tässä ois hjt-Logi...onko mitää erityistä???
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [C6501Sound] RunDll32 C6501.cpl,CMICtrlWnd
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O13 - Gopher Prefix:
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://dev.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD42/JSCDL/jre/6u6-b90/jinstall-6u6-windows-i586-jc.cab?e=1213364393649&h=7f51bc705a4818a7da27880a995888eb/&filename=jinstall-6u6-windows-i586-jc.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
--
End of file - 4562 bytes
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [C6501Sound] RunDll32 C6501.cpl,CMICtrlWnd
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O13 - Gopher Prefix:
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://dev.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD42/JSCDL/jre/6u6-b90/jinstall-6u6-windows-i586-jc.cab?e=1213364393649&h=7f51bc705a4818a7da27880a995888eb/&filename=jinstall-6u6-windows-i586-jc.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
--
End of file - 4562 bytes
Vastaukset 9
Vanhimmat
vistan lokilta
onko ongelmaa
kone tuppaa sammuilee,vaikka on lämmöt on kohallaan ja ei ole viruksia yms.
ja on vistan loki....
enpä oikeen usko tuota.
1.Lataa combofix.exe työpöydällesi yhdestä, kahdesta klinkistä:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
^^^^^^
Lataa Malwarebytes' Anti-Malware työpöydällesi.
http://www.besttechie.net/tools/mbam-setup.exe
• Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
• Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes' Anti-Malware ja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Finish.
• Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
• Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
• Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
• Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
• Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
• Lähetä lokin sisältö seuraavassa viestissäsi.
Tos on toi combofix-loki..kohta laitan sen toisenkin lokin...
ComboFix 08-06-16.5 - Tommizki 2008-06-18 16:03:14.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1035.18.805 [GMT 3:00]
Running from: C:\Users\Tommizki\Downloads\ComboFix2.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-18 to 2008-06-18 )))))))))))))))))
.
2008-06-18 16:00 . 2008-06-18 16:02 d-------- C:\327882R2FWJFW
2008-06-18 14:31 . 2008-06-18 14:31 d-------- C:\Program Files\Trend Micro
2008-06-17 20:24 . 2008-06-18 13:37 d-------- C:\Program Files\Wolfenstein - Enemy Territory
2008-06-17 16:57 . 2008-06-17 16:57 d-------- C:\Program Files\ToniArts
2008-06-17 13:49 . 2008-06-17 13:49 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-06-17 13:16 . 2008-05-10 06:35 885,248 --a------ C:\Windows\System32\RacEngn.dll
2008-06-17 13:16 . 2008-05-10 01:22 9,127 --a------ C:\Windows\System32\RacUR.xml
2008-06-17 13:16 . 2008-05-10 01:22 153 --a------ C:\Windows\System32\RacUREx.xml
2008-06-15 20:37 . 2008-06-16 13:33 d-------- C:\Users\Tommizki\AppData\Roaming\BSplayer Pro
2008-06-15 20:37 . 2008-06-16 13:32 d-------- C:\Program Files\Webteh
2008-06-15 18:43 . 2008-06-16 17:03 d--h----- C:\$AVG8.VAULT$
2008-06-15 18:35 . 2008-06-15 20:29 d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-06-15 18:35 . 2008-06-15 20:29 d-------- C:\ProgramData\Spybot - Search & Destroy
2008-06-15 18:13 . 2008-06-17 19:52 d-------- C:\Program Files\Azureus
2008-06-15 13:47 . 2008-06-15 13:47 45 --a------ C:\Windows\System32\initdebug.nfo
2008-06-15 13:41 . 2008-06-15 20:40 d-------- C:\Program Files\Common Files\PX Storage Engine
2008-06-14 15:38 . 2008-06-14 15:38 d-------- C:\PerfLogs
2008-06-14 13:51 . 2008-06-14 13:51 dr------- C:\Users\Public\Recorded TV
2008-06-14 13:45 . 2008-01-19 10:35 9,847,296 --a------ C:\Windows\System32\NlsData000a.dll
2008-06-14 13:44 . 2008-01-19 09:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL
2008-06-14 13:43 . 2008-01-19 10:33 599,552 --a------ C:\Windows\System32\vsp1cln.exe
2008-06-14 13:43 . 2008-01-19 10:36 357,888 --a------ C:\Windows\System32\wbemcomn.dll
2008-06-14 13:43 . 2008-01-05 14:31 145,455 --a------ C:\Windows\System32\perfmon.msc
2008-06-14 13:43 . 2008-01-05 14:22 144,909 --a------ C:\Windows\System32\fsmgmt.msc
2008-06-14 13:43 . 2008-01-05 14:34 15,181 --a------ C:\Windows\System32\gatherWirelessInfo.vbs
2008-06-14 13:43 . 2008-01-05 14:21 12,198 --a------ C:\Windows\System32\gatherWiredInfo.vbs
2008-06-14 13:43 . 2008-01-05 14:31 3 --a------ C:\Windows\System32\drivers\MsftWdf_Kernel_01007_Inbox_Critical.Wdf
2008-06-14 13:42 . 2008-01-19 10:36 704,512 --a------ C:\Windows\System32\SmiEngine.dll
2008-06-14 13:42 . 2008-01-19 10:36 218,624 --a------ C:\Windows\System32\wdscore.dll
2008-06-14 13:42 . 2008-01-19 10:36 139,264 --a------ C:\Windows\System32\SmiInstaller.dll
2008-06-14 13:42 . 2008-01-19 10:33 130,560 --a------ C:\Windows\System32\PkgMgr.exe
2008-06-14 13:41 . 2008-01-19 10:34 305,152 --a------ C:\Windows\System32\msdelta.dll
2008-06-14 13:41 . 2008-01-19 10:34 258,560 --a------ C:\Windows\System32\dpx.dll
2008-06-14 13:41 . 2008-01-19 10:34 246,784 --a------ C:\Windows\System32\drvstore.dll
2008-06-14 13:41 . 2008-01-19 10:35 35,328 --a------ C:\Windows\System32\mspatcha.dll
2008-06-14 11:21 . 2008-06-14 11:21 d-------- C:\Program Files\AeriaGames
2008-06-14 03:00 . 2008-06-13 16:03 d-------- C:\Windows\Panther
2008-06-14 03:00 . 2008-06-14 16:19 d--hs---- C:\Boot
2008-06-14 03:00 . 2008-01-19 10:45 333,203 -rahs---- C:\bootmgr
2008-06-14 03:00 . 2008-06-14 03:00 8,192 -ra-s---- C:\BOOTSECT.BAK
2008-06-14 02:59 . 2008-06-18 14:29 435,392 --a------ C:\Windows\System32\perfh00B.dat
2008-06-14 02:59 . 2008-06-14 02:58 274,158 --a------ C:\Windows\System32\perfi00B.dat
2008-06-14 02:59 . 2008-06-18 14:29 80,514 --a------ C:\Windows\System32\perfc00B.dat
2008-06-14 02:59 . 2008-06-14 02:58 36,790 --a------ C:\Windows\System32\perfd00B.dat
2008-06-14 02:58 . 2008-06-14 16:14 d-------- C:\Windows\System32\fi
2008-06-14 02:58 . 2008-06-14 16:13 d-------- C:\Windows\System32\drivers\fi-FI
2008-06-14 02:58 . 2008-06-14 02:58 d-------- C:\Windows\fi-FI
2008-06-13 19:56 . 2008-06-18 16:04 d-------- C:\Users\Tommizki\AppData\Roaming\Azureus
2008-06-13 19:56 . 2008-06-13 19:56 d-------- C:\Users\All Users\Azureus
2008-06-13 19:56 . 2008-06-13 19:56 d-------- C:\ProgramData\Azureus
2008-06-13 18:51 . 2008-06-17 21:01 23,352 --a------ C:\Windows\System32\drivers\PnkBstrK.sys
2008-06-13 18:51 . 2008-06-13 18:52 22,328 --a------ C:\Users\Tommizki\AppData\Roaming\PnkBstrK.sys
2008-06-13 18:50 . 2008-06-13 18:52 674,600 --a------ C:\Windows\System32\pbsvc.exe
2008-06-13 18:50 . 2008-06-17 21:00 107,832 --a------ C:\Windows\System32\PnkBstrB.exe
2008-06-13 18:50 . 2008-06-13 18:52 66,872 --a------ C:\Windows\System32\PnkBstrA.exe
2008-06-13 18:45 . 2008-06-13 18:45 d-------- C:\Windows\nvidia icons
2008-06-13 18:44 . 2008-06-13 18:44 d-------- C:\Users\Tommizki\{0e204056-aa62-49f6-a748-8f23c8553522}
2008-06-13 18:44 . 2008-06-13 18:44 d-------- C:\NVIDIA
2008-06-13 18:38 . 2008-06-13 18:50 d-------- C:\Users\All Users\NVIDIA
2008-06-13 18:38 . 2008-06-13 18:50 d-------- C:\ProgramData\NVIDIA
2008-06-13 18:35 . 2007-09-12 05:28 1,073,152 --a------ C:\Windows\System32\nvcpluir.dll
2008-06-13 18:35 . 2008-05-02 22:46 768,544 --a------ C:\Windows\System32\nvcplui.exe
2008-06-13 18:35 . 2008-05-02 22:46 420,384 --a------ C:\Windows\System32\nvcpl.cpl
2008-06-13 18:35 . 2008-05-02 22:46 313,888 --a------ C:\Windows\System32\nvexpbar.dll
2008-06-13 18:34 . 2008-06-13 18:34 d-------- C:\Program Files\Microsoft Silverlight
2008-06-13 18:27 . 2008-06-13 18:27 dr------- C:\Users\Public\Videos
2008-06-13 18:27 . 2008-06-13 18:27 dr------- C:\Users\Public\Pictures
2008-06-13 18:27 . 2008-06-13 18:27 dr------- C:\Users\Public\Downloads
2008-06-13 18:27 . 2008-06-14 13:51 dr------- C:\Users\Public\Documents
2008-06-13 18:20 . 2008-04-14 19:51 171,136 -rahs---- C:\grldr
2008-06-13 17:21 . 2008-06-13 17:21 1,820 --a------ C:\Windows\System32\rasctrnm.h
2008-06-13 17:16 . 2008-06-17 16:57 d--h----- C:\Program Files\InstallShield Installation Information
2008-06-13 17:16 . 2008-06-13 17:16 d-------- C:\Program Files\EA GAMES
2008-06-13 17:15 . 2008-06-14 14:49 d-------- C:\Program Files\Common Files\InstallShield
2008-06-13 17:08 . 2008-01-19 10:34 15,872 --a------ C:\Windows\System32\hcrstco.dll
2008-06-13 17:08 . 2006-11-02 12:46 8,704 --a------ C:\Windows\System32\hccoin.dll
2008-06-13 17:07 . 2008-06-13 17:07 d-------- C:\Program Files\CCleaner
2008-06-13 17:05 . 2008-06-13 17:05 988,216 --a------ C:\Windows\System32\winload.exe
2008-06-13 17:05 . 2008-06-13 17:05 927,288 --a------ C:\Windows\System32\winresume.exe
2008-06-13 17:05 . 2008-06-13 17:05 615,992 --a------ C:\Windows\System32\ci.dll
2008-06-13 17:05 . 2008-06-13 17:05 378,368 --a------ C:\Windows\System32\srcore.dll
2008-06-13 17:05 . 2008-06-13 17:05 318,464 --a------ C:\Windows\System32\rstrui.exe
2008-06-13 17:05 . 2008-06-13 17:05 46,592 --a------ C:\Windows\System32\setbcdlocale.dll
2008-06-13 17:05 . 2008-06-13 17:05 40,960 --a------ C:\Windows\System32\srclient.dll
2008-06-13 17:05 . 2008-06-13 17:05 19,000 --a------ C:\Windows\System32\kd1394.dll
2008-06-13 17:05 . 2008-06-13 17:05 14,848 --a------ C:\Windows\System32\srdelayed.exe
2008-06-13 17:05 . 2008-06-13 17:05 6,656 --a------ C:\Windows\System32\kbd106n.dll
2008-06-13 17:04 . 2008-06-13 17:04 2,032,128 --a------ C:\Windows\System32\win32k.sys
2008-06-13 17:03 . 2008-06-13 17:03 295,936 --a------ C:\Windows\System32\gdi32.dll
2008-06-13 17:00 . 2008-06-13 17:00 113,664 --a------ C:\Windows\System32\drivers\rmcast.sys
2008-06-13 17:00 . 2008-06-13 17:00 14,848 --a------ C:\Windows\System32\wshrm.dll
2008-06-13 16:59 . 2008-06-13 16:59 4,240,384 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-06-13 16:59 . 2008-06-13 16:59 1,695,744 --a------ C:\Windows\System32\gameux.dll
2008-06-13 16:57 . 2008-06-13 16:57 1,314,816 --a------ C:\Windows\System32\quartz.dll
2008-06-13 16:57 . 2008-06-13 16:57 428,544 --a------ C:\Windows\System32\EncDec.dll
2008-06-13 16:57 . 2008-06-13 16:57 293,376 --a------ C:\Windows\System32\psisdecd.dll
2008-06-13 16:57 . 2008-06-13 16:57 218,624 --a------ C:\Windows\System32\psisrndr.ax
2008-06-13 16:57 . 2008-06-13 16:57 80,896 --a------ C:\Windows\System32\MSNP.ax
2008-06-13 16:57 . 2008-06-13 16:57 69,632 --a------ C:\Windows\System32\Mpeg2Data.ax
2008-06-13 16:57 . 2008-06-13 16:57 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
2008-06-13 16:55 . 2008-06-13 16:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-06-13 16:55 . 2008-06-13 16:55 826,880 --a------ C:\Windows\System32\wininet.dll
2008-06-13 16:50 . 2008-06-13 18:27 dr------- C:\Users\Public\Music
2008-06-13 16:50 . 2008-06-14 13:51 dr------- C:\Users\Public
2008-06-13 16:41 . 2008-06-13 16:41 d-------- C:\Windows\Sun
2008-06-13 16:41 . 2008-06-17 19:51 d-------- C:\Users\Tommizki\AppData\Roaming\LimeWire
2008-06-13 16:39 . 2008-06-13 16:40 d-------- C:\Program Files\Java
2008-06-13 16:38 . 2008-06-13 16:38 d-------- C:\Program Files\Common Files\Java
2008-06-13 16:36 . 2008-06-13 16:37 d-------- C:\Program Files\LimeWire
2008-06-13 16:35 . 2008-06-14 14:03 d-------- C:\Program Files\SystemRequirementsLab
2008-06-13 16:33 . 2008-06-13 18:24 d-------- C:\Windows\System32\Macromed
2008-06-13 16:22 . 2008-06-13 16:22 d-------- C:\Windows\PCHEALTH
2008-06-13 16:21 . 2008-06-18 13:15 d-------- C:\Windows\System32\drivers\Avg
2008-06-13 16:21 . 2008-06-13 16:21 d-------- C:\Users\All Users\avg8
2008-06-13 16:21 . 2008-06-13 16:21 d-------- C:\ProgramData\avg8
2008-06-13 16:21 . 2008-06-13 16:21 d-------- C:\Program Files\AVG
2008-06-13 16:21 . 2008-06-13 16:21 96,520 --a------ C:\Windows\System32\drivers\avgldx86.sys
2008-06-13 16:21 . 2008-06-13 16:21 67,080 --a------ C:\Windows\System32\drivers\avgwfpx.sys
2008-06-13 16:21 . 2008-06-13 16:21 10,520 --a------ C:\Windows\System32\avgrsstx.dll
2008-06-13 16:18 . 2008-06-14 08:54 d-------- C:\Program Files\Windows Live
2008-06-13 16:18 . 2008-06-13 16:22 d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-13 16:17 . 2008-06-14 20:27 d--hs---- C:\Windows\Installer
2008-06-13 16:17 . 2008-06-13 16:17 d-------- C:\Users\All Users\WLInstaller
2008-06-13 16:17 . 2008-06-13 16:17 d-------- C:\ProgramData\WLInstaller
2008-06-13 16:13 . 2008-06-15 13:40 dr------- C:\Users\Tommizki\Videos
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-14 13:26 65,536 ----a-w C:\Windows\VMix.dll
2008-06-14 13:25 65,536 ----a-w C:\Windows\System32\CmiInstallResAll.dll
2008-06-14 13:25 53,248 ----a-w C:\Windows\System32\C6501rm.dll
2008-06-14 13:25 450,560 ----a-w C:\Windows\System32\Cmeau6501.exe
2008-06-14 13:25 32,768 ----a-w C:\Windows\System32\c6501prop.dll
2008-06-14 13:25 319,968 ----a-w C:\Windows\difxapi.dll
2008-06-14 13:25 253,952 ----a-w C:\Windows\System32\C6501rm.exe
2008-06-14 13:25 1,307,136 ----a-w C:\Windows\system32\drivers\c6501.sys
2008-06-14 13:19 174 --sha-w C:\Program Files\desktop.ini
2008-06-14 13:14 --------- d-----w C:\Program Files\Windows Sidebar
2008-06-14 13:14 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-06-14 13:14 --------- d-----w C:\Program Files\Windows Mail
2008-06-14 13:14 --------- d-----w C:\Program Files\Windows Journal
2008-06-14 13:14 --------- d-----w C:\Program Files\Windows Defender
2008-06-14 13:14 --------- d-----w C:\Program Files\Windows Collaboration
2008-06-14 13:14 --------- d-----w C:\Program Files\Windows Calendar
2008-06-14 10:56 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-06-14 10:56 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-06-13 13:59 540,672 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-06-13 13:59 458,752 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-06-13 13:59 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-06-13 13:59 2,153,984 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-06-13 13:59 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-06-13 13:06 --------- d-sh--w C:\ProgramData\Työpöytä
2008-06-13 13:06 --------- d-sh--w C:\ProgramData\Tiedostot
2008-06-13 13:06 --------- d-sh--w C:\ProgramData\Suosikit
2008-06-13 13:06 --------- d-sh--w C:\ProgramData\Mallit
2008-06-13 13:06 --------- d-sh--w C:\ProgramData\Käynnistä-valikko
2008-04-30 14:27 442,368 ----a-w C:\Windows\System32\nvuninst.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 10:33 125952]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 10:33 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-13 16:21 1177368]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-05-02 22:46 13535776]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-05-02 22:46 92704]
"C6501Sound"="C6501.cpl" []
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1767069443-2483686561-2689103795-1000]
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{FEE99A1E-C133-4791-B4B7-80E40036206B}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe
"{E6D07F5B-E5F9-4CEF-B56C-8CE2E2DF98E7}"= C:\Program Files\AVG\AVG8\avgemc.exe:avgemc.exe
"{93783360-FA38-41BE-B14C-D758A662DC61}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{771692C1-B26C-432F-A027-B8BFB486C007}"= UDP:C:\Program Files\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2
"{1DF61EF6-83CD-45AE-B98B-944BDF90F59C}"= TCP:C:\Program Files\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2
"TCP Query User{41F8C50C-8B6B-48AA-9799-0EE22CC5013D}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{A6935FB3-A589-45DA-873C-D994353D59CA}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{8EC4443E-314C-4457-A8D0-98FC7E94377B}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{663BD8A5-3E9F-41F7-8588-7D9D8825F4AF}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{F5DC2323-6739-4F94-BBF6-68822629C6C4}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{8CC20BE6-0C30-4B9E-93A1-C98BE0662472}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"TCP Query User{C5F018D7-413F-4F49-AB0C-623C6DC52547}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus
"UDP Query User{BBA140A8-8854-462B-B65E-352304ADCF25}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus
"TCP Query User{E1E653D1-0E9E-4134-9593-38CBF757AF3E}C:\\program files\\america's army\\system\\armyops.exe"= UDP:C:\program files\america's army\system\armyops.exe:ArmyOps
"UDP Query User{8E43A207-5089-4EBD-A2FD-8F990CE00E49}C:\\program files\\america's army\\system\\armyops.exe"= TCP:C:\program files\america's army\system\armyops.exe:ArmyOps
"{048DC7A1-158E-4445-A441-2BCBDD195B68}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{F2C72B85-A45A-427A-A5A7-34B18D5D0832}"= UDP:C:\Program Files\AeriaGames\ProjectTorque\ProjectTorque.bin:Project Torque
"{0265BD08-C153-4870-B18E-2AADD871E82B}"= TCP:C:\Program Files\AeriaGames\ProjectTorque\ProjectTorque.bin:Project Torque
"TCP Query User{8600DF80-2E8A-4FE8-82DC-084B499D54A6}C:\\users\\tommizki\\documents\\azureus downloads\\unreal tournament\\unrealtournament\\system\\unrealtournament.exe"= UDP:C:\users\tommizki\documents\azureus downloads\unreal tournament\unrealtournament\system\unrealtournament.exe:unrealtournament.exe
"UDP Query User{D25CD49C-B727-47A0-903F-469EC1553B5C}C:\\users\\tommizki\\documents\\azureus downloads\\unreal tournament\\unrealtournament\\system\\unrealtournament.exe"= TCP:C:\users\tommizki\documents\azureus downloads\unreal tournament\unrealtournament\system\unrealtournament.exe:unrealtournament.exe
"TCP Query User{B5860986-A84A-48C0-B6B2-535CDF59C955}C:\\program files\\wolfenstein - enemy territory\\et.exe"= UDP:C:\program files\wolfenstein - enemy territory\et.exe:ET
"UDP Query User{2C9F2AD8-BED2-497B-BD2D-C5769D849E3E}C:\\program files\\wolfenstein - enemy territory\\et.exe"= TCP:C:\program files\wolfenstein - enemy territory\et.exe:ET
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-06-13 16:21]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-13 16:21]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-13 16:21]
R3 AvgWfpX;AVG8 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfpx.sys [2008-06-13 16:21]
R3 c65013264;C-Media CM6501 Like Sound UDAX Interface;C:\Windows\system32\drivers\c6501.sys [2008-06-14 16:25]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-18 16:04:55
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-18 16:05:34
ComboFix-quarantined-files.txt 2008-06-18 13:05:31
Pre-Run: 474,360,692,736 tavua vapaana
Post-Run: 474,383,863,808 tavua vapaana
228 --- E O F --- 2008-06-18 10:18:29
C:\327882R2FWJFW
joo tos ois malware-loki.(Tsekkaan vielä ne lämmöt)
Malwarebytes' Anti-Malware 1.17
Tietokantaversio: 867
16:31:55 18.6.2008
mbam-log-6-18-2008 (16-31-55).txt
Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 128445
Kulunut aika: 16 minute(s), 26 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)
ainii ja pöytäkone on....(ite koottu)
Katoin speedfanilla ja siel oli tällei:
System:38C
CPU:36C
AUX:36C
HD0:43C
Core:13C
ihan hyvät ovat nuo