Tarvitsisin apua

ei vaan osaa itse

Nyt on käyny kämmi. Koneeseen pääsi iskemään tämä liikenteessä oleva live msn virus. noh. olen ajanut virus skannauksen läpi ties kuinka useasti jne. ja ei ole oikeastaan mitään auttanu. tai hetkellisesti kyllä. osaisiko joku auttaa miten saan ne oikeat tiedostot pois tältä koneelta tuossa jonkinlaista logia

Logfile of HijackThis v1.99.1
Scan saved at 18:24:05, on 5.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
E:\Winamp\winampa.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\AdVantage\AdVantage.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
E:\Common\Bin\WinCinemaMgr.exe
E:\ajureita tms\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
E:\ajureita tms\Logitech\SetPoint\SetPoint.exe
E:\Last.fm\LastFMHelper.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\T6\Poker\T6poker.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {487C9905-26A8-42C8-8033-C58AD3D2AEC3} - C:\WINDOWS\system32\byXRkKdb.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {81EA3F36-357A-435A-8741-52C27CCC9F21} - C:\WINDOWS\system32\mlJYspOH.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [WinampAgent] e:\Winamp\winampa.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - Startup: Last.fm Helper.lnk = E:\Last.fm\LastFMHelper.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\ajureita tms\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = E:\ajureita tms\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1197136556315
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - E:\ajureita tms\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: byXRkKdb - byXRkKdb.dll (file missing)
O20 - Winlogon Notify: mlJYspOH - C:\WINDOWS\SYSTEM32\mlJYspOH.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

14

440

    Vastaukset

    Anonyymi (Kirjaudu / Rekisteröidy)
    5000
    • FixFix
      • ei vaan osaa itse

        ComboFix 08-06-04.5 - 2008-06-05 18:46:50.1 - NTFSx86
        Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.586 [GMT 3:00]
        Running from: C:\Documents and Settings\Cahde\Työpöytä\ComboFix.exe
        * Created a new restore point

        [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
        .

        (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\bot.exe
        C:\Documents and Settings\Cahde\new.txt
        C:\WINDOWS\system32\mlJYspOH.dll
        I:\Autorun.inf

        .
        ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-05-05 to 2008-06-05 )))))))))))))))))
        .

        2008-06-04 20:53 . 2008-06-04 21:02   3,424   --a------   C:\is155400.exe
        2008-06-03 22:54 . 2008-06-04 11:30   3,423   --a------   C:\WINDOWS\is154890.exe
        2008-06-03 18:32 . 2008-06-04 11:30   3,423   --a------   C:\setz.exe
        2008-06-03 14:29 . 2008-06-03 14:29   45   ---h-----   C:\WINDOWS\dsez5288.dat
        2008-05-29 15:22 . 2008-05-30 00:22      d--------   C:\Documents and Settings\Cahde\Application Data\LimeWire
        2008-05-27 19:36 . 2008-05-27 19:36      d--------   C:\WINDOWS\system32\LogFiles
        2008-05-27 19:12 . 2008-05-27 19:12   21,035   --a------   C:\WINDOWS\system32\drivers\AegisP.sys

        .
        (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-06-05 15:09   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Google Updater
        2008-06-05 15:00   ---------   d-----w   C:\Program Files\AdVantage
        2008-06-05 15:00   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\AVG7
        2008-06-04 23:57   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\uTorrent
        2008-05-27 16:25   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
        2008-05-20 10:44   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\AVG7
        2008-04-29 19:38   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\Nokia Multimedia Player
        2008-04-23 15:13   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\dvdcss
        2008-04-22 19:35   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\dvdcss
        2008-04-08 17:22   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\vlc
        .

        (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 20:43 90112]
        "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
        "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [2007-11-05 11:12 884176]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ATIModeChange"="Ati2mdxx.exe" [2001-09-05 03:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
        "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-02-28 22:00 315392]
        "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
        "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
        "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-05-29 14:56 579584]
        "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [ ]
        "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
        "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
        "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 14:27 222208]
        "WinampAgent"="e:\Winamp\winampa.exe" [2006-11-21 20:38 35328]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-08 15:48 219136]
        "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 18:15 1634304]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byXRkKdb]
        byXRkKdb.dll

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
        @=""

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BSplayer_WhenUSave_Installer]
        --a------ 2006-04-27 16:13 148480 C:\Program Files\BSplayer_WhenUSave_Installer\BSplayer_WhenUSave_Installer.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
        --a------ 2007-04-04 00:29 165784 E:\DAEMON Tools\daemon.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DaemonTools_WhenUSave_Installer]
        --a------ 2006-05-24 12:01 148480 C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
        --a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
        --a------ 2006-11-21 20:38 35328 E:\Winamp\winampa.exe

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "E:\\ajureita tms\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
        "F:\\Pelit\\soldat\\Soldat.exe"=
        "E:\\Strong dc \\StrongDC.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
        "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
        "C:\\Program Files\\uTorrent\\uTorrent.exe"=
        "E:\\Nexuiz\\Nexuiz\\nexuiz.exe"=
        "E:\\Nexuiz\\Nexuiz\\nexuiz-sdl.exe"=

        R3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver;C:\WINDOWS\system32\DRIVERS\DP83815.SYS [2003-04-23 03:39]
        S2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys []
        S3 FA312;NETGEAR FA330/FA312/FA311 Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys [2001-08-17 23:12]

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{496e6076-a60b-11dc-928c-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{496e6077-a60b-11dc-928c-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a85fbad-fd8a-11dc-92dc-00030d08107a}]
        \Shell\AutoRun\command - J:\DataTraveler101R.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa28b08a-a276-11dc-9280-00030d08107a}]
        \Shell\AutoRun\command - H:\LaunchU3.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd18-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1b-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1c-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1d-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-06-05 18:59:16
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        ------------------------ Other Running Processes ------------------------
        .
        C:\WINDOWS\system32\ati2evxx.exe
        C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
        C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
        C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
        C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        C:\Program Files\Google\Google Updater\GoogleUpdater.exe
        E:\Common\Bin\WinCinemaMgr.exe
        E:\ajureita tms\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
        E:\ajureita tms\Logitech\SetPoint\SetPoint.exe
        E:\Last.fm\LastFMHelper.exe
        C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
        C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.exe
        .
        **************************************************************************
        .
        Completion time: 2008-06-05 19:01:02 - machine was rebooted
        ComboFix-quarantined-files.txt 2008-06-05 16:00:59

        Pre-Run: 14,161,563,648 tavua vapaana
        Post-Run: 14,655,320,064 tavua vapaana

        143   --- E O F ---   2008-05-29 21:34:03


      • FixFix
        ei vaan osaa itse kirjoitti:

        ComboFix 08-06-04.5 - 2008-06-05 18:46:50.1 - NTFSx86
        Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.586 [GMT 3:00]
        Running from: C:\Documents and Settings\Cahde\Työpöytä\ComboFix.exe
        * Created a new restore point

        [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
        .

        (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\bot.exe
        C:\Documents and Settings\Cahde\new.txt
        C:\WINDOWS\system32\mlJYspOH.dll
        I:\Autorun.inf

        .
        ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-05-05 to 2008-06-05 )))))))))))))))))
        .

        2008-06-04 20:53 . 2008-06-04 21:02   3,424   --a------   C:\is155400.exe
        2008-06-03 22:54 . 2008-06-04 11:30   3,423   --a------   C:\WINDOWS\is154890.exe
        2008-06-03 18:32 . 2008-06-04 11:30   3,423   --a------   C:\setz.exe
        2008-06-03 14:29 . 2008-06-03 14:29   45   ---h-----   C:\WINDOWS\dsez5288.dat
        2008-05-29 15:22 . 2008-05-30 00:22      d--------   C:\Documents and Settings\Cahde\Application Data\LimeWire
        2008-05-27 19:36 . 2008-05-27 19:36      d--------   C:\WINDOWS\system32\LogFiles
        2008-05-27 19:12 . 2008-05-27 19:12   21,035   --a------   C:\WINDOWS\system32\drivers\AegisP.sys

        .
        (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-06-05 15:09   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Google Updater
        2008-06-05 15:00   ---------   d-----w   C:\Program Files\AdVantage
        2008-06-05 15:00   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\AVG7
        2008-06-04 23:57   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\uTorrent
        2008-05-27 16:25   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
        2008-05-20 10:44   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\AVG7
        2008-04-29 19:38   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\Nokia Multimedia Player
        2008-04-23 15:13   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\dvdcss
        2008-04-22 19:35   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\dvdcss
        2008-04-08 17:22   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\vlc
        .

        (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 20:43 90112]
        "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
        "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [2007-11-05 11:12 884176]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ATIModeChange"="Ati2mdxx.exe" [2001-09-05 03:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
        "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-02-28 22:00 315392]
        "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
        "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
        "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-05-29 14:56 579584]
        "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [ ]
        "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
        "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
        "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 14:27 222208]
        "WinampAgent"="e:\Winamp\winampa.exe" [2006-11-21 20:38 35328]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-08 15:48 219136]
        "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 18:15 1634304]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byXRkKdb]
        byXRkKdb.dll

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
        @=""

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BSplayer_WhenUSave_Installer]
        --a------ 2006-04-27 16:13 148480 C:\Program Files\BSplayer_WhenUSave_Installer\BSplayer_WhenUSave_Installer.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
        --a------ 2007-04-04 00:29 165784 E:\DAEMON Tools\daemon.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DaemonTools_WhenUSave_Installer]
        --a------ 2006-05-24 12:01 148480 C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
        --a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
        --a------ 2006-11-21 20:38 35328 E:\Winamp\winampa.exe

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "E:\\ajureita tms\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
        "F:\\Pelit\\soldat\\Soldat.exe"=
        "E:\\Strong dc \\StrongDC.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
        "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
        "C:\\Program Files\\uTorrent\\uTorrent.exe"=
        "E:\\Nexuiz\\Nexuiz\\nexuiz.exe"=
        "E:\\Nexuiz\\Nexuiz\\nexuiz-sdl.exe"=

        R3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver;C:\WINDOWS\system32\DRIVERS\DP83815.SYS [2003-04-23 03:39]
        S2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys []
        S3 FA312;NETGEAR FA330/FA312/FA311 Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys [2001-08-17 23:12]

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{496e6076-a60b-11dc-928c-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{496e6077-a60b-11dc-928c-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a85fbad-fd8a-11dc-92dc-00030d08107a}]
        \Shell\AutoRun\command - J:\DataTraveler101R.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa28b08a-a276-11dc-9280-00030d08107a}]
        \Shell\AutoRun\command - H:\LaunchU3.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd18-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1b-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1c-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1d-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-06-05 18:59:16
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        ------------------------ Other Running Processes ------------------------
        .
        C:\WINDOWS\system32\ati2evxx.exe
        C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
        C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
        C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
        C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        C:\Program Files\Google\Google Updater\GoogleUpdater.exe
        E:\Common\Bin\WinCinemaMgr.exe
        E:\ajureita tms\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
        E:\ajureita tms\Logitech\SetPoint\SetPoint.exe
        E:\Last.fm\LastFMHelper.exe
        C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
        C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.exe
        .
        **************************************************************************
        .
        Completion time: 2008-06-05 19:01:02 - machine was rebooted
        ComboFix-quarantined-files.txt 2008-06-05 16:00:59

        Pre-Run: 14,161,563,648 tavua vapaana
        Post-Run: 14,655,320,064 tavua vapaana

        143   --- E O F ---   2008-05-29 21:34:03

        Poista lisää poista sovelutuksesta

        AdVantage

        *****

        Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

        [quote]

        File::
        C:\is155400.exe
        C:\WINDOWS\is154890.exe
        C:\WINDOWS\system32\mlJYspOH.dll
        C:\WINDOWS\system32\byXRkKdb.dll

        Folder::
        C:\Program Files\AdVantage

        [/quote]

        Tallenna se nimellä CFScript.txt

        Sitten raahaa CFScript ComboFix.exeen kuten alla.
        [img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]

        Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.


      • ei vaan itse pysty
        FixFix kirjoitti:

        Poista lisää poista sovelutuksesta

        AdVantage

        *****

        Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

        [quote]

        File::
        C:\is155400.exe
        C:\WINDOWS\is154890.exe
        C:\WINDOWS\system32\mlJYspOH.dll
        C:\WINDOWS\system32\byXRkKdb.dll

        Folder::
        C:\Program Files\AdVantage

        [/quote]

        Tallenna se nimellä CFScript.txt

        Sitten raahaa CFScript ComboFix.exeen kuten alla.
        [img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]

        Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

        Tuossahan tuota nyt olisi

        ComboFix 08-06-04.5 - Cahde 2008-06-05 22:37:18.2 - NTFSx86
        Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.692 [GMT 3:00]
        Running from: C:\Documents and Settings\Cahde\Työpöytä\ComboFix.exe
        Command switches used :: C:\Documents and Settings\Cahde\Työpöytä\CFScript.txt
        * Created a new restore point

        [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

        FILE ::
        C:\is155400.exe
        C:\WINDOWS\is154890.exe
        C:\WINDOWS\system32\byXRkKdb.dll
        C:\WINDOWS\system32\mlJYspOH.dll
        .

        (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\is155400.exe
        C:\Program Files\AdVantage
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome.manifest
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\advantage.png
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\contents.rdf
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.js
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.xul
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\vssver2.scc
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\overlay.dtd
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\vssver2.scc
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc
        C:\Program Files\AdVantage\AdVantage.db
        C:\Program Files\AdVantage\AdVantage.exe
        C:\Program Files\AdVantage\AdVantage.htm
        C:\Program Files\AdVantage\AdVUninst.exe
        C:\Program Files\AdVantage\ffext.mod
        C:\Program Files\AdVantage\TR.dll
        C:\Program Files\AdVantage\user.db
        C:\WINDOWS\is154890.exe

        .
        ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-05 to 2008-06-05 )))))))))))))))))
        .

        2008-06-03 18:32 . 2008-06-04 11:30   3,423   --a------   C:\setz.exe
        2008-06-03 14:29 . 2008-06-03 14:29   45   ---h-----   C:\WINDOWS\dsez5288.dat
        2008-05-29 15:22 . 2008-05-30 00:22      d--------   C:\Documents and Settings\Cahde\Application Data\LimeWire
        2008-05-27 19:36 . 2008-05-27 19:36      d--------   C:\WINDOWS\system32\LogFiles
        2008-05-27 19:12 . 2008-05-27 19:12   21,035   --a------   C:\WINDOWS\system32\drivers\AegisP.sys

        .
        (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-06-05 19:37   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\uTorrent
        2008-06-05 15:09   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Google Updater
        2008-06-05 15:00   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\AVG7
        2008-05-27 16:25   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
        2008-05-20 10:44   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\AVG7
        2008-04-29 19:38   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\Nokia Multimedia Player
        2008-04-23 15:13   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\dvdcss
        2008-04-22 19:35   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\dvdcss
        2008-04-08 17:22   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\vlc
        2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
        2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
        2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
        .

        (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 20:43 90112]
        "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
        "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [ ]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ATIModeChange"="Ati2mdxx.exe" [2001-09-05 03:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
        "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-02-28 22:00 315392]
        "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
        "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
        "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-05-29 14:56 579584]
        "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [ ]
        "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
        "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
        "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 14:27 222208]
        "WinampAgent"="e:\Winamp\winampa.exe" [2006-11-21 20:38 35328]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-08 15:48 219136]
        "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 18:15 1634304]

        C:\Documents and Settings\rajoitettu\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        Last.fm Helper.lnk - E:\Last.fm\LastFMHelper.exe [2007-12-09 06:01:15 106496]

        C:\Documents and Settings\Cahde\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        Last.fm Helper.lnk - E:\Last.fm\LastFMHelper.exe [2007-12-09 06:01:15 106496]

        C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06 29696]
        Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-28 19:38:51 124400]
        InterVideo WinCinema Manager.lnk - E:\Common\Bin\WinCinemaMgr.exe [2007-11-16 11:50:12 98304]
        Logitech Desktop Messenger.lnk - E:\ajureita tms\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-11-15 21:18:12 67128]
        Logitech SetPoint.lnk - E:\ajureita tms\Logitech\SetPoint\SetPoint.exe [2007-11-15 21:16:03 692224]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byXRkKdb]
        byXRkKdb.dll

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
        @=""

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BSplayer_WhenUSave_Installer]
        --a------ 2006-04-27 16:13 148480 C:\Program Files\BSplayer_WhenUSave_Installer\BSplayer_WhenUSave_Installer.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
        --a------ 2007-04-04 00:29 165784 E:\DAEMON Tools\daemon.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DaemonTools_WhenUSave_Installer]
        --a------ 2006-05-24 12:01 148480 C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
        --a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
        --a------ 2006-11-21 20:38 35328 E:\Winamp\winampa.exe

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "E:\\ajureita tms\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
        "F:\\Pelit\\soldat\\Soldat.exe"=
        "E:\\Strong dc \\StrongDC.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
        "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
        "C:\\Program Files\\uTorrent\\uTorrent.exe"=
        "E:\\Nexuiz\\Nexuiz\\nexuiz.exe"=
        "E:\\Nexuiz\\Nexuiz\\nexuiz-sdl.exe"=

        R3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver;C:\WINDOWS\system32\DRIVERS\DP83815.SYS [2003-04-23 03:39]
        S2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys []
        S3 FA312;NETGEAR FA330/FA312/FA311 Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys [2001-08-17 23:12]

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{496e6076-a60b-11dc-928c-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{496e6077-a60b-11dc-928c-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a85fbad-fd8a-11dc-92dc-00030d08107a}]
        \Shell\AutoRun\command - J:\DataTraveler101R.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa28b08a-a276-11dc-9280-00030d08107a}]
        \Shell\AutoRun\command - H:\LaunchU3.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd18-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1b-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1c-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1d-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-06-05 22:38:25
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        Completion time: 2008-06-05 22:39:15
        ComboFix-quarantined-files.txt 2008-06-05 19:39:07
        ComboFix2.txt 2008-06-05 16:01:02

        Pre-Run: 14,635,020,288 tavua vapaana
        Post-Run: 14,624,227,328 tavua vapaana

        161   --- E O F ---   2008-05-29 21:34:03


      • ei vaan ossaa
        FixFix kirjoitti:

        Poista lisää poista sovelutuksesta

        AdVantage

        *****

        Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

        [quote]

        File::
        C:\is155400.exe
        C:\WINDOWS\is154890.exe
        C:\WINDOWS\system32\mlJYspOH.dll
        C:\WINDOWS\system32\byXRkKdb.dll

        Folder::
        C:\Program Files\AdVantage

        [/quote]

        Tallenna se nimellä CFScript.txt

        Sitten raahaa CFScript ComboFix.exeen kuten alla.
        [img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]

        Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

        Unohappa tuo mun äskeinen.
        arvaas vaan unohdinko poistaa sen AdVantagen tästä koneelta eka :/
        joten palaan kohta asiaan uuden tekstin kera


      • FixFix
        ei vaan itse pysty kirjoitti:

        Tuossahan tuota nyt olisi

        ComboFix 08-06-04.5 - Cahde 2008-06-05 22:37:18.2 - NTFSx86
        Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.692 [GMT 3:00]
        Running from: C:\Documents and Settings\Cahde\Työpöytä\ComboFix.exe
        Command switches used :: C:\Documents and Settings\Cahde\Työpöytä\CFScript.txt
        * Created a new restore point

        [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

        FILE ::
        C:\is155400.exe
        C:\WINDOWS\is154890.exe
        C:\WINDOWS\system32\byXRkKdb.dll
        C:\WINDOWS\system32\mlJYspOH.dll
        .

        (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\is155400.exe
        C:\Program Files\AdVantage
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome.manifest
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\advantage.png
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\contents.rdf
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.js
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.xul
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\vssver2.scc
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\overlay.dtd
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\vssver2.scc
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf
        C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc
        C:\Program Files\AdVantage\AdVantage.db
        C:\Program Files\AdVantage\AdVantage.exe
        C:\Program Files\AdVantage\AdVantage.htm
        C:\Program Files\AdVantage\AdVUninst.exe
        C:\Program Files\AdVantage\ffext.mod
        C:\Program Files\AdVantage\TR.dll
        C:\Program Files\AdVantage\user.db
        C:\WINDOWS\is154890.exe

        .
        ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-05 to 2008-06-05 )))))))))))))))))
        .

        2008-06-03 18:32 . 2008-06-04 11:30   3,423   --a------   C:\setz.exe
        2008-06-03 14:29 . 2008-06-03 14:29   45   ---h-----   C:\WINDOWS\dsez5288.dat
        2008-05-29 15:22 . 2008-05-30 00:22      d--------   C:\Documents and Settings\Cahde\Application Data\LimeWire
        2008-05-27 19:36 . 2008-05-27 19:36      d--------   C:\WINDOWS\system32\LogFiles
        2008-05-27 19:12 . 2008-05-27 19:12   21,035   --a------   C:\WINDOWS\system32\drivers\AegisP.sys

        .
        (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-06-05 19:37   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\uTorrent
        2008-06-05 15:09   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Google Updater
        2008-06-05 15:00   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\AVG7
        2008-05-27 16:25   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
        2008-05-20 10:44   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\AVG7
        2008-04-29 19:38   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\Nokia Multimedia Player
        2008-04-23 15:13   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\dvdcss
        2008-04-22 19:35   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\dvdcss
        2008-04-08 17:22   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\vlc
        2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
        2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
        2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
        .

        (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 20:43 90112]
        "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
        "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [ ]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ATIModeChange"="Ati2mdxx.exe" [2001-09-05 03:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
        "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-02-28 22:00 315392]
        "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
        "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
        "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-05-29 14:56 579584]
        "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [ ]
        "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
        "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
        "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 14:27 222208]
        "WinampAgent"="e:\Winamp\winampa.exe" [2006-11-21 20:38 35328]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-08 15:48 219136]
        "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 18:15 1634304]

        C:\Documents and Settings\rajoitettu\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        Last.fm Helper.lnk - E:\Last.fm\LastFMHelper.exe [2007-12-09 06:01:15 106496]

        C:\Documents and Settings\Cahde\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        Last.fm Helper.lnk - E:\Last.fm\LastFMHelper.exe [2007-12-09 06:01:15 106496]

        C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06 29696]
        Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-28 19:38:51 124400]
        InterVideo WinCinema Manager.lnk - E:\Common\Bin\WinCinemaMgr.exe [2007-11-16 11:50:12 98304]
        Logitech Desktop Messenger.lnk - E:\ajureita tms\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-11-15 21:18:12 67128]
        Logitech SetPoint.lnk - E:\ajureita tms\Logitech\SetPoint\SetPoint.exe [2007-11-15 21:16:03 692224]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byXRkKdb]
        byXRkKdb.dll

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
        @=""

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BSplayer_WhenUSave_Installer]
        --a------ 2006-04-27 16:13 148480 C:\Program Files\BSplayer_WhenUSave_Installer\BSplayer_WhenUSave_Installer.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
        --a------ 2007-04-04 00:29 165784 E:\DAEMON Tools\daemon.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DaemonTools_WhenUSave_Installer]
        --a------ 2006-05-24 12:01 148480 C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
        --a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
        --a------ 2006-11-21 20:38 35328 E:\Winamp\winampa.exe

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "E:\\ajureita tms\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
        "F:\\Pelit\\soldat\\Soldat.exe"=
        "E:\\Strong dc \\StrongDC.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
        "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
        "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
        "C:\\Program Files\\uTorrent\\uTorrent.exe"=
        "E:\\Nexuiz\\Nexuiz\\nexuiz.exe"=
        "E:\\Nexuiz\\Nexuiz\\nexuiz-sdl.exe"=

        R3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver;C:\WINDOWS\system32\DRIVERS\DP83815.SYS [2003-04-23 03:39]
        S2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys []
        S3 FA312;NETGEAR FA330/FA312/FA311 Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys [2001-08-17 23:12]

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{496e6076-a60b-11dc-928c-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{496e6077-a60b-11dc-928c-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a85fbad-fd8a-11dc-92dc-00030d08107a}]
        \Shell\AutoRun\command - J:\DataTraveler101R.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa28b08a-a276-11dc-9280-00030d08107a}]
        \Shell\AutoRun\command - H:\LaunchU3.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd18-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1b-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1c-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1d-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-06-05 22:38:25
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        Completion time: 2008-06-05 22:39:15
        ComboFix-quarantined-files.txt 2008-06-05 19:39:07
        ComboFix2.txt 2008-06-05 16:01:02

        Pre-Run: 14,635,020,288 tavua vapaana
        Post-Run: 14,624,227,328 tavua vapaana

        161   --- E O F ---   2008-05-29 21:34:03

        uusi hjt:n loki scannaten


      • ei vaan ossaa
        FixFix kirjoitti:

        uusi hjt:n loki scannaten

        ComboFix 08-06-04.5 - Cahde 2008-06-05 23:02:32.3 - NTFSx86
        Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.671 [GMT 3:00]
        Running from: C:\Documents and Settings\Cahde\Työpöytä\ComboFix.exe
        Command switches used :: C:\Documents and Settings\Cahde\Työpöytä\CFScript.txt
        * Created a new restore point

        [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

        FILE ::
        C:\is155400.exe
        C:\WINDOWS\is154890.exe
        C:\WINDOWS\system32\byXRkKdb.dll
        C:\WINDOWS\system32\mlJYspOH.dll
        .

        ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-05 to 2008-06-05 )))))))))))))))))
        .

        2008-06-05 22:48 . 2008-06-05 22:48      d--------   C:\Documents and Settings\All Users\Application Data\Avg7
        2008-06-03 18:32 . 2008-06-04 11:30   3,423   --a------   C:\setz.exe
        2008-06-03 14:29 . 2008-06-03 14:29   45   ---h-----   C:\WINDOWS\dsez5288.dat
        2008-05-29 15:22 . 2008-05-30 00:22      d--------   C:\Documents and Settings\Cahde\Application Data\LimeWire
        2008-05-27 19:36 . 2008-05-27 19:36      d--------   C:\WINDOWS\system32\LogFiles
        2008-05-27 19:12 . 2008-05-27 19:12   21,035   --a------   C:\WINDOWS\system32\drivers\AegisP.sys

        .
        (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-06-05 20:02   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\uTorrent
        2008-06-05 15:09   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Google Updater
        2008-05-27 16:25   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
        2008-04-29 19:38   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\Nokia Multimedia Player
        2008-04-23 15:13   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\dvdcss
        2008-04-22 19:35   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\dvdcss
        2008-04-08 17:22   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\vlc
        2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
        2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
        2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
        .

        (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 20:43 90112]
        "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
        "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [ ]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ATIModeChange"="Ati2mdxx.exe" [2001-09-05 03:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
        "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-02-28 22:00 315392]
        "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
        "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
        "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [ ]
        "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
        "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
        "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 14:27 222208]
        "WinampAgent"="e:\Winamp\winampa.exe" [2006-11-21 20:38 35328]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 18:15 1634304]

        C:\Documents and Settings\rajoitettu\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        Last.fm Helper.lnk - E:\Last.fm\LastFMHelper.exe [2007-12-09 06:01:15 106496]

        C:\Documents and Settings\Cahde\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        Last.fm Helper.lnk - E:\Last.fm\LastFMHelper.exe [2007-12-09 06:01:15 106496]

        C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06 29696]
        Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-28 19:38:51 124400]
        InterVideo WinCinema Manager.lnk - E:\Common\Bin\WinCinemaMgr.exe [2007-11-16 11:50:12 98304]
        Logitech Desktop Messenger.lnk - E:\ajureita tms\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-11-15 21:18:12 67128]
        Logitech SetPoint.lnk - E:\ajureita tms\Logitech\SetPoint\SetPoint.exe [2007-11-15 21:16:03 692224]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byXRkKdb]
        byXRkKdb.dll

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
        @=""

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BSplayer_WhenUSave_Installer]
        --a------ 2006-04-27 16:13 148480 C:\Program Files\BSplayer_WhenUSave_Installer\BSplayer_WhenUSave_Installer.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
        --a------ 2007-04-04 00:29 165784 E:\DAEMON Tools\daemon.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DaemonTools_WhenUSave_Installer]
        --a------ 2006-05-24 12:01 148480 C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
        --a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
        --a------ 2006-11-21 20:38 35328 E:\Winamp\winampa.exe

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "E:\\ajureita tms\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
        "F:\\Pelit\\soldat\\Soldat.exe"=
        "E:\\Strong dc \\StrongDC.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
        "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
        "C:\\Program Files\\uTorrent\\uTorrent.exe"=
        "E:\\Nexuiz\\Nexuiz\\nexuiz.exe"=
        "E:\\Nexuiz\\Nexuiz\\nexuiz-sdl.exe"=

        R3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver;C:\WINDOWS\system32\DRIVERS\DP83815.SYS [2003-04-23 03:39]
        S2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys []
        S3 FA312;NETGEAR FA330/FA312/FA311 Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys [2001-08-17 23:12]

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{496e6076-a60b-11dc-928c-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{496e6077-a60b-11dc-928c-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a85fbad-fd8a-11dc-92dc-00030d08107a}]
        \Shell\AutoRun\command - J:\DataTraveler101R.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa28b08a-a276-11dc-9280-00030d08107a}]
        \Shell\AutoRun\command - H:\LaunchU3.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd18-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1b-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1c-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1d-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-06-05 23:03:10
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        Completion time: 2008-06-05 23:03:37
        ComboFix-quarantined-files.txt 2008-06-05 20:03:34
        ComboFix2.txt 2008-06-05 19:39:16
        ComboFix3.txt 2008-06-05 16:01:02

        Pre-Run: 14,657,404,928 tavua vapaana
        Post-Run: 14,650,736,640 tavua vapaana

        129   --- E O F ---   2008-05-29 21:34:03


        ----------------
        ja sitten vielä tuossa on HJT;N logi
        Logfile of HijackThis v1.99.1
        Scan saved at 23:04:34, on 5.6.2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
        C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
        E:\Winamp\winampa.exe
        C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
        C:\Program Files\Windows Live\Messenger\msnmsgr.exe
        C:\Program Files\Google\Google Updater\GoogleUpdater.exe
        E:\Common\Bin\WinCinemaMgr.exe
        E:\ajureita tms\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
        E:\ajureita tms\Logitech\SetPoint\SetPoint.exe
        E:\Last.fm\LastFMHelper.exe
        C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
        C:\Program Files\uTorrent\uTorrent.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\wscntfy.exe
        C:\WINDOWS\explorer.exe
        C:\Program Files\Hijackthis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
        O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
        O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
        O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
        O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
        O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
        O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
        O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
        O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
        O4 - HKLM\..\Run: [WinampAgent] e:\Winamp\winampa.exe
        O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
        O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
        O4 - Startup: Last.fm Helper.lnk = E:\Last.fm\LastFMHelper.exe
        O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
        O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Common\Bin\WinCinemaMgr.exe
        O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\ajureita tms\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
        O4 - Global Startup: Logitech SetPoint.lnk = E:\ajureita tms\Logitech\SetPoint\SetPoint.exe
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1197136556315
        O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - E:\ajureita tms\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
        O20 - Winlogon Notify: byXRkKdb - byXRkKdb.dll (file missing)
        O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
        O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe


      • FixFix
        ei vaan ossaa kirjoitti:

        ComboFix 08-06-04.5 - Cahde 2008-06-05 23:02:32.3 - NTFSx86
        Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.671 [GMT 3:00]
        Running from: C:\Documents and Settings\Cahde\Työpöytä\ComboFix.exe
        Command switches used :: C:\Documents and Settings\Cahde\Työpöytä\CFScript.txt
        * Created a new restore point

        [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

        FILE ::
        C:\is155400.exe
        C:\WINDOWS\is154890.exe
        C:\WINDOWS\system32\byXRkKdb.dll
        C:\WINDOWS\system32\mlJYspOH.dll
        .

        ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-05 to 2008-06-05 )))))))))))))))))
        .

        2008-06-05 22:48 . 2008-06-05 22:48      d--------   C:\Documents and Settings\All Users\Application Data\Avg7
        2008-06-03 18:32 . 2008-06-04 11:30   3,423   --a------   C:\setz.exe
        2008-06-03 14:29 . 2008-06-03 14:29   45   ---h-----   C:\WINDOWS\dsez5288.dat
        2008-05-29 15:22 . 2008-05-30 00:22      d--------   C:\Documents and Settings\Cahde\Application Data\LimeWire
        2008-05-27 19:36 . 2008-05-27 19:36      d--------   C:\WINDOWS\system32\LogFiles
        2008-05-27 19:12 . 2008-05-27 19:12   21,035   --a------   C:\WINDOWS\system32\drivers\AegisP.sys

        .
        (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-06-05 20:02   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\uTorrent
        2008-06-05 15:09   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Google Updater
        2008-05-27 16:25   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
        2008-04-29 19:38   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\Nokia Multimedia Player
        2008-04-23 15:13   ---------   d-----w   C:\Documents and Settings\Cahde\Application Data\dvdcss
        2008-04-22 19:35   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\dvdcss
        2008-04-08 17:22   ---------   d-----w   C:\Documents and Settings\rajoitettu\Application Data\vlc
        2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
        2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
        2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
        .

        (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 20:43 90112]
        "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
        "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [ ]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ATIModeChange"="Ati2mdxx.exe" [2001-09-05 03:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
        "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-02-28 22:00 315392]
        "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
        "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
        "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [ ]
        "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
        "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
        "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 14:27 222208]
        "WinampAgent"="e:\Winamp\winampa.exe" [2006-11-21 20:38 35328]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 18:15 1634304]

        C:\Documents and Settings\rajoitettu\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        Last.fm Helper.lnk - E:\Last.fm\LastFMHelper.exe [2007-12-09 06:01:15 106496]

        C:\Documents and Settings\Cahde\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        Last.fm Helper.lnk - E:\Last.fm\LastFMHelper.exe [2007-12-09 06:01:15 106496]

        C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06 29696]
        Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-28 19:38:51 124400]
        InterVideo WinCinema Manager.lnk - E:\Common\Bin\WinCinemaMgr.exe [2007-11-16 11:50:12 98304]
        Logitech Desktop Messenger.lnk - E:\ajureita tms\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-11-15 21:18:12 67128]
        Logitech SetPoint.lnk - E:\ajureita tms\Logitech\SetPoint\SetPoint.exe [2007-11-15 21:16:03 692224]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byXRkKdb]
        byXRkKdb.dll

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
        @=""

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BSplayer_WhenUSave_Installer]
        --a------ 2006-04-27 16:13 148480 C:\Program Files\BSplayer_WhenUSave_Installer\BSplayer_WhenUSave_Installer.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
        --a------ 2007-04-04 00:29 165784 E:\DAEMON Tools\daemon.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DaemonTools_WhenUSave_Installer]
        --a------ 2006-05-24 12:01 148480 C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
        --a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
        --a------ 2006-11-21 20:38 35328 E:\Winamp\winampa.exe

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "E:\\ajureita tms\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
        "F:\\Pelit\\soldat\\Soldat.exe"=
        "E:\\Strong dc \\StrongDC.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
        "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
        "C:\\Program Files\\uTorrent\\uTorrent.exe"=
        "E:\\Nexuiz\\Nexuiz\\nexuiz.exe"=
        "E:\\Nexuiz\\Nexuiz\\nexuiz-sdl.exe"=

        R3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver;C:\WINDOWS\system32\DRIVERS\DP83815.SYS [2003-04-23 03:39]
        S2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys []
        S3 FA312;NETGEAR FA330/FA312/FA311 Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys [2001-08-17 23:12]

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{496e6076-a60b-11dc-928c-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{496e6077-a60b-11dc-928c-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a85fbad-fd8a-11dc-92dc-00030d08107a}]
        \Shell\AutoRun\command - J:\DataTraveler101R.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa28b08a-a276-11dc-9280-00030d08107a}]
        \Shell\AutoRun\command - H:\LaunchU3.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd18-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1b-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1c-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8f8cd1d-a507-11dc-9283-00030d08107a}]
        \Shell\AutoRun\command - H:\AutoRun.exe

        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-06-05 23:03:10
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        Completion time: 2008-06-05 23:03:37
        ComboFix-quarantined-files.txt 2008-06-05 20:03:34
        ComboFix2.txt 2008-06-05 19:39:16
        ComboFix3.txt 2008-06-05 16:01:02

        Pre-Run: 14,657,404,928 tavua vapaana
        Post-Run: 14,650,736,640 tavua vapaana

        129   --- E O F ---   2008-05-29 21:34:03


        ----------------
        ja sitten vielä tuossa on HJT;N logi
        Logfile of HijackThis v1.99.1
        Scan saved at 23:04:34, on 5.6.2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
        C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
        E:\Winamp\winampa.exe
        C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
        C:\Program Files\Windows Live\Messenger\msnmsgr.exe
        C:\Program Files\Google\Google Updater\GoogleUpdater.exe
        E:\Common\Bin\WinCinemaMgr.exe
        E:\ajureita tms\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
        E:\ajureita tms\Logitech\SetPoint\SetPoint.exe
        E:\Last.fm\LastFMHelper.exe
        C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
        C:\Program Files\uTorrent\uTorrent.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\wscntfy.exe
        C:\WINDOWS\explorer.exe
        C:\Program Files\Hijackthis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
        O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
        O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
        O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
        O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
        O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
        O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
        O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
        O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
        O4 - HKLM\..\Run: [WinampAgent] e:\Winamp\winampa.exe
        O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
        O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
        O4 - Startup: Last.fm Helper.lnk = E:\Last.fm\LastFMHelper.exe
        O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
        O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Common\Bin\WinCinemaMgr.exe
        O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\ajureita tms\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
        O4 - Global Startup: Logitech SetPoint.lnk = E:\ajureita tms\Logitech\SetPoint\SetPoint.exe
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1197136556315
        O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - E:\ajureita tms\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
        O20 - Winlogon Notify: byXRkKdb - byXRkKdb.dll (file missing)
        O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
        O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

        sit tää tää

        scannaa hjt:llä merkkaa paina Fix checked

        O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
        O20 - Winlogon Notify: byXRkKdb - byXRkKdb.dll (file missing)

        *****

        Misäs nyt virustorjunta on


      • ei vaan ossaa
        FixFix kirjoitti:

        sit tää tää

        scannaa hjt:llä merkkaa paina Fix checked

        O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
        O20 - Winlogon Notify: byXRkKdb - byXRkKdb.dll (file missing)

        *****

        Misäs nyt virustorjunta on

        sano nyt että menin sitte sen poistamaan.
        eli pistän tuon AVG:n uusiks tänne ja sitten ajan tuon hjt:n läpi. vaikos?


      • FixFix
        ei vaan ossaa kirjoitti:

        sano nyt että menin sitte sen poistamaan.
        eli pistän tuon AVG:n uusiks tänne ja sitten ajan tuon hjt:n läpi. vaikos?

        hjt loki


      • ei vaan osaa
        FixFix kirjoitti:

        hjt loki

        saattaa kestää vähän. joutuu viikonlopuks lähtee puis kotoa niin ei pysty silloin säätää. mut jos ens viikolla voisit jatkaa tän kanssa auttamista niin olisin oikein kiitollinen


      • FixFix
        ei vaan osaa kirjoitti:

        saattaa kestää vähän. joutuu viikonlopuks lähtee puis kotoa niin ei pysty silloin säätää. mut jos ens viikolla voisit jatkaa tän kanssa auttamista niin olisin oikein kiitollinen

        pikkusen kurkimassa täälläkin


      • ei vaan ossaa
        FixFix kirjoitti:

        pikkusen kurkimassa täälläkin

        käydä tässä koneella kun poikettiin hakee kampetta. pistin AVG:n uusimman version tähän ja 10min skannausta menny niin on löytäny sanotaanko että huomattavasti enemmän kaikkea roinaa verrattuna edelliseen. onko tietoa että osaako toi 8.0 poistaa tuon viruksen. tai noh. eiköhän tuo selviä kun saan sitte seuraavalla kerralla heitettyä logit tänne. joten palaillaan ehkä huomenna


      • FixFix
        ei vaan ossaa kirjoitti:

        käydä tässä koneella kun poikettiin hakee kampetta. pistin AVG:n uusimman version tähän ja 10min skannausta menny niin on löytäny sanotaanko että huomattavasti enemmän kaikkea roinaa verrattuna edelliseen. onko tietoa että osaako toi 8.0 poistaa tuon viruksen. tai noh. eiköhän tuo selviä kun saan sitte seuraavalla kerralla heitettyä logit tänne. joten palaillaan ehkä huomenna

        yhtä ja suurta joka osaisi kaikki örkit poista.
        Mutta jos olisi niin se kone ei inahtaisikaan. :D


    Ketjusta on poistettu 0 sääntöjenvastaista viestiä.

    Luetuimmat keskustelut

    1. Ensitreffit Jenni laukoo viinilasin ääressä suorat sanat Jyrkin aikeista: "Mä sanoin, että älä"

      Voi ei… Mitä luulet: kestääkö Jennin ja Jyrkin avioliitto vai päättyykö eroon? Lue lisää: https://www.suomi24.fi/viihde
      Ensitreffit alttarilla
      27
      3020
    2. Ymmärrän paremmin kuin koskaan

      Roikut kädessäni ja vedät puoleesi. Näen kuitenkin tämän kaiken lävitse ja kaikkien takia minun on tehtävä tämä. Päästän
      Tunteet
      34
      2732
    3. 150
      2328
    4. Hullu liikenteessä?

      Mikä hullu pyörii kylillä jos jahti päällä? Näitä tosin kyllä riittää tällä kylällä.
      Kiuruvesi
      54
      2269
    5. Niina Lahtinen uudessa elämäntilanteessa - Kotiolot ovat muuttuneet merkittävästi: "Nyt on...!"

      Niina, tanssejasi on riemukasta seurata, iso kiitos! Lue Niinan haastattelu: https://www.suomi24.fi/viihde/niina-lahti
      Suomalaiset julkkikset
      24
      1920
    6. Kun Venäjä on tasannut tilit Ukrainan kanssa, onko Suomi seuraava?

      Mitä mieltä olette, onko Suomi seuraava, jonka kanssa Venäjä tasaa tilit? Ja voisiko sitä mitenkään estää? Esimerkiks
      NATO
      392
      1737
    7. Ano Turtiainen saa syytteet kansankiihoituksesta

      Syytteitä on kolme ja niissä on kyse kirjoituksista, jotka hän on kansanedustaja-aikanaan julkaissut Twitter-tilillään
      Maailman menoa
      109
      1695
    8. Pyhäinpäivän aamua

      Oikein hyvää huomenta ja rauhallista päivää. ❄️😊🥱☕❤️
      Ikävä
      319
      1598
    9. Kunta ostaa kivitipun

      Kunnanjohtajan tuleva uusi ostokohde
      Lappajärvi
      135
      1479
    10. Varokaa! Lunta voi sataa kohta!

      Vakava säävaroitus Lumisadevaroitus Satakunta, Uusimaa, Etelä-Karjala, Keski-Suomi, Etelä-Savo, Etelä-Pohjanmaa, Pohjanm
      Maailman menoa
      15
      1472
    Aihe