tällane loki mulla???

tessa...

2008-06-09 10:43:32

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40:32, on 9.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\keyhook.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\winudmr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\winudspm.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {97100B87-8C67-7ACD-73A0-9448EC2263FC} - C:\DOCUME~1\Marika\APPLIC~1\OOZEID~1\Ref base.exe (file missing)
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [dxvid] c:\windows\system32\dxvid.exe /nocomm
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [barb bits pile drv] C:\Documents and Settings\All Users\Application Data\Mapi View Barb Bits\name dvd.exe
O4 - HKLM\..\Run: [gdimx] c:\windows\system32\gdimx.exe /nocomm
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Windows svchost] ups.exe
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Drive Amen] C:\DOCUME~1\LOCALS~1\APPLIC~1\Update\Bits idol.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Felix II] C:\Program Files\ScreenMates\Felix II\Felix2.exe
O4 - HKCU\..\Run: [msnmsgr] ~"C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Office\Office10\OSA.EXE
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 9492 bytes

818

Äänestä

Vastaukset

FixFix
2008-06-09 11:01:27
poistoilla ekaksi

poista lisää poista sovelutuksesta

SweetIM For Internet Explorer
SweetIM Macrogaming Viewpoint
- tessa...
  2008-06-09 11:43:22
  miks kaikki kirjottaa nii kummallisesti. mikä ihme se vikasieto juttu on ja misä se on`? Ku ei mä saa niitä poistettua. ei ne lähe
- FixFix
  2008-06-09 11:50:43
  tessa... kirjoitti:
  miks kaikki kirjottaa nii kummallisesti. mikä ihme se vikasieto juttu on ja misä se on`? Ku ei mä saa niitä poistettua. ei ne lähe
  näin
  
  sammuta ja käynnistä
  käynnistyksen yhteydessä hakkaa F8 nappia
  valitse nuolinäppäimellä vikasietotila
  paina enter ja enter
  valitse käyttäjätilisi
  paina kyllä
  
  Jossakin koneissa hakataan F8:sin sijasta F5:tä
- tessa...
  2008-06-09 12:46:49
  FixFix kirjoitti:
  näin
  
  sammuta ja käynnistä
  käynnistyksen yhteydessä hakkaa F8 nappia
  valitse nuolinäppäimellä vikasietotila
  paina enter ja enter
  valitse käyttäjätilisi
  paina kyllä
  
  Jossakin koneissa hakataan F8:sin sijasta F5:tä
  mut ei sielä ollu mitää all files tyyppiä...eli mitähä sitte
- FixFix
  2008-06-09 12:51:09
  tessa... kirjoitti:
  mut ei sielä ollu mitää all files tyyppiä...eli mitähä sitte
  tallennus muoto: Kaikki tiedostot
- tessa...
  2008-06-09 13:01:40
  FixFix kirjoitti:
  tallennus muoto: Kaikki tiedostot
  hittolaine en mä löyä sellasta mistää.. mistä valikosta mun pitäs se löytää? mihi mun pitää mennä?
- FixFix
  2008-06-09 13:14:57
  tessa... kirjoitti:
  hittolaine en mä löyä sellasta mistää.. mistä valikosta mun pitäs se löytää? mihi mun pitää mennä?
  niin päästään eteen päin
- tessa...
  2008-06-09 13:34:53
  FixFix kirjoitti:
  niin päästään eteen päin
  ComboFix 08-06-07.1 - Marika 2008-06-09 13:25:32.3 - NTFSx86
  Running from: C:\Documents and Settings\Marika\Työpöytä\ComboFix.exe
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  .
  
  ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-09 to 2008-06-09 )))))))))))))))))
  .
  
  2008-06-09 10:39 . 2008-06-09 10:39      d--------   C:\Program Files\Trend Micro
  2008-06-09 09:03 . 2008-06-09 09:03   29,342   -r-hs----   C:\WINDOWS\winudmr.exe
  2008-06-09 09:03 . 2008-06-09 09:26   29,342   --a--c---   C:\ps.exe
  2008-06-09 09:03 . 2008-06-09 13:29   29,342   --a--c---   C:\pf.exe
  2008-06-09 09:03 . 2008-06-09 09:28   29,342   --a--c---   C:\fp.exe
  2008-06-08 22:20 . 2008-06-08 22:20   18,587   --a--c---   C:\Documents and Settings\Marika\packed.exe
  2008-06-08 22:17 . 2008-06-08 22:18   18,587   --a--c---   C:\packed.exe
  2008-06-06 22:06 . 2008-06-06 22:06   49,156   --a--c---   C:\sjgz.exe
  2008-06-06 17:52 . 2008-06-06 19:20   49,156   --a--c---   C:\sjz.exe
  2008-06-06 17:23 . 2008-06-08 20:15   2,231   --a--c---   C:\hszs.exe
  2008-06-06 17:22 . 2008-06-08 20:18   2,229   --a--c---   C:\shz.exe
  2008-06-06 15:32 . 2008-06-06 15:32   49,156   --a--c---   C:\szs.exe
  2008-06-06 15:30 . 2008-06-06 17:22   49,156   --a--c---   C:\sz.exe
  2008-06-06 15:30 . 2008-06-06 15:30   2,232   --a--c---   C:\sexx2.exe
  2008-06-06 13:47 . 2008-06-06 13:51   49,156   --a--c---   C:\sex22.exe
  2008-06-06 13:47 . 2008-06-06 13:55   49,156   --a--c---   C:\sex2.exe
  2008-06-06 08:00 . 2008-06-06 10:01   2,232   --a--c---   C:\sf.exe
  2008-06-06 08:00 . 2008-06-06 10:01   2,232   --a--c---   C:\fa.exe
  2008-06-04 16:53 . 2008-06-04 16:53   3,424   --a--c---   C:\is155400.exe
  2008-06-04 07:35 . 2008-06-04 09:31   3,423   --a------   C:\WINDOWS\is154890.exe
  2008-06-02 22:29 . 2008-06-02 22:29   97,116   --a------   C:\WINDOWS\DC5177176.zip
  2008-06-02 21:35 . 2008-06-02 22:33   96,950   --a--c---   C:\Documents and Settings\Marika\setup.exe
  2008-06-02 21:27 . 2008-06-02 21:27   96,950   --a--c---   C:\stupx.exe
  2008-06-02 21:23 . 2008-06-02 21:23   96,950   -r-hs----   C:\WINDOWS\mservice.exe
  2008-06-02 21:22 . 2008-06-02 21:23   96,950   --a--c---   C:\stup.exe
  2008-06-02 17:54 . 2008-06-03 17:50   60,114   --a--c---   C:\bot1.exe
  2008-05-30 19:23 . 2008-05-30 22:11   60,132   --a--c---   C:\dcsi.exe
  2008-05-30 09:26 . 2008-05-30 22:47   60,132   --a--c---   C:\dci.exe
  2008-05-29 21:45 . 2008-05-29 21:45   60,132   --a--c---   C:\ddc.exe
  2008-05-29 21:45 . 2008-06-08 20:19   2,231   --a--c---   C:\is154890.exe
  2008-05-29 21:42 . 2008-05-29 21:44   86,340   -r-hs----   C:\WINDOWS\winudspm.exe
  2008-05-20 17:07 . 2008-05-20 17:07   118   --a------   C:\WINDOWS\system32\MRT.INI
  
  .
  (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-06-09 09:47   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\Skype
  2008-06-09 09:32   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\skypePM
  2008-06-06 07:50   ---------   d-----w   C:\Program Files\DCPlusPlus
  2008-04-28 10:53   ---------   d-----w   C:\Program Files\Samurize
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Nokia
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\PCSuite
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\Nokia
  2008-04-21 17:05   ---------   d-----w   C:\Program Files\PC Connectivity Solution
  2008-04-21 15:53   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Installations
  2008-04-12 17:14   32   -c--a-w   C:\Documents and Settings\All Users\Application Data\ezsid.dat
  2008-04-12 17:00   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Common Files\Skype
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\dllcache\mswstr10.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\dllcache\msjint40.dll
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\dllcache\win32k.sys
  2007-03-06 13:18   12,628   -c--a-w   C:\Documents and Settings\Marika\Application Data\wklnhst.dat
  2006-01-10 14:53   60,960   -c--a-w   C:\Documents and Settings\Marika\Application Data\GDIPFONTCACHEV1.DAT
  2005-09-29 15:04   774,144   -c--a-w   C:\Program Files\RngInterstitial.dll
  .
  
  ((((((((((((((((((((((((((((( snapshot@2008-06-09_10.06.00.92 )))))))))))))))))))))))))))))))))))))))))
  .
  - 2008-06-09 06:47:50   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 09:29:52   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 09:30:40   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_4f0.dat
  .
  (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  REGEDIT4
  *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
  "Drive Amen"="C:\DOCUME~1\LOCALS~1\APPLIC~1\Update\Bits idol.exe" [ ]
  "MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2006-08-11 16:05 190024]
  "Felix II"="C:\Program Files\ScreenMates\Felix II\Felix2.exe" [ ]
  "msnmsgr"="~C:\Program Files\MSN Messenger\msnmsgr.exe" [ ]
  "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-25 22:30 68856]
  "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
  "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
  "SiSPower"="SiSPower.dll" [2004-09-02 14:47 49152 C:\WINDOWS\system32\SiSPower.dll]
  "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-09-02 14:44 249856]
  "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 19:15 106496]
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
  "dxvid"="c:\windows\system32\dxvid.exe" [ ]
  "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-27 02:01 33792]
  "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-02-08 16:28 155648]
  "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 03:11 50688]
  "barb bits pile drv"="C:\Documents and Settings\All Users\Application Data\Mapi View Barb Bits\name dvd.exe" [ ]
  "gdimx"="c:\windows\system32\gdimx.exe" [ ]
  "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
  "Windows UDP Control"="winudspm.exe" [2008-05-29 21:44 86340 C:\WINDOWS\winudspm.exe]
  "Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
  "Windows Controls Center"="winudmr.exe" [2008-06-09 09:03 29342 C:\WINDOWS\winudmr.exe]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]
  
  C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
  Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-01-10 14:16:47 113664]
  HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24 258048]
  HP Image Zone -pikak„ynnistys.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52 53248]
  Microsoft Office.lnk - C:\Program Files\Office\Office10\OSA.EXE [2004-10-01 02:23:17 83360]
  Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2004-11-24 12:22:22 331776]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "FirewallOverride"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "C:\\Program Files\\DCPlusPlus\\DCPlusPlus.exe"=
  "C:\\Program Files\\Azureus\\Azureus.exe"=
  "C:\\WINDOWS\\system32\\sessmgr.exe"=
  "C:\\Program Files\\mIRC\\mirc.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "C:\\Program Files\\Sony Ericsson\\Update Service\\ma3platform.exe"=
  "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
  "C:\\Program Files\\SopCast\\SopCast.exe"=
  "C:\\Documents and Settings\\Marika\\Application Data\\SopCast\\adv\\SopAdver.exe"=
  "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
  "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
  "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
  
  R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
  R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
  R3 CONAN;CONAN;C:\WINDOWS\system32\drivers\o2mmb.sys [2004-02-12 02:18]
  R3 MbxStby;MbxStby;C:\WINDOWS\system32\drivers\MbxStby.sys [2004-01-28 00:00]
  S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
  S3 PRISM_A00;PRISM 802.11 Driver;C:\WINDOWS\system32\DRIVERS\PRISMA00.sys [2004-07-20 21:16]
  S4 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" []
  
  *Newly Created Service* - CATCHME
  .
  'Ajoitetut tehtävät'-kansion sisältö
  "2008-06-09 10:00:00 C:\WINDOWS\Tasks\AB1BFCF090B473F8.job"
  - c:\docume~1\marika\applic~1\update\Move Four Dog.exe
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-06-09 13:29:16
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  .
  Completion time: 2008-06-09 13:32:27
  ComboFix-quarantined-files.txt 2008-06-09 10:32:12
  ComboFix2.txt 2008-06-09 07:52:44
  ComboFix3.txt 2008-06-09 07:07:31
  
  Pre-Run: 19,495,796,736 tavua vapaana
  Post-Run: 19,482,202,112 tavua vapaana
  
  157   --- E O F ---   2008-05-28 17:02:23
- FixFix
  2008-06-09 13:55:11
  tessa... kirjoitti:
  ComboFix 08-06-07.1 - Marika 2008-06-09 13:25:32.3 - NTFSx86
  Running from: C:\Documents and Settings\Marika\Työpöytä\ComboFix.exe
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  .
  
  ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-09 to 2008-06-09 )))))))))))))))))
  .
  
  2008-06-09 10:39 . 2008-06-09 10:39      d--------   C:\Program Files\Trend Micro
  2008-06-09 09:03 . 2008-06-09 09:03   29,342   -r-hs----   C:\WINDOWS\winudmr.exe
  2008-06-09 09:03 . 2008-06-09 09:26   29,342   --a--c---   C:\ps.exe
  2008-06-09 09:03 . 2008-06-09 13:29   29,342   --a--c---   C:\pf.exe
  2008-06-09 09:03 . 2008-06-09 09:28   29,342   --a--c---   C:\fp.exe
  2008-06-08 22:20 . 2008-06-08 22:20   18,587   --a--c---   C:\Documents and Settings\Marika\packed.exe
  2008-06-08 22:17 . 2008-06-08 22:18   18,587   --a--c---   C:\packed.exe
  2008-06-06 22:06 . 2008-06-06 22:06   49,156   --a--c---   C:\sjgz.exe
  2008-06-06 17:52 . 2008-06-06 19:20   49,156   --a--c---   C:\sjz.exe
  2008-06-06 17:23 . 2008-06-08 20:15   2,231   --a--c---   C:\hszs.exe
  2008-06-06 17:22 . 2008-06-08 20:18   2,229   --a--c---   C:\shz.exe
  2008-06-06 15:32 . 2008-06-06 15:32   49,156   --a--c---   C:\szs.exe
  2008-06-06 15:30 . 2008-06-06 17:22   49,156   --a--c---   C:\sz.exe
  2008-06-06 15:30 . 2008-06-06 15:30   2,232   --a--c---   C:\sexx2.exe
  2008-06-06 13:47 . 2008-06-06 13:51   49,156   --a--c---   C:\sex22.exe
  2008-06-06 13:47 . 2008-06-06 13:55   49,156   --a--c---   C:\sex2.exe
  2008-06-06 08:00 . 2008-06-06 10:01   2,232   --a--c---   C:\sf.exe
  2008-06-06 08:00 . 2008-06-06 10:01   2,232   --a--c---   C:\fa.exe
  2008-06-04 16:53 . 2008-06-04 16:53   3,424   --a--c---   C:\is155400.exe
  2008-06-04 07:35 . 2008-06-04 09:31   3,423   --a------   C:\WINDOWS\is154890.exe
  2008-06-02 22:29 . 2008-06-02 22:29   97,116   --a------   C:\WINDOWS\DC5177176.zip
  2008-06-02 21:35 . 2008-06-02 22:33   96,950   --a--c---   C:\Documents and Settings\Marika\setup.exe
  2008-06-02 21:27 . 2008-06-02 21:27   96,950   --a--c---   C:\stupx.exe
  2008-06-02 21:23 . 2008-06-02 21:23   96,950   -r-hs----   C:\WINDOWS\mservice.exe
  2008-06-02 21:22 . 2008-06-02 21:23   96,950   --a--c---   C:\stup.exe
  2008-06-02 17:54 . 2008-06-03 17:50   60,114   --a--c---   C:\bot1.exe
  2008-05-30 19:23 . 2008-05-30 22:11   60,132   --a--c---   C:\dcsi.exe
  2008-05-30 09:26 . 2008-05-30 22:47   60,132   --a--c---   C:\dci.exe
  2008-05-29 21:45 . 2008-05-29 21:45   60,132   --a--c---   C:\ddc.exe
  2008-05-29 21:45 . 2008-06-08 20:19   2,231   --a--c---   C:\is154890.exe
  2008-05-29 21:42 . 2008-05-29 21:44   86,340   -r-hs----   C:\WINDOWS\winudspm.exe
  2008-05-20 17:07 . 2008-05-20 17:07   118   --a------   C:\WINDOWS\system32\MRT.INI
  
  .
  (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-06-09 09:47   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\Skype
  2008-06-09 09:32   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\skypePM
  2008-06-06 07:50   ---------   d-----w   C:\Program Files\DCPlusPlus
  2008-04-28 10:53   ---------   d-----w   C:\Program Files\Samurize
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Nokia
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\PCSuite
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\Nokia
  2008-04-21 17:05   ---------   d-----w   C:\Program Files\PC Connectivity Solution
  2008-04-21 15:53   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Installations
  2008-04-12 17:14   32   -c--a-w   C:\Documents and Settings\All Users\Application Data\ezsid.dat
  2008-04-12 17:00   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Common Files\Skype
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\dllcache\mswstr10.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\dllcache\msjint40.dll
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\dllcache\win32k.sys
  2007-03-06 13:18   12,628   -c--a-w   C:\Documents and Settings\Marika\Application Data\wklnhst.dat
  2006-01-10 14:53   60,960   -c--a-w   C:\Documents and Settings\Marika\Application Data\GDIPFONTCACHEV1.DAT
  2005-09-29 15:04   774,144   -c--a-w   C:\Program Files\RngInterstitial.dll
  .
  
  ((((((((((((((((((((((((((((( snapshot@2008-06-09_10.06.00.92 )))))))))))))))))))))))))))))))))))))))))
  .
  - 2008-06-09 06:47:50   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 09:29:52   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 09:30:40   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_4f0.dat
  .
  (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  REGEDIT4
  *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
  "Drive Amen"="C:\DOCUME~1\LOCALS~1\APPLIC~1\Update\Bits idol.exe" [ ]
  "MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2006-08-11 16:05 190024]
  "Felix II"="C:\Program Files\ScreenMates\Felix II\Felix2.exe" [ ]
  "msnmsgr"="~C:\Program Files\MSN Messenger\msnmsgr.exe" [ ]
  "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-25 22:30 68856]
  "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
  "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
  "SiSPower"="SiSPower.dll" [2004-09-02 14:47 49152 C:\WINDOWS\system32\SiSPower.dll]
  "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-09-02 14:44 249856]
  "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 19:15 106496]
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
  "dxvid"="c:\windows\system32\dxvid.exe" [ ]
  "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-27 02:01 33792]
  "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-02-08 16:28 155648]
  "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 03:11 50688]
  "barb bits pile drv"="C:\Documents and Settings\All Users\Application Data\Mapi View Barb Bits\name dvd.exe" [ ]
  "gdimx"="c:\windows\system32\gdimx.exe" [ ]
  "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
  "Windows UDP Control"="winudspm.exe" [2008-05-29 21:44 86340 C:\WINDOWS\winudspm.exe]
  "Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
  "Windows Controls Center"="winudmr.exe" [2008-06-09 09:03 29342 C:\WINDOWS\winudmr.exe]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]
  
  C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
  Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-01-10 14:16:47 113664]
  HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24 258048]
  HP Image Zone -pikak„ynnistys.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52 53248]
  Microsoft Office.lnk - C:\Program Files\Office\Office10\OSA.EXE [2004-10-01 02:23:17 83360]
  Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2004-11-24 12:22:22 331776]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "FirewallOverride"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "C:\\Program Files\\DCPlusPlus\\DCPlusPlus.exe"=
  "C:\\Program Files\\Azureus\\Azureus.exe"=
  "C:\\WINDOWS\\system32\\sessmgr.exe"=
  "C:\\Program Files\\mIRC\\mirc.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "C:\\Program Files\\Sony Ericsson\\Update Service\\ma3platform.exe"=
  "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
  "C:\\Program Files\\SopCast\\SopCast.exe"=
  "C:\\Documents and Settings\\Marika\\Application Data\\SopCast\\adv\\SopAdver.exe"=
  "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
  "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
  "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
  
  R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
  R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
  R3 CONAN;CONAN;C:\WINDOWS\system32\drivers\o2mmb.sys [2004-02-12 02:18]
  R3 MbxStby;MbxStby;C:\WINDOWS\system32\drivers\MbxStby.sys [2004-01-28 00:00]
  S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
  S3 PRISM_A00;PRISM 802.11 Driver;C:\WINDOWS\system32\DRIVERS\PRISMA00.sys [2004-07-20 21:16]
  S4 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" []
  
  *Newly Created Service* - CATCHME
  .
  'Ajoitetut tehtävät'-kansion sisältö
  "2008-06-09 10:00:00 C:\WINDOWS\Tasks\AB1BFCF090B473F8.job"
  - c:\docume~1\marika\applic~1\update\Move Four Dog.exe
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-06-09 13:29:16
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  .
  Completion time: 2008-06-09 13:32:27
  ComboFix-quarantined-files.txt 2008-06-09 10:32:12
  ComboFix2.txt 2008-06-09 07:52:44
  ComboFix3.txt 2008-06-09 07:07:31
  
  Pre-Run: 19,495,796,736 tavua vapaana
  Post-Run: 19,482,202,112 tavua vapaana
  
  157   --- E O F ---   2008-05-28 17:02:23
  se on
  
  Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
  
  [quote]
  
  File::
  C:\WINDOWS\winudmr.exe
  C:\sjgz.exe
  C:\sjz.exe
  C:\hszs.exe
  C:\shz.exe
  C:\szs.exe
  C:\sz.exe
  C:\sexx2.exe
  C:\sex22.exe
  C:\sex2.exe
  C:\sf.exe
  C:\fa.exe
  C:\is155400.exe
  C:\WINDOWS\is154890.exe
  C:\WINDOWS\DC5177176.zip
  C:\Documents and Settings\Marika\setup.exe
  C:\stupx.exe
  C:\WINDOWS\mservice.exe
  C:\stup.exe
  C:\bot1.exe
  C:\dcsi.exe
  C:\dci.exe
  C:\ddc.exe
  C:\is154890.exe
  C:\WINDOWS\winudspm.exe
  
  [/quote]
  
  Tallenna se nimellä CFScript.txt
  
  Sitten raahaa CFScript ComboFix.exeen kuten alla.
  [img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
  
  Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
  
  **************
  
  Luo poistolista:
  •   Avaa HiJackThis
  •   Klikkaa "Configure" valintaa oikealla alhaalla
  •   Klikkaa "Misc Tools"
  •   Klikkaa boxia joka sanoo "Uninstall Manager"
  •   Klikkaa valintaa "Save list"
  •   Kopioi ja liitä kyseinen lista muistiosta postiisi
- tessa...
  2008-06-09 14:28:15
  FixFix kirjoitti:
  se on
  
  Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
  
  [quote]
  
  File::
  C:\WINDOWS\winudmr.exe
  C:\sjgz.exe
  C:\sjz.exe
  C:\hszs.exe
  C:\shz.exe
  C:\szs.exe
  C:\sz.exe
  C:\sexx2.exe
  C:\sex22.exe
  C:\sex2.exe
  C:\sf.exe
  C:\fa.exe
  C:\is155400.exe
  C:\WINDOWS\is154890.exe
  C:\WINDOWS\DC5177176.zip
  C:\Documents and Settings\Marika\setup.exe
  C:\stupx.exe
  C:\WINDOWS\mservice.exe
  C:\stup.exe
  C:\bot1.exe
  C:\dcsi.exe
  C:\dci.exe
  C:\ddc.exe
  C:\is154890.exe
  C:\WINDOWS\winudspm.exe
  
  [/quote]
  
  Tallenna se nimellä CFScript.txt
  
  Sitten raahaa CFScript ComboFix.exeen kuten alla.
  [img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
  
  Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
  
  **************
  
  Luo poistolista:
  •   Avaa HiJackThis
  •   Klikkaa "Configure" valintaa oikealla alhaalla
  •   Klikkaa "Misc Tools"
  •   Klikkaa boxia joka sanoo "Uninstall Manager"
  •   Klikkaa valintaa "Save list"
  •   Kopioi ja liitä kyseinen lista muistiosta postiisi
  Adobe Reader 6.0.1
  Athlon 64 Processor Driver
  avast! Antivirus
  Azureus
  BSPlayer
  Canon Utilities ZoomBrowser EX
  DCPlusPlus
  gdimx
  GdiplusUpgrade
  Google Toolbar for Internet Explorer
  GT Reittikartta Suomi Plus
  HijackThis 2.0.2
  Hotfix for Windows XP (KB915865)
  Hotfix-päivitys Windows Internet Explorer 7:lle (KB947864)
  Hotfix-päivitys Windows XP:lle (KB914440)
  HP Extended Capabilities 4.7
  HP Image Zone 4.7
  HP PSC & OfficeJet 4.7
  HP Software Update
  Ifi Tilausohjelma 3.5
  InterActual Player
  InterVideo WinDVD
  J2SE Runtime Environment 5.0 Update 9
  Java 2 Runtime Environment, SE v1.4.2_03
  Java(TM) 6 Update 2
  Java(TM) 6 Update 3
  Java(TM) 6 Update 5
  Macrogaming SweetIM 1.2a
  Macrogaming SweetIM 2.0
  MediaGateway
  Messenger Plus! 3 & Sponsor
  Messenger Plus! Live & Sponsor (CiD)
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1 Finnish Language Pack
  Microsoft .NET Framework 1.1 Hotfix (KB928366)
  Microsoft AutoRoute v11.0
  Microsoft Encarta Encyclopedia Standard - WE 2004
  Microsoft Internationalized Domain Names Mitigation APIs
  Microsoft National Language Support Downlevel APIs
  Microsoft Picture It! Photo Standard 9
  Microsoft Word 2002
  Microsoft Works
  Microsoft Works 2004 Osien valitseminen
  Microsoft Works Suiten Microsoft Word -lisäosan
  mIRC
  Mozilla Firefox (2.0.0.14)
  MSVC80_x86
  MSXML 4.0 SP2 (KB927978)
  MSXML 4.0 SP2 (KB936181)
  Nero OEM
  Nokia Connectivity Cable Driver
  Nokia PC Suite
  Nokia PC Suite
  O2Micro MemoryCardBus Windows Driver
  PC Connectivity Solution
  Public Messenger ver 2.03
  Päivitys Windows XP:lle (KB894391)
  Päivitys Windows XP:lle (KB896727)
  Päivitys Windows XP:lle (KB898461)
  Päivitys Windows XP:lle (KB900485)
  Päivitys Windows XP:lle (KB904942)
  Päivitys Windows XP:lle (KB910437)
  Päivitys Windows XP:lle (KB911280)
  Päivitys Windows XP:lle (KB916595)
  Päivitys Windows XP:lle (KB920872)
  Päivitys Windows XP:lle (KB922582)
  Päivitys Windows XP:lle (KB927891)
  Päivitys Windows XP:lle (KB929338)
  Päivitys Windows XP:lle (KB930916)
  Päivitys Windows XP:lle (KB931836)
  Päivitys Windows XP:lle (KB932823-v3)
  Päivitys Windows XP:lle (KB933360)
  Päivitys Windows XP:lle (KB938828)
  Päivitys Windows XP:lle (KB942763)
  QuickTime
  Serious Samurize
  Shockwave
  Shop for HP Supplies
  SiS 900 PCI Fast Ethernet Adapter Driver
  SiS VGA Utilities
  Skype™ 3.6
  Smart Link 56K Modem
  SopCast 1.1.2
  Suojauspäivitys ohjelmistolle Windows XP (KB923689)
  Suojauspäivitys ohjelmistolle Windows XP (KB941569)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB928090)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB929969)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB931768)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB933566)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB937143)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB938127)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB939653)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB942615)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB944533)
  Suojauspäivitys Windows Media Player 10:lle (KB911565)
  Suojauspäivitys Windows Media Player 10:lle (KB917734)
  Suojauspäivitys Windows Media Player 10:lle (KB936782)
  Suojauspäivitys Windows Media Player 6.4:lle (KB925398)
  Suojauspäivitys Windows Media Playerille (KB911564)
  Suojauspäivitys Windows XP:lle (KB883939)
  Suojauspäivitys Windows XP:lle (KB890046)
  Suojauspäivitys Windows XP:lle (KB893756)
  Suojauspäivitys Windows XP:lle (KB896358)
  Suojauspäivitys Windows XP:lle (KB896422)
  Suojauspäivitys Windows XP:lle (KB896423)
  Suojauspäivitys Windows XP:lle (KB896424)
  Suojauspäivitys Windows XP:lle (KB896428)
  Suojauspäivitys Windows XP:lle (KB896688)
  Suojauspäivitys Windows XP:lle (KB899587)
  Suojauspäivitys Windows XP:lle (KB899588)
  Suojauspäivitys Windows XP:lle (KB899591)
  Suojauspäivitys Windows XP:lle (KB900725)
  Suojauspäivitys Windows XP:lle (KB901017)
  Suojauspäivitys Windows XP:lle (KB901214)
  Suojauspäivitys Windows XP:lle (KB902400)
  Suojauspäivitys Windows XP:lle (KB903235)
  Suojauspäivitys Windows XP:lle (KB904706)
  Suojauspäivitys Windows XP:lle (KB905414)
  Suojauspäivitys Windows XP:lle (KB905749)
  Suojauspäivitys Windows XP:lle (KB905915)
  Suojauspäivitys Windows XP:lle (KB908519)
  Suojauspäivitys Windows XP:lle (KB908531)
  Suojauspäivitys Windows XP:lle (KB911562)
  Suojauspäivitys Windows XP:lle (KB911567)
  Suojauspäivitys Windows XP:lle (KB911927)
  Suojauspäivitys Windows XP:lle (KB912812)
  Suojauspäivitys Windows XP:lle (KB912919)
  Suojauspäivitys Windows XP:lle (KB913446)
  Suojauspäivitys Windows XP:lle (KB913580)
  Suojauspäivitys Windows XP:lle (KB914388)
  Suojauspäivitys Windows XP:lle (KB914389)
  Suojauspäivitys Windows XP:lle (KB916281)
  Suojauspäivitys Windows XP:lle (KB917159)
  Suojauspäivitys Windows XP:lle (KB917344)
  Suojauspäivitys Windows XP:lle (KB917422)
  Suojauspäivitys Windows XP:lle (KB917953)
  Suojauspäivitys Windows XP:lle (KB918118)
  Suojauspäivitys Windows XP:lle (KB918439)
  Suojauspäivitys Windows XP:lle (KB918899)
  Suojauspäivitys Windows XP:lle (KB919007)
  Suojauspäivitys Windows XP:lle (KB920213)
  Suojauspäivitys Windows XP:lle (KB920214)
  Suojauspäivitys Windows XP:lle (KB920670)
  Suojauspäivitys Windows XP:lle (KB920683)
  Suojauspäivitys Windows XP:lle (KB920685)
  Suojauspäivitys Windows XP:lle (KB921398)
  Suojauspäivitys Windows XP:lle (KB921503)
  Suojauspäivitys Windows XP:lle (KB921883)
  Suojauspäivitys Windows XP:lle (KB922616)
  Suojauspäivitys Windows XP:lle (KB922760)
  Suojauspäivitys Windows XP:lle (KB922819)
  Suojauspäivitys Windows XP:lle (KB923191)
  Suojauspäivitys Windows XP:lle (KB923414)
  Suojauspäivitys Windows XP:lle (KB923694)
  Suojauspäivitys Windows XP:lle (KB923980)
  Suojauspäivitys Windows XP:lle (KB924191)
  Suojauspäivitys Windows XP:lle (KB924270)
  Suojauspäivitys Windows XP:lle (KB924496)
  Suojauspäivitys Windows XP:lle (KB924667)
  Suojauspäivitys Windows XP:lle (KB925454)
  Suojauspäivitys Windows XP:lle (KB925486)
  Suojauspäivitys Windows XP:lle (KB925902)
  Suojauspäivitys Windows XP:lle (KB926255)
  Suojauspäivitys Windows XP:lle (KB926436)
  Suojauspäivitys Windows XP:lle (KB927779)
  Suojauspäivitys Windows XP:lle (KB927802)
  Suojauspäivitys Windows XP:lle (KB928255)
  Suojauspäivitys Windows XP:lle (KB928843)
  Suojauspäivitys Windows XP:lle (KB929123)
  Suojauspäivitys Windows XP:lle (KB930178)
  Suojauspäivitys Windows XP:lle (KB931261)
  Suojauspäivitys Windows XP:lle (KB931784)
  Suojauspäivitys Windows XP:lle (KB932168)
  Suojauspäivitys Windows XP:lle (KB933729)
  Suojauspäivitys Windows XP:lle (KB935839)
  Suojauspäivitys Windows XP:lle (KB935840)
  Suojauspäivitys Windows XP:lle (KB936021)
  Suojauspäivitys Windows XP:lle (KB938829)
  Suojauspäivitys Windows XP:lle (KB941202)
  Suojauspäivitys Windows XP:lle (KB941568)
  Suojauspäivitys Windows XP:lle (KB941644)
  Suojauspäivitys Windows XP:lle (KB941693)
  Suojauspäivitys Windows XP:lle (KB943055)
  Suojauspäivitys Windows XP:lle (KB943460)
  Suojauspäivitys Windows XP:lle (KB943485)
  Suojauspäivitys Windows XP:lle (KB944653)
  Suojauspäivitys Windows XP:lle (KB945553)
  Suojauspäivitys Windows XP:lle (KB946026)
  Suojauspäivitys Windows XP:lle (KB948590)
  Suojauspäivitys Windows XP:lle (KB948881)
  Suojauspäivitys Windows XP:lle (KB950749)
  SweetIM For Internet Explorer 1.0a
  SweetIM For Internet Explorer 3.0b
  TVUPlayer 2.3.0.0
  Update Service
  VIA Audio Driver Setup Program
  Viewpoint Manager (Remove Only)
  Viewpoint Media Player
  Viewpoint Toolbar
  Winamp (remove only)
  Windows Genuine Advantage v1.3.0254.0
  Windows Installer 3.1 (KB893803)
  Windows Internet Explorer 7
  Windows Live Messenger
  Windows Live Sign-in Assistant
  Windows Media Format Runtime
  Windows Media Player 10
  Windows XP Hotfix - KB873333
  Windows XP Hotfix - KB873339
  Windows XP Hotfix - KB885250
  Windows XP Hotfix - KB885835
  Windows XP Hotfix - KB885836
  Windows XP Hotfix - KB885884
  Windows XP Hotfix - KB886185
  Windows XP Hotfix - KB887472
  Windows XP Hotfix - KB887742
  Windows XP Hotfix - KB888113
  Windows XP Hotfix - KB888302
  Windows XP Hotfix - KB890175
  Windows XP Hotfix - KB890859
  Windows XP Hotfix - KB890923
  Windows XP Hotfix - KB891781
  Windows XP Hotfix - KB893066
  Windows XP Hotfix - KB893086
  Windowsin ohjainpaketti - Nokia Modem (03/05/2008 3.7)
  Windowsin ohjainpaketti - Nokia Modem (03/13/2008 6.86.0.1)
  Windowsin ohjainpaketti - Nokia Modem (08/03/2007 6.84.0.2)
  Windowsin ohjainpaketti - Nokia Modem (10/12/2007 3.6)
  Windowsin ohjainpaketti - Nokia pccsmcfd (10/12/2007 6.85.4.0)
- tessa...
  2008-06-09 14:30:23
  tessa... kirjoitti:
  Adobe Reader 6.0.1
  Athlon 64 Processor Driver
  avast! Antivirus
  Azureus
  BSPlayer
  Canon Utilities ZoomBrowser EX
  DCPlusPlus
  gdimx
  GdiplusUpgrade
  Google Toolbar for Internet Explorer
  GT Reittikartta Suomi Plus
  HijackThis 2.0.2
  Hotfix for Windows XP (KB915865)
  Hotfix-päivitys Windows Internet Explorer 7:lle (KB947864)
  Hotfix-päivitys Windows XP:lle (KB914440)
  HP Extended Capabilities 4.7
  HP Image Zone 4.7
  HP PSC & OfficeJet 4.7
  HP Software Update
  Ifi Tilausohjelma 3.5
  InterActual Player
  InterVideo WinDVD
  J2SE Runtime Environment 5.0 Update 9
  Java 2 Runtime Environment, SE v1.4.2_03
  Java(TM) 6 Update 2
  Java(TM) 6 Update 3
  Java(TM) 6 Update 5
  Macrogaming SweetIM 1.2a
  Macrogaming SweetIM 2.0
  MediaGateway
  Messenger Plus! 3 & Sponsor
  Messenger Plus! Live & Sponsor (CiD)
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1 Finnish Language Pack
  Microsoft .NET Framework 1.1 Hotfix (KB928366)
  Microsoft AutoRoute v11.0
  Microsoft Encarta Encyclopedia Standard - WE 2004
  Microsoft Internationalized Domain Names Mitigation APIs
  Microsoft National Language Support Downlevel APIs
  Microsoft Picture It! Photo Standard 9
  Microsoft Word 2002
  Microsoft Works
  Microsoft Works 2004 Osien valitseminen
  Microsoft Works Suiten Microsoft Word -lisäosan
  mIRC
  Mozilla Firefox (2.0.0.14)
  MSVC80_x86
  MSXML 4.0 SP2 (KB927978)
  MSXML 4.0 SP2 (KB936181)
  Nero OEM
  Nokia Connectivity Cable Driver
  Nokia PC Suite
  Nokia PC Suite
  O2Micro MemoryCardBus Windows Driver
  PC Connectivity Solution
  Public Messenger ver 2.03
  Päivitys Windows XP:lle (KB894391)
  Päivitys Windows XP:lle (KB896727)
  Päivitys Windows XP:lle (KB898461)
  Päivitys Windows XP:lle (KB900485)
  Päivitys Windows XP:lle (KB904942)
  Päivitys Windows XP:lle (KB910437)
  Päivitys Windows XP:lle (KB911280)
  Päivitys Windows XP:lle (KB916595)
  Päivitys Windows XP:lle (KB920872)
  Päivitys Windows XP:lle (KB922582)
  Päivitys Windows XP:lle (KB927891)
  Päivitys Windows XP:lle (KB929338)
  Päivitys Windows XP:lle (KB930916)
  Päivitys Windows XP:lle (KB931836)
  Päivitys Windows XP:lle (KB932823-v3)
  Päivitys Windows XP:lle (KB933360)
  Päivitys Windows XP:lle (KB938828)
  Päivitys Windows XP:lle (KB942763)
  QuickTime
  Serious Samurize
  Shockwave
  Shop for HP Supplies
  SiS 900 PCI Fast Ethernet Adapter Driver
  SiS VGA Utilities
  Skype™ 3.6
  Smart Link 56K Modem
  SopCast 1.1.2
  Suojauspäivitys ohjelmistolle Windows XP (KB923689)
  Suojauspäivitys ohjelmistolle Windows XP (KB941569)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB928090)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB929969)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB931768)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB933566)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB937143)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB938127)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB939653)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB942615)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB944533)
  Suojauspäivitys Windows Media Player 10:lle (KB911565)
  Suojauspäivitys Windows Media Player 10:lle (KB917734)
  Suojauspäivitys Windows Media Player 10:lle (KB936782)
  Suojauspäivitys Windows Media Player 6.4:lle (KB925398)
  Suojauspäivitys Windows Media Playerille (KB911564)
  Suojauspäivitys Windows XP:lle (KB883939)
  Suojauspäivitys Windows XP:lle (KB890046)
  Suojauspäivitys Windows XP:lle (KB893756)
  Suojauspäivitys Windows XP:lle (KB896358)
  Suojauspäivitys Windows XP:lle (KB896422)
  Suojauspäivitys Windows XP:lle (KB896423)
  Suojauspäivitys Windows XP:lle (KB896424)
  Suojauspäivitys Windows XP:lle (KB896428)
  Suojauspäivitys Windows XP:lle (KB896688)
  Suojauspäivitys Windows XP:lle (KB899587)
  Suojauspäivitys Windows XP:lle (KB899588)
  Suojauspäivitys Windows XP:lle (KB899591)
  Suojauspäivitys Windows XP:lle (KB900725)
  Suojauspäivitys Windows XP:lle (KB901017)
  Suojauspäivitys Windows XP:lle (KB901214)
  Suojauspäivitys Windows XP:lle (KB902400)
  Suojauspäivitys Windows XP:lle (KB903235)
  Suojauspäivitys Windows XP:lle (KB904706)
  Suojauspäivitys Windows XP:lle (KB905414)
  Suojauspäivitys Windows XP:lle (KB905749)
  Suojauspäivitys Windows XP:lle (KB905915)
  Suojauspäivitys Windows XP:lle (KB908519)
  Suojauspäivitys Windows XP:lle (KB908531)
  Suojauspäivitys Windows XP:lle (KB911562)
  Suojauspäivitys Windows XP:lle (KB911567)
  Suojauspäivitys Windows XP:lle (KB911927)
  Suojauspäivitys Windows XP:lle (KB912812)
  Suojauspäivitys Windows XP:lle (KB912919)
  Suojauspäivitys Windows XP:lle (KB913446)
  Suojauspäivitys Windows XP:lle (KB913580)
  Suojauspäivitys Windows XP:lle (KB914388)
  Suojauspäivitys Windows XP:lle (KB914389)
  Suojauspäivitys Windows XP:lle (KB916281)
  Suojauspäivitys Windows XP:lle (KB917159)
  Suojauspäivitys Windows XP:lle (KB917344)
  Suojauspäivitys Windows XP:lle (KB917422)
  Suojauspäivitys Windows XP:lle (KB917953)
  Suojauspäivitys Windows XP:lle (KB918118)
  Suojauspäivitys Windows XP:lle (KB918439)
  Suojauspäivitys Windows XP:lle (KB918899)
  Suojauspäivitys Windows XP:lle (KB919007)
  Suojauspäivitys Windows XP:lle (KB920213)
  Suojauspäivitys Windows XP:lle (KB920214)
  Suojauspäivitys Windows XP:lle (KB920670)
  Suojauspäivitys Windows XP:lle (KB920683)
  Suojauspäivitys Windows XP:lle (KB920685)
  Suojauspäivitys Windows XP:lle (KB921398)
  Suojauspäivitys Windows XP:lle (KB921503)
  Suojauspäivitys Windows XP:lle (KB921883)
  Suojauspäivitys Windows XP:lle (KB922616)
  Suojauspäivitys Windows XP:lle (KB922760)
  Suojauspäivitys Windows XP:lle (KB922819)
  Suojauspäivitys Windows XP:lle (KB923191)
  Suojauspäivitys Windows XP:lle (KB923414)
  Suojauspäivitys Windows XP:lle (KB923694)
  Suojauspäivitys Windows XP:lle (KB923980)
  Suojauspäivitys Windows XP:lle (KB924191)
  Suojauspäivitys Windows XP:lle (KB924270)
  Suojauspäivitys Windows XP:lle (KB924496)
  Suojauspäivitys Windows XP:lle (KB924667)
  Suojauspäivitys Windows XP:lle (KB925454)
  Suojauspäivitys Windows XP:lle (KB925486)
  Suojauspäivitys Windows XP:lle (KB925902)
  Suojauspäivitys Windows XP:lle (KB926255)
  Suojauspäivitys Windows XP:lle (KB926436)
  Suojauspäivitys Windows XP:lle (KB927779)
  Suojauspäivitys Windows XP:lle (KB927802)
  Suojauspäivitys Windows XP:lle (KB928255)
  Suojauspäivitys Windows XP:lle (KB928843)
  Suojauspäivitys Windows XP:lle (KB929123)
  Suojauspäivitys Windows XP:lle (KB930178)
  Suojauspäivitys Windows XP:lle (KB931261)
  Suojauspäivitys Windows XP:lle (KB931784)
  Suojauspäivitys Windows XP:lle (KB932168)
  Suojauspäivitys Windows XP:lle (KB933729)
  Suojauspäivitys Windows XP:lle (KB935839)
  Suojauspäivitys Windows XP:lle (KB935840)
  Suojauspäivitys Windows XP:lle (KB936021)
  Suojauspäivitys Windows XP:lle (KB938829)
  Suojauspäivitys Windows XP:lle (KB941202)
  Suojauspäivitys Windows XP:lle (KB941568)
  Suojauspäivitys Windows XP:lle (KB941644)
  Suojauspäivitys Windows XP:lle (KB941693)
  Suojauspäivitys Windows XP:lle (KB943055)
  Suojauspäivitys Windows XP:lle (KB943460)
  Suojauspäivitys Windows XP:lle (KB943485)
  Suojauspäivitys Windows XP:lle (KB944653)
  Suojauspäivitys Windows XP:lle (KB945553)
  Suojauspäivitys Windows XP:lle (KB946026)
  Suojauspäivitys Windows XP:lle (KB948590)
  Suojauspäivitys Windows XP:lle (KB948881)
  Suojauspäivitys Windows XP:lle (KB950749)
  SweetIM For Internet Explorer 1.0a
  SweetIM For Internet Explorer 3.0b
  TVUPlayer 2.3.0.0
  Update Service
  VIA Audio Driver Setup Program
  Viewpoint Manager (Remove Only)
  Viewpoint Media Player
  Viewpoint Toolbar
  Winamp (remove only)
  Windows Genuine Advantage v1.3.0254.0
  Windows Installer 3.1 (KB893803)
  Windows Internet Explorer 7
  Windows Live Messenger
  Windows Live Sign-in Assistant
  Windows Media Format Runtime
  Windows Media Player 10
  Windows XP Hotfix - KB873333
  Windows XP Hotfix - KB873339
  Windows XP Hotfix - KB885250
  Windows XP Hotfix - KB885835
  Windows XP Hotfix - KB885836
  Windows XP Hotfix - KB885884
  Windows XP Hotfix - KB886185
  Windows XP Hotfix - KB887472
  Windows XP Hotfix - KB887742
  Windows XP Hotfix - KB888113
  Windows XP Hotfix - KB888302
  Windows XP Hotfix - KB890175
  Windows XP Hotfix - KB890859
  Windows XP Hotfix - KB890923
  Windows XP Hotfix - KB891781
  Windows XP Hotfix - KB893066
  Windows XP Hotfix - KB893086
  Windowsin ohjainpaketti - Nokia Modem (03/05/2008 3.7)
  Windowsin ohjainpaketti - Nokia Modem (03/13/2008 6.86.0.1)
  Windowsin ohjainpaketti - Nokia Modem (08/03/2007 6.84.0.2)
  Windowsin ohjainpaketti - Nokia Modem (10/12/2007 3.6)
  Windowsin ohjainpaketti - Nokia pccsmcfd (10/12/2007 6.85.4.0)
  tai siis e mikä on tuola un install jutusa... eli varmaa on oikee? Pitää viel käyä toi läpi
- FixFix
  2008-06-09 14:51:54
  tessa... kirjoitti:
  Adobe Reader 6.0.1
  Athlon 64 Processor Driver
  avast! Antivirus
  Azureus
  BSPlayer
  Canon Utilities ZoomBrowser EX
  DCPlusPlus
  gdimx
  GdiplusUpgrade
  Google Toolbar for Internet Explorer
  GT Reittikartta Suomi Plus
  HijackThis 2.0.2
  Hotfix for Windows XP (KB915865)
  Hotfix-päivitys Windows Internet Explorer 7:lle (KB947864)
  Hotfix-päivitys Windows XP:lle (KB914440)
  HP Extended Capabilities 4.7
  HP Image Zone 4.7
  HP PSC & OfficeJet 4.7
  HP Software Update
  Ifi Tilausohjelma 3.5
  InterActual Player
  InterVideo WinDVD
  J2SE Runtime Environment 5.0 Update 9
  Java 2 Runtime Environment, SE v1.4.2_03
  Java(TM) 6 Update 2
  Java(TM) 6 Update 3
  Java(TM) 6 Update 5
  Macrogaming SweetIM 1.2a
  Macrogaming SweetIM 2.0
  MediaGateway
  Messenger Plus! 3 & Sponsor
  Messenger Plus! Live & Sponsor (CiD)
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1 Finnish Language Pack
  Microsoft .NET Framework 1.1 Hotfix (KB928366)
  Microsoft AutoRoute v11.0
  Microsoft Encarta Encyclopedia Standard - WE 2004
  Microsoft Internationalized Domain Names Mitigation APIs
  Microsoft National Language Support Downlevel APIs
  Microsoft Picture It! Photo Standard 9
  Microsoft Word 2002
  Microsoft Works
  Microsoft Works 2004 Osien valitseminen
  Microsoft Works Suiten Microsoft Word -lisäosan
  mIRC
  Mozilla Firefox (2.0.0.14)
  MSVC80_x86
  MSXML 4.0 SP2 (KB927978)
  MSXML 4.0 SP2 (KB936181)
  Nero OEM
  Nokia Connectivity Cable Driver
  Nokia PC Suite
  Nokia PC Suite
  O2Micro MemoryCardBus Windows Driver
  PC Connectivity Solution
  Public Messenger ver 2.03
  Päivitys Windows XP:lle (KB894391)
  Päivitys Windows XP:lle (KB896727)
  Päivitys Windows XP:lle (KB898461)
  Päivitys Windows XP:lle (KB900485)
  Päivitys Windows XP:lle (KB904942)
  Päivitys Windows XP:lle (KB910437)
  Päivitys Windows XP:lle (KB911280)
  Päivitys Windows XP:lle (KB916595)
  Päivitys Windows XP:lle (KB920872)
  Päivitys Windows XP:lle (KB922582)
  Päivitys Windows XP:lle (KB927891)
  Päivitys Windows XP:lle (KB929338)
  Päivitys Windows XP:lle (KB930916)
  Päivitys Windows XP:lle (KB931836)
  Päivitys Windows XP:lle (KB932823-v3)
  Päivitys Windows XP:lle (KB933360)
  Päivitys Windows XP:lle (KB938828)
  Päivitys Windows XP:lle (KB942763)
  QuickTime
  Serious Samurize
  Shockwave
  Shop for HP Supplies
  SiS 900 PCI Fast Ethernet Adapter Driver
  SiS VGA Utilities
  Skype™ 3.6
  Smart Link 56K Modem
  SopCast 1.1.2
  Suojauspäivitys ohjelmistolle Windows XP (KB923689)
  Suojauspäivitys ohjelmistolle Windows XP (KB941569)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB928090)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB929969)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB931768)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB933566)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB937143)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB938127)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB939653)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB942615)
  Suojauspäivitys Windows Internet Explorer 7:lle (KB944533)
  Suojauspäivitys Windows Media Player 10:lle (KB911565)
  Suojauspäivitys Windows Media Player 10:lle (KB917734)
  Suojauspäivitys Windows Media Player 10:lle (KB936782)
  Suojauspäivitys Windows Media Player 6.4:lle (KB925398)
  Suojauspäivitys Windows Media Playerille (KB911564)
  Suojauspäivitys Windows XP:lle (KB883939)
  Suojauspäivitys Windows XP:lle (KB890046)
  Suojauspäivitys Windows XP:lle (KB893756)
  Suojauspäivitys Windows XP:lle (KB896358)
  Suojauspäivitys Windows XP:lle (KB896422)
  Suojauspäivitys Windows XP:lle (KB896423)
  Suojauspäivitys Windows XP:lle (KB896424)
  Suojauspäivitys Windows XP:lle (KB896428)
  Suojauspäivitys Windows XP:lle (KB896688)
  Suojauspäivitys Windows XP:lle (KB899587)
  Suojauspäivitys Windows XP:lle (KB899588)
  Suojauspäivitys Windows XP:lle (KB899591)
  Suojauspäivitys Windows XP:lle (KB900725)
  Suojauspäivitys Windows XP:lle (KB901017)
  Suojauspäivitys Windows XP:lle (KB901214)
  Suojauspäivitys Windows XP:lle (KB902400)
  Suojauspäivitys Windows XP:lle (KB903235)
  Suojauspäivitys Windows XP:lle (KB904706)
  Suojauspäivitys Windows XP:lle (KB905414)
  Suojauspäivitys Windows XP:lle (KB905749)
  Suojauspäivitys Windows XP:lle (KB905915)
  Suojauspäivitys Windows XP:lle (KB908519)
  Suojauspäivitys Windows XP:lle (KB908531)
  Suojauspäivitys Windows XP:lle (KB911562)
  Suojauspäivitys Windows XP:lle (KB911567)
  Suojauspäivitys Windows XP:lle (KB911927)
  Suojauspäivitys Windows XP:lle (KB912812)
  Suojauspäivitys Windows XP:lle (KB912919)
  Suojauspäivitys Windows XP:lle (KB913446)
  Suojauspäivitys Windows XP:lle (KB913580)
  Suojauspäivitys Windows XP:lle (KB914388)
  Suojauspäivitys Windows XP:lle (KB914389)
  Suojauspäivitys Windows XP:lle (KB916281)
  Suojauspäivitys Windows XP:lle (KB917159)
  Suojauspäivitys Windows XP:lle (KB917344)
  Suojauspäivitys Windows XP:lle (KB917422)
  Suojauspäivitys Windows XP:lle (KB917953)
  Suojauspäivitys Windows XP:lle (KB918118)
  Suojauspäivitys Windows XP:lle (KB918439)
  Suojauspäivitys Windows XP:lle (KB918899)
  Suojauspäivitys Windows XP:lle (KB919007)
  Suojauspäivitys Windows XP:lle (KB920213)
  Suojauspäivitys Windows XP:lle (KB920214)
  Suojauspäivitys Windows XP:lle (KB920670)
  Suojauspäivitys Windows XP:lle (KB920683)
  Suojauspäivitys Windows XP:lle (KB920685)
  Suojauspäivitys Windows XP:lle (KB921398)
  Suojauspäivitys Windows XP:lle (KB921503)
  Suojauspäivitys Windows XP:lle (KB921883)
  Suojauspäivitys Windows XP:lle (KB922616)
  Suojauspäivitys Windows XP:lle (KB922760)
  Suojauspäivitys Windows XP:lle (KB922819)
  Suojauspäivitys Windows XP:lle (KB923191)
  Suojauspäivitys Windows XP:lle (KB923414)
  Suojauspäivitys Windows XP:lle (KB923694)
  Suojauspäivitys Windows XP:lle (KB923980)
  Suojauspäivitys Windows XP:lle (KB924191)
  Suojauspäivitys Windows XP:lle (KB924270)
  Suojauspäivitys Windows XP:lle (KB924496)
  Suojauspäivitys Windows XP:lle (KB924667)
  Suojauspäivitys Windows XP:lle (KB925454)
  Suojauspäivitys Windows XP:lle (KB925486)
  Suojauspäivitys Windows XP:lle (KB925902)
  Suojauspäivitys Windows XP:lle (KB926255)
  Suojauspäivitys Windows XP:lle (KB926436)
  Suojauspäivitys Windows XP:lle (KB927779)
  Suojauspäivitys Windows XP:lle (KB927802)
  Suojauspäivitys Windows XP:lle (KB928255)
  Suojauspäivitys Windows XP:lle (KB928843)
  Suojauspäivitys Windows XP:lle (KB929123)
  Suojauspäivitys Windows XP:lle (KB930178)
  Suojauspäivitys Windows XP:lle (KB931261)
  Suojauspäivitys Windows XP:lle (KB931784)
  Suojauspäivitys Windows XP:lle (KB932168)
  Suojauspäivitys Windows XP:lle (KB933729)
  Suojauspäivitys Windows XP:lle (KB935839)
  Suojauspäivitys Windows XP:lle (KB935840)
  Suojauspäivitys Windows XP:lle (KB936021)
  Suojauspäivitys Windows XP:lle (KB938829)
  Suojauspäivitys Windows XP:lle (KB941202)
  Suojauspäivitys Windows XP:lle (KB941568)
  Suojauspäivitys Windows XP:lle (KB941644)
  Suojauspäivitys Windows XP:lle (KB941693)
  Suojauspäivitys Windows XP:lle (KB943055)
  Suojauspäivitys Windows XP:lle (KB943460)
  Suojauspäivitys Windows XP:lle (KB943485)
  Suojauspäivitys Windows XP:lle (KB944653)
  Suojauspäivitys Windows XP:lle (KB945553)
  Suojauspäivitys Windows XP:lle (KB946026)
  Suojauspäivitys Windows XP:lle (KB948590)
  Suojauspäivitys Windows XP:lle (KB948881)
  Suojauspäivitys Windows XP:lle (KB950749)
  SweetIM For Internet Explorer 1.0a
  SweetIM For Internet Explorer 3.0b
  TVUPlayer 2.3.0.0
  Update Service
  VIA Audio Driver Setup Program
  Viewpoint Manager (Remove Only)
  Viewpoint Media Player
  Viewpoint Toolbar
  Winamp (remove only)
  Windows Genuine Advantage v1.3.0254.0
  Windows Installer 3.1 (KB893803)
  Windows Internet Explorer 7
  Windows Live Messenger
  Windows Live Sign-in Assistant
  Windows Media Format Runtime
  Windows Media Player 10
  Windows XP Hotfix - KB873333
  Windows XP Hotfix - KB873339
  Windows XP Hotfix - KB885250
  Windows XP Hotfix - KB885835
  Windows XP Hotfix - KB885836
  Windows XP Hotfix - KB885884
  Windows XP Hotfix - KB886185
  Windows XP Hotfix - KB887472
  Windows XP Hotfix - KB887742
  Windows XP Hotfix - KB888113
  Windows XP Hotfix - KB888302
  Windows XP Hotfix - KB890175
  Windows XP Hotfix - KB890859
  Windows XP Hotfix - KB890923
  Windows XP Hotfix - KB891781
  Windows XP Hotfix - KB893066
  Windows XP Hotfix - KB893086
  Windowsin ohjainpaketti - Nokia Modem (03/05/2008 3.7)
  Windowsin ohjainpaketti - Nokia Modem (03/13/2008 6.86.0.1)
  Windowsin ohjainpaketti - Nokia Modem (08/03/2007 6.84.0.2)
  Windowsin ohjainpaketti - Nokia Modem (10/12/2007 3.6)
  Windowsin ohjainpaketti - Nokia pccsmcfd (10/12/2007 6.85.4.0)
  gdimx
  J2SE Runtime Environment 5.0 Update 9
  Java 2 Runtime Environment, SE v1.4.2_03
  Java(TM) 6 Update 2
  Java(TM) 6 Update 3
  Macrogaming SweetIM 1.2a
  Macrogaming SweetIM 2.0
  MediaGateway
  Messenger Plus! 3 & Sponsor
  Messenger Plus! Live & Sponsor (CiD)
  SweetIM For Internet Explorer 1.0a
  SweetIM For Internet Explorer 3.0b
  Viewpoint Manager (Remove Only)
  Viewpoint Media Player
  Viewpoint Toolbar
  
  käynnistä nappi > ohjauspaneli > Lisää poista sovellus
- tessa...
  2008-06-09 15:45:33
  FixFix kirjoitti:
  gdimx
  J2SE Runtime Environment 5.0 Update 9
  Java 2 Runtime Environment, SE v1.4.2_03
  Java(TM) 6 Update 2
  Java(TM) 6 Update 3
  Macrogaming SweetIM 1.2a
  Macrogaming SweetIM 2.0
  MediaGateway
  Messenger Plus! 3 & Sponsor
  Messenger Plus! Live & Sponsor (CiD)
  SweetIM For Internet Explorer 1.0a
  SweetIM For Internet Explorer 3.0b
  Viewpoint Manager (Remove Only)
  Viewpoint Media Player
  Viewpoint Toolbar
  
  käynnistä nappi > ohjauspaneli > Lisää poista sovellus
  eli ny poistin nää
- FixFix
  2008-06-09 15:47:37
  tessa... kirjoitti:
  eli ny poistin nää
  combofix loki
- tessa...
  2008-06-09 19:05:12
  FixFix kirjoitti:
  combofix loki
  ComboFix 08-06-07.1 - Marika 2008-06-09 15:46:40.6 - NTFSx86
  Running from: C:\Documents and Settings\Marika\Työpöytä\ComboFix.exe
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  .
  
  ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-09 to 2008-06-09 )))))))))))))))))
  .
  
  2008-06-09 10:39 . 2008-06-09 10:39      d--------   C:\Program Files\Trend Micro
  2008-06-09 09:03 . 2008-06-09 09:26   29,342   --a--c---   C:\ps.exe
  2008-06-09 09:03 . 2008-06-09 13:33   29,342   --a--c---   C:\pf.exe
  2008-06-09 09:03 . 2008-06-09 09:28   29,342   --a--c---   C:\fp.exe
  2008-06-08 22:20 . 2008-06-08 22:20   18,587   --a--c---   C:\Documents and Settings\Marika\packed.exe
  2008-06-08 22:17 . 2008-06-08 22:18   18,587   --a--c---   C:\packed.exe
  2008-05-20 17:07 . 2008-05-20 17:07   118   --a------   C:\WINDOWS\system32\MRT.INI
  
  .
  (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-06-09 12:49   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\Skype
  2008-06-09 12:44   ---------   d-----w   C:\Program Files\Java
  2008-06-09 12:39   ---------   d-----w   C:\Program Files\MSN Messenger
  2008-06-09 09:32   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\skypePM
  2008-06-06 07:50   ---------   d-----w   C:\Program Files\DCPlusPlus
  2008-04-28 10:53   ---------   d-----w   C:\Program Files\Samurize
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Nokia
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\PCSuite
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\Nokia
  2008-04-21 17:05   ---------   d-----w   C:\Program Files\PC Connectivity Solution
  2008-04-21 15:53   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Installations
  2008-04-12 17:14   32   -c--a-w   C:\Documents and Settings\All Users\Application Data\ezsid.dat
  2008-04-12 17:00   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Common Files\Skype
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\dllcache\mswstr10.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\dllcache\msjint40.dll
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\dllcache\win32k.sys
  2007-03-06 13:18   12,628   -c--a-w   C:\Documents and Settings\Marika\Application Data\wklnhst.dat
  2006-01-10 14:53   60,960   -c--a-w   C:\Documents and Settings\Marika\Application Data\GDIPFONTCACHEV1.DAT
  2005-09-29 15:04   774,144   -c--a-w   C:\Program Files\RngInterstitial.dll
  .
  
  ((((((((((((((((((((((((((((( snapshot@2008-06-09_10.06.00.92 )))))))))))))))))))))))))))))))))))))))))
  .
  - 2008-06-09 06:47:50   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 12:28:55   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 12:29:35   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_4dc.dat
  .
  (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  REGEDIT4
  *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
  "Drive Amen"="C:\DOCUME~1\LOCALS~1\APPLIC~1\Update\Bits idol.exe" [ ]
  "Felix II"="C:\Program Files\ScreenMates\Felix II\Felix2.exe" [ ]
  "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
  "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-25 22:30 68856]
  "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
  "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "SiSPower"="SiSPower.dll" [2004-09-02 14:47 49152 C:\WINDOWS\system32\SiSPower.dll]
  "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-09-02 14:44 249856]
  "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 19:15 106496]
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
  "dxvid"="c:\windows\system32\dxvid.exe" [ ]
  "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-27 02:01 33792]
  "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-02-08 16:28 155648]
  "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 03:11 50688]
  "barb bits pile drv"="C:\Documents and Settings\All Users\Application Data\Mapi View Barb Bits\name dvd.exe" [ ]
  "gdimx"="c:\windows\system32\gdimx.exe" [ ]
  "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
  "Windows UDP Control"="winudspm.exe" []
  "Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
  "Windows Controls Center"="winudmr.exe" []
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]
  
  C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
  Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-01-10 14:16:47 113664]
  HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24 258048]
  HP Image Zone -pikak„ynnistys.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52 53248]
  Microsoft Office.lnk - C:\Program Files\Office\Office10\OSA.EXE [2004-10-01 02:23:17 83360]
  Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2004-11-24 12:22:22 331776]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "FirewallOverride"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "C:\\Program Files\\DCPlusPlus\\DCPlusPlus.exe"=
  "C:\\Program Files\\Azureus\\Azureus.exe"=
  "C:\\WINDOWS\\system32\\sessmgr.exe"=
  "C:\\Program Files\\mIRC\\mirc.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "C:\\Program Files\\Sony Ericsson\\Update Service\\ma3platform.exe"=
  "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
  "C:\\Program Files\\SopCast\\SopCast.exe"=
  "C:\\Documents and Settings\\Marika\\Application Data\\SopCast\\adv\\SopAdver.exe"=
  "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
  "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
  "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
  
  R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
  R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
  R3 CONAN;CONAN;C:\WINDOWS\system32\drivers\o2mmb.sys [2004-02-12 02:18]
  R3 MbxStby;MbxStby;C:\WINDOWS\system32\drivers\MbxStby.sys [2004-01-28 00:00]
  S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
  S3 PRISM_A00;PRISM 802.11 Driver;C:\WINDOWS\system32\DRIVERS\PRISMA00.sys [2004-07-20 21:16]
  S4 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" []
  
  .
  'Ajoitetut tehtävät'-kansion sisältö
  "2008-06-09 12:00:00 C:\WINDOWS\Tasks\AB1BFCF090B473F8.job"
  - c:\docume~1\marika\applic~1\update\Move Four Dog.exe
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-06-09 15:50:02
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  msnmsgr = "C:\Program Files\MSN Messenger\msnmsgr.exe" /background?g
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  .
  Completion time: 2008-06-09 15:52:53
  ComboFix-quarantined-files.txt 2008-06-09 12:52:19
  ComboFix2.txt 2008-06-09 11:40:42
  ComboFix3.txt 2008-06-09 11:23:20
  ComboFix4.txt 2008-06-09 10:32:28
  ComboFix5.txt 2008-06-09 07:52:44
  
  Pre-Run: 19,500,216,320 tavua vapaana
  Post-Run: 19,509,006,336 tavua vapaana
  
  136   --- E O F ---   2008-05-28 17:02:23
- FixFix
  2008-06-09 19:13:43
  tessa... kirjoitti:
  ComboFix 08-06-07.1 - Marika 2008-06-09 15:46:40.6 - NTFSx86
  Running from: C:\Documents and Settings\Marika\Työpöytä\ComboFix.exe
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  .
  
  ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-09 to 2008-06-09 )))))))))))))))))
  .
  
  2008-06-09 10:39 . 2008-06-09 10:39      d--------   C:\Program Files\Trend Micro
  2008-06-09 09:03 . 2008-06-09 09:26   29,342   --a--c---   C:\ps.exe
  2008-06-09 09:03 . 2008-06-09 13:33   29,342   --a--c---   C:\pf.exe
  2008-06-09 09:03 . 2008-06-09 09:28   29,342   --a--c---   C:\fp.exe
  2008-06-08 22:20 . 2008-06-08 22:20   18,587   --a--c---   C:\Documents and Settings\Marika\packed.exe
  2008-06-08 22:17 . 2008-06-08 22:18   18,587   --a--c---   C:\packed.exe
  2008-05-20 17:07 . 2008-05-20 17:07   118   --a------   C:\WINDOWS\system32\MRT.INI
  
  .
  (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-06-09 12:49   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\Skype
  2008-06-09 12:44   ---------   d-----w   C:\Program Files\Java
  2008-06-09 12:39   ---------   d-----w   C:\Program Files\MSN Messenger
  2008-06-09 09:32   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\skypePM
  2008-06-06 07:50   ---------   d-----w   C:\Program Files\DCPlusPlus
  2008-04-28 10:53   ---------   d-----w   C:\Program Files\Samurize
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Nokia
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\PCSuite
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\Nokia
  2008-04-21 17:05   ---------   d-----w   C:\Program Files\PC Connectivity Solution
  2008-04-21 15:53   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Installations
  2008-04-12 17:14   32   -c--a-w   C:\Documents and Settings\All Users\Application Data\ezsid.dat
  2008-04-12 17:00   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Common Files\Skype
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\dllcache\mswstr10.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\dllcache\msjint40.dll
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\dllcache\win32k.sys
  2007-03-06 13:18   12,628   -c--a-w   C:\Documents and Settings\Marika\Application Data\wklnhst.dat
  2006-01-10 14:53   60,960   -c--a-w   C:\Documents and Settings\Marika\Application Data\GDIPFONTCACHEV1.DAT
  2005-09-29 15:04   774,144   -c--a-w   C:\Program Files\RngInterstitial.dll
  .
  
  ((((((((((((((((((((((((((((( snapshot@2008-06-09_10.06.00.92 )))))))))))))))))))))))))))))))))))))))))
  .
  - 2008-06-09 06:47:50   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 12:28:55   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 12:29:35   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_4dc.dat
  .
  (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  REGEDIT4
  *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
  "Drive Amen"="C:\DOCUME~1\LOCALS~1\APPLIC~1\Update\Bits idol.exe" [ ]
  "Felix II"="C:\Program Files\ScreenMates\Felix II\Felix2.exe" [ ]
  "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
  "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-25 22:30 68856]
  "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
  "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "SiSPower"="SiSPower.dll" [2004-09-02 14:47 49152 C:\WINDOWS\system32\SiSPower.dll]
  "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-09-02 14:44 249856]
  "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 19:15 106496]
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
  "dxvid"="c:\windows\system32\dxvid.exe" [ ]
  "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-27 02:01 33792]
  "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-02-08 16:28 155648]
  "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 03:11 50688]
  "barb bits pile drv"="C:\Documents and Settings\All Users\Application Data\Mapi View Barb Bits\name dvd.exe" [ ]
  "gdimx"="c:\windows\system32\gdimx.exe" [ ]
  "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
  "Windows UDP Control"="winudspm.exe" []
  "Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
  "Windows Controls Center"="winudmr.exe" []
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]
  
  C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
  Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-01-10 14:16:47 113664]
  HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24 258048]
  HP Image Zone -pikak„ynnistys.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52 53248]
  Microsoft Office.lnk - C:\Program Files\Office\Office10\OSA.EXE [2004-10-01 02:23:17 83360]
  Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2004-11-24 12:22:22 331776]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "FirewallOverride"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "C:\\Program Files\\DCPlusPlus\\DCPlusPlus.exe"=
  "C:\\Program Files\\Azureus\\Azureus.exe"=
  "C:\\WINDOWS\\system32\\sessmgr.exe"=
  "C:\\Program Files\\mIRC\\mirc.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "C:\\Program Files\\Sony Ericsson\\Update Service\\ma3platform.exe"=
  "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
  "C:\\Program Files\\SopCast\\SopCast.exe"=
  "C:\\Documents and Settings\\Marika\\Application Data\\SopCast\\adv\\SopAdver.exe"=
  "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
  "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
  "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
  
  R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
  R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
  R3 CONAN;CONAN;C:\WINDOWS\system32\drivers\o2mmb.sys [2004-02-12 02:18]
  R3 MbxStby;MbxStby;C:\WINDOWS\system32\drivers\MbxStby.sys [2004-01-28 00:00]
  S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
  S3 PRISM_A00;PRISM 802.11 Driver;C:\WINDOWS\system32\DRIVERS\PRISMA00.sys [2004-07-20 21:16]
  S4 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" []
  
  .
  'Ajoitetut tehtävät'-kansion sisältö
  "2008-06-09 12:00:00 C:\WINDOWS\Tasks\AB1BFCF090B473F8.job"
  - c:\docume~1\marika\applic~1\update\Move Four Dog.exe
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-06-09 15:50:02
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  msnmsgr = "C:\Program Files\MSN Messenger\msnmsgr.exe" /background?g
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  .
  Completion time: 2008-06-09 15:52:53
  ComboFix-quarantined-files.txt 2008-06-09 12:52:19
  ComboFix2.txt 2008-06-09 11:40:42
  ComboFix3.txt 2008-06-09 11:23:20
  ComboFix4.txt 2008-06-09 10:32:28
  ComboFix5.txt 2008-06-09 07:52:44
  
  Pre-Run: 19,500,216,320 tavua vapaana
  Post-Run: 19,509,006,336 tavua vapaana
  
  136   --- E O F ---   2008-05-28 17:02:23
  Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
  
  [quote]
  
  File::
  C:\ps.exe
  C:\pf.exe
  C:\fp.exe
  C:\Documents and Settings\Marika\packed.exe
  C:\packed.exe
  C:\WINDOWS\Tasks\AB1BFCF090B473F8.job
  
  [/quote]
  
  Tallenna se nimellä CFScript.txt
  
  Sitten raahaa CFScript ComboFix.exeen kuten alla.
  [img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
  
  Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
  
  **********
  
  scannaa myös uusi hjt:n loki
- tessa...
  2008-06-09 20:57:22
  FixFix kirjoitti:
  Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
  
  [quote]
  
  File::
  C:\ps.exe
  C:\pf.exe
  C:\fp.exe
  C:\Documents and Settings\Marika\packed.exe
  C:\packed.exe
  C:\WINDOWS\Tasks\AB1BFCF090B473F8.job
  
  [/quote]
  
  Tallenna se nimellä CFScript.txt
  
  Sitten raahaa CFScript ComboFix.exeen kuten alla.
  [img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
  
  Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
  
  **********
  
  scannaa myös uusi hjt:n loki
  ComboFix 08-06-07.1 - Marika 2008-06-09 20:50:26.7 - NTFSx86
  Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.182 [GMT 3:00]
  Running from: C:\Documents and Settings\Marika\Työpöytä\ComboFix.exe
  Command switches used :: C:\Documents and Settings\Marika\Työpöytä\CFScript.txt
  * Created a new restore point
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  
  FILE ::
  C:\Documents and Settings\Marika\packed.exe
  C:\fp.exe
  C:\packed.exe
  C:\pf.exe
  C:\ps.exe
  C:\WINDOWS\Tasks\AB1BFCF090B473F8.job
  .
  
  (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  C:\Documents and Settings\Marika\packed.exe
  C:\fp.exe
  C:\packed.exe
  C:\pf.exe
  C:\ps.exe
  C:\WINDOWS\Tasks\AB1BFCF090B473F8.job
  
  .
  ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-09 to 2008-06-09 )))))))))))))))))
  .
  
  2008-06-09 10:39 . 2008-06-09 10:39      d--------   C:\Program Files\Trend Micro
  2008-05-20 17:07 . 2008-05-20 17:07   118   --a------   C:\WINDOWS\system32\MRT.INI
  
  .
  (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-06-09 17:53   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\Skype
  2008-06-09 13:01   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\skypePM
  2008-06-09 12:44   ---------   d-----w   C:\Program Files\Java
  2008-06-09 12:39   ---------   d-----w   C:\Program Files\MSN Messenger
  2008-06-06 07:50   ---------   d-----w   C:\Program Files\DCPlusPlus
  2008-04-28 10:53   ---------   d-----w   C:\Program Files\Samurize
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Nokia
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\PCSuite
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\Nokia
  2008-04-21 17:05   ---------   d-----w   C:\Program Files\PC Connectivity Solution
  2008-04-21 15:53   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Installations
  2008-04-12 17:14   32   -c--a-w   C:\Documents and Settings\All Users\Application Data\ezsid.dat
  2008-04-12 17:00   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Common Files\Skype
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\dllcache\mswstr10.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\dllcache\msjint40.dll
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\dllcache\win32k.sys
  2007-03-06 13:18   12,628   -c--a-w   C:\Documents and Settings\Marika\Application Data\wklnhst.dat
  2006-01-10 14:53   60,960   -c--a-w   C:\Documents and Settings\Marika\Application Data\GDIPFONTCACHEV1.DAT
  2005-09-29 15:04   774,144   -c--a-w   C:\Program Files\RngInterstitial.dll
  .
  
  ((((((((((((((((((((((((((((( snapshot@2008-06-09_10.06.00.92 )))))))))))))))))))))))))))))))))))))))))
  .
  - 2008-06-09 06:47:50   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 12:28:55   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 12:29:35   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_4dc.dat
  .
  (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  REGEDIT4
  *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
  "Drive Amen"="C:\DOCUME~1\LOCALS~1\APPLIC~1\Update\Bits idol.exe" [ ]
  "Felix II"="C:\Program Files\ScreenMates\Felix II\Felix2.exe" [ ]
  "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
  "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-25 22:30 68856]
  "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
  "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "SiSPower"="SiSPower.dll" [2004-09-02 14:47 49152 C:\WINDOWS\system32\SiSPower.dll]
  "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-09-02 14:44 249856]
  "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 19:15 106496]
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
  "dxvid"="c:\windows\system32\dxvid.exe" [ ]
  "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-27 02:01 33792]
  "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-02-08 16:28 155648]
  "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 03:11 50688]
  "barb bits pile drv"="C:\Documents and Settings\All Users\Application Data\Mapi View Barb Bits\name dvd.exe" [ ]
  "gdimx"="c:\windows\system32\gdimx.exe" [ ]
  "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
  "Windows UDP Control"="winudspm.exe" []
  "Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
  "Windows Controls Center"="winudmr.exe" []
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]
  
  C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
  Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-01-10 14:16:47 113664]
  HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24 258048]
  HP Image Zone -pikak„ynnistys.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52 53248]
  Microsoft Office.lnk - C:\Program Files\Office\Office10\OSA.EXE [2004-10-01 02:23:17 83360]
  Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2004-11-24 12:22:22 331776]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "FirewallOverride"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "C:\\Program Files\\DCPlusPlus\\DCPlusPlus.exe"=
  "C:\\Program Files\\Azureus\\Azureus.exe"=
  "C:\\WINDOWS\\system32\\sessmgr.exe"=
  "C:\\Program Files\\mIRC\\mirc.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "C:\\Program Files\\Sony Ericsson\\Update Service\\ma3platform.exe"=
  "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
  "C:\\Program Files\\SopCast\\SopCast.exe"=
  "C:\\Documents and Settings\\Marika\\Application Data\\SopCast\\adv\\SopAdver.exe"=
  "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
  "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
  "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
  
  R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
  R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
  R3 CONAN;CONAN;C:\WINDOWS\system32\drivers\o2mmb.sys [2004-02-12 02:18]
  R3 MbxStby;MbxStby;C:\WINDOWS\system32\drivers\MbxStby.sys [2004-01-28 00:00]
  S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
  S3 PRISM_A00;PRISM 802.11 Driver;C:\WINDOWS\system32\DRIVERS\PRISMA00.sys [2004-07-20 21:16]
  S4 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" []
  
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-06-09 20:53:04
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  msnmsgr = "C:\Program Files\MSN Messenger\msnmsgr.exe" /background?g
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  .
  Completion time: 2008-06-09 20:54:36
  ComboFix-quarantined-files.txt 2008-06-09 17:54:28
  ComboFix2.txt 2008-06-09 12:52:54
  ComboFix3.txt 2008-06-09 11:40:42
  ComboFix4.txt 2008-06-09 11:23:20
  ComboFix5.txt 2008-06-09 10:32:28
  
  Pre-Run: 19,399,479,296 tavua vapaana
  Post-Run: 19,455,414,272 tavua vapaana
  
  146   --- E O F ---   2008-05-28 17:02:23
- tessa...
  2008-06-09 20:59:34
  tessa... kirjoitti:
  ComboFix 08-06-07.1 - Marika 2008-06-09 20:50:26.7 - NTFSx86
  Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.182 [GMT 3:00]
  Running from: C:\Documents and Settings\Marika\Työpöytä\ComboFix.exe
  Command switches used :: C:\Documents and Settings\Marika\Työpöytä\CFScript.txt
  * Created a new restore point
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  
  FILE ::
  C:\Documents and Settings\Marika\packed.exe
  C:\fp.exe
  C:\packed.exe
  C:\pf.exe
  C:\ps.exe
  C:\WINDOWS\Tasks\AB1BFCF090B473F8.job
  .
  
  (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  C:\Documents and Settings\Marika\packed.exe
  C:\fp.exe
  C:\packed.exe
  C:\pf.exe
  C:\ps.exe
  C:\WINDOWS\Tasks\AB1BFCF090B473F8.job
  
  .
  ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-09 to 2008-06-09 )))))))))))))))))
  .
  
  2008-06-09 10:39 . 2008-06-09 10:39      d--------   C:\Program Files\Trend Micro
  2008-05-20 17:07 . 2008-05-20 17:07   118   --a------   C:\WINDOWS\system32\MRT.INI
  
  .
  (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-06-09 17:53   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\Skype
  2008-06-09 13:01   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\skypePM
  2008-06-09 12:44   ---------   d-----w   C:\Program Files\Java
  2008-06-09 12:39   ---------   d-----w   C:\Program Files\MSN Messenger
  2008-06-06 07:50   ---------   d-----w   C:\Program Files\DCPlusPlus
  2008-04-28 10:53   ---------   d-----w   C:\Program Files\Samurize
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Nokia
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\PCSuite
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\Nokia
  2008-04-21 17:05   ---------   d-----w   C:\Program Files\PC Connectivity Solution
  2008-04-21 15:53   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Installations
  2008-04-12 17:14   32   -c--a-w   C:\Documents and Settings\All Users\Application Data\ezsid.dat
  2008-04-12 17:00   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Common Files\Skype
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\dllcache\mswstr10.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\dllcache\msjint40.dll
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\dllcache\win32k.sys
  2007-03-06 13:18   12,628   -c--a-w   C:\Documents and Settings\Marika\Application Data\wklnhst.dat
  2006-01-10 14:53   60,960   -c--a-w   C:\Documents and Settings\Marika\Application Data\GDIPFONTCACHEV1.DAT
  2005-09-29 15:04   774,144   -c--a-w   C:\Program Files\RngInterstitial.dll
  .
  
  ((((((((((((((((((((((((((((( snapshot@2008-06-09_10.06.00.92 )))))))))))))))))))))))))))))))))))))))))
  .
  - 2008-06-09 06:47:50   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 12:28:55   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 12:29:35   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_4dc.dat
  .
  (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  REGEDIT4
  *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
  "Drive Amen"="C:\DOCUME~1\LOCALS~1\APPLIC~1\Update\Bits idol.exe" [ ]
  "Felix II"="C:\Program Files\ScreenMates\Felix II\Felix2.exe" [ ]
  "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
  "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-25 22:30 68856]
  "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
  "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "SiSPower"="SiSPower.dll" [2004-09-02 14:47 49152 C:\WINDOWS\system32\SiSPower.dll]
  "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-09-02 14:44 249856]
  "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 19:15 106496]
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
  "dxvid"="c:\windows\system32\dxvid.exe" [ ]
  "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-27 02:01 33792]
  "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-02-08 16:28 155648]
  "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 03:11 50688]
  "barb bits pile drv"="C:\Documents and Settings\All Users\Application Data\Mapi View Barb Bits\name dvd.exe" [ ]
  "gdimx"="c:\windows\system32\gdimx.exe" [ ]
  "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
  "Windows UDP Control"="winudspm.exe" []
  "Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
  "Windows Controls Center"="winudmr.exe" []
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]
  
  C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
  Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-01-10 14:16:47 113664]
  HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24 258048]
  HP Image Zone -pikak„ynnistys.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52 53248]
  Microsoft Office.lnk - C:\Program Files\Office\Office10\OSA.EXE [2004-10-01 02:23:17 83360]
  Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2004-11-24 12:22:22 331776]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "FirewallOverride"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "C:\\Program Files\\DCPlusPlus\\DCPlusPlus.exe"=
  "C:\\Program Files\\Azureus\\Azureus.exe"=
  "C:\\WINDOWS\\system32\\sessmgr.exe"=
  "C:\\Program Files\\mIRC\\mirc.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "C:\\Program Files\\Sony Ericsson\\Update Service\\ma3platform.exe"=
  "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
  "C:\\Program Files\\SopCast\\SopCast.exe"=
  "C:\\Documents and Settings\\Marika\\Application Data\\SopCast\\adv\\SopAdver.exe"=
  "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
  "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
  "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
  
  R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
  R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
  R3 CONAN;CONAN;C:\WINDOWS\system32\drivers\o2mmb.sys [2004-02-12 02:18]
  R3 MbxStby;MbxStby;C:\WINDOWS\system32\drivers\MbxStby.sys [2004-01-28 00:00]
  S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
  S3 PRISM_A00;PRISM 802.11 Driver;C:\WINDOWS\system32\DRIVERS\PRISMA00.sys [2004-07-20 21:16]
  S4 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" []
  
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-06-09 20:53:04
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  msnmsgr = "C:\Program Files\MSN Messenger\msnmsgr.exe" /background?g
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  .
  Completion time: 2008-06-09 20:54:36
  ComboFix-quarantined-files.txt 2008-06-09 17:54:28
  ComboFix2.txt 2008-06-09 12:52:54
  ComboFix3.txt 2008-06-09 11:40:42
  ComboFix4.txt 2008-06-09 11:23:20
  ComboFix5.txt 2008-06-09 10:32:28
  
  Pre-Run: 19,399,479,296 tavua vapaana
  Post-Run: 19,455,414,272 tavua vapaana
  
  146   --- E O F ---   2008-05-28 17:02:23
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 20:58:13, on 9.6.2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\keyhook.exe
  C:\Program Files\Winamp\winampa.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
  C:\Program Files\Skype\Phone\Skype.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\WINDOWS\system32\sistray.exe
  c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
  C:\Program Files\Skype\Plugin Manager\skypePM.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
  C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
  O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
  O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
  O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [dxvid] c:\windows\system32\dxvid.exe /nocomm
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  O4 - HKLM\..\Run: [barb bits pile drv] C:\Documents and Settings\All Users\Application Data\Mapi View Barb Bits\name dvd.exe
  O4 - HKLM\..\Run: [gdimx] c:\windows\system32\gdimx.exe /nocomm
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
  O4 - HKLM\..\Run: [Windows svchost] ups.exe
  O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [Drive Amen] C:\DOCUME~1\LOCALS~1\APPLIC~1\Update\Bits idol.exe
  O4 - HKCU\..\Run: [Felix II] C:\Program Files\ScreenMates\Felix II\Felix2.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
  O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
  O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Global Startup: Adobe Gamma Loader.lnk = ?
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Office\Office10\OSA.EXE
  O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
  
  --
  End of file - 7882 bytes
- FixFix
  2008-06-09 21:23:58
  tessa... kirjoitti:
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 20:58:13, on 9.6.2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\keyhook.exe
  C:\Program Files\Winamp\winampa.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
  C:\Program Files\Skype\Phone\Skype.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\WINDOWS\system32\sistray.exe
  c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
  C:\Program Files\Skype\Plugin Manager\skypePM.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
  C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
  O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
  O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
  O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [dxvid] c:\windows\system32\dxvid.exe /nocomm
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  O4 - HKLM\..\Run: [barb bits pile drv] C:\Documents and Settings\All Users\Application Data\Mapi View Barb Bits\name dvd.exe
  O4 - HKLM\..\Run: [gdimx] c:\windows\system32\gdimx.exe /nocomm
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
  O4 - HKLM\..\Run: [Windows svchost] ups.exe
  O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [Drive Amen] C:\DOCUME~1\LOCALS~1\APPLIC~1\Update\Bits idol.exe
  O4 - HKCU\..\Run: [Felix II] C:\Program Files\ScreenMates\Felix II\Felix2.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
  O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
  O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Global Startup: Adobe Gamma Loader.lnk = ?
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Office\Office10\OSA.EXE
  O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
  
  --
  End of file - 7882 bytes
  
  melkein loppuillaan
  
  scannaa hjt:llä merkkaa paina Fix checked
  
  O4 - HKLM\..\Run: [dxvid] c:\windows\system32\dxvid.exe /nocomm
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [gdimx] c:\windows\system32\gdimx.exe /nocomm
  O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
  O4 - HKLM\..\Run: [Windows svchost] ups.exe
  O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
  O4 - HKCU\..\Run: [Drive Amen] C:\DOCUME~1\LOCALS~1\APPLIC~1\Update\Bits idol.exe
  O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
  
  =============
  
  Kopioi / liitä seuraava teksti alapuolella tyhjään muistioFiluun
  Varmista että tiedoston tyyppi on ”all Files” ja tallenna se Poisto.bat. nimisenä
  työpöydällesi.
  
  @echo off
  sc stop NipSvc
  sc delete NipSvc
  
  Tupla-klikkaa Poisto.bat. filua työpöydälläsi , ikkuna avautuu ja Sulkeutuu tämä on normaalia.
  
  ******
  
  Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
  
  [quote]
  
  File::
  c:\windows\system32\dxvid.exe
  
  Folder::
  C:\Program Files\Viewpoint
  
  [/quote]
  
  Tallenna se nimellä CFScript.txt
  
  Sitten raahaa CFScript ComboFix.exeen kuten alla.
  http://users.pandora.be/bluepatchy/miekiemoes/images/CF Script.gif
  
  Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
tessa...
2008-06-09 23:31:44
ComboFix 08-06-07.1 - Marika 2008-06-09 23:22:32.8 - NTFSx86
Running from: C:\Documents and Settings\Marika\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Marika\Työpöytä\CFScript.txt
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

FILE ::
c:\windows\system32\dxvid.exe
.

((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-09 to 2008-06-09 )))))))))))))))))
.

2008-06-09 10:39 . 2008-06-09 10:39      d--------   C:\Program Files\Trend Micro
2008-05-20 17:07 . 2008-05-20 17:07   118   --a------   C:\WINDOWS\system32\MRT.INI

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-09 20:25   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\Skype
2008-06-09 13:01   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\skypePM
2008-06-09 12:44   ---------   d-----w   C:\Program Files\Java
2008-06-09 12:39   ---------   d-----w   C:\Program Files\MSN Messenger
2008-06-06 07:50   ---------   d-----w   C:\Program Files\DCPlusPlus
2008-04-28 10:53   ---------   d-----w   C:\Program Files\Samurize
2008-04-21 17:08   ---------   d-----w   C:\Program Files\Nokia
2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\PCSuite
2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\Nokia
2008-04-21 17:05   ---------   d-----w   C:\Program Files\PC Connectivity Solution
2008-04-21 15:53   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Installations
2008-04-12 17:14   32   -c--a-w   C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-04-12 17:00   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Skype
2008-04-12 17:00   ---------   d-----w   C:\Program Files\Skype
2008-04-12 17:00   ---------   d-----w   C:\Program Files\Common Files\Skype
2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\dllcache\mswstr10.dll
2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\dllcache\msjint40.dll
2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\dllcache\win32k.sys
2007-03-06 13:18   12,628   -c--a-w   C:\Documents and Settings\Marika\Application Data\wklnhst.dat
2006-01-10 14:53   60,960   -c--a-w   C:\Documents and Settings\Marika\Application Data\GDIPFONTCACHEV1.DAT
2005-09-29 15:04   774,144   -c--a-w   C:\Program Files\RngInterstitial.dll
.

((((((((((((((((((((((((((((( snapshot@2008-06-09_10.06.00.92 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-09 06:47:50   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
2008-06-09 12:28:55   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
2008-06-09 12:29:35   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_4dc.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
"Felix II"="C:\Program Files\ScreenMates\Felix II\Felix2.exe" [ ]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-25 22:30 68856]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSPower"="SiSPower.dll" [2004-09-02 14:47 49152 C:\WINDOWS\system32\SiSPower.dll]
"SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-09-02 14:44 249856]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 19:15 106496]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-27 02:01 33792]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 03:11 50688]
"barb bits pile drv"="C:\Documents and Settings\All Users\Application Data\Mapi View Barb Bits\name dvd.exe" [ ]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"Windows UDP Control"="winudspm.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]

C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-01-10 14:16:47 113664]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24 258048]
HP Image Zone -pikak„ynnistys.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52 53248]
Microsoft Office.lnk - C:\Program Files\Office\Office10\OSA.EXE [2004-10-01 02:23:17 83360]
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2004-11-24 12:22:22 331776]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\DCPlusPlus\\DCPlusPlus.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Sony Ericsson\\Update Service\\ma3platform.exe"=
"C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\Documents and Settings\\Marika\\Application Data\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
R3 CONAN;CONAN;C:\WINDOWS\system32\drivers\o2mmb.sys [2004-02-12 02:18]
R3 MbxStby;MbxStby;C:\WINDOWS\system32\drivers\MbxStby.sys [2004-01-28 00:00]
S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
S3 PRISM_A00;PRISM 802.11 Driver;C:\WINDOWS\system32\DRIVERS\PRISMA00.sys [2004-07-20 21:16]
S4 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" []

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-09 23:25:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
msnmsgr = "C:\Program Files\MSN Messenger\msnmsgr.exe" /background?g

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-09 23:28:18
ComboFix-quarantined-files.txt 2008-06-09 20:27:38
ComboFix2.txt 2008-06-09 17:54:37
ComboFix3.txt 2008-06-09 12:52:54
ComboFix4.txt 2008-06-09 11:40:42
ComboFix5.txt 2008-06-09 11:23:20

Pre-Run: 19,423,854,592 tavua vapaana
Post-Run: 19,413,606,400 tavua vapaana

124   --- E O F ---   2008-05-28 17:02:23
- FixFix
  2008-06-10 00:31:42
  scannaa uusi hjt:n loki
- tessa...
  2008-06-10 08:53:17
  FixFix kirjoitti:
  scannaa uusi hjt:n loki
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 8:52:13, on 10.6.2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\keyhook.exe
  C:\Program Files\Winamp\winampa.exe
  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
  C:\Program Files\Skype\Phone\Skype.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\WINDOWS\system32\sistray.exe
  c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
  C:\Program Files\Skype\Plugin Manager\skypePM.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
  C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
  O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
  O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
  O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  O4 - HKLM\..\Run: [barb bits pile drv] C:\Documents and Settings\All Users\Application Data\Mapi View Barb Bits\name dvd.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [Felix II] C:\Program Files\ScreenMates\Felix II\Felix2.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
  O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
  O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Global Startup: Adobe Gamma Loader.lnk = ?
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Office\Office10\OSA.EXE
  O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
  
  --
  End of file - 7235 bytes
- Fix.Fix
  2008-06-10 13:03:51
  tessa... kirjoitti:
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 8:52:13, on 10.6.2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\keyhook.exe
  C:\Program Files\Winamp\winampa.exe
  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
  C:\Program Files\Skype\Phone\Skype.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\WINDOWS\system32\sistray.exe
  c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
  C:\Program Files\Skype\Plugin Manager\skypePM.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
  C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
  O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
  O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
  O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  O4 - HKLM\..\Run: [barb bits pile drv] C:\Documents and Settings\All Users\Application Data\Mapi View Barb Bits\name dvd.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [Felix II] C:\Program Files\ScreenMates\Felix II\Felix2.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
  O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
  O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Global Startup: Adobe Gamma Loader.lnk = ?
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Office\Office10\OSA.EXE
  O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
  
  --
  End of file - 7235 bytes
  scannaa hjt:llä merkkaa paina Fix checked
  
  O4 - HKLM\..\Run: [barb bits pile drv] C:\Documents and Settings\All Users\Application Data\Mapi View Barb Bits\name dvd.exe
  O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
  O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
  
  *********
  
  otas uusi combofix loki
  ja hjt:n loki
- tessa...
  2008-06-10 14:40:32
  Fix.Fix kirjoitti:
  scannaa hjt:llä merkkaa paina Fix checked
  
  O4 - HKLM\..\Run: [barb bits pile drv] C:\Documents and Settings\All Users\Application Data\Mapi View Barb Bits\name dvd.exe
  O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
  O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
  
  *********
  
  otas uusi combofix loki
  ja hjt:n loki
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 14:39:31, on 10.6.2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\keyhook.exe
  C:\Program Files\Winamp\winampa.exe
  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
  C:\Program Files\Skype\Phone\Skype.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\WINDOWS\system32\sistray.exe
  c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
  C:\Program Files\Skype\Plugin Manager\skypePM.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
  C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
  O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
  O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
  O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [Felix II] C:\Program Files\ScreenMates\Felix II\Felix2.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
  O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
  O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Global Startup: Adobe Gamma Loader.lnk = ?
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Office\Office10\OSA.EXE
  O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
  
  --
  End of file - 6942 bytes
- tessa...
  2008-06-10 14:48:45
  tessa... kirjoitti:
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 14:39:31, on 10.6.2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\keyhook.exe
  C:\Program Files\Winamp\winampa.exe
  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
  C:\Program Files\Skype\Phone\Skype.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\WINDOWS\system32\sistray.exe
  c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
  C:\Program Files\Skype\Plugin Manager\skypePM.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
  C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
  O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
  O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
  O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [Felix II] C:\Program Files\ScreenMates\Felix II\Felix2.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
  O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
  O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Global Startup: Adobe Gamma Loader.lnk = ?
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Office\Office10\OSA.EXE
  O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
  
  --
  End of file - 6942 bytes
  ComboFix 08-06-07.1 - Marika 2008-06-10 14:41:30.9 - NTFSx86
  Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.145 [GMT 3:00]
  Running from: C:\Documents and Settings\Marika\Työpöytä\ComboFix.exe
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  .
  
  ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-10 to 2008-06-10 )))))))))))))))))
  .
  
  2008-06-09 10:39 . 2008-06-09 10:39      d--------   C:\Program Files\Trend Micro
  2008-05-20 17:07 . 2008-05-20 17:07   118   --a------   C:\WINDOWS\system32\MRT.INI
  
  .
  (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-06-10 11:30   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\Skype
  2008-06-10 05:04   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\skypePM
  2008-06-09 12:44   ---------   d-----w   C:\Program Files\Java
  2008-06-09 12:39   ---------   d-----w   C:\Program Files\MSN Messenger
  2008-06-06 07:50   ---------   d-----w   C:\Program Files\DCPlusPlus
  2008-04-28 10:53   ---------   d-----w   C:\Program Files\Samurize
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Nokia
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\PCSuite
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\Nokia
  2008-04-21 17:05   ---------   d-----w   C:\Program Files\PC Connectivity Solution
  2008-04-21 15:53   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Installations
  2008-04-12 17:14   32   -c--a-w   C:\Documents and Settings\All Users\Application Data\ezsid.dat
  2008-04-12 17:00   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Common Files\Skype
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\dllcache\mswstr10.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\dllcache\msjint40.dll
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\dllcache\win32k.sys
  2007-03-06 13:18   12,628   -c--a-w   C:\Documents and Settings\Marika\Application Data\wklnhst.dat
  2006-01-10 14:53   60,960   -c--a-w   C:\Documents and Settings\Marika\Application Data\GDIPFONTCACHEV1.DAT
  2005-09-29 15:04   774,144   -c--a-w   C:\Program Files\RngInterstitial.dll
  .
  
  ((((((((((((((((((((((((((((( snapshot@2008-06-09_10.06.00.92 )))))))))))))))))))))))))))))))))))))))))
  .
  - 2008-06-09 06:47:50   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 12:28:55   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 12:29:35   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_4dc.dat
  .
  (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  REGEDIT4
  *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
  "Felix II"="C:\Program Files\ScreenMates\Felix II\Felix2.exe" [ ]
  "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
  "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-25 22:30 68856]
  "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
  "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "SiSPower"="SiSPower.dll" [2004-09-02 14:47 49152 C:\WINDOWS\system32\SiSPower.dll]
  "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-09-02 14:44 249856]
  "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 19:15 106496]
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
  "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-27 02:01 33792]
  "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 03:11 50688]
  "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]
  
  C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
  Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-01-10 14:16:47 113664]
  HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24 258048]
  HP Image Zone -pikak„ynnistys.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52 53248]
  Microsoft Office.lnk - C:\Program Files\Office\Office10\OSA.EXE [2004-10-01 02:23:17 83360]
  Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2004-11-24 12:22:22 331776]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "FirewallOverride"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "C:\\Program Files\\DCPlusPlus\\DCPlusPlus.exe"=
  "C:\\Program Files\\Azureus\\Azureus.exe"=
  "C:\\WINDOWS\\system32\\sessmgr.exe"=
  "C:\\Program Files\\mIRC\\mirc.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "C:\\Program Files\\Sony Ericsson\\Update Service\\ma3platform.exe"=
  "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
  "C:\\Program Files\\SopCast\\SopCast.exe"=
  "C:\\Documents and Settings\\Marika\\Application Data\\SopCast\\adv\\SopAdver.exe"=
  "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
  "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
  "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
  
  R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
  R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
  R3 CONAN;CONAN;C:\WINDOWS\system32\drivers\o2mmb.sys [2004-02-12 02:18]
  R3 MbxStby;MbxStby;C:\WINDOWS\system32\drivers\MbxStby.sys [2004-01-28 00:00]
  S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
  S3 PRISM_A00;PRISM 802.11 Driver;C:\WINDOWS\system32\DRIVERS\PRISMA00.sys [2004-07-20 21:16]
  S4 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" []
  
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-06-10 14:43:45
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  msnmsgr = "C:\Program Files\MSN Messenger\msnmsgr.exe" /background?g
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  .
  Completion time: 2008-06-10 14:45:17
  ComboFix-quarantined-files.txt 2008-06-10 11:45:07
  ComboFix2.txt 2008-06-09 20:28:19
  ComboFix3.txt 2008-06-09 17:54:37
  ComboFix4.txt 2008-06-09 12:52:54
  ComboFix5.txt 2008-06-09 11:40:42
  
  Pre-Run: 19,329,961,984 tavua vapaana
  Post-Run: 19,404,079,104 tavua vapaana
  
  119   --- E O F ---   2008-05-28 17:02:23
- Fix.Fix
  2008-06-10 14:54:19
  tessa... kirjoitti:
  ComboFix 08-06-07.1 - Marika 2008-06-10 14:41:30.9 - NTFSx86
  Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.145 [GMT 3:00]
  Running from: C:\Documents and Settings\Marika\Työpöytä\ComboFix.exe
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  .
  
  ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-10 to 2008-06-10 )))))))))))))))))
  .
  
  2008-06-09 10:39 . 2008-06-09 10:39      d--------   C:\Program Files\Trend Micro
  2008-05-20 17:07 . 2008-05-20 17:07   118   --a------   C:\WINDOWS\system32\MRT.INI
  
  .
  (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-06-10 11:30   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\Skype
  2008-06-10 05:04   ---------   dc----w   C:\Documents and Settings\Marika\Application Data\skypePM
  2008-06-09 12:44   ---------   d-----w   C:\Program Files\Java
  2008-06-09 12:39   ---------   d-----w   C:\Program Files\MSN Messenger
  2008-06-06 07:50   ---------   d-----w   C:\Program Files\DCPlusPlus
  2008-04-28 10:53   ---------   d-----w   C:\Program Files\Samurize
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Nokia
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\PCSuite
  2008-04-21 17:08   ---------   d-----w   C:\Program Files\Common Files\Nokia
  2008-04-21 17:05   ---------   d-----w   C:\Program Files\PC Connectivity Solution
  2008-04-21 15:53   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Installations
  2008-04-12 17:14   32   -c--a-w   C:\Documents and Settings\All Users\Application Data\ezsid.dat
  2008-04-12 17:00   ---------   dc----w   C:\Documents and Settings\All Users\Application Data\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Skype
  2008-04-12 17:00   ---------   d-----w   C:\Program Files\Common Files\Skype
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
  2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\dllcache\mswstr10.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
  2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\dllcache\msjint40.dll
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
  2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\dllcache\win32k.sys
  2007-03-06 13:18   12,628   -c--a-w   C:\Documents and Settings\Marika\Application Data\wklnhst.dat
  2006-01-10 14:53   60,960   -c--a-w   C:\Documents and Settings\Marika\Application Data\GDIPFONTCACHEV1.DAT
  2005-09-29 15:04   774,144   -c--a-w   C:\Program Files\RngInterstitial.dll
  .
  
  ((((((((((((((((((((((((((((( snapshot@2008-06-09_10.06.00.92 )))))))))))))))))))))))))))))))))))))))))
  .
  - 2008-06-09 06:47:50   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 12:28:55   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-09 12:29:35   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_4dc.dat
  .
  (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  REGEDIT4
  *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
  "Felix II"="C:\Program Files\ScreenMates\Felix II\Felix2.exe" [ ]
  "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
  "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-25 22:30 68856]
  "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
  "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "SiSPower"="SiSPower.dll" [2004-09-02 14:47 49152 C:\WINDOWS\system32\SiSPower.dll]
  "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-09-02 14:44 249856]
  "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 19:15 106496]
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
  "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2005-10-27 02:01 33792]
  "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 03:11 50688]
  "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
  "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]
  
  C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
  Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-01-10 14:16:47 113664]
  HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24 258048]
  HP Image Zone -pikak„ynnistys.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52 53248]
  Microsoft Office.lnk - C:\Program Files\Office\Office10\OSA.EXE [2004-10-01 02:23:17 83360]
  Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2004-11-24 12:22:22 331776]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "FirewallOverride"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "C:\\Program Files\\DCPlusPlus\\DCPlusPlus.exe"=
  "C:\\Program Files\\Azureus\\Azureus.exe"=
  "C:\\WINDOWS\\system32\\sessmgr.exe"=
  "C:\\Program Files\\mIRC\\mirc.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "C:\\Program Files\\Sony Ericsson\\Update Service\\ma3platform.exe"=
  "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
  "C:\\Program Files\\SopCast\\SopCast.exe"=
  "C:\\Documents and Settings\\Marika\\Application Data\\SopCast\\adv\\SopAdver.exe"=
  "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
  "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
  "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
  
  R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
  R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
  R3 CONAN;CONAN;C:\WINDOWS\system32\drivers\o2mmb.sys [2004-02-12 02:18]
  R3 MbxStby;MbxStby;C:\WINDOWS\system32\drivers\MbxStby.sys [2004-01-28 00:00]
  S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
  S3 PRISM_A00;PRISM 802.11 Driver;C:\WINDOWS\system32\DRIVERS\PRISMA00.sys [2004-07-20 21:16]
  S4 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" []
  
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-06-10 14:43:45
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  msnmsgr = "C:\Program Files\MSN Messenger\msnmsgr.exe" /background?g
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  .
  Completion time: 2008-06-10 14:45:17
  ComboFix-quarantined-files.txt 2008-06-10 11:45:07
  ComboFix2.txt 2008-06-09 20:28:19
  ComboFix3.txt 2008-06-09 17:54:37
  ComboFix4.txt 2008-06-09 12:52:54
  ComboFix5.txt 2008-06-09 11:40:42
  
  Pre-Run: 19,329,961,984 tavua vapaana
  Post-Run: 19,404,079,104 tavua vapaana
  
  119   --- E O F ---   2008-05-28 17:02:23
  Lataa tuolta http://www.ccleaner.com/download/builds.aspx
  CCleaner v2.05.555- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
  
  laita asetukset näin:
  Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.
  
  aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
  aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi

Ketjusta on poistettu 1 sääntöjenvastaista viestiä.

Takaisin ylös

Luetuimmat keskustelut

Kotkalainen Demari Riku Pirinen vangittu Saksassa lapsipornosta
https://www.kymensanomat.fi/paikalliset/8081054 Kotkalainen Demari Riku Pirinen vangittu Saksassa lapsipornon hallussapi
20.11.2024 20:43Kotka
128
3170
Vanhalle ukon rähjälle
Satutit mua niin paljon kun erottiin. Oletko todella niin itsekäs että kuvittelet että huolisin sut kaiken tapahtuneen
21.11.2024 00:39Ikävä
38
2523
Olen tosi outo....
Päättelen palstajuttujen perusteella mitä mieltä minun kaipauksen kohde minusta on. Joskus kuvittelen tänne selkeitä tap
20.11.2024 00:07Ikävä
30
2435
Maisa on SALAKUVATTU huumepoliisinsa kanssa!
https://www.seiska.fi/vain-seiskassa/ensimmainen-yhteiskuva-maisa-torpan-ja-poliisikullan-lahiorakkaus-roihuaa/1525663
21.11.2024 09:27Kotimaiset julkkisjuorut
113
2198
Oletko sä luovuttanut
Mun suhteeni
20.11.2024 22:38Ikävä
114
1700
Nurmossa kuoli 2 Lasta..
Autokolarissa. Näin kertovat iltapäivälehdet juuri nyt. 22.11. Ja aina ennen Joulua näitä tulee. . .
22.11.2024 12:41Seinäjoki
27
1468
Hommaatko kinkkua jouluksi?
Itse tein pakastimeen n. 3Kg:n murekkeen sienillä ja juustokuorrutuksella. Voihan se olla, että jonkun pienen, valmiin k
20.11.2024 06:48Sinkut
173
1410
Mikko Koivu yrittää pestä mustan valkoiseksi
Ilmeisesti huomannut, että Helenan tukijoukot kasvaa kasvamistaan. Riistakamera paljasti hiljattain kylmän totuuden Mi
21.11.2024 20:14Kotimaiset julkkisjuorut
291
1277
Aatteleppa ite!
Jos ei oltaisikaan nyt NATOssa, olisimme puolueettomana sivustakatsojia ja elelisimme tyytyväisenä rauhassa maassamme.
20.11.2024 17:34Maailman menoa
292
1248
Onko se ikä
Alkanut haitata?
20.11.2024 03:29Ikävä
63
1090

Vastaukset

tessa... kirjoitti:

FixFix kirjoitti:

tessa... kirjoitti:

FixFix kirjoitti:

tessa... kirjoitti:

FixFix kirjoitti:

tessa... kirjoitti:

FixFix kirjoitti:

tessa... kirjoitti:

tessa... kirjoitti:

FixFix kirjoitti:

tessa... kirjoitti:

FixFix kirjoitti:

tessa... kirjoitti:

FixFix kirjoitti:

tessa... kirjoitti:

tessa... kirjoitti:

FixFix kirjoitti:

tessa... kirjoitti:

Fix.Fix kirjoitti:

tessa... kirjoitti:

tessa... kirjoitti:

Luetuimmat keskustelut

Kotkalainen Demari Riku Pirinen vangittu Saksassa lapsipornosta

Vanhalle ukon rähjälle

Olen tosi outo....

Maisa on SALAKUVATTU huumepoliisinsa kanssa!

Oletko sä luovuttanut

Nurmossa kuoli 2 Lasta..

Hommaatko kinkkua jouluksi?

Mikko Koivu yrittää pestä mustan valkoiseksi

Aatteleppa ite!

Onko se ikä