no mitä näkyy

logissa combofix kirjoitti:

jouni - 06-11-04 13:27:22,24 Service Pack 2
ComboFix 06.10.19 - Running from: "C:\Documents and Settings\jouni\Ty”p”yt„"

((((((((((((((((((((((((((((((( Files Created from 2006-10-04 to 2006-11-04 ))))))))))))))))))))))))))))))))))


2006-10-15   17:16   298   --a------   C:\FixAddRemove.reg
2006-10-14   19:44   49,152   --a------   C:\HXDRemove_fi.exe
2006-10-14   19:44   49,152   --a------   C:\HXDRemove_en.exe
2006-10-14   19:44   12,416   --a------   C:\hxdr.sys


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))   


2006-11-04 13:02   --------   d--------   C:\Program Files\Mozilla Firefox
2006-11-04 11:27   --------   d--------   C:\Program Files\Sandboxie
2006-11-04 11:22   --------   d--------   C:\Program Files\Java
2006-11-04 11:03   --------   d--------   C:\Program Files\Dictionary
2006-11-04 10:57   --------   d--------   C:\Program Files\hijackthis
2006-11-04 10:38   --------   d--------   C:\Program Files\Mozilla Thunderbird
2006-11-02 21:57   --------   d--------   C:\Documents and Settings\jouni\Application Data\AVG7
2006-10-26 20:37   --------   d--------   C:\Program Files\Mozilla Sunbird
2006-10-26 12:41   --------   d--------   C:\Program Files\SpywareBlaster
2006-10-26 10:21   --------   d--------   C:\Documents and Settings\jouni\Application Data\Mozilla
2006-10-23 11:04   --------   d--------   C:\Documents and Settings\jouni\Application Data\Adobe
2006-10-22 15:27   --------   d--------   C:\Documents and Settings\jouni\Application Data\Thunderbird
2006-10-12 16:55   --------   d--------   C:\Program Files\Windows Live Safety Center
2006-10-12 16:10   --------   d--------   C:\Documents and Settings\jouni\Application Data\Windows Live Safety Center
2006-10-12 16:10   --------   d--------   C:\Documents and Settings\jouni\Application Data\Microsoft
2006-10-12 07:46   --------   d--------   C:\Documents and Settings\jouni\Application Data\AdobeUM
2006-10-10 14:28   --------   d--------   C:\Documents and Settings\jouni\Application Data\WinPatrol
2006-10-10 14:27   --------   d--------   C:\Program Files\BillP Studios
2006-10-03 15:34   --------   d--------   C:\Program Files\Grisoft
2006-10-01 09:40   --------   d--------   C:\Documents and Settings\jouni\Application Data\Talkback
2006-09-28 10:38   --------   d--------   C:\Program Files\Common Files\Java
2006-09-28 10:38   --------   d--------   C:\Program Files\Common Files
2006-09-26 14:33   --------   d--------   C:\Program Files\CCleaner
2006-09-25 11:09   --------   d--------   C:\Program Files\FreeRIP2
2006-09-18 19:26   --------   d--------   C:\Program Files\efektit
2006-09-18 11:25   5845   --a------   C:\Documents and Settings\jouni\Application Data\GdiplusUpgrade_MSIApproach_Wrapper.log
2006-09-16 17:43   --------   d--------   C:\Program Files\Ty”p”yt„
2006-09-13 07:03   1084416   --a------   C:\Windows\system32\msxml3.dll
2006-09-05 18:03   3968   --a------   C:\Windows\system32\drivers\AvgAsCln.sys
2006-08-25 17:49   617472   --a------   C:\Windows\system32\comctl32.dll
2006-08-21 14:26   16896   --a------   C:\Windows\system32\fltlib.dll
2006-08-21 11:14   23040   --a------   C:\Windows\system32\fltmc.exe
2006-08-16 13:58   100352   --a------   C:\Windows\system32\6to4svc.dll
2006-08-08 18:53   635520   --a------   C:\Windows\system32\aswBoot.exe


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"SandboxieControl"="C:\\Program Files\\Sandboxie\\Control.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe"
"HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"WinPatrol"="C:\\Program Files\\BillP Studios\\WinPatrol\\winpatrol.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,fa,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,12,03,00,00,23,00,00,00,dc,00,00,00,d2,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000000
"LinkResolveIgnoreLinkInfo"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=dword:00000000
"NoResolveSearch"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Adobe Reader Speed Launch.lnk]
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~2.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"
"path"="C:\\Documents and Settings\\All Users\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\Adobe Reader Speed Launch.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="avgas"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MsnMsgr"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]   
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-11-04 13:28:14.96
C:\ComboFix.txt ... 06-11-04 13:28

kirjoitti:

Anonyymi

Kirjoita kommentti

5000

Lähetä