onko kone puhdas?jotain vikoja? (hjt-log)

otetaas jos tuo nyt onnistuis

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

 

SDFix: Version 1.121

Run by Administrator on su 02.03.2008 at 18:29

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\115695~1 - Deleted




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-02 18:48:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

C:\Documents and Settings\HP_Administrator\My Documents\My Music\My Music\leffoja\Black.Christmas.Unrated[2007].Dvdrip.Xvid.AC3[5.1]-RoCK\Thumbs.db:encryptable 0 bytes hidden from API

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 2


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"="C:\\Program Files\\AVG\\AVG8\\avgnsx.exe:*:Enabled:avgnsx.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Tue 26 Feb 2008 211 A.SHR --- "C:\BOOT.BAK"
Fri 1 Sep 2006 32,207 ..SH. --- "C:\Program Files\Common Files\Y1220OU.exe"
Thu 6 Dec 2007 625,664 A.SH. --- "C:\Program Files\Internet Explorer\iexplore.exe"
Mon 14 Mar 2005 299,008 A..H. --- "C:\Program Files\Canon\MP Navigator 2.0\Maint.exe"
Mon 28 Feb 2005 61,440 A..H. --- "C:\Program Files\Canon\MP Navigator 2.0\uinstrsc.dll"
Sat 1 Mar 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sun 28 Oct 2007 20,237,328 A..H. --- "C:\Documents and Settings\HP_Administrator\Local Settings\Temp\BITBD.tmp"
Tue 1 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\410ff09308a833491dba7686f0aee2eb\BIT4.tmp"
Sun 2 Mar 2008 5,686 A.SH. --- "C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\TempSBE\SBE1.tmp"
Sun 2 Mar 2008 5,940 A.SH. --- "C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\TempSBE\SBE2.tmp"

Finished!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:02:10, on 2.3.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
c:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
c:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Adobe Photoshop CS3\Photoshop.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "c:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Ares Galaxy Super Speed] C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe
O4 - HKCU\..\Run: [CTSyncU.exe] C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: Get a FREE audiobook!.lnk = C:\Documents and Settings\HP_Administrator\Local Settings\Temp\Get a FREE audiobook!.exe
O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O4 - Global Startup: ATI CATALYST -ilmaisinalue.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase370.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1204033224265
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - c:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - c:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 8302 bytes

 

etsi tuo servise ja laita se seis ja ei käytössä

O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

Mene käynnistä -> suorita -> services.msc -> ok

Poista tuo kansio vikasiedossa

C:\Program Files\Symantec

 

onkos vikoja sillä kyseinen netti selain yhä aukeilee ilman avaamatta

AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 14:32:10 5.3.2008

+ Scan result:



C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP33\A0006811.exe -> Backdoor.Agent.duj : Cleaned with backup (quarantined).
:mozilla.49:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.50:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.58:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.59:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.60:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.61:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.15:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.16:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.17:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.18:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.40:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.42:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.43:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.63:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.25:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : Cleaned.
:mozilla.12:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.6:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.7:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.57:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.51:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.52:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.53:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.54:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.55:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\nsoyabo3.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.


::Report end

 

scannaa hjt:llä merkkaa paina Fix checked

O4 - Startup: Get a FREE audiobook!.lnk = C:\Documents and Settings\HP_Administrator\Local Settings\Temp\Get a FREE audiobook!.exe

==============

Lataa NoLop työpöydällesi yhdestä seuraavista linkeistä...
Linkki1
Linkki2
Linkki3

1.Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen
2.Tuplaklikkaa NoLop.exe ajaaksesi sen
3.Klikkaa nappulaa "Search and Destroy"
<<Tietokoneesi skannataan saastuneiden tiedostojen osalta>>
4, Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK
5. Klikkaa "REBOOT"-painiketta.
6. NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera.
-- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataa mscomctl.ocx ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan.

==============

1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK

============

 

tuolla scannerilla ei löytynyt kyllä vikoja yhtään tässä olisi hjt-logi jos sieltä löytyy?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:32:51, on 5.3.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\HP\KBD\KBD.EXE
c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
c:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ptlg.exe
C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe
C:\Program Files\IObit\Advanced WindowsCare V2\MemCleaner.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\Program Files\Ares\Ares.exe
C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
c:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "c:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [msptlg] C:\WINDOWS\ptlg.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe"
O4 - HKLM\..\Run: [SmartRAM] C:\Program Files\IObit\Advanced WindowsCare V2\MemCleaner.exe /m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Ares Galaxy Super Speed] C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe
O4 - HKCU\..\Run: [CTSyncU.exe] C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O4 - Global Startup: ATI CATALYST -ilmaisinalue.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase370.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1204033224265
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - c:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - c:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
O23 - Service: ptlg - Unknown owner - C:\WINDOWS\system32\ptlg.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 8753 bytes

 

Loki ok

 

onkohan koneessa tällä hetkellä vikoja sillä se on todella hidas ja tilttaileva vaikka nettiyhteyksiäkin on 24 megaa

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:58:32, on 7.3.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
c:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\ptlg.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
c:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cleanmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "c:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [msptlg] C:\WINDOWS\ptlg.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Ares Galaxy Super Speed] C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe
O4 - HKCU\..\Run: [CTSyncU.exe] C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O4 - Global Startup: ATI CATALYST -ilmaisinalue.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase370.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1204033224265
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - c:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - c:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
O23 - Service: ptlg - Unknown owner - C:\WINDOWS\system32\ptlg.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 8532 bytes

 

1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

==========

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

 

ComboFix 08-03-07.3 - HP_Administrator 2008-03-07 23:59:35.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.500 [GMT 2:00]
Running from: C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.IE5\UUZB6ESO\ComboFix[1].exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-02-07 to 2008-03-07 )))))))))))))))))))))))))))))))
.

2008-03-07 23:08 . 2008-03-07 23:09 <DIR> d-------- C:\Program Files\r2 Studios
2008-03-05 21:24 . 2008-03-05 21:24 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-03-05 17:03 . 2008-03-05 17:06 <DIR> d-------- C:\Program Files\MTV Virtual World
2008-03-05 15:17 . 2008-03-05 15:17 106 --a------ C:\delete.bat
2008-03-05 14:57 . 2008-03-05 14:57 1 --a------ C:\WINDOWS\system32\SI.bin
2008-03-04 14:29 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-03 23:07 . 2008-03-03 23:07 <DIR> d-------- C:\Program Files\AskTBar
2008-03-03 21:39 . 2008-03-03 21:39 6,144 --ahs---- C:\WINDOWS\system32\access.ctl
2008-03-02 23:18 . 2008-03-03 19:06 <DIR> d-------- C:\Program Files\onOne Software
2008-03-02 22:50 . 2008-03-03 23:06 <DIR> d-------- C:\Other Photoshop Filters
2008-03-02 18:26 . 2008-03-02 18:27 <DIR> d-------- C:\WINDOWS\ERUNT
2008-03-02 13:27 . 2008-03-02 13:27 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Grisoft
2008-03-01 22:27 . 2008-03-01 22:27 0 --a------ C:\23990098.$$$
2008-03-01 14:06 . 2008-03-01 14:08 <DIR> d-------- C:\Downloads
2008-03-01 14:06 . 2008-03-01 14:08 <DIR> d-------- C:\Bases
2008-03-01 14:04 . 2008-03-01 14:08 <DIR> d-------- C:\Kaspersky
2008-03-01 11:17 . 2006-02-08 16:44 1,114,674 --a------ C:\WINDOWS\system32\drivers\ativcaxx.cpa
2008-03-01 11:17 . 2006-06-21 11:01 129,084 --a------ C:\WINDOWS\system32\atiicdxx.dat
2008-03-01 11:17 . 2005-06-09 00:45 58,560 --a------ C:\WINDOWS\system32\drivers\ativckxx.vp
2008-03-01 11:17 . 2006-07-18 23:47 31,632 --a------ C:\WINDOWS\system32\drivers\ativvpxx.vp
2008-03-01 11:17 . 2006-06-22 09:02 6,126 --a------ C:\WINDOWS\system32\atifglpf.xml
2008-03-01 11:17 . 2006-02-08 16:44 929 --a------ C:\WINDOWS\system32\drivers\ativcaxx.vp
2008-03-01 00:17 . 2003-06-12 23:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd
2008-03-01 00:16 . 2000-05-22 02:58 647,872 --------- C:\WINDOWS\system32\Mscomct2.ocx
2008-03-01 00:16 . 2008-03-01 00:16 417,792 --a------ C:\WINDOWS\system32\awrdscdc.ax
2008-03-01 00:16 . 2001-08-17 22:43 24,576 --------- C:\WINDOWS\system32\msxml3a.dll
2008-02-29 23:55 . 1999-12-12 19:01 44,032 --------- C:\WINDOWS\system32\CTSVCCDA.EXE
2008-02-29 23:55 . 1999-11-17 19:00 25,088 --------- C:\WINDOWS\system32\CTSVCCTL.EXE
2008-02-29 23:50 . 2008-02-29 23:50 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-02-29 23:50 . 2008-03-04 23:16 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-02-29 17:07 . 2008-03-03 23:24 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-02-28 19:27 . 2008-02-28 19:43 <DIR> d-------- C:\Documents and Settings\HP_Administrator\.SunDownloadManager
2008-02-28 19:22 . 2008-02-28 19:22 <DIR> d-------- C:\Program Files\Sun
2008-02-28 19:22 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-28 00:04 . 2008-02-28 00:04 86 --a------ C:\Poisto.bat
2008-02-27 20:18 . 2007-02-22 10:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2008-02-27 20:18 . 2007-02-22 10:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-02-27 20:18 . 2007-02-22 10:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-02-27 20:18 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-02-27 20:18 . 2007-02-22 10:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2008-02-27 17:34 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-02-27 17:34 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-02-27 16:45 . 2008-03-07 19:08 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-02-27 16:45 . 2008-02-27 16:45 <DIR> d-------- C:\Program Files\AVG
2008-02-27 16:45 . 2008-02-29 18:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-02-27 16:45 . 2008-02-27 16:45 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-02-27 16:45 . 2008-02-27 16:45 73,864 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-02-27 16:45 . 2008-02-27 16:45 14,104 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-02-27 16:45 . 2008-02-27 16:45 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys
2008-02-27 16:27 . 2005-05-06 22:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7I.DLL
2008-02-27 16:27 . 2005-05-06 22:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7I.DLL
2008-02-27 15:16 . 2008-02-27 15:16 <DIR> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
2008-02-27 15:15 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-27 15:15 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-27 15:14 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-27 15:14 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-27 15:08 . 2008-02-27 15:08 <DIR> d-------- C:\WINDOWS\system32\tr-tr
2008-02-27 15:08 . 2008-02-27 15:08 <DIR> d-------- C:\WINDOWS\system32\sv-se
2008-02-27 00:14 . 2008-02-27 00:14 <DIR> d-------- C:\d243b376bc34650a1058be
2008-02-27 00:14 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-02-26 23:47 . 2008-02-26 15:05 <DIR> d-a------ C:\WINDOWS\I386
2008-02-26 23:31 . 2008-03-07 22:41 <DIR> dr-hs---- C:\WINDOWS\system32\dllcache
2008-02-26 20:36 . 2006-10-24 12:30 716,288 --------- C:\WINDOWS\system32\WindowsCodecs.dll
2008-02-26 20:36 . 2006-10-24 12:30 412,160 --------- C:\WINDOWS\system32\photometadatahandler.dll
2008-02-26 20:36 . 2006-10-24 12:29 352,256 --------- C:\WINDOWS\system32\WindowsCodecsExt.dll
2008-02-26 20:36 . 2006-10-24 12:30 276,992 --------- C:\WINDOWS\system32\WMPhoto.dll
2008-02-26 20:35 . 2007-03-23 06:07 1,683,280 -----c--- C:\WINDOWS\system32\XpsSvcs.dll
2008-02-26 20:35 . 2007-03-23 06:07 1,683,280 -----c--- C:\WINDOWS\system32\dllcache\XpsSvcs.dll
2008-02-26 20:35 . 2007-03-22 20:25 677,376 -----c--- C:\WINDOWS\system32\dllcache\PrintFilterPipelineSvc.exe
2008-02-26 20:35 . 2007-03-23 06:07 583,504 -----c--- C:\WINDOWS\system32\XPSSHHDR.dll
2008-02-26 20:35 . 2007-03-23 06:07 583,504 -----c--- C:\WINDOWS\system32\dllcache\XPSSHHDR.dll
2008-02-26 20:35 . 2006-11-13 08:02 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll
2008-02-26 20:35 . 2007-03-22 20:25 124,928 -----c--- C:\WINDOWS\system32\prntvpt.dll
2008-02-26 20:35 . 2006-11-13 08:02 116,736 --------- C:\WINDOWS\system32\aaclient.dll
2008-02-26 20:35 . 2006-11-13 08:02 36,352 --------- C:\WINDOWS\system32\tsgqec.dll
2008-02-26 20:35 . 2007-03-22 20:24 28,160 -----c--- C:\WINDOWS\system32\dllcache\FilterPipelinePrintProc.dll
2008-02-26 20:33 . 2005-10-28 23:49 151,552 --------- C:\WINDOWS\system32\ifxcardm.dll
2008-02-26 20:33 . 2005-10-28 23:49 133,120 --------- C:\WINDOWS\system32\axaltocm.dll
2008-02-26 20:33 . 2005-10-28 16:40 96,792 --------- C:\WINDOWS\system32\basecsp.dll
2008-02-26 20:33 . 2005-10-28 23:49 84,480 --------- C:\WINDOWS\system32\pintool.exe
2008-02-26 20:33 . 2005-10-28 23:49 25,600 --------- C:\WINDOWS\system32\bcsprsrc.dll
2008-02-26 20:17 . 2008-02-26 20:17 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Comodo
2008-02-26 20:17 . 2008-02-26 20:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Comodo
2008-02-26 20:13 . 2008-02-28 00:32 <DIR> d-------- C:\Program Files\Comodo
2008-02-26 20:13 . 2008-02-26 20:13 3,724,840 --a------ C:\WINDOWS\sprmvr.exe
2008-02-26 20:13 . 2008-02-26 15:07 281 --a------ C:\boot.ini.comodofirewall
2008-02-26 18:12 . 2008-02-26 18:12 1,452,487 --a------ C:\WINDOWS\system32\ptlg.exe
2008-02-26 18:12 . 2008-02-26 18:12 1,452,487 --a------ C:\WINDOWS\ptlg.exe
2008-02-26 18:12 . 2008-02-26 18:12 466,432 --a------ C:\WINDOWS\ IEXPLORE.EXE
2008-02-26 16:34 . 2007-02-28 11:10 2,180,352 --------- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-02-26 16:34 . 2007-02-28 11:08 2,136,064 --------- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-02-26 16:34 . 2007-02-28 10:38 2,057,600 --------- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-02-26 16:34 . 2007-02-28 10:38 2,015,744 --------- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-02-26 16:32 . 2006-05-05 11:41 453,120 --------- C:\WINDOWS\system32\dllcache\mrxsmb.sys
2008-02-26 16:32 . 2006-06-01 20:47 163,840 --------- C:\WINDOWS\system32\dllcache\jgdw400.dll
2008-02-26 16:32 . 2006-03-17 03:05 28,672 --------- C:\WINDOWS\system32\verclsid.exe
2008-02-26 16:32 . 2006-06-01 20:47 27,648 --------- C:\WINDOWS\system32\dllcache\jgpl400.dll
2008-02-26 16:28 . 2007-06-25 14:02 475,136 --a------ C:\WINDOWS\system32\SkinCrafter2.dll
2008-02-26 16:17 . 2008-03-07 19:04 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-26 16:17 . 2008-02-26 16:17 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-04 12:34 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Nokia
2008-03-03 21:07 --------- d-----w C:\Program Files\DivX
2008-03-03 21:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-03 21:05 --------- d-----w C:\Program Files\DAEMON Tools Lite
2008-03-03 21:03 --------- d-----w C:\Program Files\Google
2008-03-03 21:03 --------- d-----w C:\Program Files\ExpressZIP
2008-03-03 14:50 1,130 ----a-w C:\Documents and Settings\HP_Administrator\Application Data\wklnhst.dat
2008-03-02 16:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-01 08:10 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-02-29 22:16 --------- d-----w C:\Program Files\Audible
2008-02-29 22:14 --------- d--h--w C:\Program Files\Creative Installation Information
2008-02-28 17:22 --------- d-----w C:\Program Files\Java
2008-02-27 23:38 1,311,911 ----a-w C:\SDFix.exe
2008-02-27 23:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-02-27 16:37 --------- d-----w C:\Program Files\OneStepSearch
2008-02-27 16:31 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-02-27 14:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-27 09:52 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-02-26 14:28 --------- d-----w C:\Program Files\AresGalaxySuperSpeed
2008-02-26 14:16 --------- d-----w C:\Program Files\QuickTime
2008-02-26 13:26 --------- d-----w C:\Program Files\MSN Messenger
2008-02-26 13:14 139,264 ----a-w C:\WINDOWS\system32\hpzjrd01.dll
2008-02-26 13:04 1,841 --sha-r C:\WINDOWS\system32\drivers\103C_HP_CPC_EP061AA-ABX m7350.fi_YC_0Pavi_QCZB602_E61FIemMPC1_48_IAMETHYST-M_SMSI_V1.0_B3.40_T051213_WXP2_L409_M1023_J250_7AMD_8Athlon 64_92.19_#060301_N10EC8139_Z_G10027146_OTSSTcorp CD DVDW TS-H552L_DSAM0115.MRK
2008-02-23 18:39 --------- d-----w C:\Program Files\iTunes
2008-02-23 18:39 --------- d-----w C:\Program Files\iPod
2008-02-10 15:35 --------- d-----w C:\Program Files\Subdownloader
2008-02-09 18:28 --------- d-----w C:\Program Files\Bonjour
2008-02-09 18:27 --------- d-----w C:\Program Files\QuickTime Alternative
2008-02-09 18:14 --------- d-----w C:\Program Files\CCleaner
2008-02-07 20:42 --------- d-----w C:\Program Files\Managed DirectX (0901)
2008-02-03 19:16 --------- d-----w C:\Program Files\Yahoo!
2008-01-22 18:13 --------- d-----w C:\Program Files\Common Files\ScanSoft Shared
2008-01-22 18:11 --------- d-----w C:\Program Files\Canon
2008-01-22 15:10 --------- d-----w C:\Program Files\Windows Doctor
2008-01-21 19:21 --------- d-----w C:\Program Files\VideoLAN
2008-01-21 19:21 --------- d-----w C:\Program Files\IObit
2008-01-19 10:22 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-18 20:11 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Apple Computer
2008-01-18 20:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-18 05:21 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\AdobeUM
2008-01-17 19:13 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-01-16 22:36 --------- d-----w C:\Documents and Settings\Heviä Perkele\Application Data\HPQ
2008-01-16 22:30 --------- d-----w C:\Documents and Settings\Heviä Perkele\Application Data\Nero
2008-01-16 17:25 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\ScanSoft
2008-01-16 13:16 --------- d-----w C:\Program Files\Mozilla Firefox 3 Beta 2
2008-01-14 14:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-01-13 14:16 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\vlc
2008-01-13 13:10 --------- d-----w C:\Program Files\RegCure
2008-01-13 01:34 210,593 ----a-w C:\! Ahead Nero 8 all versions crack.exe
2008-01-12 17:35 --------- d-----w C:\Program Files\Creative
2008-01-11 22:23 --------- d-----w C:\Program Files\HP DigitalMedia Archive
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-01-10 22:00 --------- d-----w C:\Program Files\Common Files\Nero
2008-01-09 15:23 --------- d-----w C:\Program Files\Lavasoft
2008-01-09 15:22 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-09 15:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-09 13:44 --------- d-----w C:\Program Files\Panda Security
2008-01-08 22:56 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\WinBatch
2008-01-08 22:02 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\HPQ
2008-01-08 21:57 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\gtk-2.0
2008-01-07 18:59 --------- d-----w C:\Program Files\Nero
2008-01-07 18:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-01-07 17:41 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Template
2008-01-07 13:53 --------- d-----w C:\Program Files\RegistryFix
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-23 12:34 0 --sh--w C:\nqstv.ini2
2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-13 17:09 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-12-08 05:21 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2006-09-01 15:30 32,207 -csh--w C:\Program Files\Common Files\Y1220OU.exe
2006-03-31 14:10 774,144 -c--a-w C:\Program Files\RngInterstitial.dll
2006-03-04 18:20 251 -c--a-w C:\Program Files\wt3d.ini
2005-05-12 04:36 12,288 -c--a-w C:\WINDOWS\Fonts\RandFont.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 14:00 15360]
"ares"="C:\Program Files\Ares\Ares.exe" [2008-02-20 16:33 963072]
"Ares Galaxy Super Speed"="C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe" [2008-01-22 10:31 610304]
"SunJavaUpdateSched"="" []
"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 11:03 868352]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 22:14 237568]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 06:12 49152]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44 61440]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="c:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
"msptlg"="C:\WINDOWS\ptlg.exe" [2008-02-26 18:12 1452487]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-02-27 16:45 899864]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 14:10 271360]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe" [2007-12-04 02:07 61440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 09:17 1241088]

C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-02-19 19:04:00 106496]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ATI CATALYST -ilmaisinalue.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [2005-10-02 18:13:42 57344]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 06:23:26 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-02-27 16:45]
R0 dontgo;Promise Removable Disk Control Driver;C:\WINDOWS\system32\DRIVERS\DontGo.sys [2004-06-30 06:25]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-02-27 16:45]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-02-27 16:45]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-02-27 16:45]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-02-27 16:45]
R3 3xHybrid;ASUSTek SAA713x PCI Card;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2007-01-26 10:42]
S2 Automattinen LiveUpdate-ajastustoiminto;Automattinen LiveUpdate-ajastustoiminto;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" []
S2 ptlg;ptlg;C:\WINDOWS\system32\ptlg.exe [2008-02-26 18:12]
S3 WN5301;LIteon Wireless PCI Network Adapter Service;C:\WINDOWS\system32\DRIVERS\wn5301.sys [2005-10-05 19:44]
S3 WN5401;Liteon Wireless LAN PCI 802.11 a/b/g adapter WN5401A;C:\WINDOWS\system32\DRIVERS\wn5401.sys [2005-01-07 02:08]
S4 OneStep Search Service;OneStep Search Service;"C:\Program Files\OneStepSearch\onestep.exe" "C:\Program Files\OneStepSearch\onestep.dll" Service []

.
Contents of the 'Scheduled Tasks' folder
"2008-03-07 15:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-03-03 19:00:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- c:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-27 23:41:00 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-03-03 18:00:00 C:\WINDOWS\Tasks\Norton Internet Security - Suorita täyd. järj.tarkistus - shit.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
"2008-01-12 01:30:00 C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job"
- C:\Program Files\RegistrySmart\RegistrySmart.ex
- C:\Program Files\RegistrySmart
"2008-03-07 22:10:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{AAA277C7-6104-4946-AEFF-D1A95C0FE36F}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-08 00:06:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-08 0:11:50
ComboFix-quarantined-files.txt 2008-03-07 22:11:42
ComboFix2.txt 2008-03-05 19:22:37
ComboFix3.txt 2008-02-27 22:24:05
ComboFix4.txt 2008-01-03 12:31:10
.
2008-03-03 21:25:34 --- E O F ---

 

ComboFix 08-03-07.3 - HP_Administrator 2008-03-07 23:59:35.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.500 [GMT 2:00]
Running from: C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.IE5\UUZB6ESO\ComboFix[1].exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-02-07 to 2008-03-07 )))))))))))))))))))))))))))))))
.

2008-03-07 23:08 . 2008-03-07 23:09 <DIR> d-------- C:\Program Files\r2 Studios
2008-03-05 21:24 . 2008-03-05 21:24 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-03-05 17:03 . 2008-03-05 17:06 <DIR> d-------- C:\Program Files\MTV Virtual World
2008-03-05 15:17 . 2008-03-05 15:17 106 --a------ C:\delete.bat
2008-03-05 14:57 . 2008-03-05 14:57 1 --a------ C:\WINDOWS\system32\SI.bin
2008-03-04 14:29 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-03 23:07 . 2008-03-03 23:07 <DIR> d-------- C:\Program Files\AskTBar
2008-03-03 21:39 . 2008-03-03 21:39 6,144 --ahs---- C:\WINDOWS\system32\access.ctl
2008-03-02 23:18 . 2008-03-03 19:06 <DIR> d-------- C:\Program Files\onOne Software
2008-03-02 22:50 . 2008-03-03 23:06 <DIR> d-------- C:\Other Photoshop Filters
2008-03-02 18:26 . 2008-03-02 18:27 <DIR> d-------- C:\WINDOWS\ERUNT
2008-03-02 13:27 . 2008-03-02 13:27 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Grisoft
2008-03-01 22:27 . 2008-03-01 22:27 0 --a------ C:\23990098.$$$
2008-03-01 14:06 . 2008-03-01 14:08 <DIR> d-------- C:\Downloads
2008-03-01 14:06 . 2008-03-01 14:08 <DIR> d-------- C:\Bases
2008-03-01 14:04 . 2008-03-01 14:08 <DIR> d-------- C:\Kaspersky
2008-03-01 11:17 . 2006-02-08 16:44 1,114,674 --a------ C:\WINDOWS\system32\drivers\ativcaxx.cpa
2008-03-01 11:17 . 2006-06-21 11:01 129,084 --a------ C:\WINDOWS\system32\atiicdxx.dat
2008-03-01 11:17 . 2005-06-09 00:45 58,560 --a------ C:\WINDOWS\system32\drivers\ativckxx.vp
2008-03-01 11:17 . 2006-07-18 23:47 31,632 --a------ C:\WINDOWS\system32\drivers\ativvpxx.vp
2008-03-01 11:17 . 2006-06-22 09:02 6,126 --a------ C:\WINDOWS\system32\atifglpf.xml
2008-03-01 11:17 . 2006-02-08 16:44 929 --a------ C:\WINDOWS\system32\drivers\ativcaxx.vp
2008-03-01 00:17 . 2003-06-12 23:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd
2008-03-01 00:16 . 2000-05-22 02:58 647,872 --------- C:\WINDOWS\system32\Mscomct2.ocx
2008-03-01 00:16 . 2008-03-01 00:16 417,792 --a------ C:\WINDOWS\system32\awrdscdc.ax
2008-03-01 00:16 . 2001-08-17 22:43 24,576 --------- C:\WINDOWS\system32\msxml3a.dll
2008-02-29 23:55 . 1999-12-12 19:01 44,032 --------- C:\WINDOWS\system32\CTSVCCDA.EXE
2008-02-29 23:55 . 1999-11-17 19:00 25,088 --------- C:\WINDOWS\system32\CTSVCCTL.EXE
2008-02-29 23:50 . 2008-02-29 23:50 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-02-29 23:50 . 2008-03-04 23:16 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-02-29 17:07 . 2008-03-03 23:24 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-02-28 19:27 . 2008-02-28 19:43 <DIR> d-------- C:\Documents and Settings\HP_Administrator\.SunDownloadManager
2008-02-28 19:22 . 2008-02-28 19:22 <DIR> d-------- C:\Program Files\Sun
2008-02-28 19:22 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-28 00:04 . 2008-02-28 00:04 86 --a------ C:\Poisto.bat
2008-02-27 20:18 . 2007-02-22 10:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2008-02-27 20:18 . 2007-02-22 10:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-02-27 20:18 . 2007-02-22 10:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-02-27 20:18 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-02-27 20:18 . 2007-02-22 10:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2008-02-27 17:34 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-02-27 17:34 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-02-27 16:45 . 2008-03-07 19:08 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-02-27 16:45 . 2008-02-27 16:45 <DIR> d-------- C:\Program Files\AVG
2008-02-27 16:45 . 2008-02-29 18:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-02-27 16:45 . 2008-02-27 16:45 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-02-27 16:45 . 2008-02-27 16:45 73,864 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-02-27 16:45 . 2008-02-27 16:45 14,104 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-02-27 16:45 . 2008-02-27 16:45 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys
2008-02-27 16:27 . 2005-05-06 22:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7I.DLL
2008-02-27 16:27 . 2005-05-06 22:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7I.DLL
2008-02-27 15:16 . 2008-02-27 15:16 <DIR> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
2008-02-27 15:15 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-27 15:15 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-27 15:14 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-27 15:14 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-27 15:08 . 2008-02-27 15:08 <DIR> d-------- C:\WINDOWS\system32\tr-tr
2008-02-27 15:08 . 2008-02-27 15:08 <DIR> d-------- C:\WINDOWS\system32\sv-se
2008-02-27 00:14 . 2008-02-27 00:14 <DIR> d-------- C:\d243b376bc34650a1058be
2008-02-27 00:14 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-02-26 23:47 . 2008-02-26 15:05 <DIR> d-a------ C:\WINDOWS\I386
2008-02-26 23:31 . 2008-03-07 22:41 <DIR> dr-hs---- C:\WINDOWS\system32\dllcache
2008-02-26 20:36 . 2006-10-24 12:30 716,288 --------- C:\WINDOWS\system32\WindowsCodecs.dll
2008-02-26 20:36 . 2006-10-24 12:30 412,160 --------- C:\WINDOWS\system32\photometadatahandler.dll
2008-02-26 20:36 . 2006-10-24 12:29 352,256 --------- C:\WINDOWS\system32\WindowsCodecsExt.dll
2008-02-26 20:36 . 2006-10-24 12:30 276,992 --------- C:\WINDOWS\system32\WMPhoto.dll
2008-02-26 20:35 . 2007-03-23 06:07 1,683,280 -----c--- C:\WINDOWS\system32\XpsSvcs.dll
2008-02-26 20:35 . 2007-03-23 06:07 1,683,280 -----c--- C:\WINDOWS\system32\dllcache\XpsSvcs.dll
2008-02-26 20:35 . 2007-03-22 20:25 677,376 -----c--- C:\WINDOWS\system32\dllcache\PrintFilterPipelineSvc.exe
2008-02-26 20:35 . 2007-03-23 06:07 583,504 -----c--- C:\WINDOWS\system32\XPSSHHDR.dll
2008-02-26 20:35 . 2007-03-23 06:07 583,504 -----c--- C:\WINDOWS\system32\dllcache\XPSSHHDR.dll
2008-02-26 20:35 . 2006-11-13 08:02 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll
2008-02-26 20:35 . 2007-03-22 20:25 124,928 -----c--- C:\WINDOWS\system32\prntvpt.dll
2008-02-26 20:35 . 2006-11-13 08:02 116,736 --------- C:\WINDOWS\system32\aaclient.dll
2008-02-26 20:35 . 2006-11-13 08:02 36,352 --------- C:\WINDOWS\system32\tsgqec.dll
2008-02-26 20:35 . 2007-03-22 20:24 28,160 -----c--- C:\WINDOWS\system32\dllcache\FilterPipelinePrintProc.dll
2008-02-26 20:33 . 2005-10-28 23:49 151,552 --------- C:\WINDOWS\system32\ifxcardm.dll
2008-02-26 20:33 . 2005-10-28 23:49 133,120 --------- C:\WINDOWS\system32\axaltocm.dll
2008-02-26 20:33 . 2005-10-28 16:40 96,792 --------- C:\WINDOWS\system32\basecsp.dll
2008-02-26 20:33 . 2005-10-28 23:49 84,480 --------- C:\WINDOWS\system32\pintool.exe
2008-02-26 20:33 . 2005-10-28 23:49 25,600 --------- C:\WINDOWS\system32\bcsprsrc.dll
2008-02-26 20:17 . 2008-02-26 20:17 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Comodo
2008-02-26 20:17 . 2008-02-26 20:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Comodo
2008-02-26 20:13 . 2008-02-28 00:32 <DIR> d-------- C:\Program Files\Comodo
2008-02-26 20:13 . 2008-02-26 20:13 3,724,840 --a------ C:\WINDOWS\sprmvr.exe
2008-02-26 20:13 . 2008-02-26 15:07 281 --a------ C:\boot.ini.comodofirewall
2008-02-26 18:12 . 2008-02-26 18:12 1,452,487 --a------ C:\WINDOWS\system32\ptlg.exe
2008-02-26 18:12 . 2008-02-26 18:12 1,452,487 --a------ C:\WINDOWS\ptlg.exe
2008-02-26 18:12 . 2008-02-26 18:12 466,432 --a------ C:\WINDOWS\ IEXPLORE.EXE
2008-02-26 16:34 . 2007-02-28 11:10 2,180,352 --------- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-02-26 16:34 . 2007-02-28 11:08 2,136,064 --------- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-02-26 16:34 . 2007-02-28 10:38 2,057,600 --------- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-02-26 16:34 . 2007-02-28 10:38 2,015,744 --------- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-02-26 16:32 . 2006-05-05 11:41 453,120 --------- C:\WINDOWS\system32\dllcache\mrxsmb.sys
2008-02-26 16:32 . 2006-06-01 20:47 163,840 --------- C:\WINDOWS\system32\dllcache\jgdw400.dll
2008-02-26 16:32 . 2006-03-17 03:05 28,672 --------- C:\WINDOWS\system32\verclsid.exe
2008-02-26 16:32 . 2006-06-01 20:47 27,648 --------- C:\WINDOWS\system32\dllcache\jgpl400.dll
2008-02-26 16:28 . 2007-06-25 14:02 475,136 --a------ C:\WINDOWS\system32\SkinCrafter2.dll
2008-02-26 16:17 . 2008-03-07 19:04 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-26 16:17 . 2008-02-26 16:17 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-04 12:34 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Nokia
2008-03-03 21:07 --------- d-----w C:\Program Files\DivX
2008-03-03 21:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-03 21:05 --------- d-----w C:\Program Files\DAEMON Tools Lite
2008-03-03 21:03 --------- d-----w C:\Program Files\Google
2008-03-03 21:03 --------- d-----w C:\Program Files\ExpressZIP
2008-03-03 14:50 1,130 ----a-w C:\Documents and Settings\HP_Administrator\Application Data\wklnhst.dat
2008-03-02 16:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-01 08:10 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-02-29 22:16 --------- d-----w C:\Program Files\Audible
2008-02-29 22:14 --------- d--h--w C:\Program Files\Creative Installation Information
2008-02-28 17:22 --------- d-----w C:\Program Files\Java
2008-02-27 23:38 1,311,911 ----a-w C:\SDFix.exe
2008-02-27 23:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-02-27 16:37 --------- d-----w C:\Program Files\OneStepSearch
2008-02-27 16:31 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-02-27 14:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-27 09:52 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-02-26 14:28 --------- d-----w C:\Program Files\AresGalaxySuperSpeed
2008-02-26 14:16 --------- d-----w C:\Program Files\QuickTime
2008-02-26 13:26 --------- d-----w C:\Program Files\MSN Messenger
2008-02-26 13:14 139,264 ----a-w C:\WINDOWS\system32\hpzjrd01.dll
2008-02-26 13:04 1,841 --sha-r C:\WINDOWS\system32\drivers\103C_HP_CPC_EP061AA-ABX m7350.fi_YC_0Pavi_QCZB602_E61FIemMPC1_48_IAMETHYST-M_SMSI_V1.0_B3.40_T051213_WXP2_L409_M1023_J250_7AMD_8Athlon 64_92.19_#060301_N10EC8139_Z_G10027146_OTSSTcorp CD DVDW TS-H552L_DSAM0115.MRK
2008-02-23 18:39 --------- d-----w C:\Program Files\iTunes
2008-02-23 18:39 --------- d-----w C:\Program Files\iPod
2008-02-10 15:35 --------- d-----w C:\Program Files\Subdownloader
2008-02-09 18:28 --------- d-----w C:\Program Files\Bonjour
2008-02-09 18:27 --------- d-----w C:\Program Files\QuickTime Alternative
2008-02-09 18:14 --------- d-----w C:\Program Files\CCleaner
2008-02-07 20:42 --------- d-----w C:\Program Files\Managed DirectX (0901)
2008-02-03 19:16 --------- d-----w C:\Program Files\Yahoo!
2008-01-22 18:13 --------- d-----w C:\Program Files\Common Files\ScanSoft Shared
2008-01-22 18:11 --------- d-----w C:\Program Files\Canon
2008-01-22 15:10 --------- d-----w C:\Program Files\Windows Doctor
2008-01-21 19:21 --------- d-----w C:\Program Files\VideoLAN
2008-01-21 19:21 --------- d-----w C:\Program Files\IObit
2008-01-19 10:22 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-18 20:11 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Apple Computer
2008-01-18 20:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-18 05:21 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\AdobeUM
2008-01-17 19:13 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-01-16 22:36 --------- d-----w C:\Documents and Settings\Heviä Perkele\Application Data\HPQ
2008-01-16 22:30 --------- d-----w C:\Documents and Settings\Heviä Perkele\Application Data\Nero
2008-01-16 17:25 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\ScanSoft
2008-01-16 13:16 --------- d-----w C:\Program Files\Mozilla Firefox 3 Beta 2
2008-01-14 14:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-01-13 14:16 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\vlc
2008-01-13 13:10 --------- d-----w C:\Program Files\RegCure
2008-01-13 01:34 210,593 ----a-w C:\! Ahead Nero 8 all versions crack.exe
2008-01-12 17:35 --------- d-----w C:\Program Files\Creative
2008-01-11 22:23 --------- d-----w C:\Program Files\HP DigitalMedia Archive
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-01-10 22:00 --------- d-----w C:\Program Files\Common Files\Nero
2008-01-09 15:23 --------- d-----w C:\Program Files\Lavasoft
2008-01-09 15:22 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-09 15:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-09 13:44 --------- d-----w C:\Program Files\Panda Security
2008-01-08 22:56 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\WinBatch
2008-01-08 22:02 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\HPQ
2008-01-08 21:57 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\gtk-2.0
2008-01-07 18:59 --------- d-----w C:\Program Files\Nero
2008-01-07 18:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-01-07 17:41 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Template
2008-01-07 13:53 --------- d-----w C:\Program Files\RegistryFix
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-23 12:34 0 --sh--w C:\nqstv.ini2
2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-13 17:09 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-12-08 05:21 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2006-09-01 15:30 32,207 -csh--w C:\Program Files\Common Files\Y1220OU.exe
2006-03-31 14:10 774,144 -c--a-w C:\Program Files\RngInterstitial.dll
2006-03-04 18:20 251 -c--a-w C:\Program Files\wt3d.ini
2005-05-12 04:36 12,288 -c--a-w C:\WINDOWS\Fonts\RandFont.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 14:00 15360]
"ares"="C:\Program Files\Ares\Ares.exe" [2008-02-20 16:33 963072]
"Ares Galaxy Super Speed"="C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe" [2008-01-22 10:31 610304]
"SunJavaUpdateSched"="" []
"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 11:03 868352]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 22:14 237568]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 06:12 49152]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44 61440]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="c:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
"msptlg"="C:\WINDOWS\ptlg.exe" [2008-02-26 18:12 1452487]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-02-27 16:45 899864]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 14:10 271360]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe" [2007-12-04 02:07 61440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 09:17 1241088]

C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-02-19 19:04:00 106496]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ATI CATALYST -ilmaisinalue.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [2005-10-02 18:13:42 57344]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 06:23:26 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-02-27 16:45]
R0 dontgo;Promise Removable Disk Control Driver;C:\WINDOWS\system32\DRIVERS\DontGo.sys [2004-06-30 06:25]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-02-27 16:45]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-02-27 16:45]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-02-27 16:45]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-02-27 16:45]
R3 3xHybrid;ASUSTek SAA713x PCI Card;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2007-01-26 10:42]
S2 Automattinen LiveUpdate-ajastustoiminto;Automattinen LiveUpdate-ajastustoiminto;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" []
S2 ptlg;ptlg;C:\WINDOWS\system32\ptlg.exe [2008-02-26 18:12]
S3 WN5301;LIteon Wireless PCI Network Adapter Service;C:\WINDOWS\system32\DRIVERS\wn5301.sys [2005-10-05 19:44]
S3 WN5401;Liteon Wireless LAN PCI 802.11 a/b/g adapter WN5401A;C:\WINDOWS\system32\DRIVERS\wn5401.sys [2005-01-07 02:08]
S4 OneStep Search Service;OneStep Search Service;"C:\Program Files\OneStepSearch\onestep.exe" "C:\Program Files\OneStepSearch\onestep.dll" Service []

.
Contents of the 'Scheduled Tasks' folder
"2008-03-07 15:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-03-03 19:00:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- c:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-27 23:41:00 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-03-03 18:00:00 C:\WINDOWS\Tasks\Norton Internet Security - Suorita täyd. järj.tarkistus - shit.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
"2008-01-12 01:30:00 C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job"
- C:\Program Files\RegistrySmart\RegistrySmart.ex
- C:\Program Files\RegistrySmart
"2008-03-07 22:10:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{AAA277C7-6104-4946-AEFF-D1A95C0FE36F}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-08 00:06:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-08 0:11:50
ComboFix-quarantined-files.txt 2008-03-07 22:11:42
ComboFix2.txt 2008-03-05 19:22:37
ComboFix3.txt 2008-02-27 22:24:05
ComboFix4.txt 2008-01-03 12:31:10
.
2008-03-03 21:25:34 --- E O F ---

 

Lataa Dr.Web CureIt työpöydälle:

Tuplaklikkaa drweb-cureit.exe ja anna sen tehdä express scan
Se skannaa käynnissä olevat ohjelmat ja jos jotain löytyy, klikkaa yes kun se kysyy haluatko poistaa sen. Tämä on vain lyhyt scan.
Kun scan on valmis, Klikkaa Custom scan merkkaa asemat, jotka haluat scannata.
Valitse kaikki asemat. Punainen piste osoittaa, mitkä asemat on valittu.
Klikaa vihreää nuolta oikealla ja scan alkaa.
Klikkaa 'Yes to all', jos kysytään haluatko poistaa/siirtää tiedoston.
Kun scan on valmis, katso voitko klikata next-kuvaketta löytyneiden tiedostojen vieressä:
Jos asia on niin, klikkaa sitä ja sitten klikkaa next-kuvaketta oikealla alhaalla ja valitse Move incurable kuten alla olevalla kuvassa:

Tämä siirtää sen %userprofile%\DoctorWeb\quarantine-hakemistoon.
Tämän jälkeen klikkaa Dr.Web CureIt-valikossa file ja valitse save report list
Tallenna raportti työpöydälle. Raportin nimi on DrWeb.csv
Sulje Dr.Web Cureit.
Käynnistä kone uudelleen !! Tämä siksi, että käytössä olevat tiedostot poistetaan/siirretään käynnistyksen yhteydessä.
Käynnistyksen jälkeen liitä Dr.Web-lokin, jonka tallensit aiemmin, sisältö seuraavaan vastaukseesi.

 

SDFix: Version 1.121

Run by HP_Administrator on la 08.03.2008 at 00:29

Microsoft Windows XP [versio 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found





Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-08 00:39:06
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

C:\Documents and Settings\HP_Administrator\My Documents\My Music\My Music\leffoja\Black.Christmas.Unrated[2007].Dvdrip.Xvid.AC3[5.1]-RoCK\Thumbs.db:encryptable 0 bytes hidden from API

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 2


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"="C:\\Program Files\\AVG\\AVG8\\avgnsx.exe:*:Enabled:avgnsx.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:
---------------


Files with Hidden Attributes:

Tue 26 Feb 2008 211 A.SHR --- "C:\BOOT.BAK"
Fri 1 Sep 2006 32,207 ..SH. --- "C:\Program Files\Common Files\Y1220OU.exe"
Thu 6 Dec 2007 625,664 A.SH. --- "C:\Program Files\Internet Explorer\iexplore.exe"
Mon 14 Mar 2005 299,008 A..H. --- "C:\Program Files\Canon\MP Navigator 2.0\Maint.exe"
Mon 28 Feb 2005 61,440 A..H. --- "C:\Program Files\Canon\MP Navigator 2.0\uinstrsc.dll"
Sat 1 Mar 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Tue 1 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\410ff09308a833491dba7686f0aee2eb\BIT4.tmp"
Sat 8 Mar 2008 5,940 A.SH. --- "C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\TempSBE\SBE1.tmp"
Sat 8 Mar 2008 5,686 A.SH. --- "C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\TempSBE\SBE2.tmp"

Finished!

 

Poista vanha smitfraudfix ja lataa uusi

Lataa SmitfraudFix (c) S!Ri
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita ponnahtava rapport – muistion sisältö viestiketjuusi.
Löytyy myös C:\rapport.txt

Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.

 

setup.exe;C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1;Probably BACKDOOR.Trojan;Incurable.Moved.;
KillWind.exe;C:\hp\bin;Tool.ProcessKill;Incurable.Moved.;
Process.exe;C:\SDFix\apps;Tool.Prockill;Incurable.Moved.;
A0021724.bat;C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP105;Probably BATCH.Virus;Incurable.Moved.;
A0021729.bat;C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP105;Probably SCRIPT.Virus;Incurable.Moved.;
A0023769.bat;C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP112;Probably BATCH.Virus;Incurable.Moved.;
A0023774.bat;C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP112;Probably SCRIPT.Virus;Incurable.Moved.;
A0006693.exe;C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP32;Adware.OneStep;Incurable.Moved.;
A0006894.bat;C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP34;Probably BATCH.Virus;Incurable.Moved.;
A0007824.exe;C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP35;Tool.Prockill;Incurable.Moved.;
A0007897.exe;C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP35;Tool.Prockill;Incurable.Moved.;
A0011698.exe;C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP78;Tool.Prockill;Incurable.Moved.;
A0012751.exe;C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP89;Adware.Shopper;Incurable.Moved.;
A0013292.exe;C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP89;Tool.Prockill;Incurable.Moved.;
A0013353.exe;C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP89;Tool.Prockill;Incurable.Moved.;
A0013365.exe;C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP89;Tool.ShutDown.11;Incurable.Moved.;
A0013367.exe;C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP89;Tool.Prockill;Incurable.Moved.;
A0014972.exe;C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP91;Tool.Prockill;Incurable.Moved.;

 

1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK

==========

Lataa OTMoveIt
OTMoveIt ja tallenna se työpöydällesi.

Tuplaklikkaa OTMoveIt.exe.
Klikkaa CleanUp!.
Valitse Yes kun kysytään "Begin cleanup Process?".
Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.

HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.

 

SmitFraudFix v2.300

Scan done at 18:16:58,21, la 08.03.2008
Run from C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\Rar$EX09.078\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\HP\KBD\KBD.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
c:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\ptlg.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\dllhost.exe
c:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\ IEXPLORE.EXE FOUND !
C:\WINDOWS\ptlg.exe FOUND !
C:\WINDOWS\sprmvr.exe FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ptlg.exe FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Administrator


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Administrator\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\HP_ADM~1\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Packet Scheduler Miniport
DNS Server Search Order: 192.168.0.254

HKLM\SYSTEM\CCS\Services\Tcpip\..\{9B1D4CEB-7960-4FC5-834A-9F629A758F5C}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9B1D4CEB-7960-4FC5-834A-9F629A758F5C}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9B1D4CEB-7960-4FC5-834A-9F629A758F5C}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS3\Services\Tcpip\..\{9B1D4CEB-7960-4FC5-834A-9F629A758F5C}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

 

Niin aja nyt sitten tuo optio 2 vikasiedossa

Printtaa ohjeet ulos

Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.

Vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.

Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.

Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".

Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.

Varoitus : Ajamalla optio 2:n EI-tarttuneessa tietokoneessa, poistaa sinun työpöytäsi taustakuvan.

 

KONE HIDAS!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:17:07, on 9.4.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
c:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\apvxdwin.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\SRVLOAD.EXE
C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PAVJOBS.EXE
C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
C:\Kaspersky\mwavscan.com
C:\Kaspersky\kavss.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Last.fm\LastFmHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
c:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"
O4 - HKLM\..\Run: [SmartRAM] C:\Program Files\IObit\Advanced WindowsCare V2\MemCleaner.exe /m
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Ares Galaxy Super Speed] C:\Program Files\AresGalaxySuperSpeed\Ares Galaxy Super Speed.exe
O4 - HKCU\..\Run: [CTSyncU.exe] C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
O4 - HKCU\..\Run: [Uniblue SpyEraser] "C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O4 - Global Startup: ATI CATALYST -ilmaisinalue.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1204033224265
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O23 - Service: Apple Mobile Device - Apple, Inc. - c:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - c:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe

--
End of file - 9426 bytes

 

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

Uudelleen nimeäminen

1. Klikkaa hiiren oikealla painikkeella HijackThis ikonia.


2. Valitse Uudelleennineä/ Rename.

3. Kirjoita scanner.exe


====================

scannaa hjt:llä merkkaa paina Fix checked

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

====================

O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

etsi tuo servise tuplalikkaa sitä laita seis ja alasvetovalikosta ei käytössä

käytä ok

Mene käynnistä -> suorita -> services.msc -> ok

=============

Poista kansio vikasiedossa

C:\Program Files\Symantec

=============

Lataa TÄSTÄ VundoFix.exe työpöydällesi.

Tupla-klikkaa VundoFix.exe ajaaksesi sen.
Klikkaa Scan for Vundo valintaa.
Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
Sinulta kysytään haluatko poistaa filut - klikkaa YES.
Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.