Olen ollut erään hakkerin kohteena jo jonkinaikaa, näkyiskä täsä logissa mitään? jos ei niin taitava hakkeri on osannut asiansa.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:25:06, on 2008/07/20
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal
Running processes:
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Users\Omistaja\Downloads\Privm\Privacy Mantra 2.04\privacymantra.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\conime.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Omistaja\Downloads\hijackthis_v2.0.2\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_framework.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [com.codeode.privacymantra] "C:\Users\Omistaja\Downloads\Privm\Privacy Mantra 2.04\privacymantra.exe" -minimized
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Users\Omistaja\Downloads\SUPERAntiSpyware\SUPERAntiSpyware.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: HP-leikekirja - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart -valitse - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dll
O13 - Gopher Prefix:
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/fi-fi/wlscctrl2.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E1E73B44-2D20-47A9-9CA2-B534CEBBF856} - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EDFAD4E3-43E7-4F22-85AE-EC991C433CD5}: NameServer = 195.197.54.100 195.74.0.47
O20 - Winlogon Notify: !SASWinLogon - C:\Users\Omistaja\Downloads\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 7577 bytes
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:25:06, on 2008/07/20
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal
Running processes:
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Users\Omistaja\Downloads\Privm\Privacy Mantra 2.04\privacymantra.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\conime.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Omistaja\Downloads\hijackthis_v2.0.2\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_framework.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [com.codeode.privacymantra] "C:\Users\Omistaja\Downloads\Privm\Privacy Mantra 2.04\privacymantra.exe" -minimized
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Users\Omistaja\Downloads\SUPERAntiSpyware\SUPERAntiSpyware.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: HP-leikekirja - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart -valitse - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dll
O13 - Gopher Prefix:
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/fi-fi/wlscctrl2.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E1E73B44-2D20-47A9-9CA2-B534CEBBF856} - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EDFAD4E3-43E7-4F22-85AE-EC991C433CD5}: NameServer = 195.197.54.100 195.74.0.47
O20 - Winlogon Notify: !SASWinLogon - C:\Users\Omistaja\Downloads\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 7577 bytes
Vastaukset 18
Vanhimmat
sulla on sielä koneella f-securee ja nortonia
scannaa hjt:llä merkkaa paina Fix checked
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
Nortonia ei pitäisi enää olla kun vaihdoin f-secureen poistin kyllä nortonin, mutta jos siitä jäi näköjään jotain jäämiä jonnekkin.
Merkkasin ja fixasin kyllä nuo
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
mutta se ei fixannut noitä eli edelleen ovat siellä.
Avaa Windows Defender.
Klikkaa Tools ja General Settings.
Selaa alas ja ota rasti pois Turn on real-time protection (recommended)-kohdasta.
Tämän jälkeen klikkaa Save ja sulje Windows Defender.
että ei ole päällä
===========
sitten poista koneelta
SUPERAntiSpyware
poista myös kansio
==========
fiksaa sen jälkeen annetut rivit
pitää olla valvojan oikeudet
Eipä nuokaan ohjeet autteneet.
hjt:n loki
ennnen kun scannaat uuden hjt:n lokin poista ensin vanhat hjt:n lokit
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:34:23, on 2008/07/21
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\Omistaja\Downloads\Privm\Privacy Mantra 2.04\privacymantra.exe
C:\Program Files\FirefoxPreloader\FirefoxPreloader.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\conime.exe
C:\Program Files\Mobile Partner\Mobile Partner.exe
C:\Users\Omistaja\Downloads\hijackthis_v2.0.2\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_framework.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ErrorSmart] C:\Program Files\ErrorSmart\ErrorSmart.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [com.codeode.privacymantra] "C:\Users\Omistaja\Downloads\Privm\Privacy Mantra 2.04\privacymantra.exe" -minimized
O4 - Global Startup: Firefox Preloader.lnk = C:\Program Files\FirefoxPreloader\FirefoxPreloader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: HP-leikekirja - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart -valitse - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dll
O13 - Gopher Prefix:
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/fi-fi/wlscctrl2.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E1E73B44-2D20-47A9-9CA2-B534CEBBF856} - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BDD8D80A-1E8E-4EE5-A058-86BB5AC7616F}: NameServer = 195.197.54.100 195.74.0.47
O20 - Winlogon Notify: !SASWinLogon - C:\Windows\
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 7163 bytes
ErrorSmart
C:\Program Files\>> ErrorSmart
1.Lataa combofix.exe työpöydällesi yhdestä, kahdesta klinkistä:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
================
Lataa Malwarebytes' Anti-Malware työpöydällesi.
http://www.besttechie.net/tools/mbam-setup.exe
• Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
• Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes' Anti-Malware ja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Finish.
• Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
• Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
• Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
• Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
• Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
• Lähetä lokin sisältö seuraavassa viestissäsi.
Tässä ainakin tämä comboxin logi.. Malwarebytes' Anti-Malware minulla jo on ja olen ajanut sen läpi päivittäin eikä ole löytynyt mitään. Tuo Error smart ohjelman pitäisi korjailla koneesta löytyviä vikoja.
ComboFix 08-07-21.1 - Omistaja 2008-07-22 8:52:27.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1035.18.1140 [GMT 3:00]
Running from: C:\Users\Omistaja\Downloads\ComboFix.exe\ComboFix.exe
* Created a new restore point
* Resident AV is active
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\system32\AutoRun.inf
C:\Windows\system32\KBL.LOG
.
((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-06-22 to 2008-07-22 )))))))))))))))))
.
2008-07-21 11:48 . 2008-07-21 11:48 d-------- C:\Program Files\FirefoxPreloader
2008-07-21 11:48 . 2005-01-19 05:15 28,672 --a------ C:\Windows\System32\regclass.dll
2008-07-20 19:50 . 2008-07-20 19:50 d-------- C:\Users\Omistaja\AppData\Roaming\PeerNetworking
2008-07-20 16:40 . 2008-07-21 19:34 d-------- C:\Users\Omistaja\AppData\Roaming\Vidalia
2008-07-20 16:40 . 2008-07-21 19:34 d-------- C:\Users\Omistaja\AppData\Roaming\tor
2008-07-20 16:40 . 2008-07-21 14:20 d-------- C:\Program Files\Vidalia Bundle
2008-07-20 14:28 . 2008-07-20 14:28 d-------- C:\Users\Omistaja\AppData\Roaming\Adobe(146)
2008-07-20 13:06 . 2008-07-20 13:07 d-------- C:\Program Files\Java
2008-07-19 17:13 . 2008-07-18 19:15 36,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-07-18 13:00 . 2008-07-21 10:13 118 --a------ C:\error.htm
2008-07-18 13:00 . 2008-07-21 10:00 0 --a------ C:\infect.htm
2008-07-10 12:10 . 2008-06-26 03:33 11,722,752 --a------ C:\Windows\System32\NlsLexicons0001.dll
2008-07-07 10:45 . 2008-07-19 15:02 d-------- C:\Users\Omistaja\AppData\Roaming\F-Secure
2008-07-07 10:32 . 2007-05-25 16:15 572,784 --a------ C:\Windows\System32\msvcp50.dll
2008-07-07 10:32 . 2008-07-07 11:18 60,064 --a------ C:\Windows\System32\drivers\fsdfw.sys
2008-07-07 10:32 . 2007-05-25 16:09 35,024 --a------ C:\Windows\System32\drivers\fses.sys
2008-07-07 10:31 . 2008-07-07 10:32 d-------- C:\Users\All Users\F-Secure
2008-07-07 10:31 . 2008-07-07 10:32 d-------- C:\ProgramData\F-Secure
2008-07-07 10:30 . 2008-07-07 10:30 d-------- C:\Users\All Users\fssg
2008-07-07 10:30 . 2008-07-07 10:30 d-------- C:\ProgramData\fssg
2008-07-07 10:30 . 2008-07-07 11:22 d-------- C:\Program Files\F-Secure Internet Security
2008-07-06 14:07 . 2008-07-06 14:07 0 --a------ C:\Windows\WB.ini
2008-07-06 14:06 . 2008-07-06 14:06 29 --a------ C:\Windows\.wb4
2008-07-05 10:18 . 2008-07-05 10:18 d-------- C:\Program Files\Belarc
2008-07-04 15:31 . 2008-07-05 10:51 d-------- C:\Program Files\ErrorSmart
2008-07-04 14:01 . 2008-07-04 14:01 d-------- C:\Users\Omistaja\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-07-04 14:00 . 2008-07-21 10:14 d-------- C:\Program Files\Common Files\Adobe AIR
2008-07-04 13:36 . 2008-07-04 13:36 d-------- C:\Program Files\HELPCOMP
2008-07-04 10:54 . 2008-07-05 10:51 d-------- C:\Users\Omistaja\AppData\Roaming\ErrorSmart
2008-07-03 21:06 . 2008-07-03 21:06 d-------- C:\Program Files\MSECache
2008-07-03 20:59 . 2007-02-19 00:11 296,960 --a------ C:\Windows\winhlp32.exe
2008-07-03 20:59 . 2007-02-19 00:11 194,560 --a------ C:\Windows\System32\ftsrch.dll
2008-07-03 20:59 . 2007-02-19 00:11 9,728 --a------ C:\Windows\System32\ftlx041e.dll
2008-07-03 20:59 . 2007-02-19 00:11 9,216 --a------ C:\Windows\System32\ftlx0411.dll
2008-07-03 20:55 . 2008-07-03 20:55 d-------- C:\Program Files\WGAPluginInstall
2008-07-02 16:55 . 2008-07-21 11:44 d-------- C:\Program Files\Foxit Software
2008-07-01 17:11 . 2008-07-01 17:19 d-------- C:\Program Files\Windows Live Safety Center
2008-06-30 16:54 . 2008-06-30 16:54 d-------- C:\Users\Omistaja\AppData\Roaming\IObit
2008-06-29 18:59 . 2008-04-17 10:45 12,800 --a------ C:\Windows\System32\drivers\elrawdsk.sys
2008-06-29 18:59 . 2008-06-29 18:59 406 --a------ C:\Windows\System32\ioloBootDefrag.cfg
2008-06-29 18:57 . 2008-06-29 18:57 74,703 --a------ C:\Windows\System32\mfc45.dll
2008-06-29 18:53 . 2008-07-03 17:33 d-------- C:\Users\Omistaja\AppData\Roaming\iolo
2008-06-29 18:53 . 2008-06-29 18:59 d-------- C:\Users\All Users\iolo
2008-06-29 18:53 . 2008-06-29 18:59 d-------- C:\ProgramData\iolo
2008-06-29 18:44 . 2008-06-29 18:44 818 --a------ C:\prefs.js
2008-06-29 12:18 . 2008-06-29 12:18 0 --a------ C:\Windows\System32\tviresource.val
2008-06-28 10:32 . 2008-06-28 10:32 d-------- C:\Users\Omistaja\AppData\Roaming\Malwarebytes
2008-06-28 10:32 . 2008-06-28 10:32 d-------- C:\Users\All Users\Malwarebytes
2008-06-28 10:32 . 2008-06-28 10:32 d-------- C:\ProgramData\Malwarebytes
2008-06-28 10:32 . 2008-07-18 19:15 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-06-28 09:22 . 2008-06-28 09:22 d-------- C:\Users\All Users\SUPERAntiSpyware.com
2008-06-28 09:22 . 2008-06-28 09:22 d-------- C:\ProgramData\SUPERAntiSpyware.com
2008-06-28 09:16 . 2008-06-28 09:16 d-------- C:\Users\Omistaja\AppData\Roaming\SUPERAntiSpyware.com
2008-06-28 09:14 . 2008-07-21 10:14 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-26 18:22 . 2008-06-26 18:22 d-------- C:\Program Files\Ultima
2008-06-26 18:22 . 2008-06-26 18:22 d-------- C:\Program Files\Common Files\Crystal Decisions
2008-06-23 17:00 . 2008-06-23 17:00 d-------- C:\Program Files\Free Registry Cleaner for Vista
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-21 14:30 27,620 ----a-w C:\Users\Omistaja\AppData\Roaming\nvModes.dat
2008-07-21 11:20 --------- d-----w C:\Program Files\Vidalia Bundle
2008-07-21 11:15 --------- d-----w C:\Program Files\Symantec
2008-07-21 07:14 --------- d-----w C:\Program Files\Eusing Free Registry Cleaner
2008-07-21 07:13 1,252 ----a-w C:\Program Files\F-SECURE
2008-07-10 09:01 4 ----a-w C:\Users\Omistaja\AppData\Roaming\wklnhst.dat
2008-07-09 12:08 174 --sha-w C:\Program Files\desktop.ini
2008-07-09 12:00 --------- d-----w C:\Program Files\Windows Mail
2008-07-07 07:25 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-07-07 07:19 --------- d-----w C:\ProgramData\Symantec
2008-07-06 08:17 --------- d-----w C:\ProgramData\CyberLink
2008-07-04 11:55 --------- d-----w C:\Program Files\Hewlett-Packard
2008-07-04 10:28 --------- d-----w C:\Users\Omistaja\AppData\Roaming\Hewlett-Packard
2008-07-04 09:12 --------- d-----w C:\ProgramData\HP Product Assistant
2008-07-03 17:16 --------- d-----w C:\Program Files\CyberLink YouCam
2008-07-03 16:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-03 16:28 --------- d-----w C:\Program Files\CyberLink
2008-07-03 14:33 --------- d-----w C:\Users\Omistaja\AppData\Roaming\HPAppData
2008-06-30 14:01 --------- d-----w C:\Users\Omistaja\AppData\Roaming\CyberLink
2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-06-16 16:59 --------- d-----w C:\Program Files\Common Files\Java
2008-06-15 16:38 --------- d-----w C:\Users\Omistaja\AppData\Roaming\InstallShield
2008-06-06 06:03 --------- d-----w C:\Program Files\Sun
2008-05-25 17:28 --------- d-----w C:\Program Files\Windows Live
2008-05-25 17:27 --------- d-----w C:\ProgramData\WLInstaller
2008-05-25 14:03 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-23 08:37 --------- d-----w C:\Program Files\MMEDIA
2008-05-17 16:04 2,560 ----a-w C:\Windows\_MSRSTRT.EXE
2008-05-12 13:23 615,424 ----a-w C:\Windows\System32\themeui.dll
2008-05-12 13:23 240,640 ----a-w C:\Windows\System32\uxtheme.dll
2008-05-10 03:30 14,848 ----a-w C:\Windows\System32\wshrm.dll
2008-05-08 10:17 737,280 ----a-w C:\Windows\iun6002.exe
2008-05-07 16:53 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-05-07 16:53 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2008-05-07 16:52 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-05-07 16:52 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-05-07 16:52 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-05-07 16:52 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-05-07 16:52 299,008 ----a-w C:\Windows\System32\wlansec.dll
2008-05-07 16:52 289,280 ----a-w C:\Windows\System32\wlanmsm.dll
2008-05-07 16:52 2,923,520 ----a-w C:\Windows\explorer.exe
2008-05-07 16:52 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-05-07 16:49 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-05-07 16:49 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-05-07 16:49 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-05-07 16:49 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-05-07 16:48 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-05-07 16:48 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-05-07 16:47 8,704 ----a-w C:\Windows\System32\hcrstco.dll
2008-05-07 16:47 8,704 ----a-w C:\Windows\System32\hccoin.dll
2008-05-07 16:46 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-05-07 16:46 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-05-07 16:46 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-05-07 16:42 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2008-05-07 16:42 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2008-05-07 16:42 2,048 ----a-w C:\Windows\System32\asferror.dll
2008-05-07 16:42 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2008-05-07 16:41 296,448 ----a-w C:\Windows\System32\gdi32.dll
2008-05-07 16:40 84,480 ----a-w C:\Windows\System32\INETRES.dll
2008-05-07 16:40 737,792 ----a-w C:\Windows\System32\inetcomm.dll
2008-05-07 16:40 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-05-07 16:38 83,968 ----a-w C:\Windows\System32\dnsrslvr.dll
2008-05-07 16:38 24,576 ----a-w C:\Windows\System32\dnscacheugc.exe
2008-05-07 16:37 788,992 ----a-w C:\Windows\System32\rpcrt4.dll
2008-05-07 16:34 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-05-07 12:24 53,080 ----a-w C:\Windows\System32\wuauclt.exe
2008-05-07 12:24 43,352 ----a-w C:\Windows\System32\wups2.dll
2008-05-07 12:24 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll
2008-05-07 12:24 1,524,224 ----a-w C:\Windows\System32\wucltux.dll
2008-05-07 12:23 80,896 ----a-w C:\Windows\System32\wudriver.dll
2008-05-07 12:23 549,720 ----a-w C:\Windows\System32\wuapi.dll
2008-05-07 12:23 33,624 ----a-w C:\Windows\System32\wups.dll
2008-05-07 12:22 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-05-07 12:22 163,000 ----a-w C:\Windows\System32\wuwebv.dll
2008-04-26 13:14 58,792 ------w C:\Windows\System32\wbload.dll
2008-04-26 13:14 42,672 ------w C:\Windows\System32\wbsys.dll
2008-04-26 08:02 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-04-25 04:23 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-04-25 04:23 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-04-25 04:23 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-04-25 04:22 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-04-23 04:27 428,032 ----a-w C:\Windows\System32\EncDec.dll
2008-04-23 04:27 292,352 ----a-w C:\Windows\System32\psisdecd.dll
2008-04-23 04:27 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
.
(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-30 02:41 222128]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 15:36 201728]
"com.codeode.privacymantra"="C:\Users\Omistaja\Downloads\Privm\Privacy Mantra 2.04\privacymantra.exe" [2007-07-07 17:39 917504]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 19:47 480560]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-09 02:53 311296]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-19 23:05 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-19 23:05 8497696]
"UCam_Menu"="C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-16 23:13 218408]
"F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" [2007-05-25 16:12 183208]
"F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
"ErrorSmart"="C:\Program Files\ErrorSmart\ErrorSmart.exe" [2008-06-19 12:21 16094456]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Firefox Preloader.lnk - C:\Program Files\FirefoxPreloader\FirefoxPreloader.exe [2008-07-21 11:48:44 98304]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MaxRecentDocs"= 11 (0xb)
"NoStartMenuMFUprogramsList"= 0 (0x0)
"DisallowCpl"= 1 (0x1)
"ForceClassicControlPanel"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DCF507BC-F4FE-4A10-A155-BD56F59B76C6}"= C:\Program Files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{A75005BA-799F-4B6B-956C-D2803211827E}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{40C526D0-F95E-468C-B928-6DFF76851610}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{2A0DC6CF-9D00-4EBF-A1D7-E03346C7D1F0}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{A8113235-2143-49E8-95F0-8A2A636B7DBA}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{68116645-3020-41E2-BA70-8C3C220CB78F}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R1 ElRawDisk;ElRawDisk;C:\Windows\system32\drivers\elrawdsk.sys [2008-04-17 10:45]
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-07-07 11:17]
R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2007-05-25 16:09]
R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys [2008-07-07 11:18]
R1 fsvista;F-Secure Vista Support Driver;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsvista.sys [2007-05-25 16:08]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 16:08]
R3 HpqRemHid;HP Remote Control HID Device;C:\Windows\system32\DRIVERS\HpqRemHid.sys [2007-07-11 21:30]
S3 dtvBDADEV;Digital TV stick USB 2.0 BDA;C:\Windows\system32\Drivers\dtvbdadrv.sys [2005-07-21 20:50]
S3 dtvLOAD;Digital TV stick Firmware Loader;C:\Windows\system32\DRIVERS\dtvloadp.sys [2005-07-21 20:20]
S3 MODRC;Ultima Infrared Receiver;C:\Windows\system32\DRIVERS\modrc.sys [2007-02-06 12:10]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 16:09]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 16:09]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8238dcfc-1c2e-11dd-88e9-001e6826fd5b}]
\shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8238dd58-1c2e-11dd-88e9-001e6826fd5b}]
\shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84bf3f4b-1da8-11dd-ad76-001e6826fd5b}]
\shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e755cd33-1a8e-11dd-927c-001e6826fd5b}]
\shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e755cd48-1a8e-11dd-927c-001e6826fd5b}]
\shell\AutoRun\command - F:\AutoRun.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
'Ajoitetut teht„v„t'-kansion sis„lt”
"2008-07-04 15:22:50 C:\Windows\Tasks\ErrorSmart Scheduled Scan.job"
- C:\Program Files\ErrorSmart\ErrorSmart.ex
- C:\Program Files\ErrorSmart
"2008-07-22 05:58:58 C:\Windows\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\F-Secure Internet Security\Anti-Virus\fsav.exee /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-Secure Internet Security\Anti-Virus\report.txt 2C:\PROGRA~1\F-Secure Internet Security\Anti-Virus.SYSTEM/F-Secure Anti-Virus -ohjelman lis„„m„ teht„v„.
.
- - - - ORPHANS REMOVED - - - -
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
Notify-!SASWinLogon - (no file)
Notify-WBSrv - (no file)
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.fi/
R0 -: HKLM-Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-22 09:00:00
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\Windows\Explorer.exe
-> ?:\Windows\system32\iertutil.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Program Files\DigitalPersona\Bin\DpHostW.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\FWES\program\fsdfwd.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
C:\Windows\System32\conime.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
C:\Windows\System32\drivers\XAudio.exe
C:\Windows\System32\dllhost.exe
.
**************************************************************************
.
Completion time: 2008-07-22 9:03:10 - machine was rebooted [Omistaja]
ComboFix-quarantined-files.txt 2008-07-22 06:02:59
Pre-Run: 184,430,587,904 tavua vapaana
Post-Run: 184,430,809,088 tavua vapaana
306 --- E O F --- 2008-07-16 12:01:52
Avaa Muistio ja kopioi/liitä viivojen välistä sisältö sinne:
____________
File::
C:\error.htm
C:\infect.htm
Folder::
C:\Program Files\ErrorSmart
C:\Program Files\Symantec
C:\Program Files\Common Files\Symantec Shared
C:\ProgramData\Symantec
_____________
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
Malwarebytes' Anti-Malware ja aja sen jälkeen
Kumma että jäänteitä näkyy µTorrentista, vaikka olen poistanut kys. ohjelman pois koneelta.
ComboFix 08-07-21.1 - Omistaja 2008-07-22 15:35:02.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1035.18.1100 [GMT 3:00]
Running from: C:\Users\Omistaja\Downloads\ComboFix.exe\ComboFix.exe
Command switches used :: C:\Users\Omistaja\Desktop\CFScript.txt
* Created a new restore point
* Resident AV is active
FILE ::
C:\error.htm
C:\infect.htm
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\error.htm
C:\infect.htm
C:\Program Files\Common Files\Symantec Shared
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll
C:\Program Files\Common Files\Symantec Shared\Help\LuMuiHelp\fallback.dat
C:\Program Files\Common Files\Symantec Shared\SPManifests\LuSymProtect.grd
C:\Program Files\Common Files\Symantec Shared\SPManifests\LuSymProtect.sig
C:\Program Files\Common Files\Symantec Shared\SPManifests\LuSymProtect.spm
C:\Program Files\Common Files\Symantec Shared\Support Controls\SymXPep2.dll
C:\Program Files\ErrorSmart
C:\Program Files\ErrorSmart\DataBase.ref
C:\Program Files\ErrorSmart\ErrorSmart.exe
C:\Program Files\ErrorSmart\ErrorSmart.url
C:\Program Files\ErrorSmart\RegCleaner.dll
C:\Program Files\ErrorSmart\TCL.dll
C:\Program Files\ErrorSmart\zlib.dll
C:\Program Files\Symantec
C:\ProgramData\Symantec
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-06-22 to 2008-07-22 )))))))))))))))))
.
2008-07-21 11:48 . 2008-07-21 11:48 d-------- C:\Program Files\FirefoxPreloader
2008-07-21 11:48 . 2005-01-19 05:15 28,672 --a------ C:\Windows\System32\regclass.dll
2008-07-20 19:50 . 2008-07-20 19:50 d-------- C:\Users\Omistaja\AppData\Roaming\PeerNetworking
2008-07-20 16:40 . 2008-07-22 12:23 d-------- C:\Users\Omistaja\AppData\Roaming\Vidalia
2008-07-20 16:40 . 2008-07-22 12:23 d-------- C:\Users\Omistaja\AppData\Roaming\tor
2008-07-20 16:40 . 2008-07-21 14:20 d-------- C:\Program Files\Vidalia Bundle
2008-07-20 14:28 . 2008-07-20 14:28 d-------- C:\Users\Omistaja\AppData\Roaming\Adobe(146)
2008-07-20 13:06 . 2008-07-20 13:07 d-------- C:\Program Files\Java
2008-07-19 17:13 . 2008-07-20 20:21 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-07-10 12:10 . 2008-06-26 03:33 11,722,752 --a------ C:\Windows\System32\NlsLexicons0001.dll
2008-07-07 10:45 . 2008-07-19 15:02 d-------- C:\Users\Omistaja\AppData\Roaming\F-Secure
2008-07-07 10:32 . 2007-05-25 16:15 572,784 --a------ C:\Windows\System32\msvcp50.dll
2008-07-07 10:32 . 2008-07-07 11:18 60,064 --a------ C:\Windows\System32\drivers\fsdfw.sys
2008-07-07 10:32 . 2007-05-25 16:09 35,024 --a------ C:\Windows\System32\drivers\fses.sys
2008-07-07 10:31 . 2008-07-07 10:32 d-------- C:\Users\All Users\F-Secure
2008-07-07 10:31 . 2008-07-07 10:32 d-------- C:\ProgramData\F-Secure
2008-07-07 10:30 . 2008-07-07 10:30 d-------- C:\Users\All Users\fssg
2008-07-07 10:30 . 2008-07-07 10:30 d-------- C:\ProgramData\fssg
2008-07-07 10:30 . 2008-07-07 11:22 d-------- C:\Program Files\F-Secure Internet Security
2008-07-06 14:07 . 2008-07-06 14:07 0 --a------ C:\Windows\WB.ini
2008-07-06 14:06 . 2008-07-06 14:06 29 --a------ C:\Windows\.wb4
2008-07-05 10:18 . 2008-07-05 10:18 d-------- C:\Program Files\Belarc
2008-07-04 14:01 . 2008-07-04 14:01 d-------- C:\Users\Omistaja\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-07-04 14:00 . 2008-07-21 10:14 d-------- C:\Program Files\Common Files\Adobe AIR
2008-07-04 13:36 . 2008-07-04 13:36 d-------- C:\Program Files\HELPCOMP
2008-07-04 10:54 . 2008-07-05 10:51 d-------- C:\Users\Omistaja\AppData\Roaming\ErrorSmart
2008-07-03 21:06 . 2008-07-03 21:06 d-------- C:\Program Files\MSECache
2008-07-03 20:59 . 2007-02-19 00:11 296,960 --a------ C:\Windows\winhlp32.exe
2008-07-03 20:59 . 2007-02-19 00:11 194,560 --a------ C:\Windows\System32\ftsrch.dll
2008-07-03 20:59 . 2007-02-19 00:11 9,728 --a------ C:\Windows\System32\ftlx041e.dll
2008-07-03 20:59 . 2007-02-19 00:11 9,216 --a------ C:\Windows\System32\ftlx0411.dll
2008-07-03 20:55 . 2008-07-03 20:55 d-------- C:\Program Files\WGAPluginInstall
2008-07-02 16:55 . 2008-07-21 11:44 d-------- C:\Program Files\Foxit Software
2008-07-01 17:11 . 2008-07-01 17:19 d-------- C:\Program Files\Windows Live Safety Center
2008-06-30 16:54 . 2008-06-30 16:54 d-------- C:\Users\Omistaja\AppData\Roaming\IObit
2008-06-29 18:59 . 2008-04-17 10:45 12,800 --a------ C:\Windows\System32\drivers\elrawdsk.sys
2008-06-29 18:59 . 2008-06-29 18:59 406 --a------ C:\Windows\System32\ioloBootDefrag.cfg
2008-06-29 18:57 . 2008-06-29 18:57 74,703 --a------ C:\Windows\System32\mfc45.dll
2008-06-29 18:53 . 2008-07-03 17:33 d-------- C:\Users\Omistaja\AppData\Roaming\iolo
2008-06-29 18:53 . 2008-06-29 18:59 d-------- C:\Users\All Users\iolo
2008-06-29 18:53 . 2008-06-29 18:59 d-------- C:\ProgramData\iolo
2008-06-29 18:44 . 2008-06-29 18:44 818 --a------ C:\prefs.js
2008-06-29 12:18 . 2008-06-29 12:18 0 --a------ C:\Windows\System32\tviresource.val
2008-06-28 10:32 . 2008-06-28 10:32 d-------- C:\Users\Omistaja\AppData\Roaming\Malwarebytes
2008-06-28 10:32 . 2008-06-28 10:32 d-------- C:\Users\All Users\Malwarebytes
2008-06-28 10:32 . 2008-06-28 10:32 d-------- C:\ProgramData\Malwarebytes
2008-06-28 10:32 . 2008-07-20 20:21 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-06-28 09:22 . 2008-06-28 09:22 d-------- C:\Users\All Users\SUPERAntiSpyware.com
2008-06-28 09:22 . 2008-06-28 09:22 d-------- C:\ProgramData\SUPERAntiSpyware.com
2008-06-28 09:16 . 2008-06-28 09:16 d-------- C:\Users\Omistaja\AppData\Roaming\SUPERAntiSpyware.com
2008-06-28 09:14 . 2008-07-21 10:14 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-26 18:22 . 2008-06-26 18:22 d-------- C:\Program Files\Ultima
2008-06-26 18:22 . 2008-06-26 18:22 d-------- C:\Program Files\Common Files\Crystal Decisions
2008-06-23 17:00 . 2008-06-23 17:00 d-------- C:\Program Files\Free Registry Cleaner for Vista
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-22 09:56 9,397 ----a-w C:\Program Files\F-SECURE
2008-07-21 14:30 27,620 ----a-w C:\Users\Omistaja\AppData\Roaming\nvModes.dat
2008-07-21 11:20 --------- d-----w C:\Program Files\Vidalia Bundle
2008-07-21 07:14 --------- d-----w C:\Program Files\Eusing Free Registry Cleaner
2008-07-10 09:01 4 ----a-w C:\Users\Omistaja\AppData\Roaming\wklnhst.dat
2008-07-09 12:08 174 --sha-w C:\Program Files\desktop.ini
2008-07-09 12:00 --------- d-----w C:\Program Files\Windows Mail
2008-07-06 08:17 --------- d-----w C:\ProgramData\CyberLink
2008-07-04 11:55 --------- d-----w C:\Program Files\Hewlett-Packard
2008-07-04 10:28 --------- d-----w C:\Users\Omistaja\AppData\Roaming\Hewlett-Packard
2008-07-04 09:12 --------- d-----w C:\ProgramData\HP Product Assistant
2008-07-03 17:16 --------- d-----w C:\Program Files\CyberLink YouCam
2008-07-03 16:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-03 16:28 --------- d-----w C:\Program Files\CyberLink
2008-07-03 14:33 --------- d-----w C:\Users\Omistaja\AppData\Roaming\HPAppData
2008-06-30 14:01 --------- d-----w C:\Users\Omistaja\AppData\Roaming\CyberLink
2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-06-16 16:59 --------- d-----w C:\Program Files\Common Files\Java
2008-06-15 16:38 --------- d-----w C:\Users\Omistaja\AppData\Roaming\InstallShield
2008-06-06 06:03 --------- d-----w C:\Program Files\Sun
2008-05-25 17:28 --------- d-----w C:\Program Files\Windows Live
2008-05-25 17:27 --------- d-----w C:\ProgramData\WLInstaller
2008-05-25 14:03 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-23 08:37 --------- d-----w C:\Program Files\MMEDIA
2008-05-17 16:04 2,560 ----a-w C:\Windows\_MSRSTRT.EXE
2008-05-12 13:23 615,424 ----a-w C:\Windows\System32\themeui.dll
2008-05-12 13:23 240,640 ----a-w C:\Windows\System32\uxtheme.dll
2008-05-10 03:30 14,848 ----a-w C:\Windows\System32\wshrm.dll
2008-05-08 10:17 737,280 ----a-w C:\Windows\iun6002.exe
2008-05-07 16:53 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-05-07 16:53 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2008-05-07 16:52 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-05-07 16:52 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-05-07 16:52 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-05-07 16:52 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-05-07 16:52 299,008 ----a-w C:\Windows\System32\wlansec.dll
2008-05-07 16:52 289,280 ----a-w C:\Windows\System32\wlanmsm.dll
2008-05-07 16:52 2,923,520 ----a-w C:\Windows\explorer.exe
2008-05-07 16:52 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-05-07 16:49 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-05-07 16:49 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-05-07 16:49 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-05-07 16:49 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-05-07 16:48 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-05-07 16:48 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-05-07 16:47 8,704 ----a-w C:\Windows\System32\hcrstco.dll
2008-05-07 16:47 8,704 ----a-w C:\Windows\System32\hccoin.dll
2008-05-07 16:46 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-05-07 16:46 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-05-07 16:46 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-05-07 16:42 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2008-05-07 16:42 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2008-05-07 16:42 2,048 ----a-w C:\Windows\System32\asferror.dll
2008-05-07 16:42 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2008-05-07 16:41 296,448 ----a-w C:\Windows\System32\gdi32.dll
2008-05-07 16:40 84,480 ----a-w C:\Windows\System32\INETRES.dll
2008-05-07 16:40 737,792 ----a-w C:\Windows\System32\inetcomm.dll
2008-05-07 16:40 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-05-07 16:38 83,968 ----a-w C:\Windows\System32\dnsrslvr.dll
2008-05-07 16:38 24,576 ----a-w C:\Windows\System32\dnscacheugc.exe
2008-05-07 16:37 788,992 ----a-w C:\Windows\System32\rpcrt4.dll
2008-05-07 16:34 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-05-07 12:24 53,080 ----a-w C:\Windows\System32\wuauclt.exe
2008-05-07 12:24 43,352 ----a-w C:\Windows\System32\wups2.dll
2008-05-07 12:24 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll
2008-05-07 12:24 1,524,224 ----a-w C:\Windows\System32\wucltux.dll
2008-05-07 12:23 80,896 ----a-w C:\Windows\System32\wudriver.dll
2008-05-07 12:23 549,720 ----a-w C:\Windows\System32\wuapi.dll
2008-05-07 12:23 33,624 ----a-w C:\Windows\System32\wups.dll
2008-05-07 12:22 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-05-07 12:22 163,000 ----a-w C:\Windows\System32\wuwebv.dll
2008-04-26 13:14 58,792 ------w C:\Windows\System32\wbload.dll
2008-04-26 13:14 42,672 ------w C:\Windows\System32\wbsys.dll
2008-04-26 08:02 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-04-25 04:23 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-04-25 04:23 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-04-25 04:23 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-04-25 04:22 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-04-23 04:27 428,032 ----a-w C:\Windows\System32\EncDec.dll
2008-04-23 04:27 292,352 ----a-w C:\Windows\System32\psisdecd.dll
2008-04-23 04:27 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-30 02:41 222128]
"com.codeode.privacymantra"="C:\Users\Omistaja\Downloads\Privm\Privacy Mantra 2.04\privacymantra.exe" [2007-07-07 17:39 917504]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 19:47 480560]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-09 02:53 311296]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-19 23:05 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-19 23:05 8497696]
"UCam_Menu"="C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-16 23:13 218408]
"F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" [2007-05-25 16:12 183208]
"F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Firefox Preloader.lnk - C:\Program Files\FirefoxPreloader\FirefoxPreloader.exe [2008-07-21 11:48:44 98304]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MaxRecentDocs"= 11 (0xb)
"NoStartMenuMFUprogramsList"= 0 (0x0)
"DisallowCpl"= 1 (0x1)
"ForceClassicControlPanel"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DCF507BC-F4FE-4A10-A155-BD56F59B76C6}"= C:\Program Files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{A75005BA-799F-4B6B-956C-D2803211827E}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{40C526D0-F95E-468C-B928-6DFF76851610}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{2A0DC6CF-9D00-4EBF-A1D7-E03346C7D1F0}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{A8113235-2143-49E8-95F0-8A2A636B7DBA}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{68116645-3020-41E2-BA70-8C3C220CB78F}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R1 ElRawDisk;ElRawDisk;C:\Windows\system32\drivers\elrawdsk.sys [2008-04-17 10:45]
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-07-07 11:17]
R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2007-05-25 16:09]
R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys [2008-07-07 11:18]
R1 fsvista;F-Secure Vista Support Driver;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsvista.sys [2007-05-25 16:08]
R2 QPCapSvc;QuickPlay Background Capture Service (QBCS);C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [2007-09-30 19:34]
R2 QPSched;QuickPlay Task Scheduler (QTS);C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [2007-09-30 19:34]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 16:08]
R3 HpqRemHid;HP Remote Control HID Device;C:\Windows\system32\DRIVERS\HpqRemHid.sys [2007-07-11 21:30]
S3 dtvBDADEV;Digital TV stick USB 2.0 BDA;C:\Windows\system32\Drivers\dtvbdadrv.sys [2005-07-21 20:50]
S3 dtvLOAD;Digital TV stick Firmware Loader;C:\Windows\system32\DRIVERS\dtvloadp.sys [2005-07-21 20:20]
S3 MODRC;Ultima Infrared Receiver;C:\Windows\system32\DRIVERS\modrc.sys [2007-02-06 12:10]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 16:09]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 16:09]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8238dcfc-1c2e-11dd-88e9-001e6826fd5b}]
\shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8238dd58-1c2e-11dd-88e9-001e6826fd5b}]
\shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84bf3f4b-1da8-11dd-ad76-001e6826fd5b}]
\shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e755cd33-1a8e-11dd-927c-001e6826fd5b}]
\shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e755cd48-1a8e-11dd-927c-001e6826fd5b}]
\shell\AutoRun\command - F:\AutoRun.exe
*Newly Created Service* - CATCHME
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-07-04 15:22:50 C:\Windows\Tasks\ErrorSmart Scheduled Scan.job"
- C:\Program Files\ErrorSmart\ErrorSmart.ex
- C:\Program Files\ErrorSmart
"2008-07-22 11:49:28 C:\Windows\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\F-Secure Internet Security\Anti-Virus\fsav.exee /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-Secure Internet Security\Anti-Virus\report.txt 2C:\PROGRA~1\F-Secure Internet Security\Anti-Virus.SYSTEM/F-Secure Anti-Virus -ohjelman lisäämä tehtävä.
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-ErrorSmart - C:\Program Files\ErrorSmart\ErrorSmart.exe
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-22 15:37:42
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-22 15:39:04
ComboFix-quarantined-files.txt 2008-07-22 12:38:56
ComboFix2.txt 2008-07-22 06:03:12
Pre-Run: 184,799,862,784 tavua vapaana
Post-Run: 184,766,177,280 tavua vapaana
275 --- E O F --- 2008-07-16 12:01:52
norttonin poistokalu
http://service1.symantec.com/support/inter/tsgeninfointl.nsf/fi_docid/20050411155204924?Open&docid=20040622135741928&nsf=SUPPORT\INTER\nisintl.nsf&view=fi_docid
Päivitä sitten
Malwarebytes ja aja se
Tuossa näkyy nämä jäänteet u torrent ohjelmasta jotka olen jo poistanut, onko sillä vaikutusta mitenkään koneeseen vai voiko ne poistaa jotenkin/jollakin?
"{A8113235-2143-49E8-95F0-8A2A636B7DBA}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{68116645-3020-41E2-BA70-8C3C220CB78F}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
C:\Program Files\>>> uTorrent
Nuo u-torrent jämät ei taida olla rekisterissä kun ei millään lähde eikä löydy etsimälläkään mistään.. Tuo RegSeeker on varmasti hyvä, mutta ei tahdo millään poistaa löydettyjä kelvottomia rekisterimerkintöjä, vaikka yrittää vikasietotilassakin ajaa.
olevasi kohteena? Onko ihan tunkeutunut koneelle?
Hae Nortonin sivuilta poisto-ohjelma tai saat kärsiä ongelmista enemmänkin.