Virus sekoitti koneen, Taas

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi 1Vilu7 08.02.2011.

  1. 1Vilu7

    1Vilu7 Regular member

    Liittynyt:
    31.07.2010
    Viestejä:
    103
    Kiitokset:
    0
    Pisteet:
    26
    Eli latasin ohjelman joka tarvitsi Net.Framework 4.0. latasin sen ja ohjelma alko sekoilee tuli jotai teksii et ei pysty aukasee sit framework tuli ilmotus että jatka/peruuta/lopeta ohjelma painoin jatka. sit meni vähä aikaa ja aattelin ettei tää toimi, painoin Ctrl Alt Del ja tuli et järjestelmä valvoja on poistanut komentorivin käytöstä. Sit ajoin Malwaren ja se löysi huikeat 260virusta ja pari päivää sitten kun tarkastin ei ollut yhtään. Poistin virukset käynnistin koneen uudelleen ja se sama ilmotus tuli että framework kaatui tai jotian tollast sit siinä oli ne jatka/lopeta/peruuta. Painoin Ctrl Alt Del ja komentorivi aukes. Sit pistin sieltä sen prosessin kiinni mikä oli virus laitoin komentorivin kiinni, sen jälkeen se ei lähtenyt taas käyntiin vaan tuli sama teksti että poistettu käytöstä. Sitten siel käynnistä/run juttu hävis kokonaan ja kun painan Windows R nii tuli et rajoitettu käyttä. eikä c:asemaan pääse jos sitä painaa mutta muuta reittiä pitkin pääsee. latasin spybotin se löys ton Run viruksen ja sain sen toimimaan mutta pitäis vielä C:asema ja komentorivi saaha takas toimimaa. Tällänen teksi tuli Hijackil:

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 20:19:28, on 8.2.2011
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
    c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Java\jre6\bin\javaw.exe
    c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
    C:\Program Files\Mobiililaajakaista\Mobiililaajakaista\AutoUpdateSrv.exe
    C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Documents and Settings\Omistaja\Omat tiedostot\Omat musiikkitiedostot\More Samples\svchost.exe
    C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1750559
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_2.dll
    R3 - URLSearchHook: BitTorrentBar Toolbar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\tbBitT.dll
    O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll
    O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\IPS\IPSBHO.DLL
    O2 - BHO: BitTorrentBar Toolbar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\tbBitT.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_2.dll
    O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_2.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll
    O3 - Toolbar: BitTorrentBar Toolbar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\tbBitT.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKLM\..\Run: [StartCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Steam] "C:\Program Files\Left 4 Dead 2\steam.exe" -silent
    O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
    O4 - HKCU\..\Run: [] C:\Windows\Microsoft.NET\assembly\Dungeoneering Pro[v6.7].exe
    O4 - HKCU\..\Run: [JagexGameStudios] C:\Documents and Settings\Omistaja\Application Data\Jagex\iDung.jar
    O4 - HKCU\..\Run: [userlib.exe] C:\Documents and Settings\Omistaja\Omat tiedostot\Omat musiikkitiedostot\More Samples\userlib.exe
    O4 - HKCU\..\RunServices: [JagexGameStudios] C:\Documents and Settings\Omistaja\Application Data\Jagex\iDung.jar
    O4 - HKCU\..\RunServicesOnce: [JagexGameStudios] C:\Documents and Settings\Omistaja\Application Data\Jagex\iDung.jar
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: OneNote 2007 -näyttöleikkeet ja Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
    O4 - Global Startup: Päivitysagentti.lnk = ?
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
    O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
    O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
    O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
    O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe
    O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
    O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
    O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
    O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

    --
    End of file - 11661 bytes
     
    1Vilu7, 08.02.2011
    #1
  2.  
  3. kalminen

    kalminen Regular member

    Liittynyt:
    04.05.2007
    Viestejä:
    3,915
    Kiitokset:
    0
    Pisteet:
    46
    .
    Ole hyvä ja lataa Combofix yhdestä alla olevista linkeistä:

    Linkki 3

    * TÄRKEÄÄ !!! Tallenna ComboFix.exe työpöydällesi

    * Sulje/ota pois päältä kaikki virustorjunta- ja haittaohjelmien poisto-ohjelmat, jotta ne eivät häiritse ComboFixin ajoa.
    (ei palomuuria)
    * Tuplaklikkaa Combofix.exe ja noudata ohjeita.

    * Osana skannausta Combofix tarkistaa onko palautuskonsoli asennettuna. Nykypäivän haittaohjelmien takia on erittäin suositeltua olla asennettuna palautuskonsoli ennen haittaohjelmien poistoa. Windowsin palautuskonsoli mahdollistaa käynnistyksen erityiseen palautustilaan. Palautuskonsolin kautta voimme auttaa sinua helpommin mikäli haittaohjelmien poiston yhteydessä ilmenee ongelmia.

    * Seuraa ohjeita ja salli Combofixin ladata ja asentaa Microsoftin palautuskonsoli, ja kun pyydetään, hyväksy ohjelman takuuehdot asentaaksesi palautuskonsolin.

    **Huomaa: Jos palautuskonsoli on jo asennettuna, Combofix jatkaa eteenpäin.

    [​IMG]

    Kun Microsoftin palautuskonsoli on asennettu, sinun pitäisi nähdä seuraava viesti:

    [​IMG]

    Klikkaa Kyllä jatkaaksesi skannausta.

    Varoitus: ÄLÄ aja ComboFixia ilman valvontaa. Se ei ole lelu ja sitä ei tule käyttää rutiininomaisesti päivittäin.

    Jos tarvitset apua, katso yksityiskohtaisempi ohje:
    http://www.bleepingcomputer.com/combofix/fi/combofixin-kayttoohje

    Kun ComboFix on valmis, se luo raportin. Ole hyvä ja kopioi/liitä
    seuraavat raportit vastaukseesi:

    C:\ComboFix.txt
    Uusi HijackThis-loki
    :)
     
    kalminen, 08.02.2011
    #2
  4. 1Vilu7

    1Vilu7 Regular member

    Liittynyt:
    31.07.2010
    Viestejä:
    103
    Kiitokset:
    0
    Pisteet:
    26
    Kauvan tos kestää ajaa toi ja laitanks siis mun virus torjunnan pois päält Norton internet secuitityn ja jos seki pitää laittaa nii kannattaako ottaa netti johto irti virusten varalt?
     
    1Vilu7, 08.02.2011
    #3
  5. kalminen

    kalminen Regular member

    Liittynyt:
    04.05.2007
    Viestejä:
    3,915
    Kiitokset:
    0
    Pisteet:
    46
    Säilytä nettiyhteys.
    Laita Winukan muuri siksiaikaa päälle.
    Onko sulla kiire ???
     
    kalminen, 09.02.2011
    #4
  6. 1Vilu7

    1Vilu7 Regular member

    Liittynyt:
    31.07.2010
    Viestejä:
    103
    Kiitokset:
    0
    Pisteet:
    26
    ei täs mitää hätää oo. Ajan ton tänää tai huomen
     
    1Vilu7, 09.02.2011
    #5
  7. 1Vilu7

    1Vilu7 Regular member

    Liittynyt:
    31.07.2010
    Viestejä:
    103
    Kiitokset:
    0
    Pisteet:
    26
    Ops tuli kahesti tää sama
     
    Viimeksi muokattu: 10.02.2011
    1Vilu7, 10.02.2011
    #6
  8. 1Vilu7

    1Vilu7 Regular member

    Liittynyt:
    31.07.2010
    Viestejä:
    103
    Kiitokset:
    0
    Pisteet:
    26

    Noni nyt ajoin ton ja tän sain:

    ComboFix 11-02-08.02 - Omistaja 10.02.2011 17:28:42.1.2 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.358.1035.18.2046.1424 [GMT 2:00]
    Sijainti: c:\documents and settings\Omistaja\Omat tiedostot\Lataukset\ComboFix.exe
    AV: Norton Internet Security *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
    FW: Norton Internet Security *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Autorun.inf
    c:\documents and settings\Omistaja\Application Data\PriceGong
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\1.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\a.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\b.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\c.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\d.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\e.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\f.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\g.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\h.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\i.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\J.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\k.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\l.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\m.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\mru.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\n.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\o.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\p.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\q.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\r.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\s.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\t.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\u.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\v.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\w.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\x.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\y.xml
    c:\documents and settings\Omistaja\Application Data\PriceGong\Data\z.xml
    c:\documents and settings\Omistaja\Blowfish.dll
    c:\documents and settings\Omistaja\DRVMGT.DLL
    c:\documents and settings\Omistaja\GAME.EXE
    c:\documents and settings\Omistaja\Keygen.exe
    c:\documents and settings\Omistaja\MPH.EXE
    c:\documents and settings\Omistaja\RA2-Trn-Myth.exe
    c:\documents and settings\Omistaja\ra2.exe
    c:\documents and settings\Omistaja\SECDRV.SYS
    c:\documents and settings\Omistaja\TRAINER.EXE

    .
    ((((((((((((((((((((((((((((((((((((((( Ajurit/Palvelut )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_MYWEBSEARCHSERVICE


    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2011-01-10 to 2011-02-10 )))))))))))))))))
    .

    2011-02-09 12:35 . 2011-02-09 12:35 -------- d-----w- c:\documents and settings\Omistaja\.file_store_32
    2011-02-09 12:35 . 2011-02-09 12:35 -------- d-----w- C:\.file_store_32
    2011-02-09 12:35 . 2011-02-09 12:35 -------- d-----w- c:\windows\.file_store_32
    2011-02-08 18:18 . 2011-02-08 18:18 388096 ----a-r- c:\documents and settings\Omistaja\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-02-08 18:18 . 2011-02-08 18:18 -------- d-----w- c:\program files\Trend Micro
    2011-02-08 17:51 . 2011-02-08 18:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2011-02-08 17:51 . 2011-02-08 17:51 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2011-02-06 15:41 . 2011-02-10 15:39 -------- d-----w- c:\documents and settings\Omistaja\Local Settings\Application Data\LogMeIn Hamachi
    2011-02-06 15:39 . 2011-02-06 15:55 -------- d-----w- c:\program files\Quick Memory Editor
    2011-02-06 15:39 . 2011-02-10 15:36 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\LogMeIn Hamachi
    2011-02-06 15:39 . 2011-02-06 15:39 -------- d-----w- c:\program files\LogMeIn Hamachi
    2011-02-03 20:58 . 2011-02-06 16:04 -------- d-----w- c:\documents and settings\Omistaja\Application Data\Jagex
    2011-02-03 20:01 . 2011-02-03 20:02 -------- d-----w- c:\program files\Wizard101(UK)
    2011-01-27 16:30 . 2011-01-27 16:30 -------- d-----w- c:\documents and settings\Omistaja\.jagex_cache_32
    2011-01-21 18:41 . 2011-01-21 18:41 -------- d-----w- c:\program files\ASUS
    2011-01-21 14:44 . 2011-01-21 14:44 439296 -c----w- c:\windows\system32\dllcache\shimgvw.dll
    2011-01-20 15:03 . 2011-01-21 14:24 -------- d-----w- c:\program files\ElcomSoft
    2011-01-20 13:08 . 2011-01-20 13:13 -------- d-----w- C:\SLXX
    2011-01-19 20:01 . 2011-01-19 20:01 -------- d-----w- c:\documents and settings\Omistaja\Application Data\TightVNC
    2011-01-17 14:02 . 2011-01-17 14:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Fighters
    2011-01-16 21:50 . 2011-01-16 22:50 -------- d-----w- c:\documents and settings\Ville\Application Data\Skype
    2011-01-14 13:26 . 2011-01-14 13:26 -------- d-----w- c:\documents and settings\NetworkService\Application Data\McAfee
    2011-01-13 20:01 . 2011-01-13 20:21 -------- d-----w- c:\program files\Doom 3

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-02-06 11:55 . 2010-10-16 16:07 138520 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
    2011-02-06 11:52 . 2010-10-16 16:07 234536 ----a-w- c:\windows\system32\PnkBstrB.exe
    2011-02-06 11:52 . 2010-10-16 16:07 234536 ----a-w- c:\windows\system32\PnkBstrB.ex0
    2011-02-06 11:52 . 2010-10-16 16:06 234536 ----a-w- c:\windows\system32\PnkBstrB.xtr
    2011-01-21 14:44 . 2010-10-15 21:34 439296 ----a-w- c:\windows\system32\shimgvw.dll
    2011-01-07 14:09 . 2010-10-15 21:34 290048 ----a-w- c:\windows\system32\atmfd.dll
    2010-12-31 14:03 . 2010-10-15 21:34 1855232 ----a-w- c:\windows\system32\win32k.sys
    2010-12-22 12:34 . 2010-10-15 21:34 301568 ----a-w- c:\windows\system32\kerberos.dll
    2010-12-20 22:14 . 2010-10-15 21:34 667136 ----a-w- c:\windows\system32\wininet.dll
    2010-12-20 22:14 . 2010-10-15 21:34 61952 ----a-w- c:\windows\system32\tdc.ocx
    2010-12-20 22:14 . 2010-10-15 21:34 81920 ----a-w- c:\windows\system32\ieencode.dll
    2010-12-20 22:13 . 2010-10-15 21:34 370688 ----a-w- c:\windows\system32\html.iec
    2010-12-20 17:25 . 2010-10-15 21:34 730624 ----a-w- c:\windows\system32\lsasrv.dll
    2010-12-17 16:47 . 2010-10-16 16:02 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
    2010-12-12 19:22 . 2010-12-12 19:22 5904 ----a-w- c:\windows\CLIP.EXE
    2010-12-09 15:15 . 2010-10-15 21:34 712192 ----a-w- c:\windows\system32\ntdll.dll
    2010-12-09 15:14 . 2004-09-14 16:08 2029568 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2010-12-09 15:14 . 2004-09-14 16:08 2151424 ----a-w- c:\windows\system32\ntoskrnl.exe
    2010-12-09 14:29 . 2010-10-15 21:34 33280 ----a-w- c:\windows\system32\csrsrv.dll
    2010-12-01 14:18 . 2010-12-01 14:18 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
    2010-12-01 05:24 . 2011-01-07 14:44 368248 ----a-w- c:\windows\system32\drivers\NIS\1205000.07D\symtdi.sys
    2010-12-01 05:24 . 2011-01-07 14:44 295032 ----a-w- c:\windows\system32\drivers\NIS\1205000.07D\symnets.sys
    2010-12-01 05:23 . 2011-01-07 14:44 330360 ----a-w- c:\windows\system32\drivers\NIS\1205000.07D\symtdiv.sys
    2010-11-26 10:44 . 2010-11-26 10:44 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
    2010-11-26 10:44 . 2010-11-26 10:44 126512 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
    2010-11-23 04:08 . 2011-01-07 14:44 50168 ----a-w- c:\windows\system32\drivers\NIS\1205000.07D\srtspx.sys
    2010-11-23 04:08 . 2011-01-07 14:44 509560 ----a-w- c:\windows\system32\drivers\NIS\1205000.07D\srtsp.sys
    2010-11-22 16:30 . 2010-11-07 13:02 139152 ----a-w- c:\documents and settings\Omistaja\Application Data\PnkBstrK.sys
    2010-11-22 16:30 . 2010-11-07 12:32 794408 ----a-w- c:\windows\system32\pbsvc.exe
    2010-11-18 18:15 . 2010-10-15 11:46 86016 ----a-w- c:\windows\system32\isign32.dll
    2010-11-18 02:59 . 2011-01-07 14:44 652336 ----a-w- c:\windows\system32\drivers\NIS\1205000.07D\symefa.sys
    2010-11-16 01:45 . 2011-01-07 14:44 136312 ----a-w- c:\windows\system32\drivers\NIS\1205000.07D\ironx86.sys
    2008-03-09 04:25 . 2010-10-18 11:52 236 ---ha-w- c:\program files\Common Files\dx.reg
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files\BS_Player\tbBS_2.dll" [2010-10-18 3908192]
    "{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\tbBitT.dll" [2010-11-29 3908192]

    [HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

    [HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
    2010-10-18 10:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
    2010-11-29 13:26 3908192 ----a-w- c:\program files\BitTorrentBar\tbBitT.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]
    2010-10-18 10:26 3908192 ----a-w- c:\program files\BS_Player\tbBS_2.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files\BS_Player\tbBS_2.dll" [2010-10-18 3908192]
    "{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\tbBitT.dll" [2010-11-29 3908192]

    [HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

    [HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}"= "c:\program files\BS_Player\tbBS_2.dll" [2010-10-18 3908192]
    "{88C7F2AA-F93F-432C-8F0E-B7D85967A527}"= "c:\program files\BitTorrentBar\tbBitT.dll" [2010-11-29 3908192]

    [HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

    [HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
    @="{C5994560-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 05:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
    @="{C5994561-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 05:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
    @="{C5994562-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 05:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
    @="{C5994563-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 05:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
    @="{C5994564-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 05:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
    @="{C5994565-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 05:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
    @="{C5994566-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 05:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
    @="{C5994567-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 05:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
    @="{C5994568-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 05:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
    "ares"="c:\program files\Ares\Ares.exe" [2010-02-08 1015808]
    "Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-01-03 15028104]
    "Steam"="c:\program files\Left 4 Dead 2\steam.exe" [2010-11-17 1242448]
    "Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2010-12-04 2984856]
    "JagexGameStudios"="c:\documents and settings\Omistaja\Application Data\Jagex\iDung.jar" [2011-02-06 19280]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
    "JagexGameStudios"="c:\documents and settings\Omistaja\Application Data\Jagex\iDung.jar" [2011-02-06 19280]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]
    "JagexGameStudios"="c:\documents and settings\Omistaja\Application Data\Jagex\iDung.jar" [2011-02-06 19280]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RTHDCPL"="RTHDCPL.EXE" [2008-03-06 16858112]
    "ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-09-10 98304]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-23 421160]
    "LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2010-12-06 1910152]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

    c:\documents and settings\Omistaja\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    OneNote 2007 -n„ytt”leikkeet ja Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

    c:\documents and settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
    P„ivitysagentti.lnk - c:\program files\Mobiililaajakaista\Mobiililaajakaista\AutoUpdateSrv.exe [2010-10-25 479232]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
    2010-02-08 14:51 1015808 ----a-w- c:\program files\Ares\Ares.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2010-09-23 23:10 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
    2009-11-09 03:17 180224 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\BitTorrent\\bittorrent.exe"=
    "c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "c:\\Program Files\\Left 4 Dead 2\\Steam.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "c:\\Program Files\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
    "c:\\Program Files\\Left 4 Dead 2\\steamapps\\common\\amd driver updater, xp, 32 bit\\Setup.exe"=
    "c:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "c:\\Program Files\\Left 4 Dead 2\\steamapps\\vilu7\\counter-strike source\\hl2.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "58912:TCP"= 58912:TCP:pando Media Booster
    "58912:UDP"= 58912:UDP:pando Media Booster

    R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1205000.07D\symds.sys [7.1.2011 16:44 340016]
    R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1205000.07D\symefa.sys [7.1.2011 16:44 652336]
    R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110114.001\BHDrvx86.sys [19.1.2011 8:07 691248]
    R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1205000.07D\ironx86.sys [7.1.2011 16:44 136312]
    R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [6.12.2010 8:31 1238408]
    R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\18.5.0.125\ccsvchst.exe [7.1.2011 16:41 130000]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [28.11.2010 21:28 102448]
    R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110209.001\IDSXpx86.sys [10.2.2011 8:00 341944]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
    S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\Omistaja\LOCALS~1\Temp\NVEB0.tmp --> c:\docume~1\Omistaja\LOCALS~1\Temp\NVEB0.tmp [?]
    S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\plugins\UI\safedrv.sys --> c:\program files\Garena\plugins\UI\safedrv.sys [?]
    S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15.1.2010 14:49 227232]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
    .
    'Ajoitetut tehtävät'-kansion sisältö

    2011-01-27 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 08:50]
    .
    .
    ------- Täydentävä tarkistus -------
    .
    uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1750559
    uInternet Settings,ProxyOverride = *.local
    IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
    IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
    IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
    IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
    IE: V&ie Microsoft Exceliin - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
    FF - ProfilePath - c:\documents and settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\fddoatdm.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2680363&SearchSource=3&q={searchTerms}
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Runescape Community Toolbar: {a8864317-e18b-4292-99d9-e6e65ab905d3} - %profile%\extensions\{a8864317-e18b-4292-99d9-e6e65ab905d3}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: AmbientFox: {c8f71e5b-88f8-42a7-98bb-e4c506161de9} - %profile%\extensions\{c8f71e5b-88f8-42a7-98bb-e4c506161de9}
    FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
    FF - Ext: BitTorrentBar Community Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - %profile%\extensions\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    FF - Ext: Norton IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn
    FF - Ext: Norton Toolbar: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn
    .
    - - - - POISTETUT JÄMÄRIVIT - - - -

    HKCU-Run-RGSC - c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe
    HKCU-Run-userlib.exe - c:\documents and settings\Omistaja\Omat tiedostot\Omat musiikkitiedostot\More Samples\userlib.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-02-10 17:37
    Windows 5.1.2600 Service Pack 3 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NIS]
    "ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\GarenaPEngine]
    "ImagePath"="\??\c:\docume~1\Omistaja\LOCALS~1\Temp\NVEB0.tmp"
    .
    --------------------- LUKITUT REKISTERIAVAIMET ---------------------

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\�•€|ÿÿÿÿ"•€|ù•Ów*]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\PUBPLACE.HTT"
    .
    --------------------- Prosesseihin ladatut DLLt ---------------------

    - - - - - - - > 'winlogon.exe'(744)
    c:\windows\system32\Ati2evxx.dll
    c:\windows\system32\atiadlxx.dll

    - - - - - - - > 'explorer.exe'(1976)
    c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    c:\program files\TortoiseSVN\bin\TortoiseStub.dll
    c:\program files\TortoiseSVN\bin\TortoiseSVN.dll
    c:\program files\TortoiseSVN\bin\intl3_tsvn.dll
    c:\windows\system32\msi.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Muut prosessit ------------------------
    .
    c:\windows\system32\Ati2evxx.exe
    c:\windows\system32\Ati2evxx.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\system32\PnkBstrA.exe
    c:\windows\system32\wscntfy.exe
    c:\program files\TortoiseSVN\bin\TSVNCache.exe
    c:\windows\RTHDCPL.EXE
    c:\program files\iPod\bin\iPodService.exe
    c:\program files\Java\jre6\bin\javaw.exe
    c:\program files\Skype\Plugin Manager\skypePM.exe
    .
    **************************************************************************
    .
    Valmistumisajankohta: 2011-02-10 17:43:31 - kone käynnistettiin uudelleen
    ComboFix-quarantined-files.txt 2011-02-10 15:43

    Ennen ajoa: 102 773 379 072 tavua vapaana
    Ajon jälkeen: 103 092 604 928 tavua vapaana

    WindowsXP-KB310994-SP2-Home-BootDisk-FIN.EXE
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

    - - End Of File - - 243D17A557A646C7579A6F8AC42A3E99

    ja nyt kaikki alko toimimaa siis oliko tää ny täs?
     
    1Vilu7, 10.02.2011
    #7
  9. kalminen

    kalminen Regular member

    Liittynyt:
    04.05.2007
    Viestejä:
    3,915
    Kiitokset:
    0
    Pisteet:
    46
    .
    Olipa siellä vielä tauhkaa !!!

    -------------

    Kirjoita windowsin käynnistävalikon suorita-kenttään Combofix /uninstall paina OK

    ********************************************************

    Mene Windowsin ControlPaneliin (Ohjauspaneli) ja sieltä Lisää / Poista sovellus
    Vistassa (7) Ohjelmat ja toiminnot
    Etsi ja poista ohjelma jonka nimessä on:

    BitTorrentBar Toolbar
    BS Player Toolbar
    Conduit Engine

    ----------------------------------------------------

    * Lataa OTM by OldTimer.
    * Tallenna se työpöydällesi.
    * Kopioi (CTRL+C) alla olevasta laatikosta kaikki teksti.
    Koodi:
    :Processes
explorer.exe
:files 
C:\Windows\Microsoft.NET\assembly\Dungeoneering Pro[v6.7].exe
C:\Documents and Settings\Omistaja\Application Data\Jagex\iDung.jar
C:\Documents and Settings\Omistaja\Omat tiedostot\Omat musiikkitiedostot\More Samples\userlib.exe
C:\Program Files\BitTorrentBar
C:\Documents and Settings\Omistaja\Omat tiedostot\Omat musiikkitiedostot\More Samples\svchost.exe
C:\Program Files\ConduitEngine
:Commands
[purity]
[emptytemp]
[emptyflash]
[start explorer]
[Reboot]
    * Tuplaklikkaa OTM.exe käynnistääksesi sen.
    * Paina oikeanpuoleista hiiren nappia vasemmanpuoleisessa laatikossa
    * Paste Instructions for Items to be Move-ikkunassa (Keltaisen palkin alla) ja paina Liitä tai (Ctrl+V).
    * Paina punaista MoveIt! -nappia.
    * Jos jotain tiedostoa/kansiota ei voitu siirtää heti, ohjelma ehdottaa koneen
    uudelleenkäynnistystä. Vastaa ehdotukseen Yes, jolloin OtMoveIt
    käynnistää koneesi uudelleen.
    * Logi avautuu Notepadiin maalaa ja Kopioi se (CTRL+C) ja liitä (CTRL+V) teksti seuraavaan viestiisi.

    OTM logi. Löytyy myös => C:\_OTM kansiosta.

    *********************************************************

    Poista ne rivit jotka ovat vielä jäljellä:

    Sammuta selain ja muut ohjelmat Fixin ajaksi. (ei virustorjuntaa)
    Käynnistä HijackThis:ja Scan ja ruksaa seuraavat punaisella listatut rivit
    (HJT sammuttaa ohjelman ei poista)

    R3 - URLSearchHook: BitTorrentBar Toolbar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\tbBitT.dll
    R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_2.dll
    O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: BitTorrentBar Toolbar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\tbBitT.dll
    O2 - BHO: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_2.dll
    O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_2.dll
    O3 - Toolbar: BitTorrentBar Toolbar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\tbBitT.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKCU\..\Run: [] C:\Windows\Microsoft.NET\assembly\Dungeoneering Pro[v6.7].exe
    O4 - HKCU\..\Run: [JagexGameStudios] C:\Documents and Settings\Omistaja\Application Data\Jagex\iDung.jar
    O4 - HKCU\..\Run: [userlib.exe] C:\Documents and Settings\Omistaja\Omat tiedostot\Omat musiikkitiedostot\More Samples\userlib.exe
    O4 - HKCU\..\RunServices: [JagexGameStudios] C:\Documents and Settings\Omistaja\Application Data\Jagex\iDung.jar
    O4 - HKCU\..\RunServicesOnce: [JagexGameStudios] C:\Documents and Settings\Omistaja\Application Data\Jagex\iDung.jar
    O4 - Startup: OneNote 2007 -näyttöleikkeet ja Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O4 - Global Startup: McAfee Security Scan Plus.lnk = ?

    sekä sammuta ne.(fix Chekked) napista.

    ----------------------------------------------------

    Tyhjennä roskakori ja Käynnistä koneesi uudelleen.

    Postita tänne seuraavat logit:
    * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
    * OTM raportti
    *
    * Mikä on tilanne ???
    *
    :)
     
    kalminen, 10.02.2011
    #8
  10. 1Vilu7

    1Vilu7 Regular member

    Liittynyt:
    31.07.2010
    Viestejä:
    103
    Kiitokset:
    0
    Pisteet:
    26
    Täs:

    All processes killed
    ========== PROCESSES ==========
    No active process named explorer.exe was found!
    ========== FILES ==========
    C:\Windows\Microsoft.NET\assembly\Dungeoneering Pro[v6.7].exe moved successfully.
    C:\Documents and Settings\Omistaja\Application Data\Jagex\iDung.jar moved successfully.
    File/Folder C:\Documents and Settings\Omistaja\Omat tiedostot\Omat musiikkitiedostot\More Samples\userlib.exe not found.
    File/Folder C:\Program Files\BitTorrentBar not found.
    C:\Documents and Settings\Omistaja\Omat tiedostot\Omat musiikkitiedostot\More Samples\svchost.exe moved successfully.
    C:\Program Files\ConduitEngine folder moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: Omistaja
    ->Temp folder emptied: 12919885 bytes
    ->Temporary Internet Files folder emptied: 6282180 bytes
    ->Java cache emptied: 163145372 bytes
    ->FireFox cache emptied: 93608236 bytes
    ->Flash cache emptied: 9652 bytes

    User: Ville
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 74835209 bytes
    ->Flash cache emptied: 7955 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 2400896 bytes
    %systemroot%\System32 .tmp files removed: 591318 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 32768 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 435074374 bytes

    Total Files Cleaned = 752,00 mb


    OTM by OldTimer - Version 3.1.17.2 log created on 02112011_141114

    Files moved on Reboot...
    File C:\WINDOWS\temp\Perflib_Perfdata_4ac.dat not found!

    Registry entries deleted on Reboot...



    Täs toi hijack:All processes killed
    ========== PROCESSES ==========
    No active process named explorer.exe was found!
    ========== FILES ==========
    C:\Windows\Microsoft.NET\assembly\Dungeoneering Pro[v6.7].exe moved successfully.
    C:\Documents and Settings\Omistaja\Application Data\Jagex\iDung.jar moved successfully.
    File/Folder C:\Documents and Settings\Omistaja\Omat tiedostot\Omat musiikkitiedostot\More Samples\userlib.exe not found.
    File/Folder C:\Program Files\BitTorrentBar not found.
    C:\Documents and Settings\Omistaja\Omat tiedostot\Omat musiikkitiedostot\More Samples\svchost.exe moved successfully.
    C:\Program Files\ConduitEngine folder moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: Omistaja
    ->Temp folder emptied: 12919885 bytes
    ->Temporary Internet Files folder emptied: 6282180 bytes
    ->Java cache emptied: 163145372 bytes
    ->FireFox cache emptied: 93608236 bytes
    ->Flash cache emptied: 9652 bytes

    User: Ville
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 74835209 bytes
    ->Flash cache emptied: 7955 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 2400896 bytes
    %systemroot%\System32 .tmp files removed: 591318 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 32768 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 435074374 bytes

    Total Files Cleaned = 752,00 mb


    OTM by OldTimer - Version 3.1.17.2 log created on 02112011_141114

    Files moved on Reboot...
    File C:\WINDOWS\temp\Perflib_Perfdata_4ac.dat not found!

    Registry entries deleted on Reboot...


    Täs toi hijack:

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 14:27:27, on 11.2.2011
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Pando Networks\Media Booster\PMB.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
    C:\Program Files\Mobiililaajakaista\Mobiililaajakaista\AutoUpdateSrv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Java\jre6\bin\java.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1750559
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll
    O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\IPS\IPSBHO.DLL
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll
    O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [StartCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [Steam] "C:\Program Files\Left 4 Dead 2\steam.exe" -silent
    O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Päivitysagentti.lnk = ?
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
    O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
    O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
    O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
    O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe
    O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
    O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
    O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
    O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

    --
    End of file - 9496 bytes


    sieltä hijackista puuttu muutama noita mitä piti ruksittaa
     
    1Vilu7, 11.02.2011
    #9
  11. kalminen

    kalminen Regular member

    Liittynyt:
    04.05.2007
    Viestejä:
    3,915
    Kiitokset:
    0
    Pisteet:
    46
    .
    Se oli täämöinen jutska !!!
    sieltä hijackista puuttu muutama noita mitä piti ruksittaa

    Poista ne rivit jotka ovat vielä jäljellä:
    Asia OK.

    -------------------------------------------------------------

    Logien mukaan homma olis OK.

    Toimiiko kone nyt ???

    Lopuksi poistamme kaikki käytetyt työkalut roskineen.

    * TuplaklikkaaOTM.exe.
    * Klikkaa CleanUp!.
    * Valitse Yes kun kysytään "Begin cleanup Process?".
    * Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.
    * OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.

    :)
     
    kalminen, 11.02.2011
    #10
  12. 1Vilu7

    1Vilu7 Regular member

    Liittynyt:
    31.07.2010
    Viestejä:
    103
    Kiitokset:
    0
    Pisteet:
    26
    Ok. Kiitos paljon!
     
    1Vilu7, 12.02.2011
    #11

Jaa tämä sivu