Vaihteeksi liikenteessä uus mese virus....

Sain tossa kello klo 22 suunnilleen kaverilta linkin joka kehottaa kattoomaan ketkä kaikki mahtaa estää sut omassa mesessään....En ottanu sitä linkkiä ylös mutta se oli joku tyyliin www.checkstatus.tk.
Nyt poistin koko mesen ja siihen liittyvät tempit ja muuta siihen liittyviä tiedostaja.Olen myös vahtinut COMODON connections ja applications listoja ja sieltä ei näytä muuta epäilyttävää löytyvän kuin bootstrap.exe. Voisiko se olla se virus mikä hyökkäsi koneelleni? Tämä virus näyttää tekevän samaa kuin edelliset MSN-virukset eli pistää kaikille onlinessa oleville kavereille sen linkin mistä virus minulle tuli.

Saiskohan tähän vaivaan apua?

 

ai nii ja tässä hijackin logi:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:47:58, on 29.8.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Comodo\Firewall\CPF.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\Jones\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 3475 bytes

 

Google --> bootstrap.exe --> viides osuma

http://www.fileresearchcenter.com/B/BOOTSTRAP.EXE-1734.html

 

Lataa VundoFix.exe työpöydällesi.

Tupla-klikkaa VundoFix.exe ajaaksesi sen.
Klikkaa Scan for Vundo valintaa.
Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
Sinulta kysytään haluatko poistaa filut - klikkaa YES.
Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.

 

Eipä tuo vundofix löydä mitään...

Muita ehdotuksia?

 

1. Lataa tästä poistotyökalu ja tallenna se työpöydällesi http://sosvirus.changelog.fr/MSNFix.zip
2. Pura se MSNFix kansioon
3. Avaa kansio ja käynnistä MSNFix.bat
4. Valitse haluamasi kieli ikkunassa näkyvästä listasta kirjoittamalla joku niistä kirjaimista ja paina ENTER. E = englanti
5. Kirjoita seuraavaksi R kirjain ja paina ENTER käynnistääksesi virushaun.
6. Sen jälkeen paina uusiksi ENTER poistaaksesi työkalun löytämät tiedostot.

================

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:
" Käynnistä tietokone
" Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
" Seuraavaksi pitäisi ilmestyä valikko
" Valitse valikosta vikasietotila.

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

================
scannaa uusi hjt:n loki

 

Voi helvetti että minä olen avuton näitten uusien windowsien kanssa. En meinaan tiedä miten pääsen siihen valikkoon ennen windowsin käynnisymistä mistä sais viansietotilan päälle kun se F8 ei toimi vaikka naputtaa sitä koneen starttaamisesta asti

Ja tuo sinun neuvoma MSN-fix ei myöskään löytänyt mitään malwarea
Tässä sen loki:
MSNFix 1.482

C:\Documents and Settings\Jones\Desktop\Paskoo\MSNFix\MSNFix
Scan done at to 30.08.2007 - 9:43:58,65 By Jones
normal mode

************************ Checking Files

No files found

************************ Checking Folders

No Folders Found


************************ Suspect Files

/!\ The detected files must be reviewed by a forum Helper before changes can be made

[C:\Documents and Settings\Jones\HijackThis.exe] C4CA7416A6DF6D95075F81D9E3B41AD1



------------------------------------------------------------------------
Author : !aur3n7 Contact: http://changelog.fr
------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------

 

sinne vikasietotilaan mennään toisissa koneissa F5 :tä naputtamalla

 

Tai riippuu näppiksestä ite kans taistelin ton kans joskus, kunnes huomasin et näppiksessä oli F lock nappi jota piti painaa, että F napit toimii.

 

Ja kaikki usb-näppikset ei päästä mitenkään siihen valikkoon. Itellä Logitech merkkinen, biosiin pääsee mut sen jälkeen ei näppis toimi ennen käyttiksen käynnistymistä. Jos haluaa vikasietotilaa, tarvii laittaa vanha ps2 tai eri usb-näppis kii.

 

Jes! Piti hyökätä tonne varaston puolelle et löyty vanhoja näppiksiä missä ei oo USB liitäntää ja pääsin viansietotilaan, kiitos neuvosta!

No niin ja sitten siihen trojaniin eli tässä sen Sdfixin logi:
SDFix: Version 1.101

Run by Jones on to 30.08.2007 at 14:32

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\DOCUME~1\Jones\Desktop\SDFix\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\system32\winsys.exe - Deleted



Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:
---------------

File Backups: - C:\DOCUME~1\Jones\Desktop\SDFix\SDFix\backups\backups.zip

Files with Hidden Attributes:


Finished

ja sit Hijackin logi:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:39:35, on 30.8.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Comodo\Firewall\CPF.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\Jones\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 3720 bytes
Eli nyt kaiken pitäisi olla kunnossa?

 

laitas itteles aloitus sivu.

tossa 04 yläpuolella on aika paljon tyhjää ookos itse fixsaillut?

ajas tuosta

1.Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe


2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

nimetääs tuo uudeleen

C:\Documents and Settings\Jones\HijackThis.exe

1. Klikkaa hiiren oikealla painikkeella HijackThis ikonia.


2. Valitse Uudelleennineä/ Rename.

3. Kirjoita scanner.exe

 

Tuommosen login se teki:
ComboFix 07-08-30.3 - "Jones" 2007-08-30 14:57:55.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.682 [GMT 3:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\pthreadVC.dll
C:\WINDOWS\system32\wanpacket.dll
C:\WINDOWS\system32\wpcap.dll


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\NPF


((((((((((((((((((((((((( Files Created from 2007-07-28 to 2007-08-30 )))))))))))))))))))))))))))))))


2007-08-30 14:56 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-30 14:32 <DIR> d-------- C:\WINDOWS\ERUNT
2007-08-30 09:57 <DIR> d-------- C:\Program Files\PeerGuardian2
2007-08-30 09:49 <DIR> d-------- C:\Program Files\Lavasoft
2007-08-30 09:49 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-30 09:48 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-08-29 16:31 1,504 --a------ C:\WINDOWS\system32\tmp.reg
2007-08-29 15:45 <DIR> d-------- C:\VundoFix Backups
2007-08-29 00:12 <DIR> d-------- C:\kav
2007-08-28 23:03 <DIR> d-------- C:\DOCUME~1\Jones\backups
2007-08-28 23:02 396,288 --a------ C:\DOCUME~1\Jones\HijackThis.exe
2007-08-28 23:01 <DIR> d-------- C:\Program Files\Trend Micro
2007-08-28 22:54 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2007-08-28 22:10 <DIR> d-------- C:\Program Files\Bethesda Softworks
2007-08-28 18:01 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2007-08-28 17:55 <DIR> d-------- C:\UT2004
2007-08-28 15:13 <DIR> d-------- C:\Program Files\Common Files\NSV
2007-08-28 12:34 <DIR> d-------- C:\DOCUME~1\Ninni\APPLIC~1\Opera
2007-08-28 09:41 <DIR> d-------- C:\Program Files\DAEMON Tools
2007-08-28 09:38 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-08-27 17:10 <DIR> d-------- C:\DOCUME~1\Ninni\APPLIC~1\Comodo
2007-08-27 10:46 <DIR> d-------- C:\Program Files\B2BPOKER
2007-08-27 10:38 306,688 --a------ C:\WINDOWS\IsUninst.exe
2007-08-27 10:08 <DIR> d-------- C:\Program Files\FileSubmit
2007-08-27 09:59 <DIR> d-------- C:\WINDOWS\system32\Lang
2007-08-27 09:54 <DIR> d-------- C:\Program Files\Winamp
2007-08-27 09:41 630,784 --a------ C:\WINDOWS\system32\ANIWZCS2.dll
2007-08-27 09:41 57,407 --a------ C:\WINDOWS\system32\ANICtl.dll
2007-08-27 09:41 49,152 --a------ C:\WINDOWS\system32\JJAKEn.dll
2007-08-27 09:41 49,152 --a------ C:\WINDOWS\system32\AQCKGen.dll
2007-08-27 09:41 237,568 --a------ C:\WINDOWS\system32\wlanapi.dll
2007-08-27 09:41 204,800 --a------ C:\WINDOWS\system32\aIPH.dll
2007-08-27 09:41 163,840 --a------ C:\WINDOWS\system32\WlanApp.dll
2007-08-27 09:41 1,327,189 --a------ C:\WINDOWS\system32\odSupp_M.dll
2007-08-27 09:40 50,176 --a------ C:\WINDOWS\system32\ANIO64.sys
2007-08-27 09:40 36,864 --a------ C:\WINDOWS\system32\ANIOApi.dll
2007-08-27 09:40 24,288 --a------ C:\WINDOWS\system32\ANIO.sys
2007-08-27 09:40 11,904 --a------ C:\WINDOWS\system32\anio4.sys
2007-08-27 09:40 <DIR> d-------- C:\Program Files\D-Link
2007-08-27 09:40 <DIR> d-------- C:\Program Files\ANI
2007-08-27 09:39 <DIR> d-------- C:\Program Files\WinPcap
2007-08-27 09:38 299,520 --a------ C:\WINDOWS\uninst.exe
2007-08-27 09:38 <DIR> d-------- C:\Program Files\ADSL Pure Bridge Utility
2007-08-27 09:38 <DIR> d-------- C:\DOCUME~1\Jones\WINDOWS
2007-08-26 19:36 <DIR> d-------- C:\NVIDIA
2007-08-26 19:29 <DIR> d-------- C:\Program Files\Opera
2007-08-26 19:29 <DIR> d-------- C:\DOCUME~1\Jones\APPLIC~1\Opera
2007-08-26 19:24 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-08-26 19:24 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2007-08-26 19:18 <DIR> d---s---- C:\DOCUME~1\Jones\UserData
2007-08-26 19:17 5,376 --a------ C:\WINDOWS\system32\antiwpa.dll
2007-08-26 19:16 <DIR> d-------- C:\Program Files\IZArc
2007-08-26 19:11 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-08-26 19:11 <DIR> d-------- C:\DOCUME~1\Jones\Contacts
2007-08-26 18:59 <DIR> d-------- C:\DOCUME~1\Jones\APPLIC~1\Comodo
2007-08-26 18:59 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Comodo
2007-08-26 18:58 <DIR> d-------- C:\Program Files\Comodo
2007-08-26 18:50 92,800 -ra------ C:\WINDOWS\system32\drivers\nvata.sys
2007-08-26 18:50 82,944 --a--c--- C:\WINDOWS\system32\dllcache\wdmaud.sys
2007-08-26 18:50 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2007-08-26 18:50 6,400 --a--c--- C:\WINDOWS\system32\dllcache\splitter.sys
2007-08-26 18:50 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2007-08-26 18:50 52,864 --a--c--- C:\WINDOWS\system32\dllcache\dmusic.sys
2007-08-26 18:50 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2007-08-26 18:50 300,032 -ra------ C:\WINDOWS\system32\idecoi.dll
2007-08-26 18:49 <DIR> d-------- C:\Program Files\Realtek Sound Manager
2007-08-26 18:49 <DIR> d-------- C:\Program Files\AvRack
2007-08-26 18:48 9,524,224 --a------ C:\WINDOWS\system32\RTLCPL.EXE
2007-08-26 18:48 208,896 --------- C:\WINDOWS\alcupd.exe
2007-08-26 18:48 139,264 --------- C:\WINDOWS\alcrmv.exe
2007-08-26 18:47 38,912 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys
2007-08-26 18:47 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-08-26 18:47 <DIR> d-------- C:\Program Files\AMD
2007-08-26 18:41 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-08-26 17:29 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2007-08-26 16:47 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-08-26 16:46 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2007-08-26 16:46 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-08-26 16:45 87,424 --a------ C:\WINDOWS\system32\drivers\irda.sys
2007-08-26 16:45 8,192 --a------ C:\WINDOWS\system32\wshirda.dll
2007-08-26 16:45 27,136 --a------ C:\WINDOWS\system32\irmon.dll
2007-08-26 16:45 19,584 --a------ C:\WINDOWS\system32\drivers\rasirda.sys
2007-08-26 16:45 18,688 --a------ C:\WINDOWS\system32\drivers\irsir.sys
2007-08-26 16:45 152,576 --a------ C:\WINDOWS\system32\irftp.exe
2007-08-26 16:44 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Documents
2007-08-26 14:00 <DIR> d-------- C:\Program Files\microsoft frontpage
2007-08-26 13:59 <DIR> d--hs---- C:\DOCUME~1\ALLUSE~1\DRM


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-28 09:51 12464 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2007-06-29 01:54 356352 --a------ C:\WINDOWS\system32\nvusmb.exe
2007-06-29 01:54 356352 --a------ C:\WINDOWS\system32\nvunrm.exe
2007-06-29 01:54 356352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-06-29 01:54 356352 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-06-29 00:43 8466432 --a------ C:\WINDOWS\system32\nvcpl.dll
2007-06-29 00:43 81920 --a------ C:\WINDOWS\system32\nvwddi.dll
2007-06-29 00:43 81920 --a------ C:\WINDOWS\system32\nvmctray.dll
2007-06-29 00:43 753664 --a------ C:\WINDOWS\system32\nvcplui.exe
2007-06-29 00:43 6807328 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-06-29 00:43 6729728 --a------ C:\WINDOWS\system32\nvoglnt.dll
2007-06-29 00:43 6234112 --a------ C:\WINDOWS\system32\nvdisps.dll
2007-06-29 00:43 5690624 --a------ C:\WINDOWS\system32\nv4_disp.dll
2007-06-29 00:43 5455872 --a------ C:\WINDOWS\system32\nvdispsr.dll
2007-06-29 00:43 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2007-06-29 00:43 458752 --a------ C:\WINDOWS\system32\nvmccssr.dll
2007-06-29 00:43 45056 --a------ C:\WINDOWS\system32\nvmccsrs.dll
2007-06-29 00:43 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2007-06-29 00:43 425984 --a------ C:\WINDOWS\system32\keystone.exe
2007-06-29 00:43 37376 --a------ C:\WINDOWS\system32\nvcodins.dll
2007-06-29 00:43 37376 --a------ C:\WINDOWS\system32\nvcod.dll
2007-06-29 00:43 360448 --a------ C:\WINDOWS\system32\nvapi.dll
2007-06-29 00:43 3600384 --a------ C:\WINDOWS\system32\nvvitvsr.dll
2007-06-29 00:43 3518464 --a------ C:\WINDOWS\system32\nvvitvs.dll
2007-06-29 00:43 3321856 --a------ C:\WINDOWS\system32\nvgames.dll
2007-06-29 00:43 3072000 --a------ C:\WINDOWS\system32\nvgamesr.dll
2007-06-29 00:43 307200 --a------ C:\WINDOWS\system32\nvexpbar.dll
2007-06-29 00:43 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll
2007-06-29 00:43 2854912 --a------ C:\WINDOWS\system32\nvmoblsr.dll
2007-06-29 00:43 2416640 --a------ C:\WINDOWS\system32\nvwssr.dll
2007-06-29 00:43 2330624 --a------ C:\WINDOWS\system32\nvwss.dll
2007-06-29 00:43 229376 --a------ C:\WINDOWS\system32\nvmccs.dll
2007-06-29 00:43 188416 --a------ C:\WINDOWS\system32\nvmccss.dll
2007-06-29 00:43 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2007-06-29 00:43 1626112 --a------ C:\WINDOWS\system32\nwiz.exe
2007-06-29 00:43 155716 --a------ C:\WINDOWS\system32\nvsvc32.exe
2007-06-29 00:43 1474560 --a------ C:\WINDOWS\system32\nview.dll
2007-06-29 00:43 147456 --a------ C:\WINDOWS\system32\nvcolor.exe
2007-06-29 00:43 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2007-06-29 00:43 1142784 --a------ C:\WINDOWS\system32\nvmobls.dll
2007-06-29 00:43 1073152 --a------ C:\WINDOWS\system32\nvcpluir.dll
2007-06-29 00:43 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2007-06-29 00:43 1018772 --a------ C:\WINDOWS\system32\nvucode.bin


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43]
"nwiz"="nwiz.exe" [2007-06-29 00:43 C:\WINDOWS\system32\nwiz.exe]
"SW20"="C:\WINDOWS\system32\sw20.exe" [2006-02-22 09:46]
"SW24"="C:\WINDOWS\system32\sw24.exe" [2006-02-22 09:46]
"SoundMan"="SOUNDMAN.EXE" [2004-12-22 12:09 C:\WINDOWS\SOUNDMAN.EXE]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-08-26 18:58]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-26 19:24]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 00:43]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-11-23 15:04]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2005-10-19 18:19]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 01:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" []
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-22 15:06]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
antiwpa.dll 2005-09-18 02:32 5376 C:\WINDOWS\system32\antiwpa.dll



**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-30 15:00:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\CrystalSysInfo]
"ImagePath"="\??\C:\WINDOWS\system32\SysInfo.sys"

Completion time: 2007-08-30 15:00:33 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-30 15:00

--- E O F ---

 

niin sieltä varmaan lähti kaiken näköstä tuotetta pois siinä samalla ku huomasin et mulle tuli se MSN-virus.....olin pienessä "simassa" ja päätin sit kerralla poistaa kaikki messengeriin liittyvät.Alkaa vaan mennä huumorintaju näitten koneitten kanssa kun viikon loppuna veljeen koneen formatointi meni pikkasen penkin alle ihanan LINUX ubuntun GRUB error 21 takia. =)

 

laitas scannaten uusi hjt:n loki

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:19:07, on 30.8.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Comodo\Firewall\CPF.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Winamp\winamp.exe
C:\Documents and Settings\Jones\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 3690 bytes

Mitä tuo Hijackin uudelleen nimeäminen oikeen tekee/hyödyttää?

 

C:\Documents and Settings\Jones\===> HijackThis.exe <===

eipä sitä vielä ole uudelleen nimetty.
sillä näkee ne mitkä osaa piiloutua hjt:tä

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:28:46, on 30.8.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Comodo\Firewall\CPF.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Winamp\winamp.exe
C:\Documents and Settings\Jones\scanner.exe.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 3691 bytes

oorrait nyt pitäis olla kaikki niin kuin pyysit.
Nytkö on kone puhras?

 

tehääs tuosta vielä

Lataa Deckard's System Scanner
Työpöydällesi.

Huomioi: Sinulla tulee olla Järjestelmänvalvojan oikeudet ajaaksesi ohjelman.

[*]Sulje kaikki avoimet ikkunat ja ohjelmat.
[*]Tupla Klikkaa Dss.exe tiedostoa ajaaksesi ohjelman, seuraa ohjeita.
[*]Kun Scannaus on valmis 2 textitiedostoa pitäisi avautua, Main.txt ja extra.txt
[*]Näppäile Kopioi ( CTRL+A -> CTRL + C ) ja liitä ( CTRL + V )
[*]kopioi ja liitä main.txt ja extra.txt sisältö seuraavaan vastaukseesi.

 

Tässä tämä main.txt sisältö:

Deckard's System Scanner v20070826.66
Run by Jones on 2007-08-30 16:08:16
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
15: 2007-08-30 13:08:17 UTC - RP15 - Deckard's System Scanner Restore Point
14: 2007-08-30 11:57:53 UTC - RP14 - ComboFix created restore point
13: 2007-08-30 06:49:12 UTC - RP13 - Installed Ad-Aware 2007
12: 2007-08-28 19:54:07 UTC - RP12 - Poistettu Windows Live Messenger
11: 2007-08-28 19:20:31 UTC - RP11 - Installed DirectX 9.0


-- First Restore Point --
1: 2007-08-26 11:36:03 UTC - RP1 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Jones.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:08:25, on 30.8.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Comodo\Firewall\CPF.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Jones\Desktop\Paskoo\dss.exe
C:\DOCUME~1\Jones\Jones.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 3657 bytes

-- HijackThis Fixed Entries (C:\DOCUME~1\Jones\backups\) -----------------------

backup-20070828-230356-273 O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
backup-20070828-230714-849 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
backup-20070828-230715-565 O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R2 ANIO (ANIO Service) - c:\windows\system32\anio.sys <Not Verified; Alpha Networks Inc.; ANIO (NT5) Driver>
R3 catchme - c:\docume~1\jones\locals~1\temp\catchme.sys (file missing)

S3 GMSIPCI - e:\install\gmsipci.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 aawservice (Ad-Aware 2007 Service) - "c:\program files\lavasoft\ad-aware 2007\aawservice.exe" <Not Verified; Lavasoft AB; Ad-Aware 2007 Service>

S2 ANIWZCSdService (ANIWZCSd Service) - c:\program files\ani\aniwzcs2 service\aniwzcsds.exe <Not Verified; Alpha Networks Inc.; ANIWZCS2 Service Launcher (NT)>
S3 rpcapd (Remote Packet Capture Protocol v.0 (experimental)) - "c:\program files\winpcap\rpcapd.exe" -d -f "c:\program files\winpcap\rpcapd.ini" <Not Verified; NetGroup - Politecnico di Torino; Remote Packet Capture Daemon>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: D-Link AirPlus G DWL-G122 Wireless USB Adapter(rev.C)
Device ID: USB\VID_07D1&PID_3C03\5&49700A4&0&10
Manufacturer: D-Link
Name: D-Link AirPlus G DWL-G122 Wireless USB Adapter(rev.C)
PNP Device ID: USB\VID_07D1&PID_3C03\5&49700A4&0&10
Service: RT73


-- Files created between 2007-07-30 and 2007-08-30 -----------------------------

2007-08-30 16:08:25 396288 --a------ C:\Documents and Settings\Jones\Jones.exe <Not Verified; Trend Micro Inc.; HijackThis>
2007-08-30 14:32:17 0 d-------- C:\WINDOWS\ERUNT
2007-08-30 09:57:09 0 d-------- C:\Program Files\PeerGuardian2
2007-08-30 09:49:14 0 d-------- C:\Program Files\Lavasoft
2007-08-30 09:49:13 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-08-30 09:48:42 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-08-29 16:31:01 1504 --a------ C:\WINDOWS\system32\tmp.reg
2007-08-29 15:45:51 0 d-------- C:\VundoFix Backups
2007-08-29 00:12:23 0 d-------- C:\kav
2007-08-28 23:03:56 0 d-------- C:\Documents and Settings\Jones\backups
2007-08-28 23:02:19 396288 --a------ C:\Documents and Settings\Jones\scanner.exe <Not Verified; Trend Micro Inc.; HijackThis>
2007-08-28 23:01:37 0 d-------- C:\Program Files\Trend Micro
2007-08-28 22:54:11 0 d-------- C:\WINDOWS\system32\appmgmt
2007-08-28 22:54:10 0 d-------- C:\WINDOWS\SxsCaPendDel
2007-08-28 22:10:33 0 d-------- C:\Program Files\Bethesda Softworks
2007-08-28 18:01:01 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2007-08-28 17:55:39 0 d-------- C:\UT2004
2007-08-28 15:13:08 0 d-------- C:\Program Files\Common Files\NSV
2007-08-28 12:35:45 0 d-------- C:\Documents and Settings\Ninni\Application Data\Macromedia
2007-08-28 12:34:50 0 d-------- C:\Documents and Settings\Ninni\Application Data\Opera
2007-08-28 09:41:07 0 d-------- C:\Program Files\DAEMON Tools
2007-08-28 09:38:59 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-08-27 17:10:39 0 d-------- C:\Documents and Settings\Ninni\Application Data\Comodo
2007-08-27 17:10:38 0 d-------- C:\Documents and Settings\Ninni\Application Data\AVG7
2007-08-27 17:10:32 0 d-------- C:\Documents and Settings\Ninni\Application Data\Identities
2007-08-27 17:10:28 0 d--h----- C:\Documents and Settings\Ninni\Templates
2007-08-27 17:10:28 0 dr------- C:\Documents and Settings\Ninni\Start Menu
2007-08-27 17:10:28 0 dr-h----- C:\Documents and Settings\Ninni\SendTo
2007-08-27 17:10:28 0 dr-h----- C:\Documents and Settings\Ninni\Recent
2007-08-27 17:10:28 0 d--h----- C:\Documents and Settings\Ninni\PrintHood
2007-08-27 17:10:28 0 d--h----- C:\Documents and Settings\Ninni\NetHood
2007-08-27 17:10:28 0 dr------- C:\Documents and Settings\Ninni\My Documents
2007-08-27 17:10:28 0 d--h----- C:\Documents and Settings\Ninni\Local Settings
2007-08-27 17:10:28 0 dr------- C:\Documents and Settings\Ninni\Favorites
2007-08-27 17:10:28 0 d-------- C:\Documents and Settings\Ninni\Desktop
2007-08-27 17:10:28 0 d---s---- C:\Documents and Settings\Ninni\Cookies
2007-08-27 17:10:28 0 dr-h----- C:\Documents and Settings\Ninni\Application Data
2007-08-27 17:10:28 0 d---s---- C:\Documents and Settings\Ninni\Application Data\Microsoft
2007-08-27 17:10:27 786432 --ah----- C:\Documents and Settings\Ninni\NTUSER.DAT
2007-08-27 10:46:52 0 d-------- C:\Program Files\B2BPOKER
2007-08-27 10:38:03 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2007-08-27 10:08:47 0 d-------- C:\Program Files\FileSubmit
2007-08-27 09:59:24 0 d-------- C:\WINDOWS\system32\Lang
2007-08-27 09:56:28 0 d-------- C:\WINDOWS\RegisteredPackages
2007-08-27 09:54:32 0 d-------- C:\Program Files\Winamp
2007-08-27 09:41:01 163840 --a------ C:\WINDOWS\system32\WlanApp.dll <Not Verified; Alpha Networks Inc.; WlanApp Dynamic Link Library>
2007-08-27 09:41:01 237568 --a------ C:\WINDOWS\system32\wlanapi.dll <Not Verified; Alpha Networks Inc.; WLANAPI Dynamic Link Library>
2007-08-27 09:41:01 1327189 --a------ C:\WINDOWS\system32\odSupp_M.dll <Not Verified; Funk Software, Inc.; Odyssey Supplicant Toolkit>
2007-08-27 09:41:01 49152 --a------ C:\WINDOWS\system32\JJAKEn.dll <Not Verified; ; JJAKEn Dynamic Link Library>
2007-08-27 09:41:01 49152 --a------ C:\WINDOWS\system32\AQCKGen.dll <Not Verified; Alpha Networks Inc.; AQuickKey Generator>
2007-08-27 09:41:01 630784 --a------ C:\WINDOWS\system32\ANIWZCS2.dll <Not Verified; Alpha Networks Inc.; ANIWZCS Dynamic Link Library>
2007-08-27 09:41:01 57407 --a------ C:\WINDOWS\system32\ANICtl.dll <Not Verified; Alpha Networks Inc.; DevCtrl Dynamic Link Library>
2007-08-27 09:41:01 204800 --a------ C:\WINDOWS\system32\aIPH.dll <Not Verified; Alpha Networks Inc.; IPH Dynamic Link Library>
2007-08-27 09:40:52 36864 --a------ C:\WINDOWS\system32\ANIOApi.dll <Not Verified; Alpha Networks Inc.; ANIO Helper DLL API library>
2007-08-27 09:40:52 50176 --a------ C:\WINDOWS\system32\ANIO64.sys <Not Verified; Alpha Networks Inc.; ANIO (NT5) Driver>
2007-08-27 09:40:52 11904 --a------ C:\WINDOWS\system32\anio4.sys <Not Verified; ANI; ANIO (NDIS4) Driver>
2007-08-27 09:40:52 24288 --a------ C:\WINDOWS\system32\ANIO.sys <Not Verified; Alpha Networks Inc.; ANIO (NT5) Driver>
2007-08-27 09:40:52 0 d-------- C:\Program Files\ANI
2007-08-27 09:40:50 0 d-------- C:\Program Files\D-Link
2007-08-27 09:39:09 0 d-------- C:\Program Files\WinPcap
2007-08-27 09:38:40 0 d-------- C:\Program Files\ADSL Pure Bridge Utility
2007-08-27 09:38:37 299520 --a------ C:\WINDOWS\uninst.exe <Not Verified; InstallShield Corporation, Inc.; InstallShield unInstaller>
2007-08-27 09:38:35 0 d-------- C:\Documents and Settings\Jones\WINDOWS
2007-08-26 19:36:56 0 d-------- C:\NVIDIA
2007-08-26 19:31:19 0 d-------- C:\Documents and Settings\Jones\Application Data\Macromedia
2007-08-26 19:29:09 0 d-------- C:\Documents and Settings\Jones\Application Data\Opera
2007-08-26 19:29:04 0 d-------- C:\Program Files\Opera
2007-08-26 19:24:38 0 d-------- C:\Documents and Settings\Jones\Application Data\AVG7
2007-08-26 19:24:28 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-08-26 19:24:24 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-08-26 19:24:24 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7
2007-08-26 19:18:28 0 d---s---- C:\Documents and Settings\Jones\UserData
2007-08-26 19:17:58 5376 --a------ C:\WINDOWS\system32\antiwpa.dll
2007-08-26 19:16:32 0 d-------- C:\Program Files\IZArc
2007-08-26 19:11:54 0 d-------- C:\Documents and Settings\Jones\Contacts
2007-08-26 19:11:03 0 d------c- C:\WINDOWS\system32\DRVSTORE
2007-08-26 18:59:37 0 d-------- C:\Documents and Settings\Jones\Application Data\Comodo
2007-08-26 18:59:36 0 d-------- C:\Documents and Settings\All Users\Application Data\Comodo
2007-08-26 18:58:08 0 d-------- C:\Program Files\Comodo
2007-08-26 18:49:39 0 d-------- C:\Program Files\Realtek Sound Manager
2007-08-26 18:49:27 0 d-------- C:\Program Files\AvRack
2007-08-26 18:49:16 40960 -----n--- C:\WINDOWS\system32\ChCfg.exe
2007-08-26 18:48:21 208896 -----n--- C:\WINDOWS\alcupd.exe <Not Verified; Realtek Semiconductor Corp.; Update Application for Realtek AC'97>
2007-08-26 18:48:20 139264 -----n--- C:\WINDOWS\alcrmv.exe <Not Verified; Realtek Semiconductor Corp.; Realtek AC'97 Removing Tool>
2007-08-26 18:47:46 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-08-26 18:47:46 0 d-------- C:\Program Files\AMD
2007-08-26 18:45:38 0 d-------- C:\WINDOWS\system32\ReinstallBackups
2007-08-26 18:42:54 53 --a------ C:\biosinfo
2007-08-26 18:41:39 0 d-------- C:\WINDOWS\nview
2007-08-26 18:41:38 9728 -ra------ C:\WINDOWS\system32\sysinfoX64.sys
2007-08-26 18:41:38 8192 -ra------ C:\WINDOWS\system32\sysinfo.sys
2007-08-26 18:41:38 114688 -ra------ C:\WINDOWS\system32\sysinfo.dll <Not Verified; Crystal Dew World; SysInfo>
2007-08-26 18:41:38 69632 -ra------ C:\WINDOWS\system32\sw24.exe
2007-08-26 18:41:38 208896 -ra------ C:\WINDOWS\system32\sw20.exe <Not Verified; ; sw20 Application>
2007-08-26 18:41:37 1445888 -ra------ C:\WINDOWS\system32\msicpl.dll <Not Verified; MSI; MSI MsiCpl>
2007-08-26 18:41:15 0 d-------- C:\Program Files\Common Files\InstallShield
2007-08-26 16:44:56 0 d--hs---- C:\WINDOWS\Installer
2007-08-26 16:44:55 0 d-------- C:\Program Files\Common Files\ODBC
2007-08-26 16:44:53 0 d-------- C:\Program Files\Common Files\SpeechEngines
2007-08-26 16:44:52 0 dr------- C:\Program Files
2007-08-26 16:44:52 0 d-------- C:\Program Files\Common Files
2007-08-26 16:44:27 0 d--h----- C:\Documents and Settings\Default User\Templates
2007-08-26 16:44:27 0 dr------- C:\Documents and Settings\Default User\Start Menu
2007-08-26 16:44:27 0 dr-h----- C:\Documents and Settings\Default User\SendTo
2007-08-26 16:44:27 0 d--h----- C:\Documents and Settings\Default User\Recent
2007-08-26 16:44:27 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2007-08-26 16:44:27 0 d--h----- C:\Documents and Settings\Default User\NetHood
2007-08-26 16:44:27 0 d-------- C:\Documents and Settings\Default User\My Documents
2007-08-26 16:44:27 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
2007-08-26 16:44:27 0 d-------- C:\Documents and Settings\Default User\Favorites
2007-08-26 16:44:27 0 d-------- C:\Documents and Settings\Default User\Desktop
2007-08-26 16:44:27 0 d---s---- C:\Documents and Settings\Default User\Cookies
2007-08-26 16:44:27 0 d--h----- C:\Documents and Settings\All Users\Templates
2007-08-26 16:44:27 0 dr------- C:\Documents and Settings\All Users\Start Menu
2007-08-26 16:44:27 0 d-------- C:\Documents and Settings\All Users\Favorites
2007-08-26 16:44:27 0 dr------- C:\Documents and Settings\All Users\Documents
2007-08-26 16:44:27 0 d-------- C:\Documents and Settings\All Users\Desktop
2007-08-26 16:44:14 0 d-------- C:\WINDOWS\system32\CatRoot2
2007-08-26 16:44:14 0 d-------- C:\WINDOWS\system32\CatRoot
2007-08-26 16:44:09 0 dr-h----- C:\Documents and Settings\Default User\Application Data
2007-08-26 16:44:09 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2007-08-26 16:44:09 0 dr-h----- C:\Documents and Settings\All Users\Application Data
2007-08-26 16:44:09 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
2007-08-26 16:43:48 0 d--hs---- C:\System Volume Information
2007-08-26 16:43:48 0 d-------- C:\Documents and Settings
2007-08-26 16:37:26 0 d-------- C:\WINDOWS
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\WinSxS
2007-08-26 16:37:26 0 dr------- C:\WINDOWS\Web
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\twain_32
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\wins
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\wbem
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\usmt
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\spool
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\ShellExt
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\Setup
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\ras
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\oobe
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\npp
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\mui
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\inetsrv
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\IME
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\icsxml
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\ias
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\export
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\drivers
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\drivers\etc
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\drivers\disdn
2007-08-26 16:37:26 0 dr-hs--c- C:\WINDOWS\system32\dllcache
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\dhcp
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\config
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\3com_dmi
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\3076
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\2052
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\1054
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\1042
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\1041
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\1037
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\1033
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\1031
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\1028
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system32\1025
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\system
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\security
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\Resources
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\repair
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\Provisioning
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\PeerNet
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\pchealth
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\mui
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\msapps
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\msagent
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\Media
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\java
2007-08-26 16:37:26 0 d--h----- C:\WINDOWS\inf
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\ime
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\Help
2007-08-26 16:37:26 0 dr--s---- C:\WINDOWS\Fonts
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\ehome
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\Driver Cache
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\Debug
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\Cursors
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\Connection Wizard
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\Config
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\AppPatch
2007-08-26 16:37:26 0 d-------- C:\WINDOWS\addins
2007-08-26 14:35:52 0 d-------- C:\Documents and Settings\Jones\Application Data\Identities
2007-08-26 14:35:45 0 d--h----- C:\Documents and Settings\Jones\Templates
2007-08-26 14:35:45 0 dr------- C:\Documents and Settings\Jones\Start Menu
2007-08-26 14:35:45 0 dr-h----- C:\Documents and Settings\Jones\SendTo
2007-08-26 14:35:45 0 dr-h----- C:\Documents and Settings\Jones\Recent
2007-08-26 14:35:45 0 d--h----- C:\Documents and Settings\Jones\PrintHood
2007-08-26 14:35:45 0 d--h----- C:\Documents and Settings\Jones\NetHood
2007-08-26 14:35:45 0 dr------- C:\Documents and Settings\Jones\My Documents
2007-08-26 14:35:45 0 d--h----- C:\Documents and Settings\Jones\Local Settings
2007-08-26 14:35:45 0 dr------- C:\Documents and Settings\Jones\Favorites
2007-08-26 14:35:45 0 d-------- C:\Documents and Settings\Jones\Desktop
2007-08-26 14:35:45 0 d---s---- C:\Documents and Settings\Jones\Cookies
2007-08-26 14:35:45 0 dr-h----- C:\Documents and Settings\Jones\Application Data
2007-08-26 14:35:44 1572864 --ah----- C:\Documents and Settings\Jones\NTUSER.DAT
2007-08-26 14:33:39 0 d-------- C:\WINDOWS\SoftwareDistribution
2007-08-26 14:33:38 0 d-------- C:\WINDOWS\Prefetch
2007-08-26 14:33:37 0 d---s---- C:\WINDOWS\system32\Microsoft
2007-08-26 14:33:36 262144 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT
2007-08-26 14:33:36 0 d--h----- C:\Documents and Settings\LocalService\Local Settings
2007-08-26 14:33:36 0 d---s---- C:\Documents and Settings\LocalService\Cookies
2007-08-26 14:33:36 0 d-------- C:\Documents and Settings\LocalService\Application Data
2007-08-26 14:33:36 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
2007-08-26 14:03:00 262144 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
2007-08-26 14:03:00 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
2007-08-26 14:03:00 0 d---s---- C:\Documents and Settings\NetworkService\Cookies
2007-08-26 14:03:00 0 d-------- C:\Documents and Settings\NetworkService\Application Data
2007-08-26 14:03:00 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
2007-08-26 14:00:10 0 d-------- C:\WINDOWS\system32\xircom
2007-08-26 14:00:10 0 d-------- C:\Program Files\microsoft frontpage
2007-08-26 14:00:00 225280 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2007-08-26 13:59:54 0 -rahs---- C:\MSDOS.SYS
2007-08-26 13:59:54 0 -rahs---- C:\IO.SYS
2007-08-26 13:59:54 0 --a------ C:\CONFIG.SYS
2007-08-26 13:59:54 0 --a------ C:\AUTOEXEC.BAT
2007-08-26 13:59:03 0 d--hs---- C:\Documents and Settings\All Users\DRM
2007-08-26 13:58:55 0 dr------- C:\WINDOWS\Offline Web Pages
2007-08-26 13:58:55 0 d---s---- C:\WINDOWS\Downloaded Program Files
2007-08-26 13:58:47 0 d--h----- C:\Program Files\WindowsUpdate
2007-08-26 13:58:27 0 d-------- C:\WINDOWS\system32\DirectX
2007-08-26 13:57:54 0 d---s---- C:\WINDOWS\Tasks
2007-08-26 13:57:53 0 d-------- C:\Program Files\Common Files\MSSoap
2007-08-26 13:57:50 0 d-------- C:\WINDOWS\srchasst
2007-08-26 13:57:49 0 d-------- C:\WINDOWS\system32\Macromed
2007-08-26 13:57:43 0 d-------- C:\Program Files\Movie Maker
2007-08-26 13:57:35 0 d-------- C:\WINDOWS\system32\Restore
2007-08-26 13:57:01 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-08-26 13:56:46 0 d-------- C:\WINDOWS\Registration
2007-08-26 13:56:41 0 d-------- C:\Program Files\Online Services
2007-08-26 13:56:31 0 d-------- C:\Program Files\MSN Gaming Zone
2007-08-26 13:55:52 0 d-------- C:\Program Files\Windows NT
2007-08-26 13:55:49 0 d-------- C:\WINDOWS\system32\MsDtc
2007-08-26 13:55:48 0 d-------- C:\WINDOWS\system32\Com


-- Find3M Report ---------------------------------------------------------------

2007-08-26 16:44:27 62 --ahs---- C:\Documents and Settings\Jones\Application Data\desktop.ini
2007-06-29 00:43:00 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2007-06-29 00:43:00 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2007-06-29 00:43:00 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2007-06-29 00:43:00 1626112 --a------ C:\WINDOWS\system32\nwiz.exe
2007-06-29 00:43:00 1474560 --a------ C:\WINDOWS\system32\nview.dll
2007-06-29 00:43:00 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2007-06-29 00:43:00 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2007-06-29 00:43:00 425984 --a------ C:\WINDOWS\system32\keystone.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [29.06.2007 00:43]
"nwiz"="nwiz.exe" [29.06.2007 00:43 C:\WINDOWS\system32\nwiz.exe]
"SW20"="C:\WINDOWS\system32\sw20.exe" [22.02.2006 09:46]
"SW24"="C:\WINDOWS\system32\sw24.exe" [22.02.2006 09:46]
"SoundMan"="SOUNDMAN.EXE" [22.12.2004 12:09 C:\WINDOWS\SOUNDMAN.EXE]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [26.08.2007 18:58]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [26.08.2007 19:24]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [29.06.2007 00:43]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [23.11.2005 15:04]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [19.10.2005 18:19]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [15.05.2007 01:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" []
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [22.08.2007 15:06]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04.08.2004 15:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
antiwpa.dll 18.09.2005 02:32 5376 C:\WINDOWS\system32\antiwpa.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"




-- End of Deckard's System Scanner: finished at 2007-08-30 16:09:20 ------------

Ja sit extra.txt sisältö:

Deckard's System Scanner v20070826.66
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: AMD Athlon(tm) 64 Processor 3000+
Percentage of Memory in Use: 33%
Physical Memory (total/avail): 1023.48 MiB / 676.73 MiB
Pagefile Memory (total/avail): 2460.16 MiB / 2200.48 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1970.29 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 149.04 GiB total, 112.74 GiB free.
D: is CDROM (CDFS)
E: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - SAMSUNG HD160JJ - 149.05 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 149.04 GiB - C:



-- Security Center -------------------------------------------------------------

AUOptions is disabled.
Windows Internal Firewall is disabled.

FirstRunDisabled is set.

FW: COMODO Firewall Pro v2.3.035 (COMODO)
AV: AVG 7.5.484 v7.5.484 (GRISOFT)

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Jones\Application Data
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=CBA987-8FCCF55C
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Jones
LOGONSERVER=\\CBA987-8FCCF55C
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 47 Stepping 2, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=2f02
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Jones\LOCALS~1\Temp
TMP=C:\DOCUME~1\Jones\LOCALS~1\Temp
USERDOMAIN=CBA987-8FCCF55C
USERNAME=Jones
USERPROFILE=C:\Documents and Settings\Jones
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Jones (admin)
Ninni (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware 2007 --> MsiExec.exe /X{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
ADSL Pure Bridge Utility --> C:\WINDOWS\uninst.exe -f"C:\Program Files\ADSL Pure Bridge Utility\DeIsL1.isu" -c"C:\Program Files\ADSL Pure Bridge Utility\_ISREG32.DLL"
AirPlus G --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe /M{2B7E4354-0492-460A-BDB1-1F59EE141025} /l1035
ANIO Service --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7B5CE976-C7A9-4E38-A7F3-6C8EF025DD8E}\Setup.exe"
ANIWZCS2 Service --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setup.exe"
Athlon 64 Processor Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe" -l0xb
AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL
COMODO Firewall Pro --> C:\Program Files\Comodo\Firewall\fwconfig.exe -uninstalln
HijackThis 2.0.2 --> "C:\Documents and Settings\Jones\HijackThis.exe" /uninstall
IZArc 3.81 --> "C:\Program Files\IZArc\unins000.exe"
Medieval - Total War (TM) - Viking Invasion (TM) --> C:\DOCUME~1\Jones\MYDOCU~1\MTW\Uninstall\Unwise.exe /u C:\DOCUME~1\Jones\MYDOCU~1\MTW\Uninstall\Install.log
NVIDIA Drivers --> C:\WINDOWS\system32\nvudisp.exe UninstallGUI
Oblivion --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{35CB6715-41F8-4F99-8881-6FC75BF054B0}\setup.exe" -l0x9 -removeonly
Opera 9.23 --> MsiExec.exe /X{45A54FAD-AADB-4CD2-9E56-2507A15F013D}
PeerGuardian 2.0 --> "C:\Program Files\PeerGuardian2\unins000.exe"
Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
Royal Guard --> C:\PROGRA~1\FILESU~1\ROYALG~1\UNWISE.EXE C:\PROGRA~1\FILESU~1\ROYALG~1\INSTALL.LOG
SpeechRedist --> MsiExec.exe /X{8795CBED-55E2-4693-9F14-84EC446935BE}
Unreal Tournament 2004 --> C:\UT2004\System\Setup.exe uninstall "UT2004"
Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe"
WinPcap 3.1 beta3 --> "C:\Program Files\WinPcap\Uninstall.exe" "C:\Program Files\WinPcap\install.log"


-- Application Event Log -------------------------------------------------------

Event Record #/Type202 / Success
Event Submitted/Written: 08/28/2007 10:08:43 PM
Event ID/Source: 12001 / usnjsvc
Event Description:


Event Record #/Type196 / Error
Event Submitted/Written: 08/28/2007 06:01:20 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application Setup.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event Record #/Type182 / Success
Event Submitted/Written: 08/28/2007 02:16:40 PM
Event ID/Source: 12001 / usnjsvc
Event Description:


Event Record #/Type164 / Success
Event Submitted/Written: 08/28/2007 10:06:21 AM
Event ID/Source: 12001 / usnjsvc
Event Description:


Event Record #/Type148 / Success
Event Submitted/Written: 08/28/2007 09:33:33 AM
Event ID/Source: 12001 / usnjsvc
Event Description:




-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type944 / Warning
Event Submitted/Written: 08/30/2007 02:59:14 PM / 08/30/2007 02:59:58 PM
Event ID/Source: 51 / Disk
Event Description:
An error was detected on device \Device\Harddisk0\D during a paging operation.

Event Record #/Type943 / Warning
Event Submitted/Written: 08/30/2007 02:59:14 PM / 08/30/2007 02:59:58 PM
Event ID/Source: 51 / Disk
Event Description:
An error was detected on device \Device\Harddisk0\D during a paging operation.

Event Record #/Type942 / Warning
Event Submitted/Written: 08/30/2007 02:59:14 PM / 08/30/2007 02:59:58 PM
Event ID/Source: 51 / Disk
Event Description:
An error was detected on device \Device\Harddisk0\D during a paging operation.

Event Record #/Type941 / Warning
Event Submitted/Written: 08/30/2007 02:59:14 PM / 08/30/2007 02:59:58 PM
Event ID/Source: 51 / Disk
Event Description:
An error was detected on device \Device\Harddisk0\D during a paging operation.

Event Record #/Type940 / Warning
Event Submitted/Written: 08/30/2007 02:59:14 PM / 08/30/2007 02:59:58 PM
Event ID/Source: 51 / Disk
Event Description:
An error was detected on device \Device\Harddisk0\D during a paging operation.



-- End of Deckard's System Scanner: finished at 2007-08-30 16:09:20 ------------