Kone tilttaa ja suoritinkäyttö 100%

Jooooooooooooooooooooooooooooooo fixed

 

Syyksi olen todennut että näytönohjain kuumenee liian kuumaksi ja kone tilttaa ja boottaa ittensä itestään?
Olisko apua?

 

scannaa hjt:llä merkkaa paina Fix checked

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


Kopioi / liitä seuraava teksti alapuolella tyhjään muistioFiluun
Varmista että tiedoston tyyppi on ”all Files” ja tallenna se Poisto.bat. nimisenä
työpöydällesi.

@echo off
sc stop SymWSC
sc delete SymWSC


Tupla-klikkaa Poisto.bat. filua työpöydälläsi , ikkuna avautuu ja Sulkeutuu tämä on normaalia.


Poista vikasiedossa kansio

c:\Program Files\Common Files\Symantec Shared

====================

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

 

SDFix: Version 1.240
Run by HP_Omistaja on ti 02.12.2008 at 22:47

Microsoft Windows XP [versio 5.1.2600]
Running From: C:\Documents and Settings\HP_Omistaja.MIIKKA\Ty”p”yt„\SDFix\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\SYSTEM32\SETUP_~1.EXE - Deleted
C:\WINDOWS\system32\Setup_ver1.1441.0.exe - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-02 22:54:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"%ProgramFiles%\\iTunes\\iTunes.exe"="%ProgramFiles%\\iTunes\\iTunes.exe:*:enabled:iTunes"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :


File Backups: - C:\DOCUME~1\HP_OMI~1.MII\TYPYT~1\SDFix\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sun 5 Oct 2008 213 A.SHR --- "C:\BOOT.BAK"
Tue 17 Jun 2008 65,536 A.SH. --- "C:\Program Files\MessengerDiscovery\AlertSkinInstaller.exe"
Sun 22 Jun 2008 40,960 A.SH. --- "C:\Program Files\MessengerDiscovery\SpellCHK.exe"
Wed 2 Dec 1998 143,360 A.SH. --- "C:\Program Files\MessengerDiscovery\unzip.dll"
Tue 11 Apr 2006 32 A.SH. --- "C:\WINDOWS\SMINST\HPCD.SYS"
Fri 21 Nov 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0be1361452f65c042d9f57f3cb12e221\BIT34.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\1095dcf1989563f29249489b5df12215\BIT5F.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\11aa074f3fe4e4310334a5e3b13964e0\BIT3D.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\18f7de7388f2ecc3ee2c049ee2fc9d0e\BIT3A.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\1a7c02b89e84aa289203de8d42ab6aab\BIT10.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2706899d69e6fe717249704788ceb17a\BIT5B.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2a9af77915d50aa8c49a031a1f10b6ff\BIT5A.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\300b28ed68f6135eed9f43fd03c89fe9\BIT5C.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\3082d0faf4ab17888ff73a544582dfd5\BIT3B.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\330a4d5ecd31c83f255537d6587ce52e\BIT40.tmp"
Sun 5 Oct 2008 5,652,328 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\357d5a4856ec081e948564d55a7a3874\BITF.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\39737f8bd20981fb485b0c0cc5ecb7ea\BIT4D.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\3991e7e6ebf291821b9a0667af90a9ad\BIT22.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\39f6cf67abed2ca8894f00e506145216\BIT64.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\44979ad6096e28df5c1a4e84ef6d4a2b\BIT4E.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\48e8301ea45ef4d00cbc2e18d22d00ea\BIT31.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4d751569682bcfab516d1b90aefe69c0\BIT23.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\51f605d615d706ed335e44101daf2df7\BIT58.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5397746a594a7d61d3e54be30560fae7\BIT3F.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\56f70cca1e2a40d22c814f1bfefc9bb1\BIT46.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5c21a120780a300cf4813481901e851b\BIT59.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5d84bce1e6dc6864a3cf8fb4b6fd376a\BIT43.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\61d94dcc2cfb22137875864a6ba3bd35\BIT51.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\64280fa1997e4f7f6a00252b4a55a0f8\BIT60.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\684db52ea714c497f235d65bb1f36c83\BIT63.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6a5e0ac81b305e5bbc0293b72ef8338c\BIT47.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6c3b88f4b16cf163a4cea1e14aee9425\BIT38.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\7708f167d5169af618bbeb30cdb2b1a7\BIT5E.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\7c87381decbfc5191ce4ea070e0892b4\BIT4F.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\7cde4e92d87f06cc4457a83c3710b62a\BIT48.tmp"
Sun 5 Oct 2008 9,249,736 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\80541332f80149b5f3f271f730226312\BIT27.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8248f68c89943fa7c3311c7d9b0dcdbc\BIT39.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\83b6df52cdb930a6f939b1d4798b27c5\BIT56.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8436cda0baa5481bc338e6ee2beb1ecc\BIT42.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\86831e5e925ba02101beff57397757f9\BIT3C.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8a63c9398158ec80701db982bcbd7cca\BIT36.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8dd4640e901c5de38f0d64d197b1b2cd\BIT3E.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\96156a2ef7a2c5dee8d691fa03c9edb1\BIT65.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9bdb478ba8417d739a3c7ead1452ae1c\BIT49.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a34537e0ed1db3b42c2e4182f301eaf3\BIT37.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a489706e9d5ea7dc3d43b43642a7d51d\BIT50.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b37f98fadb766cea2c024b3f99cdf289\BIT32.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b39fc27e96e0e32059f45b4808a8594d\BIT66.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b5be6d028e4dbb6dd6a89ccb6fd68f72\BIT53.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b6dc3f3622f986cc1a95d8877dbd775a\BIT35.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b6eb675d5f85f7cde20befdb34dbe983\BIT33.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b7f41b806501f1d51e02fc562a76f4a9\BIT54.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cef940f3b263e71524ca627eee33edea\BIT57.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e3733102018a3400101ffede29e556f9\BIT44.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e41a589dc265b6b9321428a83ae844bb\BIT52.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e630756b08c4d863fbaf50cc71bedb61\BIT62.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ea0f75676c11484a862a8b83cc7166ab\BIT45.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ee5488f0a0d7c2d3346104b76390be31\BIT5D.tmp"
Sun 5 Oct 2008 152,703 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f55493df0bc3b4b8615b2a0a3272569e\BIT55.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\120535ea4c8089eee11dd5cdd909e08d\download\BIT6F.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4275123841de54fb6e319265fd1862e2\download\BIT7B.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4fa7077dc904550867b20e133969e20a\download\BIT1F.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9df72f37cac9f88436f5e64660004705\download\BIT6D.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c31655aa1f722605d9c99f8cddb01796\download\BIT7D.tmp"
Sun 5 Oct 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f052a5a48ce71727f801d1f48f751740\download\BIT6E.tmp"

Finished!





JA
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:57:40, on 2.12.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsqh.exe
C:\Program Files\Sonera Tietoturva\FSAUA\program\fsaua.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
C:\Program Files\Sonera Tietoturva\FSAUA\program\fsus.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\MessengerDiscovery\MessengerDiscovery.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q305&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q305&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: HP-näkymä - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\Stardock\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTCheck] C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1223216223437
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: FAH@C:+Documents and Settings+HP_Omistaja.MIIKKA+Omat tiedostot+Downloads+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe - Unknown owner - C:\WINDOWS\
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\ORSP Client\fsorsp.exe
O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (file missing)

--
End of file - 8769 bytes

 

1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
Combofix1
Combofix2

2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

 

ComboFix 08-12-01.03 - HP_Omistaja 2008-12-03 11:57:59.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.621 [GMT 2:00]
Sijainti: c:\documents and settings\HP_Omistaja.MIIKKA\Työpöytä\ComboFix.exe
* Resident AV is active

.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\Autorun.inf

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-11-03 to 2008-12-03 )))))))))))))))))
.

2008-12-02 22:42 . 2008-12-02 22:42 <KANSIO> d-------- c:\windows\ERUNT
2008-12-02 20:10 . 2008-12-02 20:10 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-11-29 16:27 . 2000-05-22 02:58 647,872 --------- c:\windows\system32\Mscomct2.ocx
2008-11-29 16:27 . 2006-10-06 00:17 53,248 --------- c:\windows\Ctregrun.exe
2008-11-29 16:26 . 2008-11-29 16:26 <KANSIO> d-------- c:\program files\Audible
2008-11-29 16:26 . 2008-11-29 16:26 417,792 --a------ c:\windows\system32\awrdscdc.ax
2008-11-29 16:25 . 2008-11-30 11:20 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Creative
2008-11-29 16:23 . 2008-11-29 16:25 <KANSIO> d--h----- c:\program files\Creative Installation Information
2008-11-29 16:23 . 2008-11-30 11:24 <KANSIO> d-------- c:\program files\Creative
2008-11-29 16:23 . 2008-11-29 16:23 <KANSIO> d-------- c:\program files\Common Files\Creative
2008-11-29 16:23 . 1999-12-12 19:01 44,032 --------- c:\windows\system32\CTSVCCDA.EXE
2008-11-29 16:23 . 1999-11-17 19:00 25,088 --------- c:\windows\system32\CTSVCCTL.EXE
2008-11-29 16:21 . 2008-11-29 16:21 <KANSIO> d-------- c:\program files\LitexMedia
2008-11-28 21:54 . 2008-11-28 21:54 <KANSIO> d-------- c:\documents and settings\HP_OMI~1~MII\LOCALS~1
2008-11-28 21:54 . 2008-11-28 21:54 <KANSIO> d-------- c:\documents and settings\HP_OMI~1~MII
2008-11-22 15:10 . 2008-12-03 07:34 31 --a------ c:\documents and settings\HP_Omistaja.MIIKKA\jagex_runescape_preferences.dat
2008-11-22 15:09 . 2008-11-22 21:02 <KANSIO> d-------- c:\windows\.jagex_cache_32
2008-11-21 17:25 . 2008-11-21 17:25 <KANSIO> d-------- c:\program files\Windows Media Connect 2
2008-11-21 17:24 . 2008-11-21 17:24 <KANSIO> d-------- c:\windows\system32\LogFiles
2008-11-21 17:24 . 2008-11-21 17:30 <KANSIO> d-------- c:\windows\system32\drivers\UMDF
2008-11-21 17:23 . 2008-11-21 17:23 <KANSIO> d-------- c:\program files\Common Files\Sony Shared
2008-11-20 21:03 . 2008-11-20 21:33 <KANSIO> d-------- c:\program files\ActivIcons
2008-11-20 21:03 . 2008-11-20 21:03 <KANSIO> d-------- c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\CursorArts
2008-11-20 21:03 . 2008-11-20 21:03 0 --a------ C:\Default.Bmp
2008-11-18 21:14 . 2008-11-18 21:15 108 ---h----- c:\documents and settings\Desktop.ini
2008-11-18 21:13 . 2008-11-18 21:13 48 --a------ c:\windows\iltwain.ini
2008-11-18 11:25 . 2008-11-18 11:25 664 --a------ c:\windows\system32\d3d9caps.dat
2008-11-17 12:19 . 2008-11-17 12:19 244 --ah----- C:\sqmnoopt00.sqm
2008-11-17 12:19 . 2008-11-17 12:19 232 --ah----- C:\sqmdata00.sqm
2008-11-14 19:55 . 2008-11-20 21:32 <KANSIO> d-------- c:\program files\CCleaner
2008-11-13 15:53 . 2008-11-13 15:54 <KANSIO> d-------- c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\Filter Forge Freepack 1 - Metals
2008-11-12 17:40 . 2007-05-16 16:45 3,497,832 --a------ c:\windows\system32\d3dx9_34.dll
2008-11-12 17:40 . 2007-05-16 16:45 1,124,720 --a------ c:\windows\system32\D3DCompiler_34.dll
2008-11-12 17:40 . 2007-05-16 16:45 443,752 --a------ c:\windows\system32\d3dx10_34.dll
2008-11-12 17:40 . 2007-06-20 20:46 266,088 --a------ c:\windows\system32\xactengine2_8.dll
2008-11-12 17:40 . 2007-04-04 18:53 81,768 --a------ c:\windows\system32\xinput1_3.dll
2008-11-12 17:40 . 2007-06-20 20:45 18,280 --a------ c:\windows\system32\x3daudio1_2.dll
2008-11-12 17:39 . 2007-03-12 16:42 3,495,784 --a------ c:\windows\system32\d3dx9_33.dll
2008-11-12 17:39 . 2007-03-12 16:42 1,123,696 --a------ c:\windows\system32\D3DCompiler_33.dll
2008-11-12 17:39 . 2007-03-15 16:57 443,752 --a------ c:\windows\system32\d3dx10_33.dll
2008-11-12 17:39 . 2007-04-04 18:55 261,480 --a------ c:\windows\system32\xactengine2_7.dll
2008-11-12 17:39 . 2007-01-24 15:27 255,848 --a------ c:\windows\system32\xactengine2_6.dll
2008-11-12 17:39 . 2007-03-05 12:42 15,128 --a------ c:\windows\system32\x3daudio1_1.dll
2008-11-10 13:59 . 2008-11-12 10:42 <KANSIO> d-------- c:\windows\SxsCaPendDel
2008-11-10 10:15 . 2008-11-10 10:15 30,856 --a------ c:\windows\system32\drivers\fsbts.sys
2008-11-03 12:22 . 2008-11-03 12:38 <KANSIO> d-------- c:\program files\Fraps

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-03 08:34 --------- d-----w c:\program files\Sonera Tietoturva
2008-12-02 18:10 410,976 ----a-w c:\windows\system32\deploytk.dll
2008-12-02 18:09 --------- d-----w c:\program files\Java
2008-12-02 15:38 --------- d-----w c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\uTorrent
2008-12-01 19:56 --------- d-----w c:\program files\DC++
2008-12-01 07:57 --------- d-----w c:\program files\mIRC
2008-11-30 22:50 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-29 21:54 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-29 15:10 --------- d-----w c:\program files\HyCam2
2008-11-20 19:34 --------- d-----w c:\program files\Common Files\stardock
2008-11-18 18:59 --------- d-----w c:\program files\BSplayerPro
2008-11-18 18:29 --------- d-----w c:\program files\Winamp
2008-11-15 13:34 --------- d-----w c:\program files\uTorrent
2008-11-14 18:00 --------- d-----w c:\program files\Google
2008-11-13 14:26 --------- d-----w c:\program files\MessengerDiscovery
2008-11-12 11:45 453,152 ----a-w c:\windows\system32\NVUNINST.EXE
2008-11-10 11:02 --------- d-----w c:\program files\SCAR 3.15
2008-11-10 08:06 --------- d-----w c:\documents and settings\All Users\Application Data\fssg
2008-11-10 08:06 --------- d-----w c:\documents and settings\All Users\Application Data\F-Secure
2008-11-02 22:00 --------- d-----w c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\Sony
2008-10-24 14:35 --------- d-----w c:\program files\Xvid
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 11:10 453,632 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-24 09:01 --------- d-----w c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\Sonic
2008-10-24 09:01 --------- d-----w c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\Leadertech
2008-10-23 21:12 --------- d-----w c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\AdobeUM
2008-10-19 09:38 --------- d-----w c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\F-Secure
2008-10-17 12:44 --------- d-----w c:\program files\MSXML 6.0
2008-10-16 19:24 --------- d-----w c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\Publish Providers
2008-10-16 19:20 --------- d-----w c:\program files\Vstplugins
2008-10-16 19:20 --------- d-----w c:\documents and settings\All Users\Application Data\Sony
2008-10-16 19:19 --------- d-----w c:\program files\Sony
2008-10-16 19:04 --------- d-----w c:\program files\MSBuild
2008-10-16 18:59 --------- d-----w c:\program files\Reference Assemblies
2008-10-16 18:42 --------- d-----w c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\Sony Setup
2008-10-16 18:41 --------- d-----w c:\program files\Sony Setup
2008-10-16 12:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 12:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 12:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 12:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 12:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 12:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 12:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 12:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 12:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 12:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 12:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 12:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 12:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 12:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 12:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 12:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 12:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-15 17:00 332,800 ----a-w c:\windows\system32\dllcache\netapi32.dll
2008-10-12 16:38 --------- d-----w c:\program files\Common Files\Macromedia
2008-10-12 16:36 --------- d-----w c:\program files\Macromedia
2008-10-11 19:14 --------- d-----w c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\TortoiseSVN
2008-10-11 15:25 5,499,904 ----a-w c:\windows\system32\logonuiX.exe
2008-10-11 15:23 --------- d-----w c:\program files\Stardock
2008-10-10 15:42 --------- d-----w c:\program files\Codec Pack - All In 1
2008-10-08 15:06 --------- d-----w c:\program files\QuickTime
2008-10-08 15:06 --------- d-----w c:\program files\Common Files\Apple
2008-10-08 15:05 --------- d-----w c:\program files\Apple Software Update
2008-10-08 15:05 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-10-08 15:05 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2008-10-07 20:18 --------- d-----w c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\BSplayer PRO
2008-10-07 17:04 --------- d-----w c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\Winamp
2008-10-07 13:33 --------- d-----w c:\program files\SystemRequirementsLab
2008-10-07 13:32 --------- d-----w c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\SystemRequirementsLab
2008-10-05 20:47 --------- d-----w c:\program files\Last.fm
2008-10-05 20:08 --------- d-----w c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\Subversion
2008-10-05 14:40 --------- d-----w c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\mIRC
2008-10-05 14:24 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-10-05 14:10 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-10-05 14:05 --------- d-----w c:\program files\Symantec
2008-10-05 13:57 --------- d-----w c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\Symantec
2008-10-05 13:15 1,846 --sha-r c:\windows\system32\drivers\103C_HP_CPC_EC640AA-ABX t3149.fi_YC_0Pavi_QCZB526_E53FIheBLU1_47_IAMETHYST-M_SMSI_V1.0_B3.18_T050609_WXH2_L40B_M1023_J200_7AMD_8Athlon 64_91.99_#081004_N10EC8139_Z11C1048C_G10DE0141.MRK
2008-10-05 08:55 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-10-05 08:53 --------- d-----w c:\program files\MSXML 4.0
2008-10-05 07:17 --------- d-----w c:\program files\Common Files\Adobe
2008-10-05 07:15 --------- d-----w c:\program files\Common Files\Adobe Systems Shared
2008-10-05 07:15 --------- d-----w c:\documents and settings\All Users\Application Data\Adobe Systems
2008-10-04 21:08 --------- d-----w c:\documents and settings\All Users\Application Data\Last.fm
2008-10-04 17:11 737,280 ----a-w c:\windows\iun6002.exe
2008-10-04 14:07 --------- d-----w c:\program files\Subversion
2008-10-04 13:17 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-10-04 13:17 --------- d-----w c:\program files\Windows Live
2008-10-04 12:26 --------- d-----w c:\documents and settings\All Users\Application Data\Winamp Toolbar
2008-10-02 23:46 81,920 ----a-w c:\windows\system32\frapsvid.dll
2008-09-30 14:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-17 06:55 453,152 ----a-w c:\windows\system32\nvudisp.exe
2008-09-15 15:40 1,846,272 ----a-w c:\windows\system32\win32k.sys
2008-09-15 15:40 1,846,272 ----a-w c:\windows\system32\dllcache\win32k.sys
2008-09-08 22:12 637,984 ----a-w c:\windows\system32\dllcache\iexplore.exe
2008-09-04 16:45 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-09-04 16:45 1,106,944 ----a-w c:\windows\system32\dllcache\msxml3.dll
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-09-15 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"HPHmon06"="c:\windows\system32\hphmon06.exe" [2004-06-07 659456]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2004-10-13 278528]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"PS2"="c:\windows\system32\ps2.exe" [2004-10-25 90112]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"F-Secure Manager"="c:\program files\Sonera Tietoturva\Common\FSM32.EXE" [2008-09-23 182936]
"F-Secure TNB"="c:\program files\Sonera Tietoturva\FSGUI\TNBUtil.exe" [2008-09-23 957024]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352]
"LogonStudio"="c:\program files\Stardock\LogonStudio\logonstudio.exe" [2002-09-03 987187]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"CTCheck"="c:\program files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 397312]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 c:\windows\AGRSMMSG.exe]

c:\windows\system32\config\systemprofile\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
AutoTBar.exe [2003-09-30 57344]

c:\windows\system32\config\systemprofile\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
AutoTBar.exe [2003-09-30 57344]

c:\documents and settings\HP_Omistaja.MIIKKA\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

c:\documents and settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-05 258048]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\\WINDOWS\\system32\\logonuiX.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
2005-01-31 15:13 49152 c:\progra~1\COMMON~1\stardock\MCPStub.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2008-10-05 15:41 184320 c:\program files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

*Newly Created Service* - PROCEXP90
.
'Ajoitetut tehtävät'-kansion sisältö

2008-12-03 c:\windows\Tasks\Scheduled scanning task.job
- c:\progra~1\SONERA~1\ANTI-V~1\fsav.exe [2008-09-23 15:35]

2005-01-01 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-09-02 23:25]
.
.
------- Täydentävä tarkistus -------
.
FireFox -: Profile - c:\documents and settings\HP_Omistaja.MIIKKA\Application Data\Mozilla\Firefox\Profiles\f3b492g9.default\
FF -: plugin - c:\program files\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-03 12:00:11
Windows 5.1.2600 Service Pack 2 NTFS

tarkistaa piilotettuja prosesseja ...

tarkistaa piilotettuja käynnistysarvoja ...

tarkistaa piilotettuja tiedostoja ...

tarkistus on valmis
piilotetut tiedostot: 0

**************************************************************************
"ImagePath"="\??\c:\program files\Sonera Tietoturva\Anti-Virus\Win2K\FSrec.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\FAH@C:+Documents and Settings+HP_Omistaja.MIIKKA+Omat tiedostot+Downloads+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe]
"ImagePath"="c:\documents and settings\HP_Omistaja.MIIKKA\Omat tiedostot\Downloads\
[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING\FAH.exe -svcstart"


[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\FAH@C:+Documents and Settings+HP_Omistaja.MIIKKA+Omat tiedostot+Downloads+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe]
"ImagePath"="c:\documents and settings\HP_Omistaja.MIIKKA\Omat tiedostot\Downloads\
.
--------------------- Prosesseihin ladatut DLLt ---------------------

- - - - - - - > 'winlogon.exe'(540)
c:\progra~1\COMMON~1\Stardock\mcpstub.dll
c:\program files\Sonera Tietoturva\FWES\Program\fsdc32.dll
c:\program files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll

- - - - - - - > 'lsass.exe'(596)
c:\program files\Sonera Tietoturva\FSPS\program\FSLSP.DLL
c:\program files\Sonera Tietoturva\FWES\Program\fsdc32.dll

- - - - - - - > 'csrss.exe'(516)
c:\program files\Sonera Tietoturva\FWES\Program\fsdc32.dll
.
Valmistumisajankohta: 2008-12-03 12:01:21
ComboFix-quarantined-files.txt 2008-12-03 10:01:18

Ennen ajoa: 177 385 603 072 tavua vapaana
Ajon jälkeen: 177,372,389,376 tavua vapaana

256 --- E O F --- 2008-11-22 07:23:52

 

sulla on koneella cclener aja puhdistaja ja rekisteri

 

Ei ole auttanut :S Luulen silti että tilttaaminen johtuu siitä että näytön ohjain kuumeneee.
Niin ja pitäiskä näytönohjaimessa tuuletin pyöriä,miten sen saa pyörimään taas ja miten n-ohjaimen saa irti?

 

tällä saat niitä lämpöjä kateltua
EVEREST Home Edition 2.20

 

Ja miten helvetis tolla katotaa lämmöt?

 

Ei voi muokata viestii tai en löydä nappia :S No ei näy näytönohhjaimen
lämpöjä.

 

avaat ja Tetokone > anturit

 

Kyllä mutta ei ole näytönohjainta siellä!

 

Joo eipä näyttä olevan.
Jää nyt pelkäksi arvailuksi lämpö ongelma.
Vieläkös siellä tuo FULLSCREE ja suoritin huutaa saataa ja saapaita

 

Valitettavasti vielläkin :S

 

ettei vain kävisi niinkuin entiselle miehelle kone on sanomassa työsopimusta irti

==============

Tarkista Kaspersky Online Skannerilla

1. Lue läpi vaatimukset ja yksityisyyssäännökset ja klikkaa Accept.
2. Skannerin ja virustietokannan lataus alkaa. Sinulta kysytään sallitko Kasperskyltä tulevan ohjelman asentamisen. Klikkaa Aja/Run.
3. Kun lataus on valmis, klikkaa Settings.
4. Varmistu, että seuraavat kohdat on valittu. Jos ne eivät ole, valitse ne ja klikkaa Save:
Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases
5. Klikkaa Oma Tietokone, My Computer Scan-kohdan alapuolelta.
6. Kun tarkistus on valmis, tulokset näytetään. Klikkaa View Scan Report.
7. Näet listan saastuneista kohteista. Klikkaa Save Report As....
8. Tallenna tiedosto työpöydällesi. Muuta Tiedostotyyppi/Files of type muotoon Tekstitiedosto/Text file(.txt) ennen kuin klikkaat Save.
9. Kopioi ja liitä tiedoston sisältö seuraavaan vastaukseesi uuden HijackThis-lokin kera

 

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, December 4, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, December 04, 2008 11:22:06
Records in database: 1436426
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\

Scan statistics:
Files scanned: 92542
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 01:44:33

No malware has been detected. The scan area is clean.

The selected area was scanned.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:17:25, on 4.12.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsqh.exe
C:\Program Files\MessengerDiscovery\MessengerDiscovery.exe
C:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Tietoturva\FSAUA\program\fsaua.exe
C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
C:\Program Files\Sonera Tietoturva\FSAUA\program\fsus.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Sonera Tietoturva\FSGUI\scanwizard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q305&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q305&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: HP-näkymä - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\Stardock\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTCheck] C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1223216223437
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: FAH@C:+Documents and Settings+HP_Omistaja.MIIKKA+Omat tiedostot+Downloads+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe - Unknown owner - C:\WINDOWS\
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\ORSP Client\fsorsp.exe
O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (file missing)

--
End of file - 8700 bytes

 

O23 - Service: SymWMI Service (SymWSC) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (file missing)

Mene käynnistä -> suorita -> services.msc -> ok

Etsi yllä oleva service ja tuplalikkaa sitä laita SEIS alasvetovalikosta Ei käytössä

Käytä ja ok

 

Huomasin kyl just et pelatessa java.exe suoritinkäyttö on nykyään 80% ei +90. Mutta silti tilttailee ja suoritinkäyttö 80-100% pelatessa.

 

Paljos koneessa on keskusmuistia