kone ei pelitä.

ComboFix 08-06-07.3 - Niblaa 2008-06-08 19:43:34.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.643 [GMT 3:00]
Running from: C:\Documents and Settings\Niblaa\Työpöytä\ComboFix.exe
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\bot.exe
C:\setup.exe
C:\WINDOWS\service.exe
C:\WINDOWS\system32\gcgbqipo.ini
C:\WINDOWS\system32\QqYGOqru.ini
C:\WINDOWS\system32\QqYGOqru.ini2
C:\WINDOWS\wkssvr.exe

.
((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-05-08 to 2008-06-08 )))))))))))))))))
.

2008-06-08 16:32 . 2008-06-08 16:32      d--------   C:\Program Files\Trend Micro
2008-06-08 03:00 . 2008-06-08 03:05   1,355   --a------   C:\WINDOWS\imsins.BAK
2008-06-05 00:29 . 2008-06-05 00:29   290,110   --a------   C:\WINDOWS\ftp.exe
2008-06-04 22:14 . 2008-06-04 22:14   86,528   --a------   C:\Documents and Settings\Niblaa\stp.exe
2008-06-04 22:13 . 2008-06-04 22:20   86,528   --a------   C:\stp.exe
2008-06-04 20:56 . 2008-06-04 20:56      d--------   C:\Program Files\MSN Messenger
2008-06-04 19:57 . 2008-06-04 20:09      d--------   C:\WINDOWS\SxsCaPendDel
2008-06-04 19:56 . 2008-02-22 02:33   69,632   --a------   C:\WINDOWS\system32\javacpl.cpl
2008-06-03 23:53 . 2008-06-03 23:55   202,210   --a------   C:\sxy.exe
2008-06-03 19:49 . 2008-06-03 21:27   49,156   --a------   C:\roffl.exe
2008-06-03 19:47 . 2008-06-03 19:47   49,156   -r-hs----   C:\WINDOWS\svchosl.exe
2008-06-03 19:47 . 2008-06-03 19:47   49,156   --a------   C:\rofl.exe
2008-06-03 19:13 . 2008-06-03 23:12   52,331   --a------   C:\f.bat
2008-06-03 18:50 . 2008-06-03 23:38   96,950   --a------   C:\Documents and Settings\Niblaa\setupa.exe
2008-06-03 18:46 . 2008-06-03 22:25   96,950   --a------   C:\setz.exe
2008-06-03 18:23 . 2008-06-03 23:19   96,950   --a------   C:\ssetup.exe
2008-06-03 14:06 . 2008-06-03 22:24   96,950   -r-hs----   C:\WINDOWS\mservice.exe
2008-06-03 14:06 . 2008-06-03 18:32   60,114   --a------   C:\bot1.exe
2008-06-01 13:51 . 2008-06-07 20:54      d--------   C:\Documents and Settings\All Users\Application Data\Google Updater
2008-05-30 19:37 . 2008-05-30 19:37   40,960   --a------   C:\dcsi.exe
2008-05-30 17:09 . 2008-06-04 16:17   86,492   --a------   C:\Documents and Settings\Niblaa\setup.exe
2008-05-30 05:55 . 2008-05-30 22:03   40,960   --a------   C:\dci.exe
2008-05-29 23:22 . 2008-05-29 23:22   86,340   --a------   C:\profile.com
2008-05-29 21:25 . 2008-05-29 21:25   91,522   --a------   C:\daf.exe
2008-05-29 20:45 . 2008-05-29 20:45   249,496   --a------   C:\Documents and Settings\Niblaa\sexy.exe
2008-05-29 20:32 . 2008-05-29 20:32   56,832   --a------   C:\img.com
2008-05-29 20:31 . 2008-05-29 20:36   249,496   --a------   C:\jester.exe
2008-05-29 20:29 . 2008-05-29 20:38   249,496   --a------   C:\Documents and Settings\Niblaa\exy.exe
2008-05-29 20:27 . 2008-05-29 20:56   249,496   --a------   C:\sexy.exe
2008-05-29 19:51 . 2008-05-29 19:51   40,960   --a------   C:\dsdc.exe
2008-05-29 18:28 . 2008-05-29 18:28   56,832   -r-hs----   C:\WINDOWS\winudspm.exe
2008-05-29 18:28 . 2008-05-29 23:10   40,960   --a------   C:\ddc.exe
2008-05-22 16:43 . 2008-06-04 21:06      d--------   C:\Program Files\Zoom Player
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\RealMedia
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\OpenSource Flash Video Splitter
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\DScaler5
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\CD Audio Reader Filter
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\Haali
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\ffdshow
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\DSP-worx
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\DirectVobSub
2008-05-22 15:47 . 2007-11-29 12:52   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
2008-05-22 15:47 . 2007-12-03 16:34   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
2008-05-22 15:47 . 2007-11-29 12:52   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 16:07   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-08 10:50   ---------   d-----w   C:\Documents and Settings\Niblaa\Application Data\uTorrent
2008-06-04 18:58   ---------   d-----w   C:\Program Files\DC++
2008-06-04 16:56   ---------   d-----w   C:\Program Files\Java
2008-06-01 10:51   ---------   d-----w   C:\Program Files\Google
2008-05-16 15:26   ---------   d-----w   C:\Program Files\B2BPOKER
2008-05-11 14:54   ---------   d-----w   C:\Program Files\PAFPoker
2008-03-18 09:22   98,304   ----a-w   C:\WINDOWS\DUMP6dfc.tmp
2005-03-31 19:17   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
2004-09-14 13:12   249,496   --sh--r   C:\WINDOWS\system32\telecms.exe
.

(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\nbj.exe" [2005-05-19 20:38 1957888]
"FreeRAM XP"="C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-23 01:13 1591808]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-11-30 16:56 1306624]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PtiuPbmd"="ptipbm.dll" [2003-01-15 14:41 24576 C:\WINDOWS\system32\ptipbm.dll]
"Gainward"="C:\WINDOWS\TBPanel.exe" [2003-06-16 06:56 2031616]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-12-15 19:56 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 11:31 67584 C:\WINDOWS\soundman.exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 21:41 33792]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2005-12-13 08:49 217088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"psyspy-2.1.4 Client Server"="C:\WINDOWS\system32\telecms.exe" [2004-09-14 16:12 249496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-14 16:12 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.divf"= divx412.dll
"vidc.mjpg"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
"vidc.avrn"= C:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.advj"= C:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.mszh"= C:\PROGRA~1\ACEMEG~1\SystemS\avimszh.dll
"vidc.zlib"= C:\PROGRA~1\ACEMEG~1\SystemS\avizlib.dll
"msacm.sl_anet"= C:\PROGRA~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.wrpr"= C:\PROGRA~1\ACEMEG~1\SystemS\aviwrap.dll
"vidc.3ivx"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv0"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv1"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv2"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3ivd"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.yv12"= C:\PROGRA~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.divx"= C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivX511.dll
"vidc.iyuv"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.uyvy"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yuy2"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yvyu"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"msacm.msaudio1"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\javaw.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\javaw.exe"=
"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\javaw.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\WINDOWS\\system32\\telecms.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=

R0 d343bus;d343bus;C:\WINDOWS\system32\DRIVERS\d343bus.sys [2003-12-15 19:46]
R0 d343port;d343port;C:\WINDOWS\system32\DRIVERS\d343port.sys [2003-12-15 18:29]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
R3 2802W;SMC2802W 2.4GHz 54 Mbps Wireless PCI Driver;C:\WINDOWS\system32\DRIVERS\2802W.sys [2004-03-08 17:23]
R3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\Core Center\NTGLM7X.sys [2004-08-20 19:03]
R3 RushTopDevice;RushTopDevice;C:\Program Files\MSI\Core Center\RushTop.sys [2004-05-26 20:55]
R3 w3304an5;WN3X0X Wireless Adapter;C:\PROGRA~1\SMC\SMC280~1.4GH\INSTAL~1\WINXP\w3304an5.SYS [2002-10-07 05:14]

*Newly Created Service* - PCALERTDRIVER
*Newly Created Service* - RUSHTOPDEVICE
.
'Ajoitetut teht„v„t'-kansion sis„lt”
"2008-06-08 16:43:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 19:48:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\MSI\Core Center\CoreCenter.exe
C:\Program Files\SMC\SMC2802W 2.4GHz 54 Mbps Wireless PCI Adapter\Installer\WINXP\SMC11GMonitor.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Completion time: 2008-06-08 19:51:37 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-08 16:51:34

Pre-Run: 214,024,192 tavua vapaana
Post-Run: 159,232,000 tavua vapaana

193   --- E O F ---   2008-06-08 00:05:25

J.Doe kirjoitti:

ComboFix 08-06-07.3 - Niblaa 2008-06-08 19:43:34.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.643 [GMT 3:00]
Running from: C:\Documents and Settings\Niblaa\Työpöytä\ComboFix.exe
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\bot.exe
C:\setup.exe
C:\WINDOWS\service.exe
C:\WINDOWS\system32\gcgbqipo.ini
C:\WINDOWS\system32\QqYGOqru.ini
C:\WINDOWS\system32\QqYGOqru.ini2
C:\WINDOWS\wkssvr.exe

.
((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-05-08 to 2008-06-08 )))))))))))))))))
.

2008-06-08 16:32 . 2008-06-08 16:32      d--------   C:\Program Files\Trend Micro
2008-06-08 03:00 . 2008-06-08 03:05   1,355   --a------   C:\WINDOWS\imsins.BAK
2008-06-05 00:29 . 2008-06-05 00:29   290,110   --a------   C:\WINDOWS\ftp.exe
2008-06-04 22:14 . 2008-06-04 22:14   86,528   --a------   C:\Documents and Settings\Niblaa\stp.exe
2008-06-04 22:13 . 2008-06-04 22:20   86,528   --a------   C:\stp.exe
2008-06-04 20:56 . 2008-06-04 20:56      d--------   C:\Program Files\MSN Messenger
2008-06-04 19:57 . 2008-06-04 20:09      d--------   C:\WINDOWS\SxsCaPendDel
2008-06-04 19:56 . 2008-02-22 02:33   69,632   --a------   C:\WINDOWS\system32\javacpl.cpl
2008-06-03 23:53 . 2008-06-03 23:55   202,210   --a------   C:\sxy.exe
2008-06-03 19:49 . 2008-06-03 21:27   49,156   --a------   C:\roffl.exe
2008-06-03 19:47 . 2008-06-03 19:47   49,156   -r-hs----   C:\WINDOWS\svchosl.exe
2008-06-03 19:47 . 2008-06-03 19:47   49,156   --a------   C:\rofl.exe
2008-06-03 19:13 . 2008-06-03 23:12   52,331   --a------   C:\f.bat
2008-06-03 18:50 . 2008-06-03 23:38   96,950   --a------   C:\Documents and Settings\Niblaa\setupa.exe
2008-06-03 18:46 . 2008-06-03 22:25   96,950   --a------   C:\setz.exe
2008-06-03 18:23 . 2008-06-03 23:19   96,950   --a------   C:\ssetup.exe
2008-06-03 14:06 . 2008-06-03 22:24   96,950   -r-hs----   C:\WINDOWS\mservice.exe
2008-06-03 14:06 . 2008-06-03 18:32   60,114   --a------   C:\bot1.exe
2008-06-01 13:51 . 2008-06-07 20:54      d--------   C:\Documents and Settings\All Users\Application Data\Google Updater
2008-05-30 19:37 . 2008-05-30 19:37   40,960   --a------   C:\dcsi.exe
2008-05-30 17:09 . 2008-06-04 16:17   86,492   --a------   C:\Documents and Settings\Niblaa\setup.exe
2008-05-30 05:55 . 2008-05-30 22:03   40,960   --a------   C:\dci.exe
2008-05-29 23:22 . 2008-05-29 23:22   86,340   --a------   C:\profile.com
2008-05-29 21:25 . 2008-05-29 21:25   91,522   --a------   C:\daf.exe
2008-05-29 20:45 . 2008-05-29 20:45   249,496   --a------   C:\Documents and Settings\Niblaa\sexy.exe
2008-05-29 20:32 . 2008-05-29 20:32   56,832   --a------   C:\img.com
2008-05-29 20:31 . 2008-05-29 20:36   249,496   --a------   C:\jester.exe
2008-05-29 20:29 . 2008-05-29 20:38   249,496   --a------   C:\Documents and Settings\Niblaa\exy.exe
2008-05-29 20:27 . 2008-05-29 20:56   249,496   --a------   C:\sexy.exe
2008-05-29 19:51 . 2008-05-29 19:51   40,960   --a------   C:\dsdc.exe
2008-05-29 18:28 . 2008-05-29 18:28   56,832   -r-hs----   C:\WINDOWS\winudspm.exe
2008-05-29 18:28 . 2008-05-29 23:10   40,960   --a------   C:\ddc.exe
2008-05-22 16:43 . 2008-06-04 21:06      d--------   C:\Program Files\Zoom Player
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\RealMedia
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\OpenSource Flash Video Splitter
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\DScaler5
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\CD Audio Reader Filter
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\Haali
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\ffdshow
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\DSP-worx
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\DirectVobSub
2008-05-22 15:47 . 2007-11-29 12:52   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
2008-05-22 15:47 . 2007-12-03 16:34   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
2008-05-22 15:47 . 2007-11-29 12:52   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 16:07   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-08 10:50   ---------   d-----w   C:\Documents and Settings\Niblaa\Application Data\uTorrent
2008-06-04 18:58   ---------   d-----w   C:\Program Files\DC++
2008-06-04 16:56   ---------   d-----w   C:\Program Files\Java
2008-06-01 10:51   ---------   d-----w   C:\Program Files\Google
2008-05-16 15:26   ---------   d-----w   C:\Program Files\B2BPOKER
2008-05-11 14:54   ---------   d-----w   C:\Program Files\PAFPoker
2008-03-18 09:22   98,304   ----a-w   C:\WINDOWS\DUMP6dfc.tmp
2005-03-31 19:17   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
2004-09-14 13:12   249,496   --sh--r   C:\WINDOWS\system32\telecms.exe
.

(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\nbj.exe" [2005-05-19 20:38 1957888]
"FreeRAM XP"="C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-23 01:13 1591808]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-11-30 16:56 1306624]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PtiuPbmd"="ptipbm.dll" [2003-01-15 14:41 24576 C:\WINDOWS\system32\ptipbm.dll]
"Gainward"="C:\WINDOWS\TBPanel.exe" [2003-06-16 06:56 2031616]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-12-15 19:56 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 11:31 67584 C:\WINDOWS\soundman.exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 21:41 33792]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2005-12-13 08:49 217088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"psyspy-2.1.4 Client Server"="C:\WINDOWS\system32\telecms.exe" [2004-09-14 16:12 249496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-14 16:12 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.divf"= divx412.dll
"vidc.mjpg"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
"vidc.avrn"= C:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.advj"= C:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.mszh"= C:\PROGRA~1\ACEMEG~1\SystemS\avimszh.dll
"vidc.zlib"= C:\PROGRA~1\ACEMEG~1\SystemS\avizlib.dll
"msacm.sl_anet"= C:\PROGRA~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.wrpr"= C:\PROGRA~1\ACEMEG~1\SystemS\aviwrap.dll
"vidc.3ivx"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv0"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv1"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv2"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3ivd"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.yv12"= C:\PROGRA~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.divx"= C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivX511.dll
"vidc.iyuv"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.uyvy"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yuy2"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yvyu"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"msacm.msaudio1"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\javaw.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\javaw.exe"=
"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\javaw.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\WINDOWS\\system32\\telecms.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=

R0 d343bus;d343bus;C:\WINDOWS\system32\DRIVERS\d343bus.sys [2003-12-15 19:46]
R0 d343port;d343port;C:\WINDOWS\system32\DRIVERS\d343port.sys [2003-12-15 18:29]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
R3 2802W;SMC2802W 2.4GHz 54 Mbps Wireless PCI Driver;C:\WINDOWS\system32\DRIVERS\2802W.sys [2004-03-08 17:23]
R3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\Core Center\NTGLM7X.sys [2004-08-20 19:03]
R3 RushTopDevice;RushTopDevice;C:\Program Files\MSI\Core Center\RushTop.sys [2004-05-26 20:55]
R3 w3304an5;WN3X0X Wireless Adapter;C:\PROGRA~1\SMC\SMC280~1.4GH\INSTAL~1\WINXP\w3304an5.SYS [2002-10-07 05:14]

*Newly Created Service* - PCALERTDRIVER
*Newly Created Service* - RUSHTOPDEVICE
.
'Ajoitetut teht„v„t'-kansion sis„lt”
"2008-06-08 16:43:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 19:48:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\MSI\Core Center\CoreCenter.exe
C:\Program Files\SMC\SMC2802W 2.4GHz 54 Mbps Wireless PCI Adapter\Installer\WINXP\SMC11GMonitor.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Completion time: 2008-06-08 19:51:37 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-08 16:51:34

Pre-Run: 214,024,192 tavua vapaana
Post-Run: 159,232,000 tavua vapaana

193   --- E O F ---   2008-06-08 00:05:25

konetta

Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

[quote]

File::
C:\stp.exe
C:\sxy.exe
C:\roffl.exe
C:\WINDOWS\svchosl.exe
C:\rofl.exe
C:\f.bat
C:\Documents and Settings\Niblaa\setupa.exe
C:\setz.exe
C:\ssetup.exe
C:\WINDOWS\mservice.exe
C:\bot1.exe
C:\dcsi.exe
C:\Documents and Settings\Niblaa\setup.exe
C:\dci.exe
C:\daf.exe
C:\Documents and Settings\Niblaa\sexy.exe
C:\img.com
C:\jester.exe
C:\Documents and Settings\Niblaa\exy.exe
C:\sexy.exe
C:\dsdc.exe
C:\WINDOWS\winudspm.exe
C:\ddc.exe
C:\WINDOWS\system32\telecms.exe

[/quote]

Tallenna se nimellä CFScript.txt

Sitten raahaa CFScript ComboFix.exeen kuten alla.
[img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]

Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

FixFix kirjoitti:

konetta

Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

[quote]

File::
C:\stp.exe
C:\sxy.exe
C:\roffl.exe
C:\WINDOWS\svchosl.exe
C:\rofl.exe
C:\f.bat
C:\Documents and Settings\Niblaa\setupa.exe
C:\setz.exe
C:\ssetup.exe
C:\WINDOWS\mservice.exe
C:\bot1.exe
C:\dcsi.exe
C:\Documents and Settings\Niblaa\setup.exe
C:\dci.exe
C:\daf.exe
C:\Documents and Settings\Niblaa\sexy.exe
C:\img.com
C:\jester.exe
C:\Documents and Settings\Niblaa\exy.exe
C:\sexy.exe
C:\dsdc.exe
C:\WINDOWS\winudspm.exe
C:\ddc.exe
C:\WINDOWS\system32\telecms.exe

[/quote]

Tallenna se nimellä CFScript.txt

Sitten raahaa CFScript ComboFix.exeen kuten alla.
[img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]

Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

ComboFix 08-06-07.3 - Niblaa 2008-06-08 20:49:26.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.618 [GMT 3:00]
Running from: C:\Documents and Settings\Niblaa\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Niblaa\Työpöytä\CFScript.txt
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

FILE ::
C:\bot1.exe
C:\daf.exe
C:\dci.exe
C:\dcsi.exe
C:\ddc.exe
C:\Documents and Settings\Niblaa\exy.exe
C:\Documents and Settings\Niblaa\setup.exe
C:\Documents and Settings\Niblaa\setupa.exe
C:\Documents and Settings\Niblaa\sexy.exe
C:\dsdc.exe
C:\f.bat
C:\img.com
C:\jester.exe
C:\roffl.exe
C:\rofl.exe
C:\setz.exe
C:\sexy.exe
C:\ssetup.exe
C:\stp.exe
C:\sxy.exe
C:\WINDOWS\mservice.exe
C:\WINDOWS\svchosl.exe
C:\WINDOWS\system32\telecms.exe
C:\WINDOWS\winudspm.exe
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\bot1.exe
C:\daf.exe
C:\dci.exe
C:\dcsi.exe
C:\ddc.exe
C:\Documents and Settings\Niblaa\exy.exe
C:\Documents and Settings\Niblaa\setup.exe
C:\Documents and Settings\Niblaa\setupa.exe
C:\Documents and Settings\Niblaa\sexy.exe
C:\dsdc.exe
C:\f.bat
C:\img.com
C:\jester.exe
C:\roffl.exe
C:\rofl.exe
C:\setz.exe
C:\sexy.exe
C:\ssetup.exe
C:\stp.exe
C:\sxy.exe
C:\WINDOWS\mservice.exe
C:\WINDOWS\svchosl.exe
C:\WINDOWS\system32\telecms.exe
C:\WINDOWS\winudspm.exe

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
.

2008-06-08 19:51 . 2008-06-08 19:51      d--------   C:\Documents and Settings\Jõrjestelmõnvalvoja
2008-06-08 16:32 . 2008-06-08 16:32      d--------   C:\Program Files\Trend Micro
2008-06-08 03:00 . 2008-06-08 03:05   1,355   --a------   C:\WINDOWS\imsins.BAK
2008-06-05 00:29 . 2008-06-05 00:29   290,110   --a------   C:\WINDOWS\ftp.exe
2008-06-04 22:14 . 2008-06-04 22:14   86,528   --a------   C:\Documents and Settings\Niblaa\stp.exe
2008-06-04 20:56 . 2008-06-04 20:56      d--------   C:\Program Files\MSN Messenger
2008-06-04 19:57 . 2008-06-04 20:09      d--------   C:\WINDOWS\SxsCaPendDel
2008-06-04 19:56 . 2008-02-22 02:33   69,632   --a------   C:\WINDOWS\system32\javacpl.cpl
2008-06-01 13:51 . 2008-06-07 20:54      d--------   C:\Documents and Settings\All Users\Application Data\Google Updater
2008-05-29 23:22 . 2008-05-29 23:22   86,340   --a------   C:\profile.com
2008-05-22 16:43 . 2008-06-04 21:06      d--------   C:\Program Files\Zoom Player
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\RealMedia
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\OpenSource Flash Video Splitter
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\DScaler5
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\CD Audio Reader Filter
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\Haali
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\ffdshow
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\DSP-worx
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\DirectVobSub
2008-05-22 15:47 . 2007-11-29 12:52   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
2008-05-22 15:47 . 2007-12-03 16:34   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
2008-05-22 15:47 . 2007-11-29 12:52   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 16:07   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-08 10:50   ---------   d-----w   C:\Documents and Settings\Niblaa\Application Data\uTorrent
2008-06-04 18:58   ---------   d-----w   C:\Program Files\DC++
2008-06-04 16:56   ---------   d-----w   C:\Program Files\Java
2008-06-01 10:51   ---------   d-----w   C:\Program Files\Google
2008-05-16 15:26   ---------   d-----w   C:\Program Files\B2BPOKER
2008-05-11 14:54   ---------   d-----w   C:\Program Files\PAFPoker
2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
2008-03-18 09:22   98,304   ----a-w   C:\WINDOWS\DUMP6dfc.tmp
2005-03-31 19:17   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((( snapshot@2008-06-08_19.51.21.37 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-08 16:37:03   58,596   ----a-w   C:\WINDOWS\system32\perfc009.dat
+ 2008-06-08 16:51:54   58,596   ----a-w   C:\WINDOWS\system32\perfc009.dat
- 2008-06-08 16:37:03   70,990   ----a-w   C:\WINDOWS\system32\perfc00B.dat
+ 2008-06-08 16:51:55   70,990   ----a-w   C:\WINDOWS\system32\perfc00B.dat
- 2008-06-08 16:37:03   392,296   ----a-w   C:\WINDOWS\system32\perfh009.dat
+ 2008-06-08 16:51:55   392,296   ----a-w   C:\WINDOWS\system32\perfh009.dat
- 2008-06-08 16:37:03   366,492   ----a-w   C:\WINDOWS\system32\perfh00B.dat
+ 2008-06-08 16:51:55   366,492   ----a-w   C:\WINDOWS\system32\perfh00B.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\nbj.exe" [2005-05-19 20:38 1957888]
"FreeRAM XP"="C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-23 01:13 1591808]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-11-30 16:56 1306624]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PtiuPbmd"="ptipbm.dll" [2003-01-15 14:41 24576 C:\WINDOWS\system32\ptipbm.dll]
"Gainward"="C:\WINDOWS\TBPanel.exe" [2003-06-16 06:56 2031616]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-12-15 19:56 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 11:31 67584 C:\WINDOWS\soundman.exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 21:41 33792]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2005-12-13 08:49 217088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"psyspy-2.1.4 Client Server"="C:\WINDOWS\system32\telecms.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-14 16:12 15360]

C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
CoreCenter.lnk - C:\Program Files\MSI\Core Center\CoreCenter.exe [2005-11-04 20:38:42 826368]
SMC2802W 54Mbps WLAN Monitor.lnk - C:\Program Files\SMC\SMC2802W 2.4GHz 54 Mbps Wireless PCI Adapter\Installer\WINXP\SMC11GMonitor.exe [2003-11-28 17:38:18 860262]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.divf"= divx412.dll
"vidc.mjpg"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
"vidc.avrn"= C:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.advj"= C:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.mszh"= C:\PROGRA~1\ACEMEG~1\SystemS\avimszh.dll
"vidc.zlib"= C:\PROGRA~1\ACEMEG~1\SystemS\avizlib.dll
"msacm.sl_anet"= C:\PROGRA~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.wrpr"= C:\PROGRA~1\ACEMEG~1\SystemS\aviwrap.dll
"vidc.3ivx"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv0"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv1"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv2"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3ivd"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.yv12"= C:\PROGRA~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.divx"= C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivX511.dll
"vidc.iyuv"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.uyvy"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yuy2"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yvyu"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"msacm.msaudio1"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\javaw.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\javaw.exe"=
"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\javaw.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=

R0 d343bus;d343bus;C:\WINDOWS\system32\DRIVERS\d343bus.sys [2003-12-15 19:46]
R0 d343port;d343port;C:\WINDOWS\system32\DRIVERS\d343port.sys [2003-12-15 18:29]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
R3 2802W;SMC2802W 2.4GHz 54 Mbps Wireless PCI Driver;C:\WINDOWS\system32\DRIVERS\2802W.sys [2004-03-08 17:23]
R3 w3304an5;WN3X0X Wireless Adapter;C:\PROGRA~1\SMC\SMC280~1.4GH\INSTAL~1\WINXP\w3304an5.SYS [2002-10-07 05:14]

*Newly Created Service* - PCALERTDRIVER
*Newly Created Service* - RUSHTOPDEVICE
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-06-08 17:43:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 20:50:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-08 20:51:19
ComboFix-quarantined-files.txt 2008-06-08 17:51:03
ComboFix2.txt 2008-06-08 16:51:38

Pre-Run: 234,795,008 tavua vapaana
Post-Run: 218,341,376 tavua vapaana

209   --- E O F ---   2008-06-08 00:05:25

J.Doe kirjoitti:

ComboFix 08-06-07.3 - Niblaa 2008-06-08 20:49:26.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.618 [GMT 3:00]
Running from: C:\Documents and Settings\Niblaa\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Niblaa\Työpöytä\CFScript.txt
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

FILE ::
C:\bot1.exe
C:\daf.exe
C:\dci.exe
C:\dcsi.exe
C:\ddc.exe
C:\Documents and Settings\Niblaa\exy.exe
C:\Documents and Settings\Niblaa\setup.exe
C:\Documents and Settings\Niblaa\setupa.exe
C:\Documents and Settings\Niblaa\sexy.exe
C:\dsdc.exe
C:\f.bat
C:\img.com
C:\jester.exe
C:\roffl.exe
C:\rofl.exe
C:\setz.exe
C:\sexy.exe
C:\ssetup.exe
C:\stp.exe
C:\sxy.exe
C:\WINDOWS\mservice.exe
C:\WINDOWS\svchosl.exe
C:\WINDOWS\system32\telecms.exe
C:\WINDOWS\winudspm.exe
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\bot1.exe
C:\daf.exe
C:\dci.exe
C:\dcsi.exe
C:\ddc.exe
C:\Documents and Settings\Niblaa\exy.exe
C:\Documents and Settings\Niblaa\setup.exe
C:\Documents and Settings\Niblaa\setupa.exe
C:\Documents and Settings\Niblaa\sexy.exe
C:\dsdc.exe
C:\f.bat
C:\img.com
C:\jester.exe
C:\roffl.exe
C:\rofl.exe
C:\setz.exe
C:\sexy.exe
C:\ssetup.exe
C:\stp.exe
C:\sxy.exe
C:\WINDOWS\mservice.exe
C:\WINDOWS\svchosl.exe
C:\WINDOWS\system32\telecms.exe
C:\WINDOWS\winudspm.exe

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
.

2008-06-08 19:51 . 2008-06-08 19:51      d--------   C:\Documents and Settings\Jõrjestelmõnvalvoja
2008-06-08 16:32 . 2008-06-08 16:32      d--------   C:\Program Files\Trend Micro
2008-06-08 03:00 . 2008-06-08 03:05   1,355   --a------   C:\WINDOWS\imsins.BAK
2008-06-05 00:29 . 2008-06-05 00:29   290,110   --a------   C:\WINDOWS\ftp.exe
2008-06-04 22:14 . 2008-06-04 22:14   86,528   --a------   C:\Documents and Settings\Niblaa\stp.exe
2008-06-04 20:56 . 2008-06-04 20:56      d--------   C:\Program Files\MSN Messenger
2008-06-04 19:57 . 2008-06-04 20:09      d--------   C:\WINDOWS\SxsCaPendDel
2008-06-04 19:56 . 2008-02-22 02:33   69,632   --a------   C:\WINDOWS\system32\javacpl.cpl
2008-06-01 13:51 . 2008-06-07 20:54      d--------   C:\Documents and Settings\All Users\Application Data\Google Updater
2008-05-29 23:22 . 2008-05-29 23:22   86,340   --a------   C:\profile.com
2008-05-22 16:43 . 2008-06-04 21:06      d--------   C:\Program Files\Zoom Player
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\RealMedia
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\OpenSource Flash Video Splitter
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\DScaler5
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\CD Audio Reader Filter
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\Haali
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\ffdshow
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\DSP-worx
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\DirectVobSub
2008-05-22 15:47 . 2007-11-29 12:52   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
2008-05-22 15:47 . 2007-12-03 16:34   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
2008-05-22 15:47 . 2007-11-29 12:52   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 16:07   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-08 10:50   ---------   d-----w   C:\Documents and Settings\Niblaa\Application Data\uTorrent
2008-06-04 18:58   ---------   d-----w   C:\Program Files\DC++
2008-06-04 16:56   ---------   d-----w   C:\Program Files\Java
2008-06-01 10:51   ---------   d-----w   C:\Program Files\Google
2008-05-16 15:26   ---------   d-----w   C:\Program Files\B2BPOKER
2008-05-11 14:54   ---------   d-----w   C:\Program Files\PAFPoker
2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
2008-03-18 09:22   98,304   ----a-w   C:\WINDOWS\DUMP6dfc.tmp
2005-03-31 19:17   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((( snapshot@2008-06-08_19.51.21.37 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-08 16:37:03   58,596   ----a-w   C:\WINDOWS\system32\perfc009.dat
+ 2008-06-08 16:51:54   58,596   ----a-w   C:\WINDOWS\system32\perfc009.dat
- 2008-06-08 16:37:03   70,990   ----a-w   C:\WINDOWS\system32\perfc00B.dat
+ 2008-06-08 16:51:55   70,990   ----a-w   C:\WINDOWS\system32\perfc00B.dat
- 2008-06-08 16:37:03   392,296   ----a-w   C:\WINDOWS\system32\perfh009.dat
+ 2008-06-08 16:51:55   392,296   ----a-w   C:\WINDOWS\system32\perfh009.dat
- 2008-06-08 16:37:03   366,492   ----a-w   C:\WINDOWS\system32\perfh00B.dat
+ 2008-06-08 16:51:55   366,492   ----a-w   C:\WINDOWS\system32\perfh00B.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\nbj.exe" [2005-05-19 20:38 1957888]
"FreeRAM XP"="C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-23 01:13 1591808]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-11-30 16:56 1306624]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PtiuPbmd"="ptipbm.dll" [2003-01-15 14:41 24576 C:\WINDOWS\system32\ptipbm.dll]
"Gainward"="C:\WINDOWS\TBPanel.exe" [2003-06-16 06:56 2031616]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-12-15 19:56 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 11:31 67584 C:\WINDOWS\soundman.exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 21:41 33792]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2005-12-13 08:49 217088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"psyspy-2.1.4 Client Server"="C:\WINDOWS\system32\telecms.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-14 16:12 15360]

C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
CoreCenter.lnk - C:\Program Files\MSI\Core Center\CoreCenter.exe [2005-11-04 20:38:42 826368]
SMC2802W 54Mbps WLAN Monitor.lnk - C:\Program Files\SMC\SMC2802W 2.4GHz 54 Mbps Wireless PCI Adapter\Installer\WINXP\SMC11GMonitor.exe [2003-11-28 17:38:18 860262]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.divf"= divx412.dll
"vidc.mjpg"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
"vidc.avrn"= C:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.advj"= C:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.mszh"= C:\PROGRA~1\ACEMEG~1\SystemS\avimszh.dll
"vidc.zlib"= C:\PROGRA~1\ACEMEG~1\SystemS\avizlib.dll
"msacm.sl_anet"= C:\PROGRA~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.wrpr"= C:\PROGRA~1\ACEMEG~1\SystemS\aviwrap.dll
"vidc.3ivx"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv0"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv1"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv2"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3ivd"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.yv12"= C:\PROGRA~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.divx"= C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivX511.dll
"vidc.iyuv"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.uyvy"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yuy2"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yvyu"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"msacm.msaudio1"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\javaw.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\javaw.exe"=
"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\javaw.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=

R0 d343bus;d343bus;C:\WINDOWS\system32\DRIVERS\d343bus.sys [2003-12-15 19:46]
R0 d343port;d343port;C:\WINDOWS\system32\DRIVERS\d343port.sys [2003-12-15 18:29]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
R3 2802W;SMC2802W 2.4GHz 54 Mbps Wireless PCI Driver;C:\WINDOWS\system32\DRIVERS\2802W.sys [2004-03-08 17:23]
R3 w3304an5;WN3X0X Wireless Adapter;C:\PROGRA~1\SMC\SMC280~1.4GH\INSTAL~1\WINXP\w3304an5.SYS [2002-10-07 05:14]

*Newly Created Service* - PCALERTDRIVER
*Newly Created Service* - RUSHTOPDEVICE
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-06-08 17:43:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 20:50:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-08 20:51:19
ComboFix-quarantined-files.txt 2008-06-08 17:51:03
ComboFix2.txt 2008-06-08 16:51:38

Pre-Run: 234,795,008 tavua vapaana
Post-Run: 218,341,376 tavua vapaana

209   --- E O F ---   2008-06-08 00:05:25

taas vähän

Lataa Malwarebytes' Anti-Malware työpöydällesi.
http://www.besttechie.net/tools/mbam-setup.exe
•   Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
•   Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes' Anti-Malware ja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Finish.
•   Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
•   Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
•   Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
•   Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
•   Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
•   Lähetä lokin sisältö seuraavassa viestissäsi.

FixFix kirjoitti:

taas vähän

Lataa Malwarebytes' Anti-Malware työpöydällesi.
http://www.besttechie.net/tools/mbam-setup.exe
•   Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
•   Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes' Anti-Malware ja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Finish.
•   Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
•   Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
•   Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
•   Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
•   Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
•   Lähetä lokin sisältö seuraavassa viestissäsi.

Malwarebytes' Anti-Malware 1.15
Tietokantaversio: 841

23:35:52 8.6.2008
mbam-log-6-8-2008 (23-35-52).txt

Tarkistustyyppi: Täysi tarkistus (C:\|E:\|)
Tarkistetut kohteet: 109097
Kulunut aika: 1 hour(s), 26 minute(s), 0 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 4
Saastuneita rekisteriarvoja: 2
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 43

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
HKEY_CLASSES_ROOT\Typelib\{f9fa603d-697c-4900-a950-e54f08324a24} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\nmwegbsf.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{81ea3f36-357a-435a-8741-52c27ccc9f21} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\psyspy-2.1.4 Client Server (Worm.IRCBot) -> Quarantined and deleted successfully.

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
C:\profile.com (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\bot1.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\daf.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\dci.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\dcsi.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\ddc.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\dsdc.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\img.com.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\jester.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\setz.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\sexy.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\ssetup.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\Niblaa\exy.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\Niblaa\setupa.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\Niblaa\sexy.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\mservice.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\winudspm.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\wkssvr.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\telecms.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP939\A0172224.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP939\A0172225.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP939\A0172228.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP939\A0172234.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP950\A0173993.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP950\A0174021.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174059.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174060.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174061.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174062.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174063.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174064.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174066.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174067.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174068.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174070.com (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174071.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174074.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174075.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174076.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174079.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174081.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174082.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

J.Doe kirjoitti:

Malwarebytes' Anti-Malware 1.15
Tietokantaversio: 841

23:35:52 8.6.2008
mbam-log-6-8-2008 (23-35-52).txt

Tarkistustyyppi: Täysi tarkistus (C:\|E:\|)
Tarkistetut kohteet: 109097
Kulunut aika: 1 hour(s), 26 minute(s), 0 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 4
Saastuneita rekisteriarvoja: 2
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 43

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
HKEY_CLASSES_ROOT\Typelib\{f9fa603d-697c-4900-a950-e54f08324a24} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\nmwegbsf.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{81ea3f36-357a-435a-8741-52c27ccc9f21} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\psyspy-2.1.4 Client Server (Worm.IRCBot) -> Quarantined and deleted successfully.

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
C:\profile.com (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\bot1.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\daf.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\dci.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\dcsi.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\ddc.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\dsdc.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\img.com.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\jester.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\setz.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\sexy.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\ssetup.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\Niblaa\exy.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\Niblaa\setupa.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\Niblaa\sexy.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\mservice.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\winudspm.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\wkssvr.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\telecms.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP939\A0172224.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP939\A0172225.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP939\A0172228.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP939\A0172234.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP950\A0173993.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP950\A0174021.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174059.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174060.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174061.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174062.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174063.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174064.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174066.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174067.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174068.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174070.com (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174071.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174074.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174075.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174076.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174079.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174081.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3CE52505-D42F-4594-B9C5-8F5E706BAA56}\RP951\A0174082.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

hyviä nää työkalut :D

1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK

*********

scannaa uusi combofix
scannaa uusi hjt:n loki

FixFix kirjoitti:

hyviä nää työkalut :D

1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK

*********

scannaa uusi combofix
scannaa uusi hjt:n loki

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:01:19, on 9.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\TBPanel.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SMC\SMC2802W 2.4GHz 54 Mbps Wireless PCI Adapter\Installer\WINXP\SMC11GMonitor.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.soneraplaza.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;localhost;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: CoreCenter.lnk = C:\Program Files\MSI\Core Center\CoreCenter.exe
O4 - Global Startup: SMC2802W 54Mbps WLAN Monitor.lnk = C:\Program Files\SMC\SMC2802W 2.4GHz 54 Mbps Wireless PCI Adapter\Installer\WINXP\SMC11GMonitor.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/229?67068f8e6125402789e7f6dabed0c01c
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/230?67068f8e6125402789e7f6dabed0c01c
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 7449 bytes

FixFix kirjoitti:

hyviä nää työkalut :D

1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK

*********

scannaa uusi combofix
scannaa uusi hjt:n loki

ComboFix 08-06-07.3 - Niblaa 2008-06-08 23:56:24.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.358.1035.18.627 [GMT 3:00]
Running from: C:\Documents and Settings\Niblaa\Työpöytä\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
.

2008-06-08 21:34 . 2008-06-08 21:34      d--------   C:\Program Files\Malwarebytes' Anti-Malware
2008-06-08 21:34 . 2008-06-08 21:34      d--------   C:\Documents and Settings\Niblaa\Application Data\Malwarebytes
2008-06-08 21:34 . 2008-06-08 21:34      d--------   C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-08 21:34 . 2008-06-05 16:04   34,296   --a------   C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-08 21:34 . 2008-06-05 16:04   15,864   --a------   C:\WINDOWS\system32\drivers\mbam.sys
2008-06-08 19:51 . 2008-06-08 19:51      d--------   C:\Documents and Settings\Jõrjestelmõnvalvoja
2008-06-08 16:32 . 2008-06-08 16:32      d--------   C:\Program Files\Trend Micro
2008-06-08 03:00 . 2008-06-08 03:05   1,355   --a------   C:\WINDOWS\imsins.BAK
2008-06-05 00:29 . 2008-06-05 00:29   290,110   --a------   C:\WINDOWS\ftp.exe
2008-06-04 22:14 . 2008-06-04 22:14   86,528   --a------   C:\Documents and Settings\Niblaa\stp.exe
2008-06-04 20:56 . 2008-06-04 20:56      d--------   C:\Program Files\MSN Messenger
2008-06-04 19:57 . 2008-06-04 20:09      d--------   C:\WINDOWS\SxsCaPendDel
2008-06-04 19:56 . 2008-02-22 02:33   69,632   --a------   C:\WINDOWS\system32\javacpl.cpl
2008-06-01 13:51 . 2008-06-08 21:55      d--------   C:\Documents and Settings\All Users\Application Data\Google Updater
2008-05-22 16:43 . 2008-06-04 21:06      d--------   C:\Program Files\Zoom Player
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\RealMedia
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\OpenSource Flash Video Splitter
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\DScaler5
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\CD Audio Reader Filter
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\Haali
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\ffdshow
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\DSP-worx
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\DirectVobSub
2008-05-22 15:47 . 2007-11-29 12:52   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
2008-05-22 15:47 . 2007-12-03 16:34   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
2008-05-22 15:47 . 2007-11-29 12:52   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 20:51   ---------   d-----w   C:\Documents and Settings\Niblaa\Application Data\uTorrent
2008-06-08 16:07   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-04 18:58   ---------   d-----w   C:\Program Files\DC++
2008-06-04 16:56   ---------   d-----w   C:\Program Files\Java
2008-06-01 10:51   ---------   d-----w   C:\Program Files\Google
2008-05-16 15:26   ---------   d-----w   C:\Program Files\B2BPOKER
2008-05-11 14:54   ---------   d-----w   C:\Program Files\PAFPoker
2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
2008-03-18 09:22   98,304   ----a-w   C:\WINDOWS\DUMP6dfc.tmp
2005-03-31 19:17   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((( snapshot@2008-06-08_19.51.21.37 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-08 16:47:26   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
+ 2008-06-08 20:52:44   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
- 2008-06-08 16:37:03   58,596   ----a-w   C:\WINDOWS\system32\perfc009.dat
+ 2008-06-08 20:57:07   58,596   ----a-w   C:\WINDOWS\system32\perfc009.dat
- 2008-06-08 16:37:03   70,990   ----a-w   C:\WINDOWS\system32\perfc00B.dat
+ 2008-06-08 20:57:07   70,990   ----a-w   C:\WINDOWS\system32\perfc00B.dat
- 2008-06-08 16:37:03   392,296   ----a-w   C:\WINDOWS\system32\perfh009.dat
+ 2008-06-08 20:57:07   392,296   ----a-w   C:\WINDOWS\system32\perfh009.dat
- 2008-06-08 16:37:03   366,492   ----a-w   C:\WINDOWS\system32\perfh00B.dat
+ 2008-06-08 20:57:07   366,492   ----a-w   C:\WINDOWS\system32\perfh00B.dat
+ 2008-06-08 20:52:51   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_110.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\nbj.exe" [2005-05-19 20:38 1957888]
"FreeRAM XP"="C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-23 01:13 1591808]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-11-30 16:56 1306624]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PtiuPbmd"="ptipbm.dll" [2003-01-15 14:41 24576 C:\WINDOWS\system32\ptipbm.dll]
"Gainward"="C:\WINDOWS\TBPanel.exe" [2003-06-16 06:56 2031616]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-12-15 19:56 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 11:31 67584 C:\WINDOWS\soundman.exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 21:41 33792]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2005-12-13 08:49 217088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-14 16:12 15360]

C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
CoreCenter.lnk - C:\Program Files\MSI\Core Center\CoreCenter.exe [2005-11-04 20:38:42 826368]
SMC2802W 54Mbps WLAN Monitor.lnk - C:\Program Files\SMC\SMC2802W 2.4GHz 54 Mbps Wireless PCI Adapter\Installer\WINXP\SMC11GMonitor.exe [2003-11-28 17:38:18 860262]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.divf"= divx412.dll
"vidc.mjpg"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
"vidc.avrn"= C:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.advj"= C:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.mszh"= C:\PROGRA~1\ACEMEG~1\SystemS\avimszh.dll
"vidc.zlib"= C:\PROGRA~1\ACEMEG~1\SystemS\avizlib.dll
"msacm.sl_anet"= C:\PROGRA~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.wrpr"= C:\PROGRA~1\ACEMEG~1\SystemS\aviwrap.dll
"vidc.3ivx"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv0"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv1"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv2"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3ivd"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.yv12"= C:\PROGRA~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.divx"= C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivX511.dll
"vidc.iyuv"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.uyvy"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yuy2"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yvyu"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"msacm.msaudio1"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\javaw.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\javaw.exe"=
"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\javaw.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=

R0 d343bus;d343bus;C:\WINDOWS\system32\DRIVERS\d343bus.sys [2003-12-15 19:46]
R0 d343port;d343port;C:\WINDOWS\system32\DRIVERS\d343port.sys [2003-12-15 18:29]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
R3 2802W;SMC2802W 2.4GHz 54 Mbps Wireless PCI Driver;C:\WINDOWS\system32\DRIVERS\2802W.sys [2004-03-08 17:23]
R3 w3304an5;WN3X0X Wireless Adapter;C:\PROGRA~1\SMC\SMC280~1.4GH\INSTAL~1\WINXP\w3304an5.SYS [2002-10-07 05:14]

*Newly Created Service* - CATCHME
*Newly Created Service* - RUSHTOPDEVICE
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-06-08 20:43:01 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 23:58:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-08 23:59:19
ComboFix-quarantined-files.txt 2008-06-08 20:59:01
ComboFix2.txt 2008-06-08 17:51:20
ComboFix3.txt 2008-06-08 16:51:38

Pre-Run: 714,833,920 tavua vapaana
Post-Run: 701,677,568 tavua vapaana

161   --- E O F ---   2008-06-08 00:05:25

J.Doe kirjoitti:

ComboFix 08-06-07.3 - Niblaa 2008-06-08 23:56:24.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.358.1035.18.627 [GMT 3:00]
Running from: C:\Documents and Settings\Niblaa\Työpöytä\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
.

2008-06-08 21:34 . 2008-06-08 21:34      d--------   C:\Program Files\Malwarebytes' Anti-Malware
2008-06-08 21:34 . 2008-06-08 21:34      d--------   C:\Documents and Settings\Niblaa\Application Data\Malwarebytes
2008-06-08 21:34 . 2008-06-08 21:34      d--------   C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-08 21:34 . 2008-06-05 16:04   34,296   --a------   C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-08 21:34 . 2008-06-05 16:04   15,864   --a------   C:\WINDOWS\system32\drivers\mbam.sys
2008-06-08 19:51 . 2008-06-08 19:51      d--------   C:\Documents and Settings\Jõrjestelmõnvalvoja
2008-06-08 16:32 . 2008-06-08 16:32      d--------   C:\Program Files\Trend Micro
2008-06-08 03:00 . 2008-06-08 03:05   1,355   --a------   C:\WINDOWS\imsins.BAK
2008-06-05 00:29 . 2008-06-05 00:29   290,110   --a------   C:\WINDOWS\ftp.exe
2008-06-04 22:14 . 2008-06-04 22:14   86,528   --a------   C:\Documents and Settings\Niblaa\stp.exe
2008-06-04 20:56 . 2008-06-04 20:56      d--------   C:\Program Files\MSN Messenger
2008-06-04 19:57 . 2008-06-04 20:09      d--------   C:\WINDOWS\SxsCaPendDel
2008-06-04 19:56 . 2008-02-22 02:33   69,632   --a------   C:\WINDOWS\system32\javacpl.cpl
2008-06-01 13:51 . 2008-06-08 21:55      d--------   C:\Documents and Settings\All Users\Application Data\Google Updater
2008-05-22 16:43 . 2008-06-04 21:06      d--------   C:\Program Files\Zoom Player
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\RealMedia
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\OpenSource Flash Video Splitter
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\DScaler5
2008-05-22 15:48 . 2008-05-22 15:48      d--------   C:\Program Files\CD Audio Reader Filter
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\Haali
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\ffdshow
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\DSP-worx
2008-05-22 15:47 . 2008-05-22 15:47      d--------   C:\Program Files\DirectVobSub
2008-05-22 15:47 . 2007-11-29 12:52   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
2008-05-22 15:47 . 2007-12-03 16:34   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
2008-05-22 15:47 . 2007-11-29 12:52   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 20:51   ---------   d-----w   C:\Documents and Settings\Niblaa\Application Data\uTorrent
2008-06-08 16:07   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-04 18:58   ---------   d-----w   C:\Program Files\DC++
2008-06-04 16:56   ---------   d-----w   C:\Program Files\Java
2008-06-01 10:51   ---------   d-----w   C:\Program Files\Google
2008-05-16 15:26   ---------   d-----w   C:\Program Files\B2BPOKER
2008-05-11 14:54   ---------   d-----w   C:\Program Files\PAFPoker
2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
2008-03-18 09:22   98,304   ----a-w   C:\WINDOWS\DUMP6dfc.tmp
2005-03-31 19:17   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((( snapshot@2008-06-08_19.51.21.37 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-08 16:47:26   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
+ 2008-06-08 20:52:44   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
- 2008-06-08 16:37:03   58,596   ----a-w   C:\WINDOWS\system32\perfc009.dat
+ 2008-06-08 20:57:07   58,596   ----a-w   C:\WINDOWS\system32\perfc009.dat
- 2008-06-08 16:37:03   70,990   ----a-w   C:\WINDOWS\system32\perfc00B.dat
+ 2008-06-08 20:57:07   70,990   ----a-w   C:\WINDOWS\system32\perfc00B.dat
- 2008-06-08 16:37:03   392,296   ----a-w   C:\WINDOWS\system32\perfh009.dat
+ 2008-06-08 20:57:07   392,296   ----a-w   C:\WINDOWS\system32\perfh009.dat
- 2008-06-08 16:37:03   366,492   ----a-w   C:\WINDOWS\system32\perfh00B.dat
+ 2008-06-08 20:57:07   366,492   ----a-w   C:\WINDOWS\system32\perfh00B.dat
+ 2008-06-08 20:52:51   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_110.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\nbj.exe" [2005-05-19 20:38 1957888]
"FreeRAM XP"="C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-23 01:13 1591808]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-11-30 16:56 1306624]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PtiuPbmd"="ptipbm.dll" [2003-01-15 14:41 24576 C:\WINDOWS\system32\ptipbm.dll]
"Gainward"="C:\WINDOWS\TBPanel.exe" [2003-06-16 06:56 2031616]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-12-15 19:56 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 11:31 67584 C:\WINDOWS\soundman.exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 21:41 33792]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2005-12-13 08:49 217088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-14 16:12 15360]

C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
CoreCenter.lnk - C:\Program Files\MSI\Core Center\CoreCenter.exe [2005-11-04 20:38:42 826368]
SMC2802W 54Mbps WLAN Monitor.lnk - C:\Program Files\SMC\SMC2802W 2.4GHz 54 Mbps Wireless PCI Adapter\Installer\WINXP\SMC11GMonitor.exe [2003-11-28 17:38:18 860262]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.divf"= divx412.dll
"vidc.mjpg"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
"vidc.avrn"= C:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.advj"= C:\PROGRA~1\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.mszh"= C:\PROGRA~1\ACEMEG~1\SystemS\avimszh.dll
"vidc.zlib"= C:\PROGRA~1\ACEMEG~1\SystemS\avizlib.dll
"msacm.sl_anet"= C:\PROGRA~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.wrpr"= C:\PROGRA~1\ACEMEG~1\SystemS\aviwrap.dll
"vidc.3ivx"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv0"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv1"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3iv2"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.3ivd"= C:\PROGRA~1\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL
"vidc.yv12"= C:\PROGRA~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.divx"= C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivX511.dll
"vidc.iyuv"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.uyvy"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yuy2"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yvyu"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"msacm.msaudio1"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\javaw.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\javaw.exe"=
"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\javaw.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=

R0 d343bus;d343bus;C:\WINDOWS\system32\DRIVERS\d343bus.sys [2003-12-15 19:46]
R0 d343port;d343port;C:\WINDOWS\system32\DRIVERS\d343port.sys [2003-12-15 18:29]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
R3 2802W;SMC2802W 2.4GHz 54 Mbps Wireless PCI Driver;C:\WINDOWS\system32\DRIVERS\2802W.sys [2004-03-08 17:23]
R3 w3304an5;WN3X0X Wireless Adapter;C:\PROGRA~1\SMC\SMC280~1.4GH\INSTAL~1\WINXP\w3304an5.SYS [2002-10-07 05:14]

*Newly Created Service* - CATCHME
*Newly Created Service* - RUSHTOPDEVICE
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-06-08 20:43:01 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 23:58:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-08 23:59:19
ComboFix-quarantined-files.txt 2008-06-08 20:59:01
ComboFix2.txt 2008-06-08 17:51:20
ComboFix3.txt 2008-06-08 16:51:38

Pre-Run: 714,833,920 tavua vapaana
Post-Run: 701,677,568 tavua vapaana

161   --- E O F ---   2008-06-08 00:05:25

mites kone nyt toimii

FixFix kirjoitti:

mites kone nyt toimii

Eroa aiempaan tilanteeseen on kun yöllä ja päivällä! Joten kiitoksia paljon! tästä eteenpäin pitää olla hieman tarkempi mitä sitä availee ja mitä ei! :P