälkeen

    ===========

    rijkardo

    Pyyhkäse tuo lokisi pois
     
    Moderaattorin viimeksi muokkaama: 15.03.2008
    Hujo, 15.03.2008
    #24
  6. spiru4

    spiru4 Member

    Liittynyt:
    08.11.2006
    Viestejä:
    94
    Kiitokset:
    0
    Pisteet:
    16
    Sammutin ja käynnistin joooooo. Tuossa tuo, sama se on kuin äskenkin kai...

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:19, on 2008-03-15
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMB32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FCH32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FAMEH32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsqh.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsaua.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fssm32.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsus.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\ispnews.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Elisa\Avustaja\Elisa.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\fsguidll.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsav32.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\HP_Omistaja\Työpöytä\hjt jne\hjt\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {6B5EA728-7500-4F65-A2B7-9B59E7C73D51} - C:\WINDOWS\system32\mljji.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
    O3 - Toolbar: HP-näkymä - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [Elisa Avustaja] "C:\Program Files\Elisa\Avustaja\Elisa.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: SMS-viesti - {A178D03A-7E91-4D9F-BFB9-26E68AF7ECA4} - http://sms.kolumbus.fi/ (file missing) (HKCU)
    O9 - Extra button: Tuki - {CD5B0ED3-71DC-42AA-A1BB-D724426FD9F8} - http://tuki.elisa.net/ (file missing) (HKCU)
    O9 - Extra button: Palvelut - {E7158FA5-2BFF-4ACE-838C-0860F0A350A3} - http://service.kolumbus.fi/ (file missing) (HKCU)
    O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
    O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

    --
    End of file - 8736 bytes
     
    spiru4, 15.03.2008
    #25
  7. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: (no name) - {6B5EA728-7500-4F65-A2B7-9B59E7C73D51} - C:\WINDOWS\system32\mljji.dll



    ==============

    C:\Documents and Settings\HP_Omistaja\Työpöytä\hjt jne\hjt\HijackThis.exe

    laita se vielä tuonne omaan kansioon

    näin

    C:\HJT\HijackThis.exe


    Nimetään uudelleen

    Uudelleen nimeäminen

    1. Klikkaa hiiren oikealla painikkeella HijackThis ikonia.

    [​IMG]
    2. Valitse Uudelleennineä/ Rename.
    [​IMG]
    3. Kirjoita scanner.exe
    [​IMG]
     
    Moderaattorin viimeksi muokkaama: 15.03.2008
    Hujo, 15.03.2008
    #26
  8. spiru4

    spiru4 Member

    Liittynyt:
    08.11.2006
    Viestejä:
    94
    Kiitokset:
    0
    Pisteet:
    16
    Kaikki tehty, mutta mikään ei auta. Vatun *dll on ja pysyy...

    Mitäs sitten?
     
    spiru4, 16.03.2008
    #27
  9. spiru4

    spiru4 Member

    Liittynyt:
    08.11.2006
    Viestejä:
    94
    Kiitokset:
    0
    Pisteet:
    16
    Ajoin sen F-securen ohjelman uudestaan. Nyt se onnistui uudelleennimeämään mljji.dll:n mljji.dll.bak:si. Eikä F-secure huutanut enää startupissakaan mitään. Fixasin tuon mljji.dll(no file):n Hjt:lla pois.

    Kone on kyllä vieläkin todella hidas käynnistymään, joten laitan uuden Hjt:n. Olisi muuten kiva rajoittaa jotenkin startupissa käynnistyvien ohjelmien määrää, mitenköhän onnistuisi? Otin EasyCleanerin, mutta sillä käynnistyviä ohjelmia pystyy vain poistamaan. En viitsisi poistaa mitään, kun ei ole oma kone.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:40, on 2008-03-16
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMB32.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FCH32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FAMEH32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsqh.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsaua.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fssm32.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsus.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\ispnews.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Elisa\Avustaja\Elisa.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\fsguidll.exe
    C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsav32.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\hjt\scanner.exe.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
    O3 - Toolbar: HP-näkymä - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [Elisa Avustaja] "C:\Program Files\Elisa\Avustaja\Elisa.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: SMS-viesti - {A178D03A-7E91-4D9F-BFB9-26E68AF7ECA4} - http://sms.kolumbus.fi/ (file missing) (HKCU)
    O9 - Extra button: Tuki - {CD5B0ED3-71DC-42AA-A1BB-D724426FD9F8} - http://tuki.elisa.net/ (file missing) (HKCU)
    O9 - Extra button: Palvelut - {E7158FA5-2BFF-4ACE-838C-0860F0A350A3} - http://service.kolumbus.fi/ (file missing) (HKCU)
    O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
    O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

    --
    End of file - 8591 bytes
     
    spiru4, 16.03.2008
    #28
  10. Hujo

    Hujo Guest

    Hujo, 16.03.2008
    #29
  11. spiru4

    spiru4 Member

    Liittynyt:
    08.11.2006
    Viestejä:
    94
    Kiitokset:
    0
    Pisteet:
    16
    File C:\WINDOWS\system32\mljji.dll.bak tagged as not-a-virus:AdWare.Win32.Virtumonde.gen. No Action Taken.
    File C:\Documents and Settings\HP_Omistaja\Local Settings\Temporary Internet Files\Content.IE5\W1CP07GP\iddqd[1] tagged as not-a-virus:AdWare.Win32.Virtumonde.gen. No Action Taken.
    File C:\Documents and Settings\HP_Omistaja\Työpöytä\hjt jne\SmitfraudFix_v2.301.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
    File C:\QooBox\Quarantine\C\Program Files\Helper\1203203056.dll.vir tagged as not-a-virus:AdWare.Win32.E404.i. No Action Taken.
    File C:\QooBox\Quarantine\C\Program Files\Helper\1203203070.dll.vir tagged as not-a-virus:AdWare.Win32.E404.i. No Action Taken.
    File C:\QooBox\Quarantine\C\Program Files\Helper\1204032539.dll.vir tagged as not-a-virus:AdWare.Win32.E404.i. No Action Taken.
    File C:\QooBox\Quarantine\C\WINDOWS\system32\kwomvuhb.dll.vir tagged as not-a-virus:AdWare.Win32.Virtumonde.gen. No Action Taken.
    File C:\QooBox\Quarantine\C\WINDOWS\system32\lmcwuqvd.dll.vir tagged as not-a-virus:AdWare.Win32.Virtumonde.gen. No Action Taken.
    File C:\QooBox\Quarantine\C\WINDOWS\system32\uvkjmqdn.dll.vir tagged as not-a-virus:AdWare.Win32.Virtumonde.gen. No Action Taken.
    File C:\WINDOWS\system32\mljji.dll.bak tagged as not-a-virus:AdWare.Win32.Virtumonde.gen. No Action Taken.
     
    spiru4, 16.03.2008
    #30
  12. Hujo

    Hujo Guest

    1) Lataa VirtumundoBegone
    2) Tallenna VirtumundoBeGone.exe työpöydällesi.
    3) Aja VirtumundoBeGone.exe ja seuraa ohjeita. Älä huoli jos näet sinisen ruudun "Fatal Error" viestin, tämä on normaalia.
    4) Kun työkalu on valmis, käynnistä kone uudelleen
     
    Hujo, 16.03.2008
    #31
  13. spiru4

    spiru4 Member

    Liittynyt:
    08.11.2006
    Viestejä:
    94
    Kiitokset:
    0
    Pisteet:
    16
    Ei löytänyt mitään...
     
    spiru4, 16.03.2008
    #32
  14. Hujo

    Hujo Guest

    onkos sulla combofix vielä koneella.
     
    Hujo, 16.03.2008
    #33
  15. spiru4

    spiru4 Member

    Liittynyt:
    08.11.2006
    Viestejä:
    94
    Kiitokset:
    0
    Pisteet:
    16
    Khyyl se tuolla vielä on. Laitan ajoon.
     
    spiru4, 16.03.2008
    #34
  16. Supo

    Supo Regular member

    Liittynyt:
    31.03.2002
    Viestejä:
    437
    Kiitokset:
    0
    Pisteet:
    26
    Miksette vaan laita windowsia suoraan uusiks ,pääsette helpomalla ja saatte takuulla puhtaan koneen.Ihme että jaksatte leikkiä noilla kun aikaa menee enemmän ja lopputulos on hakusessa.
     
    Supo, 16.03.2008
    #35
  17. spiru4

    spiru4 Member

    Liittynyt:
    08.11.2006
    Viestejä:
    94
    Kiitokset:
    0
    Pisteet:
    16
    Sain oikein raportinkin tällä kertaa. Kauan se kyllä kesti.

    ComboFix 08-03-10.1 - HP_Omistaja 2008-03-16 19:17:29.3 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.241 [GMT 2:00]
    Running from: C:\Documents and Settings\HP_Omistaja\Työpöytä\hjt jne\ComboFix.exe
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\ijjlm.ini
    C:\WINDOWS\system32\ijjlm.ini2
    .
    ---- Previous Run -------
    .
    C:\Program Files\Helper
    C:\Program Files\Helper\1203203056.dll
    C:\Program Files\Helper\1203203070.dll
    C:\Program Files\Helper\1204032539.dll
    C:\Program Files\VirusHeat 4.3
    C:\Program Files\VirusHeat 4.3\vpp.ini
    C:\WINDOWS\BMfbbf1200.xml
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\system32\bhuvmowk.ini
    C:\WINDOWS\system32\ijjlm.ini
    C:\WINDOWS\system32\ijjlm.ini2
    C:\WINDOWS\system32\kwomvuhb.dll
    C:\WINDOWS\system32\lmcwuqvd.dll
    C:\WINDOWS\system32\mcrh.tmp
    C:\WINDOWS\system32\uvkjmqdn.dll
    D:\Autorun.inf

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-02-16 to 2008-03-16 )))))))))))))))))
    .

    2008-03-16 15:37 . 2008-03-16 15:37 0 --a------ C:\23990098.$$$
    2008-03-16 13:36 . 2008-03-16 13:46 <KANSIO> d-------- C:\Downloads
    2008-03-16 13:36 . 2008-03-16 13:45 <KANSIO> d-------- C:\Bases
    2008-03-16 13:32 . 2008-03-16 13:46 <KANSIO> d-------- C:\Kaspersky
    2008-03-15 18:21 . 2008-03-15 18:21 <KANSIO> d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Talkback
    2008-03-15 18:20 . 2008-03-15 18:20 0 --a------ C:\WINDOWS\nsreg.dat
    2008-03-15 17:32 . 2008-03-15 17:33 <KANSIO> d-------- C:\WINDOWS\ERUNT
    2008-03-15 16:13 . 2008-03-15 16:13 15 --a------ C:\WINDOWS\system32\f88c3312
    2008-03-15 14:44 . 2008-03-15 14:44 <KANSIO> d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Grisoft
    2008-03-15 14:43 . 2008-03-15 14:43 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-03-15 14:43 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-03-15 14:12 . 2008-03-15 14:12 <KANSIO> d-------- C:\VundoFix Backups
    2008-03-14 19:15 . 2008-03-14 19:15 <KANSIO> d-------- C:\Documents and Settings\LocalService\Ty”p”yt„
    2008-03-14 19:00 . 2008-03-14 19:13 <KANSIO> d-------- C:\fixwareout
    2008-03-14 16:51 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
    2008-03-14 16:51 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
    2008-03-14 16:51 . 2008-03-09 01:15 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-03-14 16:51 . 2008-03-05 22:29 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-03-14 16:51 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
    2008-03-14 16:51 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
    2008-03-14 16:51 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
    2008-03-14 16:51 . 2008-03-14 19:19 2,726 --a------ C:\WINDOWS\system32\tmp.reg
    2008-03-14 16:37 . 2008-03-14 16:37 1,359,621 ---hs---- C:\WINDOWS\system32\uwwqnpjy.ini
    2008-03-13 16:51 . 2008-03-16 19:10 <KANSIO> d-------- C:\hjt
    2008-03-06 15:46 . 2008-03-13 17:49 2,683,780 ---hs---- C:\WINDOWS\system32\exaicvca.ini
    2008-03-04 18:31 . 2008-03-04 18:31 268 --ah----- C:\sqmdata10.sqm
    2008-03-04 18:31 . 2008-03-04 18:31 244 --ah----- C:\sqmnoopt10.sqm
    2008-03-03 20:24 . 2008-03-03 20:24 268 --ah----- C:\sqmdata09.sqm
    2008-03-03 20:24 . 2008-03-03 20:24 244 --ah----- C:\sqmnoopt09.sqm
    2008-03-02 22:03 . 2008-03-02 22:03 268 --ah----- C:\sqmdata08.sqm
    2008-03-02 22:03 . 2008-03-02 22:03 244 --ah----- C:\sqmnoopt08.sqm
    2008-02-28 14:14 . 2008-03-06 15:39 1,307,489 ---hs---- C:\WINDOWS\system32\syeihiwy.ini
    2008-02-26 15:48 . 2008-02-26 15:48 <KANSIO> d-------- C:\Program Files\Elisa
    2008-02-26 15:38 . 2008-02-26 15:48 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Elisa
    2008-02-26 15:34 . 2008-02-26 15:34 287,744 --a------ C:\WINDOWS\system32\mljji.dll.bak
    2008-02-22 15:35 . 2008-02-28 14:39 <KANSIO> d-------- C:\Program Files\AntiSpyKit 5.3
    2008-02-22 15:09 . 2008-02-28 14:39 <KANSIO> d-------- C:\Program Files\VirusRanger
    2008-02-21 16:54 . 2008-02-21 16:54 <KANSIO> d-------- C:\Program Files\Lavasoft
    2008-02-21 16:54 . 2008-02-21 16:55 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-02-21 16:53 . 2008-02-21 16:53 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-02-18 14:23 . 2008-02-20 20:53 <KANSIO> d-------- C:\Program Files\AntiSpyKit 5.2
    2008-02-18 14:23 . 2008-02-28 14:39 <KANSIO> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2008-02-16 03:04 . 2008-02-16 03:04 268 --ah----- C:\sqmdata07.sqm
    2008-02-16 03:04 . 2008-02-16 03:04 244 --ah----- C:\sqmnoopt07.sqm

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-15 18:01 --------- d-----w C:\Program Files\Windows Live
    2008-03-15 15:17 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-03-15 15:01 --------- d-----w C:\Program Files\Java
    2008-03-15 14:50 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\BeoMediaDatabase
    2008-02-28 12:39 --------- d-----w C:\Program Files\VirusRanger
    2008-02-26 13:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-02-15 18:48 --------- d-----w C:\Program Files\Elisa Tietoturvapalvelu
    2008-02-15 18:41 30,016 ----a-w C:\WINDOWS\system32\drivers\fsndis5.sys
    2008-02-13 00:38 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\Azureus
    2008-02-11 18:00 432 ----a-w C:\Documents and Settings\HP_Omistaja\Application Data\wklnhst.dat
    2008-02-03 13:56 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\Media Player Classic
    2008-02-03 13:54 --------- d-----w C:\Program Files\K-Lite Codec Pack
    2008-02-03 13:52 --------- d-----w C:\Program Files\ffdshow
    2008-02-03 13:52 --------- d-----w C:\Program Files\AC3Filter
    2008-01-16 13:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
    2006-10-16 18:41 5,007,104 ----a-w C:\Program Files\GoogleVideoPlayerSetup.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-03-13_17.55.54.73 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-03-14 08:32:29 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
    + 2008-03-15 15:33:36 7,737,344 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
    + 2008-03-15 15:33:36 196,608 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
    + 2008-03-14 08:32:29 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
    + 2008-03-15 15:33:03 7,737,344 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
    + 2008-03-15 15:33:04 196,608 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
    - 2008-02-16 01:04:11 34,304 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\misc.exe
    + 2008-03-14 18:07:10 34,304 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\misc.exe
    - 2008-02-16 01:04:11 8,192 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\mspicons.exe
    + 2008-03-14 18:07:10 8,192 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\mspicons.exe
    - 2008-02-16 01:04:11 3,584 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\opwicon.exe
    + 2008-03-14 18:07:10 3,584 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\opwicon.exe
    - 2008-02-16 01:04:11 16,384 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\PEicons.exe
    + 2008-03-14 18:07:10 16,384 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\PEicons.exe
    - 2008-02-16 01:04:11 22,528 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\unbndico.exe
    + 2008-03-14 18:07:10 22,528 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\unbndico.exe
    - 2008-02-16 01:04:11 45,056 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\wordicon.exe
    + 2008-03-14 18:07:09 45,056 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\wordicon.exe
    - 2007-09-24 19:30:28 135,168 ----a-w C:\WINDOWS\system32\java.exe
    + 2008-02-21 23:23:35 135,168 ----a-w C:\WINDOWS\system32\java.exe
    - 2007-09-24 19:30:30 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
    + 2008-02-21 23:23:39 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
    - 2007-09-24 20:31:42 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
    + 2008-02-22 00:33:32 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
    - 2008-02-04 23:09:46 18,214,008 ----a-w C:\WINDOWS\system32\MRT.exe
    + 2008-03-05 16:30:54 19,148,408 ----a-w C:\WINDOWS\system32\MRT.exe
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 14:00 15360]
    "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 16:52 1409024]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-15 14:00 110592 C:\WINDOWS\system32\bthprops.cpl]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-02 05:52 98304]
    "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-04-26 07:29 237568]
    "F-Secure Manager"="C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.exe" [2007-04-26 19:12 183208]
    "F-Secure TNB"="C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\TNBUtil.exe" [2007-04-26 19:10 740208]
    "News Service"="C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\ispnews.exe" [2005-05-31 14:45 356352]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 07:28 36352]
    "Elisa Avustaja"="C:\Program Files\Elisa\Avustaja\Elisa.exe" [2007-10-22 15:15 189768]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe"=

    R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2007-04-26 19:09]
    R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Elisa Tietoturvapalvelu\HIPS\fshs.sys [2008-02-15 20:40]
    R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\minifilter\fsgk.sys [2007-04-26 19:07]
    S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\Win2K\FSfilter.sys [2007-04-26 19:08]
    S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\Win2K\FSrec.sys [2007-04-26 19:08]

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-03-16 06:56:01 C:\WINDOWS\Tasks\Scheduled scanning task.job"
    - C:\PROGRA~1\ELISAT~1\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\ELISAT~1\ANTI-V~1\report.txt
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-16 19:26:16
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
    -> C:\Ohjelmat\WinRAR\rarext.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMB32.EXE
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FCH32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsqh.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FAMEH32.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\fsguidll.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsaua.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fssm32.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
    C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsus.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsav32.exe
    .
    **************************************************************************
    .
    Completion time: 2008-03-16 19:35:00 - machine was rebooted [HP_Omistaja]
    ComboFix-quarantined-files.txt 2008-03-16 17:34:52
    .
    2008-03-16 06:56:56 --- E O F ---

    Supo: Varmaan olisikin helpompaa joo, mutta kun ei ole edes oma kone. Koita kestää :p
     
    spiru4, 16.03.2008
    #36
  18. Hujo

    Hujo Guest

    Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

    Tallenna se nimellä CFScript.txt

    Sitten raahaa CFScript ComboFix.exeen kuten alla.
    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
     
    Hujo, 16.03.2008
    #37
  19. spiru4

    spiru4 Member

    Liittynyt:
    08.11.2006
    Viestejä:
    94
    Kiitokset:
    0
    Pisteet:
    16
    ComboFix 08-03-10.1 - HP_Omistaja 2008-03-16 20:04:30.4 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.165 [GMT 2:00]
    Running from: C:\Documents and Settings\HP_Omistaja\Työpöytä\hjt jne\ComboFix.exe
    Command switches used :: C:\Documents and Settings\HP_Omistaja\Ty÷p÷ytõ\CFScript.txt
    * Created a new restore point
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-02-16 to 2008-03-16 )))))))))))))))))
    .

    2008-03-16 15:37 . 2008-03-16 15:37 0 --a------ C:\23990098.$$$
    2008-03-16 13:36 . 2008-03-16 13:46 <KANSIO> d-------- C:\Downloads
    2008-03-16 13:36 . 2008-03-16 13:45 <KANSIO> d-------- C:\Bases
    2008-03-16 13:32 . 2008-03-16 13:46 <KANSIO> d-------- C:\Kaspersky
    2008-03-15 18:21 . 2008-03-15 18:21 <KANSIO> d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Talkback
    2008-03-15 18:20 . 2008-03-15 18:20 0 --a------ C:\WINDOWS\nsreg.dat
    2008-03-15 17:32 . 2008-03-15 17:33 <KANSIO> d-------- C:\WINDOWS\ERUNT
    2008-03-15 16:13 . 2008-03-15 16:13 15 --a------ C:\WINDOWS\system32\f88c3312
    2008-03-15 14:44 . 2008-03-15 14:44 <KANSIO> d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Grisoft
    2008-03-15 14:43 . 2008-03-15 14:43 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-03-15 14:43 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-03-15 14:12 . 2008-03-15 14:12 <KANSIO> d-------- C:\VundoFix Backups
    2008-03-14 19:15 . 2008-03-14 19:15 <KANSIO> d-------- C:\Documents and Settings\LocalService\Työpöytä
    2008-03-14 19:00 . 2008-03-14 19:13 <KANSIO> d-------- C:\fixwareout
    2008-03-14 16:51 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
    2008-03-14 16:51 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
    2008-03-14 16:51 . 2008-03-09 01:15 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-03-14 16:51 . 2008-03-05 22:29 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-03-14 16:51 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
    2008-03-14 16:51 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
    2008-03-14 16:51 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
    2008-03-14 16:51 . 2008-03-14 19:19 2,726 --a------ C:\WINDOWS\system32\tmp.reg
    2008-03-14 16:37 . 2008-03-14 16:37 1,359,621 ---hs---- C:\WINDOWS\system32\uwwqnpjy.ini
    2008-03-13 16:51 . 2008-03-16 19:10 <KANSIO> d-------- C:\hjt
    2008-03-06 15:46 . 2008-03-13 17:49 2,683,780 ---hs---- C:\WINDOWS\system32\exaicvca.ini
    2008-03-04 18:31 . 2008-03-04 18:31 268 --ah----- C:\sqmdata10.sqm
    2008-03-04 18:31 . 2008-03-04 18:31 244 --ah----- C:\sqmnoopt10.sqm
    2008-03-03 20:24 . 2008-03-03 20:24 268 --ah----- C:\sqmdata09.sqm
    2008-03-03 20:24 . 2008-03-03 20:24 244 --ah----- C:\sqmnoopt09.sqm
    2008-03-02 22:03 . 2008-03-02 22:03 268 --ah----- C:\sqmdata08.sqm
    2008-03-02 22:03 . 2008-03-02 22:03 244 --ah----- C:\sqmnoopt08.sqm
    2008-02-28 14:14 . 2008-03-06 15:39 1,307,489 ---hs---- C:\WINDOWS\system32\syeihiwy.ini
    2008-02-26 15:48 . 2008-02-26 15:48 <KANSIO> d-------- C:\Program Files\Elisa
    2008-02-26 15:38 . 2008-02-26 15:48 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Elisa
    2008-02-26 15:34 . 2008-02-26 15:34 287,744 --a------ C:\WINDOWS\system32\mljji.dll.bak
    2008-02-22 15:35 . 2008-02-28 14:39 <KANSIO> d-------- C:\Program Files\AntiSpyKit 5.3
    2008-02-22 15:09 . 2008-02-28 14:39 <KANSIO> d-------- C:\Program Files\VirusRanger
    2008-02-21 16:54 . 2008-02-21 16:54 <KANSIO> d-------- C:\Program Files\Lavasoft
    2008-02-21 16:54 . 2008-02-21 16:55 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-02-21 16:53 . 2008-02-21 16:53 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-02-18 14:23 . 2008-02-20 20:53 <KANSIO> d-------- C:\Program Files\AntiSpyKit 5.2
    2008-02-18 14:23 . 2008-02-28 14:39 <KANSIO> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2008-02-16 03:04 . 2008-02-16 03:04 268 --ah----- C:\sqmdata07.sqm
    2008-02-16 03:04 . 2008-02-16 03:04 244 --ah----- C:\sqmnoopt07.sqm

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-15 18:01 --------- d-----w C:\Program Files\Windows Live
    2008-03-15 15:17 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-03-15 15:01 --------- d-----w C:\Program Files\Java
    2008-03-15 14:50 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\BeoMediaDatabase
    2008-02-28 12:39 --------- d-----w C:\Program Files\VirusRanger
    2008-02-26 13:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-02-15 18:48 --------- d-----w C:\Program Files\Elisa Tietoturvapalvelu
    2008-02-15 18:41 30,016 ----a-w C:\WINDOWS\system32\drivers\fsndis5.sys
    2008-02-13 00:38 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\Azureus
    2008-02-11 18:00 432 ----a-w C:\Documents and Settings\HP_Omistaja\Application Data\wklnhst.dat
    2008-02-03 13:56 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\Media Player Classic
    2008-02-03 13:54 --------- d-----w C:\Program Files\K-Lite Codec Pack
    2008-02-03 13:52 --------- d-----w C:\Program Files\ffdshow
    2008-02-03 13:52 --------- d-----w C:\Program Files\AC3Filter
    2008-01-16 13:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
    2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys
    2006-10-16 18:41 5,007,104 ----a-w C:\Program Files\GoogleVideoPlayerSetup.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-03-13_17.55.54.73 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-03-14 08:32:29 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
    + 2008-03-15 15:33:36 7,737,344 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
    + 2008-03-15 15:33:36 196,608 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
    + 2008-03-14 08:32:29 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
    + 2008-03-15 15:33:03 7,737,344 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
    + 2008-03-15 15:33:04 196,608 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
    - 2008-02-16 01:04:11 34,304 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\misc.exe
    + 2008-03-14 18:07:10 34,304 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\misc.exe
    - 2008-02-16 01:04:11 8,192 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\mspicons.exe
    + 2008-03-14 18:07:10 8,192 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\mspicons.exe
    - 2008-02-16 01:04:11 3,584 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\opwicon.exe
    + 2008-03-14 18:07:10 3,584 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\opwicon.exe
    - 2008-02-16 01:04:11 16,384 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\PEicons.exe
    + 2008-03-14 18:07:10 16,384 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\PEicons.exe
    - 2008-02-16 01:04:11 22,528 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\unbndico.exe
    + 2008-03-14 18:07:10 22,528 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\unbndico.exe
    - 2008-02-16 01:04:11 45,056 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\wordicon.exe
    + 2008-03-14 18:07:09 45,056 ----a-r C:\WINDOWS\Installer\{911B040B-6000-11D3-8CFE-0050048383C9}\wordicon.exe
    - 2007-09-24 19:30:28 135,168 ----a-w C:\WINDOWS\system32\java.exe
    + 2008-02-21 23:23:35 135,168 ----a-w C:\WINDOWS\system32\java.exe
    - 2007-09-24 19:30:30 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
    + 2008-02-21 23:23:39 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
    - 2007-09-24 20:31:42 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
    + 2008-02-22 00:33:32 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
    - 2008-02-04 23:09:46 18,214,008 ----a-w C:\WINDOWS\system32\MRT.exe
    + 2008-03-05 16:30:54 19,148,408 ----a-w C:\WINDOWS\system32\MRT.exe
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 14:00 15360]
    "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 16:52 1409024]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-15 14:00 110592 C:\WINDOWS\system32\bthprops.cpl]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-02 05:52 98304]
    "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-04-26 07:29 237568]
    "F-Secure Manager"="C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.exe" [2007-04-26 19:12 183208]
    "F-Secure TNB"="C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\TNBUtil.exe" [2007-04-26 19:10 740208]
    "News Service"="C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\ispnews.exe" [2005-05-31 14:45 356352]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 07:28 36352]
    "Elisa Avustaja"="C:\Program Files\Elisa\Avustaja\Elisa.exe" [2007-10-22 15:15 189768]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-08-16 15:46:54 113664]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624]
    InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2005-01-02 06:16:50 114688]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 11:01:04 83360]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe"=

    R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2007-04-26 19:09]
    R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Elisa Tietoturvapalvelu\HIPS\fshs.sys [2008-02-15 20:40]
    R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\minifilter\fsgk.sys [2007-04-26 19:07]
    S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\Win2K\FSfilter.sys [2007-04-26 19:08]
    S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\Win2K\FSrec.sys [2007-04-26 19:08]

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-03-16 06:56:01 C:\WINDOWS\Tasks\Scheduled scanning task.job"
    - C:\PROGRA~1\ELISAT~1\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\ELISAT~1\ANTI-V~1\report.txt
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-16 20:07:29
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-03-16 20:08:27
    ComboFix-quarantined-files.txt 2008-03-16 18:08:24
    ComboFix2.txt 2008-03-16 17:35:01
    .
    2008-03-16 06:56:56 --- E O F ---
     
    spiru4, 17.03.2008
    #38
  20. Hujo

    Hujo Guest

    • Avaa HiJackThis
    • Klikkaa "Configure" valintaa oikealla alhaalla
    • Klikkaa "Misc Tools"
    • Klikkaa boxia joka sanoo "Uninstall Manager"
    • Klikkaa valintaa "Save list"
    • Kopioi ja liitä kyseinen lista muistiosta postiisi
     
    Hujo, 17.03.2008
    #39
  21. spiru4

    spiru4 Member

    Liittynyt:
    08.11.2006
    Viestejä:
    94
    Kiitokset:
    0
    Pisteet:
    16
    Ad-Aware 2007
    Adobe Acrobat - Reader 6.0.2 Update
    Adobe Acrobat 4.0
    Adobe Flash Player 9
    Adobe Flash Player ActiveX
    Adobe Photoshop CS
    Adobe Reader 6.0.1 - Suomi
    Agere Systems PCI Soft Modem
    ATI Control Panel
    ATI Display Driver
    AudioEdit Deluxe
    AVG Anti-Spyware 7.5
    AVIcodec (remove only)
    Azureus Vuze
    BSPlayer
    EasyCleaner
    Elisa Avustaja
    Elisa Tietoturvapalvelu
    Google Video Player
    GSpot Codec Information Appliance
    Guitar Pro 5.2
    Help and Support Additions
    HijackThis 2.0.2
    HP Deskjet Preloaded Printer Drivers
    HP Extended Capabilities 5.3
    HP Image Zone 4.5.3
    HP Image Zone Express
    HP Image Zone Plus 4.5.3
    HP Imaging Device Functions 5.3
    HP Photosmart -kamerat 4.0
    HP PSC & OfficeJet 5.3.B
    HP Software Update
    HP Solution Center & Imaging Support Tools 5.3
    HPIZplus450
    InterVideo DiscLabel
    InterVideo WinDVD Creator
    InterVideo WinDVD Platinum 5
    InterVideo WinDVD Player
    iTunes
    Java(TM) 6 Update 5
    KBD
    K-Lite Codec Pack 3.5.7 Full
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Finnish Language Pack
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Word 2002
    Microsoft Works
    Mozilla Firefox (2.0.0.12)
    MSXML 4.0 SP2 (KB936181)
    Nokia Connectivity Cable Driver
    Nokia Lifeblog 2.1
    Nokia MTP driver
    Nokia N73 highlights
    Nokia Nseries Skin for Microsoft Windows Media Player
    Nokia PC Connectivity Solution
    Nokia PC Suite
    Nokia themes for your device
    PartyPoker
    Photosmart 320,370,7400,8100,8400 Series (fin)
    PS2
    Python 2.2 pywin32 extensions (build 203)
    Python 2.2.3
    Päivitys Windows XP:lle (KB894391)
    Päivitys Windows XP:lle (KB898461)
    Päivitys Windows XP:lle (KB900485)
    Päivitys Windows XP:lle (KB910437)
    Päivitys Windows XP:lle (KB916595)
    Päivitys Windows XP:lle (KB920872)
    Päivitys Windows XP:lle (KB922582)
    Päivitys Windows XP:lle (KB927891)
    Päivitys Windows XP:lle (KB930916)
    Päivitys Windows XP:lle (KB933360)
    Päivitys Windows XP:lle (KB938828)
    Päivitys Windows XP:lle (KB942763)
    Päivitys Windows XP:lle (KB942840)
    Päivitys Windows XP:lle (KB946627)
    QuickTime
    Real Alternative 1.27
    Security Update for CAPICOM (KB931906)
    Security Update for CAPICOM (KB931906)
    Sonic Express Labeler
    Sonic RecordNow!
    Suojauspäivitys ohjelmistolle Windows XP (KB923689)
    Suojauspäivitys ohjelmistolle Windows XP (KB941569)
    Suojauspäivitys Windows Media Player 6.4:lle (KB925398)
    Suojauspäivitys Windows Media Player 9:lle (KB911565)
    Suojauspäivitys Windows Media Player 9:lle (KB917734)
    Suojauspäivitys Windows Media Player 9:lle (KB936782)
    Suojauspäivitys Windows Media Playerille (KB911564)
    Suojauspäivitys Windows XP:lle (KB890046)
    Suojauspäivitys Windows XP:lle (KB893066)
    Suojauspäivitys Windows XP:lle (KB893756)
    Suojauspäivitys Windows XP:lle (KB896358)
    Suojauspäivitys Windows XP:lle (KB896422)
    Suojauspäivitys Windows XP:lle (KB896423)
    Suojauspäivitys Windows XP:lle (KB896424)
    Suojauspäivitys Windows XP:lle (KB896428)
    Suojauspäivitys Windows XP:lle (KB899587)
    Suojauspäivitys Windows XP:lle (KB899591)
    Suojauspäivitys Windows XP:lle (KB900725)
    Suojauspäivitys Windows XP:lle (KB901017)
    Suojauspäivitys Windows XP:lle (KB901214)
    Suojauspäivitys Windows XP:lle (KB902400)
    Suojauspäivitys Windows XP:lle (KB904706)
    Suojauspäivitys Windows XP:lle (KB905414)
    Suojauspäivitys Windows XP:lle (KB905749)
    Suojauspäivitys Windows XP:lle (KB905915)
    Suojauspäivitys Windows XP:lle (KB908519)
    Suojauspäivitys Windows XP:lle (KB908531)
    Suojauspäivitys Windows XP:lle (KB911280)
    Suojauspäivitys Windows XP:lle (KB911562)
    Suojauspäivitys Windows XP:lle (KB911567)
    Suojauspäivitys Windows XP:lle (KB911927)
    Suojauspäivitys Windows XP:lle (KB912812)
    Suojauspäivitys Windows XP:lle (KB912919)
    Suojauspäivitys Windows XP:lle (KB913446)
    Suojauspäivitys Windows XP:lle (KB913580)
    Suojauspäivitys Windows XP:lle (KB914388)
    Suojauspäivitys Windows XP:lle (KB914389)
    Suojauspäivitys Windows XP:lle (KB916281)
    Suojauspäivitys Windows XP:lle (KB917159)
    Suojauspäivitys Windows XP:lle (KB917344)
    Suojauspäivitys Windows XP:lle (KB917422)
    Suojauspäivitys Windows XP:lle (KB917953)
    Suojauspäivitys Windows XP:lle (KB918118)
    Suojauspäivitys Windows XP:lle (KB918439)
    Suojauspäivitys Windows XP:lle (KB918899)
    Suojauspäivitys Windows XP:lle (KB919007)
    Suojauspäivitys Windows XP:lle (KB920213)
    Suojauspäivitys Windows XP:lle (KB920214)
    Suojauspäivitys Windows XP:lle (KB920670)
    Suojauspäivitys Windows XP:lle (KB920683)
    Suojauspäivitys Windows XP:lle (KB920685)
    Suojauspäivitys Windows XP:lle (KB921398)
    Suojauspäivitys Windows XP:lle (KB921503)
    Suojauspäivitys Windows XP:lle (KB921883)
    Suojauspäivitys Windows XP:lle (KB922616)
    Suojauspäivitys Windows XP:lle (KB922819)
    Suojauspäivitys Windows XP:lle (KB923191)
    Suojauspäivitys Windows XP:lle (KB923414)
    Suojauspäivitys Windows XP:lle (KB923980)
    Suojauspäivitys Windows XP:lle (KB924191)
    Suojauspäivitys Windows XP:lle (KB924270)
    Suojauspäivitys Windows XP:lle (KB924496)
    Suojauspäivitys Windows XP:lle (KB924667)
    Suojauspäivitys Windows XP:lle (KB925486)
    Suojauspäivitys Windows XP:lle (KB925902)
    Suojauspäivitys Windows XP:lle (KB926255)
    Suojauspäivitys Windows XP:lle (KB926436)
    Suojauspäivitys Windows XP:lle (KB927779)
    Suojauspäivitys Windows XP:lle (KB927802)
    Suojauspäivitys Windows XP:lle (KB928255)
    Suojauspäivitys Windows XP:lle (KB928843)
    Suojauspäivitys Windows XP:lle (KB929123)
    Suojauspäivitys Windows XP:lle (KB930178)
    Suojauspäivitys Windows XP:lle (KB931261)
    Suojauspäivitys Windows XP:lle (KB931784)
    Suojauspäivitys Windows XP:lle (KB932168)
    Suojauspäivitys Windows XP:lle (KB933729)
    Suojauspäivitys Windows XP:lle (KB935839)
    Suojauspäivitys Windows XP:lle (KB935840)
    Suojauspäivitys Windows XP:lle (KB936021)
    Suojauspäivitys Windows XP:lle (KB937143)
    Suojauspäivitys Windows XP:lle (KB938127)
    Suojauspäivitys Windows XP:lle (KB938829)
    Suojauspäivitys Windows XP:lle (KB939653)
    Suojauspäivitys Windows XP:lle (KB941202)
    Suojauspäivitys Windows XP:lle (KB941568)
    Suojauspäivitys Windows XP:lle (KB941644)
    Suojauspäivitys Windows XP:lle (KB942615)
    Suojauspäivitys Windows XP:lle (KB943055)
    Suojauspäivitys Windows XP:lle (KB943460)
    Suojauspäivitys Windows XP:lle (KB943485)
    Suojauspäivitys Windows XP:lle (KB944533)
    Suojauspäivitys Windows XP:lle (KB944653)
    Suojauspäivitys Windows XP:lle (KB946026)
    TukiCD - Adaptec ASPI-ajuri
    ViewSonic Monitor Drivers
    Winamp
    Windows Driver Package - Nokia Modem (04/06/2006 6.8.0.17)
    Windows Imaging Component
    Windows Installer 3.1 (KB893803)
    Windows Live installer
    Windows Live Messenger
    Windows Live Writer
    Windows Liven kirjautumisavustaja
    Windows Liven sähköposti
    Windows Media Format Runtime
    Windows XP Hotfix - KB873339
    Windows XP Hotfix - KB883667
    Windows XP Hotfix - KB885250
    Windows XP Hotfix - KB885835
    Windows XP Hotfix - KB885836
    Windows XP Hotfix - KB885884
    Windows XP Hotfix - KB886185
    Windows XP Hotfix - KB887472
    Windows XP Hotfix - KB887742
    Windows XP Hotfix - KB888113
    Windows XP Hotfix - KB888302
    Windows XP Hotfix - KB890175
    Windows XP Hotfix - KB890859
    Windows XP Hotfix - KB891781

     
    spiru4, 17.03.2008
    #40
Sivu 2 / 3

Jaa tämä sivu