Jotain pielessä?

ihmettelijä2

2008-08-28 18:24:39

Kaiken maailman ikkunoita rupes aukeilemaan yhtäkkiä. Ajoin joitakin puhdistusohjelmia läpi ja löytyikin jotain mutta vieläkös olisi jotain?
Kiitos jo etukäteen!!

Logfile of HijackThis v1.99.1
Scan saved at 18:21:05, on 28.8.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [BM574e09e9] Rundll32.exe "C:\WINDOWS\system32\rksqaplg.dll",s
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [THGuard] C:\Program Files\TrojanHunter 4.2\THGuard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219428325796
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: hupbrd.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

1165

Äänestä

Vastaukset

ihmettelijä2
2008-08-28 18:46:04
Sen verran että molemmat nettiselaimet (IE 7 ja FirFox 3) takkuaa ja sekoilevat edelleen ja pompahtelee jotain mainos ikkunoita auki.
123321
2008-08-28 19:25:06
scannaa hjt:llä merkkaa paina Fix checked

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [BM574e09e9] Rundll32.exe "C:\WINDOWS\system32\rksqaplg.dll",s
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [THGuard] C:\Program Files\TrojanHunter 4.2\THGuard.exe

==================

1.Lataa combofix.exe työpöydällesi yhdestä, kahdesta klinkistä:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

===============

Lataa Malwarebytes' Anti-Malware työpöydällesi.
http://www.besttechie.net/tools/mbam-setup.exe
•   Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
•   Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes' Anti-Malware ja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Finish.
•   Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
•   Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
•   Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
•   Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
•   Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
•   Lähetä lokin sisältö seuraavassa viestissäsi.
ihmettelijä2
2008-08-28 19:39:51
ComboFix 08-08-27.06 - Butu 2008-08-28 19:34:26.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1035.18.2598 [GMT 3:00]
Running from: C:\Documents and Settings\Butu\Työpöytä\ComboFix.exe
* Created a new restore point
* Resident AV is active

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Butu\Application Data\inst.exe
C:\WINDOWS\BM574e09e9.txt
C:\WINDOWS\BM574e09e9.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\awtqnNDu.dll
C:\WINDOWS\system32\cbXPhfCS.dll
C:\WINDOWS\system32\crasdsiv.ini
C:\WINDOWS\system32\hupbrd.dll
C:\WINDOWS\system32\jkkKeFXn.dll
C:\WINDOWS\system32\nXFeKkkj.ini
C:\WINDOWS\system32\nXFeKkkj.ini2
C:\WINDOWS\system32\opnLdedd.dll
C:\WINDOWS\system32\rksqaplg.dll
C:\WINDOWS\system32\ssqRICuT.dll
C:\WINDOWS\system32\tuvwXpQK.dll
C:\WINDOWS\system32\tuxmaemp.dll
C:\WINDOWS\system32\urqPFxYr.dll
C:\WINDOWS\system32\visdsarc.dll

.
((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-07-28 to 2008-08-28 )))))))))))))))))
.

2008-08-28 18:18 . 2008-08-28 19:31      d--------   C:\HJT
2008-08-28 18:13 . 2008-08-28 18:14      d--------   C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-28 18:03 . 2008-08-28 18:03      d--------   C:\Documents and Settings\All Users\Application Data\Grisoft
2008-08-28 18:00 . 2008-08-28 18:13      d--------   C:\Documents and Settings\Butu\Application Data\Lavasoft
2008-08-28 17:53 . 2008-08-28 17:53      d--------   C:\Documents and Settings\Butu\Application Data\PC Tools
2008-08-28 17:34 . 2008-08-28 17:34      d--------   C:\Documents and Settings\All Users\Application Data\ESET
2008-08-27 16:41 . 2008-08-28 18:57      d--------   C:\Program Files\mIRC
2008-08-27 16:41 . 2008-08-27 16:42      d--------   C:\Documents and Settings\Butu\Application Data\mIRC
2008-08-26 21:21 . 2008-08-28 18:15      d--hs----   C:\Program Files\POL
2008-08-25 18:33 . 1998-10-02 19:00   327,168   --a------   C:\WINDOWS\IsUninst.exe
2008-08-24 20:00 . 2008-08-24 20:00      d--------   C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-08-24 19:54 . 2008-08-24 19:54      d--------   C:\Program Files\Microsoft Works
2008-08-24 19:53 . 2008-08-24 19:53      d--------   C:\WINDOWS\SHELLNEW
2008-08-24 19:53 . 2008-08-24 19:53      dr-h-----   C:\MSOCache
2008-08-24 19:53 . 2008-08-24 20:13      d--------   C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-23 20:34 . 2008-08-23 20:34      d--------   C:\Documents and Settings\All Users\Application Data\vsosdk
2008-08-23 20:31 . 2008-08-23 20:40      d--------   C:\Program Files\DVDFab Platinum 4
2008-08-23 20:28 . 2008-08-23 20:28      d--------   C:\Documents and Settings\Butu\Application Data\Canon
2008-08-23 20:27 . 2008-08-23 20:31      d--------   C:\Program Files\DVDFab 5
2008-08-23 20:27 . 2008-08-23 20:33      d--------   C:\Documents and Settings\Butu\Application Data\Vso
2008-08-23 20:27 . 2008-08-23 20:31   47,360   --a------   C:\WINDOWS\system32\drivers\pcouffin.sys
2008-08-23 20:27 . 2008-08-23 20:31   47,360   --a------   C:\Documents and Settings\Butu\Application Data\pcouffin.sys
2008-08-23 20:23 . 2008-08-23 20:23      d--h-----   C:\Program Files\CanonBJ
2008-08-23 20:23 . 2008-08-23 20:23      d--------   C:\Program Files\Canon
2008-08-23 20:23 . 2008-08-23 20:23      d--h-----   C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-08-23 19:05 . 2008-08-28 19:36   12,770   --a------   C:\WINDOWS\system32\oodbs.lor
2008-08-23 19:01 . 2008-08-23 19:01      d--------   C:\Program Files\Nero
2008-08-23 18:58 . 2008-02-28 13:26   1,414,440   --a------   C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-08-23 18:58 . 2008-02-28 13:01   774,144   --a------   C:\WINDOWS\system32\NEROINSTAEC43759.DB
2008-08-23 18:58 . 2008-08-23 18:58   0   --a------   C:\WINDOWS\Irremote.ini
2008-08-23 18:51 . 2008-08-23 18:51      d--------   C:\Program Files\NeroInstall.bak
2008-08-23 18:51 . 2008-08-23 18:51      d--------   C:\Documents and Settings\Butu\Application Data\Nero
2008-08-23 18:49 . 2008-08-23 18:49      d--------   C:\Program Files\Foxit Software
2008-08-23 18:49 . 2008-08-23 19:02      d--------   C:\Program Files\Common Files\Nero
2008-08-23 18:49 . 2008-08-23 19:01      d--------   C:\Documents and Settings\All Users\Application Data\Nero
2008-08-23 18:33 . 2008-08-23 18:33      d--------   C:\Program Files\MSXML 4.0
2008-08-23 18:30 . 2008-08-23 18:30      d--------   C:\Documents and Settings\Butu\Application Data\InterVideo
2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Program Files\InterVideo Information Service
2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Program Files\Common Files\Ulead
2008-08-23 18:29 . 2008-08-23 20:21      d--------   C:\Documents and Settings\Butu\Application Data\Ventrilo
2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-23 18:29 . 2006-05-11 18:41   654   ---------   C:\WINDOWS\remove.iss
2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\VentriloMIX
2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\InterVideo
2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\Common Files\InterVideo
2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Documents and Settings\All Users\Application Data\InstallShield
2008-08-23 18:26 . 2008-08-23 18:26      d--------   C:\WINDOWS\Logs
2008-08-23 18:24 . 2008-08-28 18:58      d--------   C:\Documents and Settings\Butu\Application Data\MailWasherPro
2008-08-23 18:23 . 2008-08-23 18:23      d--------   C:\Program Files\FireTrust
2008-08-23 18:22 . 2008-08-23 18:22      d--------   C:\Program Files\OO Software
2008-08-23 16:23 . 2008-08-23 16:23      d--------   C:\Program Files\uTorrent
2008-08-23 16:23 . 2008-08-28 18:40      d--------   C:\Documents and Settings\Butu\Application Data\uTorrent
2008-08-23 16:11 . 2008-08-23 16:11      d--------   C:\Program Files\Sygate
2008-08-23 16:11 . 2008-08-28 18:26      d--------   C:\Program Files\Common Files\Wise Installation Wizard
2008-08-23 16:11 . 2005-06-06 18:05   83,096   --a------   C:\WINDOWS\system32\SSSensor.dll
2008-08-23 16:11 . 2005-06-06 17:32   61,008   --a------   C:\WINDOWS\system32\drivers\Teefer.sys
2008-08-23 16:11 . 2005-06-06 17:34   21,075   --a------   C:\WINDOWS\system32\drivers\wpsdrvnt.sys
2008-08-23 16:11 . 2005-06-06 18:06   14,448   --a------   C:\WINDOWS\system32\drivers\wg6n.sys
2008-08-23 16:11 . 2005-06-06 18:06   14,448   --a------   C:\WINDOWS\system32\drivers\wg5n.sys
2008-08-23 16:11 . 2005-06-06 18:05   14,448   --a------   C:\WINDOWS\system32\drivers\wg4n.sys
2008-08-23 16:11 . 2005-06-06 18:05   14,448   --a------   C:\WINDOWS\system32\drivers\wg3n.sys
2008-08-23 16:10 . 2008-08-28 17:37      d--------   C:\Program Files\ESET
2008-08-23 16:01 . 2008-08-23 16:01      d--------   C:\WINDOWS\system32\Lang
2008-08-23 16:01 . 2008-08-23 16:01   940,794   --a------   C:\WINDOWS\system32\LoopyMusic.wav
2008-08-23 16:01 . 2008-08-23 16:01   146,650   --a------   C:\WINDOWS\system32\BuzzingBee.wav
2008-08-23 16:00 . 2008-08-23 16:00      d--------   C:\Program Files\Realtek
2008-08-23 15:47 . 2008-08-23 15:47      d--------   C:\Program Files\FileZilla FTP Client
2008-08-23 15:47 . 2008-08-28 18:42      d--------   C:\Documents and Settings\Butu\Application Data\FileZilla
2008-08-23 15:21 . 2008-07-18 22:07   270,880   --a------   C:\WINDOWS\system32\mucltui.dll
2008-08-23 15:21 . 2008-07-18 22:07   210,976   --a------   C:\WINDOWS\system32\muweb.dll
2008-08-23 15:21 . 2008-07-18 22:07   29,728   --a------   C:\WINDOWS\system32\mucltui.dll.mui
2008-08-23 03:13 . 2008-08-25 17:45      d--------   C:\Documents and Settings\Butu\Contacts
2008-08-23 03:12 . 2008-08-23 03:12      d----c---   C:\WINDOWS\system32\DRVSTORE
2008-08-23 03:07 . 2008-08-23 03:11      d--------   C:\Program Files\Windows Live
2008-08-23 03:07 . 2008-08-23 03:11      d--hsc---   C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-23 03:07 . 2008-08-23 03:07      d--------   C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-08-22 22:14 . 2008-08-22 22:14      d--------   C:\Program Files\DAEMON Tools Lite
2008-08-22 21:58 . 2008-08-22 21:58      d--------   C:\Documents and Settings\Butu\Application Data\DAEMON Tools
2008-08-22 21:58 . 2008-08-22 21:58   717,296   --a------   C:\WINDOWS\system32\drivers\sptd.sys
2008-08-22 21:53 . 2008-08-22 21:53      d--------   C:\Documents and Settings\NetworkService\Application Data\Xfire
2008-08-22 21:52 . 2008-08-22 21:53      d--------   C:\Program Files\Xfire
2008-08-22 21:52 . 2008-08-25 19:05      d--------   C:\Documents and Settings\Butu\Application Data\Xfire
2008-08-22 21:51 . 2008-08-23 18:29      d--h-----   C:\Program Files\InstallShield Installation Information
2008-08-22 21:51 . 2008-08-22 21:51      d--------   C:\Program Files\EA GAMES
2008-08-22 21:30 . 2008-08-22 21:30      d--------   C:\Program Files\yatzy
2008-08-22 21:29 . 2008-08-22 21:29      d--------   C:\Program Files\ventrilo_2_1_2_server
2008-08-22 21:15 . 2008-08-22 21:15      d--------   C:\Program Files\Windows Media Connect 2
2008-08-22 21:14 . 2008-08-22 21:14      d--------   C:\WINDOWS\system32\LogFiles
2008-08-22 21:14 . 2008-08-22 21:14      d--------   C:\WINDOWS\system32\drivers\UMDF
2008-08-22 21:13 . 2008-06-14 20:34   272,128   ---------   C:\WINDOWS\system32\drivers\bthport.sys
2008-08-22 21:13 . 2008-06-14 20:34   272,128   -----c---   C:\WINDOWS\system32\dllcache\bthport.sys
2008-08-22 21:13 . 2008-08-22 21:13   0   --a------   C:\WINDOWS\nsreg.dat
2008-08-22 21:12 . 2008-08-22 21:12      d--------   C:\WINDOWS\system32\Adobe
2008-08-22 21:09 . 2008-08-27 13:05      d--h-----   C:\WINDOWS\$hf_mig$
2008-08-22 21:09 . 2006-09-25 17:58   23,856   --a------   C:\WINDOWS\system32\spupdsvc.exe
2008-08-22 21:07 . 2008-08-28 18:30      d--------   C:\Program Files\Unlocker
2008-08-22 21:06 . 2008-08-22 21:06      d--------   C:\Program Files\ffdshow
2008-08-22 21:06 . 2008-08-22 21:06      d--------   C:\Program Files\AC3Filter
2008-08-22 21:06 . 2006-12-10 23:32   499,712   --a------   C:\WINDOWS\system32\msvcp71.dll
2008-08-22 21:06 . 2007-08-09 14:27   380,928   --a------   C:\WINDOWS\system32\ac3filter.acm
2008-08-22 21:06 . 2006-12-10 23:32   348,160   --a------   C:\WINDOWS\system32\msvcr71.dll
2008-08-22 21:06 . 2007-04-24 17:30   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
2008-08-22 21:06 . 2008-03-28 19:41   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
2008-08-22 21:06 . 2007-07-10 18:10   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-08-22 21:05 . 2008-08-22 21:05      d--hs----   C:\Documents and Settings\Butu\UserData
2008-08-22 21:05 . 2008-07-18 22:10   45,768   --a------   C:\WINDOWS\system32\wups2.dll
2008-08-22 21:05 . 2008-07-18 22:10   33,992   --a------   C:\WINDOWS\system32\wucltui.dll.mui
2008-08-22 21:05 . 2008-07-18 22:09   29,896   --a------   C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-08-22 21:05 . 2008-07-18 22:08   25,800   --a------   C:\WINDOWS\system32\wuapi.dll.mui
2008-08-22 21:05 . 2008-07-18 22:08   21,192   --a------   C:\WINDOWS\system32\wuaueng.dll.mui
2008-08-22 21:03 . 2008-08-22 21:03   592   --a------   C:\WINDOWS\chgkey.vbs
2008-08-13 01:07 . 2008-08-13 01:07   42,320   --a------   C:\WINDOWS\system32\xfcodec.dll

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-23 20:07   111,928   ----a-w   C:\WINDOWS\system32\PnkBstrB.exe
2008-08-23 19:57   139,600   ----a-w   C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-08-23 17:34   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\vsosdk
2008-08-23 17:33   ---------   d-----w   C:\Documents and Settings\Butu\Application Data\Vso
2008-08-23 15:29   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2008-08-23 13:00   315,392   ----a-w   C:\WINDOWS\HideWin.exe
2008-08-22 20:08   66,872   ----a-w   C:\WINDOWS\system32\PnkBstrA.exe
2008-08-22 20:04   ---------   d-----w   C:\Documents and Settings\LocalService\Application Data\Xfire
2008-08-22 17:49   ---------   d-----w   C:\Program Files\microsoft frontpage
2008-07-31 07:41   68,616   ----a-w   C:\WINDOWS\system32\XAPOFX1_1.dll
2008-07-31 07:41   238,088   ----a-w   C:\WINDOWS\system32\xactengine3_2.dll
2008-07-31 07:40   509,448   ----a-w   C:\WINDOWS\system32\XAudio2_2.dll
2008-07-18 19:10   94,920   ----a-w   C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10   53,448   ----a-w   C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10   36,552   ----a-w   C:\WINDOWS\system32\wups.dll
2008-07-18 19:09   563,912   ----a-w   C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09   325,832   ----a-w   C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09   205,000   ----a-w   C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09   1,811,656   ----a-w   C:\WINDOWS\system32\wuaueng.dll
2008-07-12 05:18   467,984   ----a-w   C:\WINDOWS\system32\d3dx10_39.dll
2008-07-12 05:18   3,851,784   ----a-w   C:\WINDOWS\system32\D3DX9_39.dll
2008-07-12 05:18   1,493,528   ----a-w   C:\WINDOWS\system32\D3DCompiler_39.dll
2008-07-07 20:28   253,952   ----a-w   C:\WINDOWS\system32\es.dll
2008-07-03 14:03   4,745,216   ------r   C:\WINDOWS\system32\drivers\RtkHDAud.sys
2008-07-03 13:51   16,876,032   ------r   C:\WINDOWS\RTHDCPL.exe
2008-06-24 16:44   74,240   ----a-w   C:\WINDOWS\system32\mscms.dll
2008-06-24 13:06   972,072   ----a-w   C:\WINDOWS\UNNeroMediaHome.exe
2008-06-23 16:29   826,368   ----a-w   C:\WINDOWS\system32\wininet.dll
2008-06-20 17:47   246,784   ----a-w   C:\WINDOWS\system32\mswsock.dll
2008-06-19 13:42   2,808,832   ------r   C:\WINDOWS\alcwzrd.exe
2008-06-19 13:27   9,715,200   ------r   C:\WINDOWS\RTLCPL.exe
2008-06-19 13:20   57,344   ------r   C:\WINDOWS\Alcmtr.exe
2008-06-18 15:01   77,824   ------r   C:\WINDOWS\SoundMan.exe
2008-06-06 11:54   972,072   ----a-w   C:\WINDOWS\UNRecode.exe
2008-06-06 11:54   95,600   ----a-w   C:\WINDOWS\system32\NeroCo.dll
2008-06-04 13:29   446,464   ----a-w   C:\WINDOWS\system32\NVUNINST.EXE
2008-05-30 11:19   507,400   ----a-w   C:\WINDOWS\system32\XAudio2_1.dll
2008-05-30 11:18   238,088   ----a-w   C:\WINDOWS\system32\xactengine3_1.dll
2008-05-30 11:17   65,032   ----a-w   C:\WINDOWS\system32\XAPOFX1_0.dll
2008-05-30 11:17   25,608   ----a-w   C:\WINDOWS\system32\X3DAudio1_4.dll
2008-05-30 11:11   467,984   ----a-w   C:\WINDOWS\system32\d3dx10_38.dll
2008-05-30 11:11   3,850,760   ----a-w   C:\WINDOWS\system32\D3DX9_38.dll
2008-05-30 11:11   1,491,992   ----a-w   C:\WINDOWS\system32\D3DCompiler_38.dll
.

(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 09:12 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 16:06 1840424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2005-06-06 18:05 2614496]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-05-11 02:08 2512392]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 09:31 2221352]
"POL Agent"="C:\Program Files\POL\POL.exe" [2008-08-15 23:57 933888]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 18:52 1447168]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-03 16:51 16876032 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 09:12 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=hupbrd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\ventrilo_2_1_2_server\\ventrilo_srv.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

R0 nvgts;nvgts;C:\WINDOWS\system32\DRIVERS\nvgts.sys [2008-01-25 20:01]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 18:56]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-BM574e09e9 - C:\WINDOWS\system32\rksqaplg.dll

.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Butu\Application Data\Mozilla\Firefox\Profiles\lret89u2.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fi/
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-28 19:36:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]
"ImagePath"=""
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
.
**************************************************************************
.
Completion time: 2008-08-28 19:37:46 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-28 16:37:44

Pre-Run: 223,593,615,360 tavua vapaana
Post-Run: 225,137,717,248 tavua vapaana

272   --- E O F ---   2008-08-27 10:05:09
- 123321
  2008-08-28 19:53:14
  menemään
- ihmettelijä2
  2008-08-28 20:04:39
  123321 kirjoitti:
  menemään
  samalla ohjelmalla uusi skanni?
ihmettelijä2
2008-08-28 20:17:52
Malwarebytes' Anti-Malware 1.25
Tietokantaversio: 1092
Windows 5.1.2600 Service Pack 3

20:13:19 28.8.2008
mbam-log-08-28-2008 (20-13-19).txt

Tarkistustyyppi: Täysi tarkistus (C:\|I:\|)
Tarkistetut kohteet: 110819
Kulunut aika: 31 minute(s), 6 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 23

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
C:\QooBox\Quarantine\C\WINDOWS\system32\awtqnNDu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\cbXPhfCS.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\hupbrd.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\jkkKeFXn.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\opnLdedd.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\rksqaplg.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ssqRICuT.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\tuvwXpQK.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\tuxmaemp.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\urqPFxYr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\visdsarc.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002369.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002370.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002371.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002372.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002373.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002374.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002375.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002376.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002377.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002378.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002379.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
I:\System Volume Information\_restore{4112482E-24B9-4B0F-B806-7A0DD1FA5798}\RP194\A0039666.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
ihmettelijä2
2008-08-28 20:21:26
Tässä toisen ajon jälkeinen loki.

ComboFix 08-08-27.06 - Butu 2008-08-28 20:18:40.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1035.18.2539 [GMT 3:00]
Running from: C:\Documents and Settings\Butu\Työpöytä\ComboFix.exe
* Resident AV is active

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-07-28 to 2008-08-28 )))))))))))))))))
.

2008-08-28 19:40 . 2008-08-28 19:40      d--------   C:\Program Files\Malwarebytes' Anti-Malware
2008-08-28 19:40 . 2008-08-28 19:40      d--------   C:\Documents and Settings\Butu\Application Data\Malwarebytes
2008-08-28 19:40 . 2008-08-28 19:40      d--------   C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-28 19:40 . 2008-08-17 15:01   38,472   --a------   C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-28 19:40 . 2008-08-17 15:01   17,144   --a------   C:\WINDOWS\system32\drivers\mbam.sys
2008-08-28 18:18 . 2008-08-28 19:31      d--------   C:\HJT
2008-08-28 18:13 . 2008-08-28 18:14      d--------   C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-28 18:03 . 2008-08-28 18:03      d--------   C:\Documents and Settings\All Users\Application Data\Grisoft
2008-08-28 18:00 . 2008-08-28 18:13      d--------   C:\Documents and Settings\Butu\Application Data\Lavasoft
2008-08-28 17:53 . 2008-08-28 17:53      d--------   C:\Documents and Settings\Butu\Application Data\PC Tools
2008-08-28 17:34 . 2008-08-28 17:34      d--------   C:\Documents and Settings\All Users\Application Data\ESET
2008-08-27 16:41 . 2008-08-28 18:57      d--------   C:\Program Files\mIRC
2008-08-27 16:41 . 2008-08-27 16:42      d--------   C:\Documents and Settings\Butu\Application Data\mIRC
2008-08-26 21:21 . 2008-08-28 18:15      d--hs----   C:\Program Files\POL
2008-08-25 18:33 . 1998-10-02 19:00   327,168   --a------   C:\WINDOWS\IsUninst.exe
2008-08-24 20:00 . 2008-08-24 20:00      d--------   C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-08-24 19:54 . 2008-08-24 19:54      d--------   C:\Program Files\Microsoft Works
2008-08-24 19:53 . 2008-08-24 19:53      d--------   C:\WINDOWS\SHELLNEW
2008-08-24 19:53 . 2008-08-24 19:53      dr-h-----   C:\MSOCache
2008-08-24 19:53 . 2008-08-24 20:13      d--------   C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-23 20:34 . 2008-08-23 20:34      d--------   C:\Documents and Settings\All Users\Application Data\vsosdk
2008-08-23 20:31 . 2008-08-23 20:40      d--------   C:\Program Files\DVDFab Platinum 4
2008-08-23 20:28 . 2008-08-23 20:28      d--------   C:\Documents and Settings\Butu\Application Data\Canon
2008-08-23 20:27 . 2008-08-23 20:31      d--------   C:\Program Files\DVDFab 5
2008-08-23 20:27 . 2008-08-23 20:33      d--------   C:\Documents and Settings\Butu\Application Data\Vso
2008-08-23 20:27 . 2008-08-23 20:31   47,360   --a------   C:\WINDOWS\system32\drivers\pcouffin.sys
2008-08-23 20:27 . 2008-08-23 20:31   47,360   --a------   C:\Documents and Settings\Butu\Application Data\pcouffin.sys
2008-08-23 20:23 . 2008-08-23 20:23      d--h-----   C:\Program Files\CanonBJ
2008-08-23 20:23 . 2008-08-23 20:23      d--------   C:\Program Files\Canon
2008-08-23 20:23 . 2008-08-23 20:23      d--h-----   C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-08-23 19:05 . 2008-08-28 19:36   12,770   --a------   C:\WINDOWS\system32\oodbs.lor
2008-08-23 19:01 . 2008-08-23 19:01      d--------   C:\Program Files\Nero
2008-08-23 18:58 . 2008-02-28 13:26   1,414,440   --a------   C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-08-23 18:58 . 2008-02-28 13:01   774,144   --a------   C:\WINDOWS\system32\NEROINSTAEC43759.DB
2008-08-23 18:58 . 2008-08-23 18:58   0   --a------   C:\WINDOWS\Irremote.ini
2008-08-23 18:51 . 2008-08-23 18:51      d--------   C:\Program Files\NeroInstall.bak
2008-08-23 18:51 . 2008-08-23 18:51      d--------   C:\Documents and Settings\Butu\Application Data\Nero
2008-08-23 18:49 . 2008-08-23 18:49      d--------   C:\Program Files\Foxit Software
2008-08-23 18:49 . 2008-08-23 19:02      d--------   C:\Program Files\Common Files\Nero
2008-08-23 18:49 . 2008-08-23 19:01      d--------   C:\Documents and Settings\All Users\Application Data\Nero
2008-08-23 18:33 . 2008-08-23 18:33      d--------   C:\Program Files\MSXML 4.0
2008-08-23 18:30 . 2008-08-23 18:30      d--------   C:\Documents and Settings\Butu\Application Data\InterVideo
2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Program Files\InterVideo Information Service
2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Program Files\Common Files\Ulead
2008-08-23 18:29 . 2008-08-23 20:21      d--------   C:\Documents and Settings\Butu\Application Data\Ventrilo
2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-23 18:29 . 2006-05-11 18:41   654   ---------   C:\WINDOWS\remove.iss
2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\VentriloMIX
2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\InterVideo
2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\Common Files\InterVideo
2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Documents and Settings\All Users\Application Data\InstallShield
2008-08-23 18:26 . 2008-08-23 18:26      d--------   C:\WINDOWS\Logs
2008-08-23 18:24 . 2008-08-28 18:58      d--------   C:\Documents and Settings\Butu\Application Data\MailWasherPro
2008-08-23 18:23 . 2008-08-23 18:23      d--------   C:\Program Files\FireTrust
2008-08-23 18:22 . 2008-08-23 18:22      d--------   C:\Program Files\OO Software
2008-08-23 16:23 . 2008-08-23 16:23      d--------   C:\Program Files\uTorrent
2008-08-23 16:23 . 2008-08-28 18:40      d--------   C:\Documents and Settings\Butu\Application Data\uTorrent
2008-08-23 16:11 . 2008-08-23 16:11      d--------   C:\Program Files\Sygate
2008-08-23 16:11 . 2008-08-28 18:26      d--------   C:\Program Files\Common Files\Wise Installation Wizard
2008-08-23 16:11 . 2005-06-06 18:05   83,096   --a------   C:\WINDOWS\system32\SSSensor.dll
2008-08-23 16:11 . 2005-06-06 17:32   61,008   --a------   C:\WINDOWS\system32\drivers\Teefer.sys
2008-08-23 16:11 . 2005-06-06 17:34   21,075   --a------   C:\WINDOWS\system32\drivers\wpsdrvnt.sys
2008-08-23 16:11 . 2005-06-06 18:06   14,448   --a------   C:\WINDOWS\system32\drivers\wg6n.sys
2008-08-23 16:11 . 2005-06-06 18:06   14,448   --a------   C:\WINDOWS\system32\drivers\wg5n.sys
2008-08-23 16:11 . 2005-06-06 18:05   14,448   --a------   C:\WINDOWS\system32\drivers\wg4n.sys
2008-08-23 16:11 . 2005-06-06 18:05   14,448   --a------   C:\WINDOWS\system32\drivers\wg3n.sys
2008-08-23 16:10 . 2008-08-28 17:37      d--------   C:\Program Files\ESET
2008-08-23 16:01 . 2008-08-23 16:01      d--------   C:\WINDOWS\system32\Lang
2008-08-23 16:01 . 2008-08-23 16:01   940,794   --a------   C:\WINDOWS\system32\LoopyMusic.wav
2008-08-23 16:01 . 2008-08-23 16:01   146,650   --a------   C:\WINDOWS\system32\BuzzingBee.wav
2008-08-23 16:00 . 2008-08-23 16:00      d--------   C:\Program Files\Realtek
2008-08-23 15:47 . 2008-08-23 15:47      d--------   C:\Program Files\FileZilla FTP Client
2008-08-23 15:47 . 2008-08-28 18:42      d--------   C:\Documents and Settings\Butu\Application Data\FileZilla
2008-08-23 15:21 . 2008-07-18 22:07   270,880   --a------   C:\WINDOWS\system32\mucltui.dll
2008-08-23 15:21 . 2008-07-18 22:07   210,976   --a------   C:\WINDOWS\system32\muweb.dll
2008-08-23 15:21 . 2008-07-18 22:07   29,728   --a------   C:\WINDOWS\system32\mucltui.dll.mui
2008-08-23 03:13 . 2008-08-25 17:45      d--------   C:\Documents and Settings\Butu\Contacts
2008-08-23 03:12 . 2008-08-23 03:12      d----c---   C:\WINDOWS\system32\DRVSTORE
2008-08-23 03:07 . 2008-08-23 03:11      d--------   C:\Program Files\Windows Live
2008-08-23 03:07 . 2008-08-23 03:11      d--hsc---   C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-23 03:07 . 2008-08-23 03:07      d--------   C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-08-22 22:14 . 2008-08-22 22:14      d--------   C:\Program Files\DAEMON Tools Lite
2008-08-22 21:58 . 2008-08-22 21:58      d--------   C:\Documents and Settings\Butu\Application Data\DAEMON Tools
2008-08-22 21:58 . 2008-08-22 21:58   717,296   --a------   C:\WINDOWS\system32\drivers\sptd.sys
2008-08-22 21:53 . 2008-08-22 21:53      d--------   C:\Documents and Settings\NetworkService\Application Data\Xfire
2008-08-22 21:52 . 2008-08-22 21:53      d--------   C:\Program Files\Xfire
2008-08-22 21:52 . 2008-08-25 19:05      d--------   C:\Documents and Settings\Butu\Application Data\Xfire
2008-08-22 21:51 . 2008-08-23 18:29      d--h-----   C:\Program Files\InstallShield Installation Information
2008-08-22 21:51 . 2008-08-22 21:51      d--------   C:\Program Files\EA GAMES
2008-08-22 21:30 . 2008-08-22 21:30      d--------   C:\Program Files\yatzy
2008-08-22 21:29 . 2008-08-22 21:29      d--------   C:\Program Files\ventrilo_2_1_2_server
2008-08-22 21:15 . 2008-08-22 21:15      d--------   C:\Program Files\Windows Media Connect 2
2008-08-22 21:14 . 2008-08-22 21:14      d--------   C:\WINDOWS\system32\LogFiles
2008-08-22 21:14 . 2008-08-22 21:14      d--------   C:\WINDOWS\system32\drivers\UMDF
2008-08-22 21:13 . 2008-06-14 20:34   272,128   ---------   C:\WINDOWS\system32\drivers\bthport.sys
2008-08-22 21:13 . 2008-06-14 20:34   272,128   -----c---   C:\WINDOWS\system32\dllcache\bthport.sys
2008-08-22 21:13 . 2008-08-22 21:13   0   --a------   C:\WINDOWS\nsreg.dat
2008-08-22 21:12 . 2008-08-22 21:12      d--------   C:\WINDOWS\system32\Adobe
2008-08-22 21:09 . 2008-08-27 13:05      d--h-----   C:\WINDOWS\$hf_mig$
2008-08-22 21:09 . 2006-09-25 17:58   23,856   --a------   C:\WINDOWS\system32\spupdsvc.exe
2008-08-22 21:07 . 2008-08-28 18:30      d--------   C:\Program Files\Unlocker
2008-08-22 21:06 . 2008-08-22 21:06      d--------   C:\Program Files\ffdshow
2008-08-22 21:06 . 2008-08-22 21:06      d--------   C:\Program Files\AC3Filter
2008-08-22 21:06 . 2006-12-10 23:32   499,712   --a------   C:\WINDOWS\system32\msvcp71.dll
2008-08-22 21:06 . 2007-08-09 14:27   380,928   --a------   C:\WINDOWS\system32\ac3filter.acm
2008-08-22 21:06 . 2006-12-10 23:32   348,160   --a------   C:\WINDOWS\system32\msvcr71.dll
2008-08-22 21:06 . 2007-04-24 17:30   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
2008-08-22 21:06 . 2008-03-28 19:41   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
2008-08-22 21:06 . 2007-07-10 18:10   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-08-22 21:05 . 2008-08-22 21:05      d--hs----   C:\Documents and Settings\Butu\UserData
2008-08-22 21:05 . 2008-07-18 22:10   45,768   --a------   C:\WINDOWS\system32\wups2.dll
2008-08-22 21:05 . 2008-07-18 22:10   33,992   --a------   C:\WINDOWS\system32\wucltui.dll.mui
2008-08-22 21:05 . 2008-07-18 22:09   29,896   --a------   C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-08-22 21:05 . 2008-07-18 22:08   25,800   --a------   C:\WINDOWS\system32\wuapi.dll.mui
2008-08-22 21:05 . 2008-07-18 22:08   21,192   --a------   C:\WINDOWS\system32\wuaueng.dll.mui
2008-08-22 21:03 . 2008-08-22 21:03   592   --a------   C:\WINDOWS\chgkey.vbs
2008-08-13 01:07 . 2008-08-13 01:07   42,320   --a------   C:\WINDOWS\system32\xfcodec.dll

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-23 20:07   111,928   ----a-w   C:\WINDOWS\system32\PnkBstrB.exe
2008-08-23 19:57   139,600   ----a-w   C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-08-23 17:34   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\vsosdk
2008-08-23 17:33   ---------   d-----w   C:\Documents and Settings\Butu\Application Data\Vso
2008-08-23 15:29   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2008-08-23 13:00   315,392   ----a-w   C:\WINDOWS\HideWin.exe
2008-08-22 20:08   66,872   ----a-w   C:\WINDOWS\system32\PnkBstrA.exe
2008-08-22 20:04   ---------   d-----w   C:\Documents and Settings\LocalService\Application Data\Xfire
2008-08-22 17:49   ---------   d-----w   C:\Program Files\microsoft frontpage
2008-07-31 07:41   68,616   ----a-w   C:\WINDOWS\system32\XAPOFX1_1.dll
2008-07-31 07:41   238,088   ----a-w   C:\WINDOWS\system32\xactengine3_2.dll
2008-07-31 07:40   509,448   ----a-w   C:\WINDOWS\system32\XAudio2_2.dll
2008-07-18 19:10   94,920   ----a-w   C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10   53,448   ----a-w   C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10   36,552   ----a-w   C:\WINDOWS\system32\wups.dll
2008-07-18 19:09   563,912   ----a-w   C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09   325,832   ----a-w   C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09   205,000   ----a-w   C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09   1,811,656   ----a-w   C:\WINDOWS\system32\wuaueng.dll
2008-07-12 05:18   467,984   ----a-w   C:\WINDOWS\system32\d3dx10_39.dll
2008-07-12 05:18   3,851,784   ----a-w   C:\WINDOWS\system32\D3DX9_39.dll
2008-07-12 05:18   1,493,528   ----a-w   C:\WINDOWS\system32\D3DCompiler_39.dll
2008-07-07 20:28   253,952   ----a-w   C:\WINDOWS\system32\es.dll
2008-07-03 14:03   4,745,216   ------r   C:\WINDOWS\system32\drivers\RtkHDAud.sys
2008-07-03 13:51   16,876,032   ------r   C:\WINDOWS\RTHDCPL.exe
2008-06-24 16:44   74,240   ----a-w   C:\WINDOWS\system32\mscms.dll
2008-06-24 13:06   972,072   ----a-w   C:\WINDOWS\UNNeroMediaHome.exe
2008-06-23 16:29   826,368   ----a-w   C:\WINDOWS\system32\wininet.dll
2008-06-20 17:47   246,784   ----a-w   C:\WINDOWS\system32\mswsock.dll
2008-06-19 13:42   2,808,832   ------r   C:\WINDOWS\alcwzrd.exe
2008-06-19 13:27   9,715,200   ------r   C:\WINDOWS\RTLCPL.exe
2008-06-19 13:20   57,344   ------r   C:\WINDOWS\Alcmtr.exe
2008-06-18 15:01   77,824   ------r   C:\WINDOWS\SoundMan.exe
2008-06-06 11:54   972,072   ----a-w   C:\WINDOWS\UNRecode.exe
2008-06-06 11:54   95,600   ----a-w   C:\WINDOWS\system32\NeroCo.dll
2008-06-04 13:29   446,464   ----a-w   C:\WINDOWS\system32\NVUNINST.EXE
2008-05-30 11:19   507,400   ----a-w   C:\WINDOWS\system32\XAudio2_1.dll
2008-05-30 11:18   238,088   ----a-w   C:\WINDOWS\system32\xactengine3_1.dll
2008-05-30 11:17   65,032   ----a-w   C:\WINDOWS\system32\XAPOFX1_0.dll
2008-05-30 11:17   25,608   ----a-w   C:\WINDOWS\system32\X3DAudio1_4.dll
2008-05-30 11:11   467,984   ----a-w   C:\WINDOWS\system32\d3dx10_38.dll
2008-05-30 11:11   3,850,760   ----a-w   C:\WINDOWS\system32\D3DX9_38.dll
2008-05-30 11:11   1,491,992   ----a-w   C:\WINDOWS\system32\D3DCompiler_38.dll
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 09:12 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 16:06 1840424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2005-06-06 18:05 2614496]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-05-11 02:08 2512392]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 09:31 2221352]
"POL Agent"="C:\Program Files\POL\POL.exe" [2008-08-15 23:57 933888]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 18:52 1447168]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-03 16:51 16876032 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 09:12 15360]

C:\Documents and Settings\Butu\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
MailWasherPro.lnk - C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe [2008-08-23 18:23:56 16667786]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=hupbrd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders   msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\ventrilo_2_1_2_server\\ventrilo_srv.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

R0 nvgts;nvgts;C:\WINDOWS\system32\DRIVERS\nvgts.sys [2008-01-25 20:01]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 18:56]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Butu\Application Data\Mozilla\Firefox\Profiles\lret89u2.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fi/
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-28 20:19:31
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\vsdatant]
"ImagePath"=""
.
Completion time: 2008-08-28 20:19:57
ComboFix-quarantined-files.txt 2008-08-28 17:19:55
ComboFix2.txt 2008-08-28 16:37:47

Pre-Run: 225,111,269,376 tavua vapaana
Post-Run: 225,102,176,256 tavua vapaana

242   --- E O F ---   2008-08-27 10:05:09
ihmettelijä2
2008-08-28 21:15:28
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:13:25, on 28.8.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219428325796
O20 - AppInit_DLLs: hupbrd.dll
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

--
End of file - 4878 bytes
- 123321
  2008-08-29 00:16:12
  Milles tämä kuuluu hupbrd.dll
  
  ==============
  
  Lataa SDFix by AndyManchesta
  http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
  ja tallenna se työpöydällesi.
  
  Käynnistä koneesi vikasietotilaan:
  sammuta ja käynnistä
  käynnistyksen yhteydessä hakkaa F8 nappia
  valitse nuolinäppäimellä vikasietotila
  paina enter ja enter
  valitse käyttäjätilisi
  paina kyllä
  
  Jossakin koneissa hakataan F8:sin sijasta F5:tä
  •   Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
  •   Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
  •   Paina Y käynnistääksesi skriptin.
  •   Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
  •   Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
  •   Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
  •   Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
  •   Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
  •   Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.
- ihmettelijä2
  2008-08-29 03:50:42
  123321 kirjoitti:
  Milles tämä kuuluu hupbrd.dll
  
  ==============
  
  Lataa SDFix by AndyManchesta
  http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
  ja tallenna se työpöydällesi.
  
  Käynnistä koneesi vikasietotilaan:
  sammuta ja käynnistä
  käynnistyksen yhteydessä hakkaa F8 nappia
  valitse nuolinäppäimellä vikasietotila
  paina enter ja enter
  valitse käyttäjätilisi
  paina kyllä
  
  Jossakin koneissa hakataan F8:sin sijasta F5:tä
  •   Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
  •   Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
  •   Paina Y käynnistääksesi skriptin.
  •   Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
  •   Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
  •   Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
  •   Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
  •   Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
  •   Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.
  ei kyllä aavistustakaan mille tuo dll tiedosto kuuluu. winukan etsi toiminto ei löytänyt koneelta tuollaista tiedostoa.. eikä googlekaan auttanut :D
- ihmettelijä2
  2008-08-29 04:04:07
  123321 kirjoitti:
  Milles tämä kuuluu hupbrd.dll
  
  ==============
  
  Lataa SDFix by AndyManchesta
  http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
  ja tallenna se työpöydällesi.
  
  Käynnistä koneesi vikasietotilaan:
  sammuta ja käynnistä
  käynnistyksen yhteydessä hakkaa F8 nappia
  valitse nuolinäppäimellä vikasietotila
  paina enter ja enter
  valitse käyttäjätilisi
  paina kyllä
  
  Jossakin koneissa hakataan F8:sin sijasta F5:tä
  •   Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
  •   Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
  •   Paina Y käynnistääksesi skriptin.
  •   Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
  •   Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
  •   Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
  •   Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
  •   Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
  •   Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.
  [b]SDFix: Version 1.219 [/b]
  Run by Butu on pe 29.08.2008 at 03:55
  
  Microsoft Windows XP [versio 5.1.2600]
  Running From: C:\Documents and Settings\Butu\Ty”p”yt„\SDFix
  
  [b]Checking Services [/b]:
  
  Restoring Default Security Values
  Restoring Default Hosts File
  
  Rebooting
  
  [b]Checking Files [/b]:
  
  No Trojan Files Found
  
  Folder C:\Documents and Settings\Butu\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#w*w.redtube.com - Removed
  
  Removing Temp Files
  
  [b]ADS Check [/b]:
  
  [b]Final Check [/b]:
  
  catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-08-29 03:59:19
  Windows 5.1.2600 Service Pack 3 NTFS
  
  scanning hidden processes ...
  
  scanning hidden services & system hive ...
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
  "s1"=dword:2df9c43f
  "s2"=dword:110480d0
  "h0"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
  "p0"="C:\Program Files\DAEMON Tools Lite\"
  "h0"=dword:00000000
  "khjeh"=hex:ec,c3,6e,50,ab,7e,db,ec,6e,20,94,2c,69,e2,b7,ce,fb,b5,f1,19,7c,..
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
  "a0"=hex:20,01,00,00,0b,8d,77,5b,e1,0f,d0,e2,cf,18,22,83,4d,60,fb,da,1d,..
  "khjeh"=hex:9c,21,cf,bc,e9,2f,aa,87,e6,78,ee,19,53,49,57,15,29,5e,f6,b0,47,..
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
  "khjeh"=hex:bc,e9,50,44,16,2e,8a,03,05,f5,43,95,6e,df,42,10,6e,44,c0,3c,c2,..
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
  "p0"="C:\Program Files\DAEMON Tools Lite\"
  "h0"=dword:00000000
  "khjeh"=hex:ec,c3,6e,50,ab,7e,db,ec,6e,20,94,2c,69,e2,b7,ce,fb,b5,f1,19,7c,..
  
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
  "a0"=hex:20,01,00,00,0b,8d,77,5b,e1,0f,d0,e2,cf,18,22,83,4d,60,fb,da,1d,..
  "khjeh"=hex:9c,21,cf,bc,e9,2f,aa,87,e6,78,ee,19,53,49,57,15,29,5e,f6,b0,47,..
  
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
  "khjeh"=hex:bc,e9,50,44,16,2e,8a,03,05,f5,43,95,6e,df,42,10,6e,44,c0,3c,c2,..
  
  scanning hidden registry entries ...
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
  "OODEFRAG10.00.00.01WORKSTATION"="A52EFEBBDE85D6E953C370946F0593EDCA4848020687A89BB669687C4B4449C4E008793D7D48FB549FEF2802A05C60F3CDED759C41410391572E11DD49334DA6526CCB47DD45715229F5938C5788F3CDD87685EEBD8847A1B41F08DB610D6BB5C7907BE3F73728AC391EF8FD5469530F4D5FA09EA400A64C690FF61AC5D8268334BAD356272A979DBA46E3D6BCB00641B03A320982205D89B363C9700C740B122F466314A982BAD7BDDD24C699E497E1AAAAEA3C4AB4A5C1F41732EB3090A558F3A3FAFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667A2D97226D213B555C038D530D6EB345236E30F06BDF160D5C9F0BA7DEEDFA3A5C29DE7EAA9841A6A8DE10206D098F8E2B98E7AC597B168D0682250494CE52D65F628E94B77EA2FBF0A293BABC757C77CE0B64183CA6F5E52F6F1464B01766043FAB6FE933125FA5993CBEFCA9D97AFF1F1A3A613F962B425B93045283B27A2ABB0C5D359B24077E0468CF0897D7DE350E904C34DBA6AF256A994498B9FAC71CB2D346BB64DECB4467614651503D129E57669820F9687B2B573BAA5A2C362DB943B459A4D43FD593CA9EEC71BC000D8C87CC724390D62A159F61EFB1EB2C7843F57200BBC4D6B9C3B9B0DE8513A9B60501479BBB08EC28399C92447B36CFE22C1B3D03CAD98D1C97D39C369EDE8584017063DB15D0216AC943311521F634F025DB5C6FDC843704281A54AC12DB90F0F00D4B2C1ABC17009AA3011C09AFE230114F554F6BE62AB790CB7BDBA4F8E3D74AD33DEF98C1B8616027231846B9A8A14ABC232A0417E0BF8A2F99E7317BB82AE8887ACC0F5CFB16683DC63E7D48437422C9DFB4886913A5B912AD1E0CC0BA48FBC6E694CDF16F09F5B080087207F80A6673C2F124B8E89D2E6BB1E47BAB70C7A3AB64527C419E57CFAC140D41DC2626FEC87B0F0CAD6ECA17655B0C3B27447EA3565D634A875D5CB9988C2139C7AF961141E48AFC944FBA157509BC2066605EC263096A50EBEAA6FAC14895B73440C5476D09F6C8FA1F2BE663C50870EA49BA1C88362827E7874DDF4C97B1CFB33FCB17224481966AF31F73FDBA9AAA63E033F1EFD7BA70620E121F0C7621413CF5AF829D3347A9BA23CE347A463952E34D88D69F48744B4A04AD6E65E6D599B9350BE824C3A2C02A1B9A826C19C8688F95D6C33EE8FDCA1DDA8326091AFD27AEDB429A72E1899F149770445125B119D79764AC7A68248E3AC98792A9A9D4099C1FCF307D06B06452A63C55527879C5A10AC2EB60D2F3317D75E86D4E512AFE6E644EE533CB786D9C7935249486DE22C0F2CB054454C9C5D9DDE47B6134D8753A8C87C012EE4061319BDA0D6EE3DF1083AC67F39A6F3D8DA2E23BF67F7EE0054C3"
  
  scanning hidden files ...
  
  scan completed successfully
  hidden processes: 0
  hidden services: 0
  hidden files: 0
  
  [b]Remaining Services [/b]:
  
  Authorized Application Key Export:
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
  "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
  "C:\\Program Files\\ventrilo_2_1_2_server\\ventrilo_srv.exe"="C:\\Program Files\\ventrilo_2_1_2_server\\ventrilo_srv.exe:*:Enabled:ventrilo_srv"
  "C:\\Program Files\\Xfire\\xfire.exe"="C:\\Program Files\\Xfire\\xfire.exe:*:Enabled:Xfire"
  "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"="C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe:*:Enabled:Battlefield 2"
  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
  "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
  "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
  "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
  "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
  
  [b]Remaining Files [/b]:
  
  [b]Files with Hidden Attributes [/b]:
  
  Tue 19 Sep 2006 304,736 A..H. --- "C:\Program Files\Canon\MP Navigator 3.0\Maint.exe"
  Thu 26 Jan 2006 61,440 A..H. --- "C:\Program Files\Canon\MP Navigator 3.0\uinstrsc.dll"
  Fri 22 Aug 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
  
  [b]Finished![/b]
- ihmettelijä2
  2008-08-29 04:04:52
  123321 kirjoitti:
  Milles tämä kuuluu hupbrd.dll
  
  ==============
  
  Lataa SDFix by AndyManchesta
  http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
  ja tallenna se työpöydällesi.
  
  Käynnistä koneesi vikasietotilaan:
  sammuta ja käynnistä
  käynnistyksen yhteydessä hakkaa F8 nappia
  valitse nuolinäppäimellä vikasietotila
  paina enter ja enter
  valitse käyttäjätilisi
  paina kyllä
  
  Jossakin koneissa hakataan F8:sin sijasta F5:tä
  •   Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
  •   Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
  •   Paina Y käynnistääksesi skriptin.
  •   Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
  •   Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
  •   Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
  •   Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
  •   Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
  •   Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 4:03:57, on 29.8.2008
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16705)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
  C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
  C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\oodag.exe
  C:\WINDOWS\system32\IoctlSvc.exe
  C:\WINDOWS\system32\PnkBstrA.exe
  C:\Program Files\Sygate\SPF\smc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\WINDOWS\RTHDCPL.EXE
  C:\WINDOWS\system32\oodtray.exe
  C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
  C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
  C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
  C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\HJT\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
  O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
  O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
  O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219428325796
  O20 - AppInit_DLLs: hupbrd.dll
  O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
  O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
  O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
  O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
  O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
  O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
  
  --
  End of file - 4949 bytes
- 123321
  2008-08-29 11:17:35
  ihmettelijä2 kirjoitti:
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 4:03:57, on 29.8.2008
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16705)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
  C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
  C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\oodag.exe
  C:\WINDOWS\system32\IoctlSvc.exe
  C:\WINDOWS\system32\PnkBstrA.exe
  C:\Program Files\Sygate\SPF\smc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\WINDOWS\RTHDCPL.EXE
  C:\WINDOWS\system32\oodtray.exe
  C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
  C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
  C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
  C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\HJT\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
  O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
  O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
  O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219428325796
  O20 - AppInit_DLLs: hupbrd.dll
  O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
  O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
  O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
  O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
  O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
  O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
  
  --
  End of file - 4949 bytes
  merkkaa paina Fix checked
  
  O20 - AppInit_DLLs: hupbrd.dll
  
  scannaa uusi combofix loki
- ihmettelijä2
  2008-08-29 14:16:20
  123321 kirjoitti:
  merkkaa paina Fix checked
  
  O20 - AppInit_DLLs: hupbrd.dll
  
  scannaa uusi combofix loki
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 14:15:15, on 29.8.2008
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16705)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
  C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
  C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\oodag.exe
  C:\WINDOWS\system32\IoctlSvc.exe
  C:\WINDOWS\system32\PnkBstrA.exe
  C:\Program Files\Sygate\SPF\smc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\WINDOWS\RTHDCPL.EXE
  C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
  C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
  C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
  C:\Program Files\uTorrent\uTorrent.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\HJT\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
  O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
  O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
  O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219428325796
  O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
  O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
  O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
  O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
  O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
  O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
  
  --
  End of file - 4839 bytes
- 123321
  2008-08-29 14:22:03
  ihmettelijä2 kirjoitti:
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 14:15:15, on 29.8.2008
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16705)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
  C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
  C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\oodag.exe
  C:\WINDOWS\system32\IoctlSvc.exe
  C:\WINDOWS\system32\PnkBstrA.exe
  C:\Program Files\Sygate\SPF\smc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\WINDOWS\RTHDCPL.EXE
  C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
  C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
  C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
  C:\Program Files\uTorrent\uTorrent.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\HJT\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
  O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
  O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
  O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219428325796
  O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
  O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
  O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
  O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
  O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
  O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
  
  --
  End of file - 4839 bytes
  Lataa http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
  OTMoveIt ja tallenna se työpöydällesi.
  
  Tuplaklikkaa OTMoveIt.exe.
  Klikkaa CleanUp!.
  Valitse Yes kun kysytään "Begin cleanup Process?".
  Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.
  
  HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.
- ihmettelijä2
  2008-08-29 14:23:07
  123321 kirjoitti:
  merkkaa paina Fix checked
  
  O20 - AppInit_DLLs: hupbrd.dll
  
  scannaa uusi combofix loki
  ComboFix 08-08-28.06 - Butu 2008-08-29 14:18:41.3 - NTFSx86
  Microsoft Windows XP Professional 5.1.2600.3.1252.1.1035.18.2603 [GMT 3:00]
  Running from: C:\Documents and Settings\Butu\Työpöytä\ComboFix.exe
  * Created a new restore point
  * Resident AV is active
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  .
  
  ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-07-28 to 2008-08-29 )))))))))))))))))
  .
  
  2008-08-29 03:54 . 2008-08-29 03:54      d--------   C:\WINDOWS\ERUNT
  2008-08-28 19:40 . 2008-08-28 19:40      d--------   C:\Program Files\Malwarebytes' Anti-Malware
  2008-08-28 19:40 . 2008-08-28 19:40      d--------   C:\Documents and Settings\Butu\Application Data\Malwarebytes
  2008-08-28 19:40 . 2008-08-28 19:40      d--------   C:\Documents and Settings\All Users\Application Data\Malwarebytes
  2008-08-28 19:40 . 2008-08-17 15:01   38,472   --a------   C:\WINDOWS\system32\drivers\mbamswissarmy.sys
  2008-08-28 19:40 . 2008-08-17 15:01   17,144   --a------   C:\WINDOWS\system32\drivers\mbam.sys
  2008-08-28 18:18 . 2008-08-29 14:15      d--------   C:\HJT
  2008-08-28 18:13 . 2008-08-28 18:14      d--------   C:\Documents and Settings\All Users\Application Data\Lavasoft
  2008-08-28 18:03 . 2008-08-28 18:03      d--------   C:\Documents and Settings\All Users\Application Data\Grisoft
  2008-08-28 18:00 . 2008-08-28 18:13      d--------   C:\Documents and Settings\Butu\Application Data\Lavasoft
  2008-08-28 17:53 . 2008-08-28 17:53      d--------   C:\Documents and Settings\Butu\Application Data\PC Tools
  2008-08-28 17:34 . 2008-08-28 17:34      d--------   C:\Documents and Settings\All Users\Application Data\ESET
  2008-08-27 16:41 . 2008-08-28 18:57      d--------   C:\Program Files\mIRC
  2008-08-27 16:41 . 2008-08-27 16:42      d--------   C:\Documents and Settings\Butu\Application Data\mIRC
  2008-08-25 18:33 . 1998-10-02 19:00   327,168   --a------   C:\WINDOWS\IsUninst.exe
  2008-08-24 20:00 . 2008-08-24 20:00      d--------   C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
  2008-08-24 19:54 . 2008-08-24 19:54      d--------   C:\Program Files\Microsoft Works
  2008-08-24 19:53 . 2008-08-24 19:53      d--------   C:\WINDOWS\SHELLNEW
  2008-08-24 19:53 . 2008-08-24 19:53      dr-h-----   C:\MSOCache
  2008-08-24 19:53 . 2008-08-24 20:13      d--------   C:\Documents and Settings\All Users\Application Data\Microsoft Help
  2008-08-23 20:34 . 2008-08-23 20:34      d--------   C:\Documents and Settings\All Users\Application Data\vsosdk
  2008-08-23 20:31 . 2008-08-23 20:40      d--------   C:\Program Files\DVDFab Platinum 4
  2008-08-23 20:28 . 2008-08-23 20:28      d--------   C:\Documents and Settings\Butu\Application Data\Canon
  2008-08-23 20:27 . 2008-08-23 20:31      d--------   C:\Program Files\DVDFab 5
  2008-08-23 20:27 . 2008-08-23 20:33      d--------   C:\Documents and Settings\Butu\Application Data\Vso
  2008-08-23 20:27 . 2008-08-23 20:31   47,360   --a------   C:\WINDOWS\system32\drivers\pcouffin.sys
  2008-08-23 20:27 . 2008-08-23 20:31   47,360   --a------   C:\Documents and Settings\Butu\Application Data\pcouffin.sys
  2008-08-23 20:23 . 2008-08-23 20:23      d--h-----   C:\Program Files\CanonBJ
  2008-08-23 20:23 . 2008-08-23 20:23      d--------   C:\Program Files\Canon
  2008-08-23 20:23 . 2008-08-23 20:23      d--h-----   C:\Documents and Settings\All Users\Application Data\CanonBJ
  2008-08-23 19:05 . 2008-08-29 03:58   15,324   --a------   C:\WINDOWS\system32\oodbs.lor
  2008-08-23 19:01 . 2008-08-23 19:01      d--------   C:\Program Files\Nero
  2008-08-23 18:58 . 2008-02-28 13:26   1,414,440   --a------   C:\WINDOWS\system32\ShellManager310E2D762.dll
  2008-08-23 18:58 . 2008-02-28 13:01   774,144   --a------   C:\WINDOWS\system32\NEROINSTAEC43759.DB
  2008-08-23 18:58 . 2008-08-23 18:58   0   --a------   C:\WINDOWS\Irremote.ini
  2008-08-23 18:51 . 2008-08-23 18:51      d--------   C:\Program Files\NeroInstall.bak
  2008-08-23 18:51 . 2008-08-23 18:51      d--------   C:\Documents and Settings\Butu\Application Data\Nero
  2008-08-23 18:49 . 2008-08-23 18:49      d--------   C:\Program Files\Foxit Software
  2008-08-23 18:49 . 2008-08-23 19:02      d--------   C:\Program Files\Common Files\Nero
  2008-08-23 18:49 . 2008-08-23 19:01      d--------   C:\Documents and Settings\All Users\Application Data\Nero
  2008-08-23 18:33 . 2008-08-23 18:33      d--------   C:\Program Files\MSXML 4.0
  2008-08-23 18:30 . 2008-08-23 18:30      d--------   C:\Documents and Settings\Butu\Application Data\InterVideo
  2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Program Files\InterVideo Information Service
  2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Program Files\Common Files\Ulead
  2008-08-23 18:29 . 2008-08-23 20:21      d--------   C:\Documents and Settings\Butu\Application Data\Ventrilo
  2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Documents and Settings\All Users\Application Data\Apple Computer
  2008-08-23 18:29 . 2006-05-11 18:41   654   ---------   C:\WINDOWS\remove.iss
  2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\VentriloMIX
  2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\InterVideo
  2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\Common Files\InterVideo
  2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Documents and Settings\All Users\Application Data\InstallShield
  2008-08-23 18:26 . 2008-08-23 18:26      d--------   C:\WINDOWS\Logs
  2008-08-23 18:24 . 2008-08-29 14:16      d--------   C:\Documents and Settings\Butu\Application Data\MailWasherPro
  2008-08-23 18:23 . 2008-08-23 18:23      d--------   C:\Program Files\FireTrust
  2008-08-23 18:22 . 2008-08-23 18:22      d--------   C:\Program Files\OO Software
  2008-08-23 16:23 . 2008-08-23 16:23      d--------   C:\Program Files\uTorrent
  2008-08-23 16:23 . 2008-08-29 14:15      d--------   C:\Documents and Settings\Butu\Application Data\uTorrent
  2008-08-23 16:11 . 2008-08-23 16:11      d--------   C:\Program Files\Sygate
  2008-08-23 16:11 . 2008-08-28 18:26      d--------   C:\Program Files\Common Files\Wise Installation Wizard
  2008-08-23 16:11 . 2005-06-06 18:05   83,096   --a------   C:\WINDOWS\system32\SSSensor.dll
  2008-08-23 16:11 . 2005-06-06 17:32   61,008   --a------   C:\WINDOWS\system32\drivers\Teefer.sys
  2008-08-23 16:11 . 2005-06-06 17:34   21,075   --a------   C:\WINDOWS\system32\drivers\wpsdrvnt.sys
  2008-08-23 16:11 . 2005-06-06 18:06   14,448   --a------   C:\WINDOWS\system32\drivers\wg6n.sys
  2008-08-23 16:11 . 2005-06-06 18:06   14,448   --a------   C:\WINDOWS\system32\drivers\wg5n.sys
  2008-08-23 16:11 . 2005-06-06 18:05   14,448   --a------   C:\WINDOWS\system32\drivers\wg4n.sys
  2008-08-23 16:11 . 2005-06-06 18:05   14,448   --a------   C:\WINDOWS\system32\drivers\wg3n.sys
  2008-08-23 16:10 . 2008-08-28 17:37      d--------   C:\Program Files\ESET
  2008-08-23 16:01 . 2008-08-23 16:01      d--------   C:\WINDOWS\system32\Lang
  2008-08-23 16:01 . 2008-08-23 16:01   940,794   --a------   C:\WINDOWS\system32\LoopyMusic.wav
  2008-08-23 16:01 . 2008-08-23 16:01   146,650   --a------   C:\WINDOWS\system32\BuzzingBee.wav
  2008-08-23 16:00 . 2008-08-23 16:00      d--------   C:\Program Files\Realtek
  2008-08-23 15:47 . 2008-08-23 15:47      d--------   C:\Program Files\FileZilla FTP Client
  2008-08-23 15:47 . 2008-08-29 03:50      d--------   C:\Documents and Settings\Butu\Application Data\FileZilla
  2008-08-23 15:21 . 2008-07-18 22:07   270,880   --a------   C:\WINDOWS\system32\mucltui.dll
  2008-08-23 15:21 . 2008-07-18 22:07   210,976   --a------   C:\WINDOWS\system32\muweb.dll
  2008-08-23 15:21 . 2008-07-18 22:07   29,728   --a------   C:\WINDOWS\system32\mucltui.dll.mui
  2008-08-23 03:13 . 2008-08-25 17:45      d--------   C:\Documents and Settings\Butu\Contacts
  2008-08-23 03:12 . 2008-08-23 03:12      d----c---   C:\WINDOWS\system32\DRVSTORE
  2008-08-23 03:07 . 2008-08-23 03:11      d--------   C:\Program Files\Windows Live
  2008-08-23 03:07 . 2008-08-23 03:11      d--hsc---   C:\Program Files\Common Files\WindowsLiveInstaller
  2008-08-23 03:07 . 2008-08-23 03:07      d--------   C:\Documents and Settings\All Users\Application Data\WLInstaller
  2008-08-22 22:14 . 2008-08-22 22:14      d--------   C:\Program Files\DAEMON Tools Lite
  2008-08-22 21:58 . 2008-08-22 21:58      d--------   C:\Documents and Settings\Butu\Application Data\DAEMON Tools
  2008-08-22 21:58 . 2008-08-22 21:58   717,296   --a------   C:\WINDOWS\system32\drivers\sptd.sys
  2008-08-22 21:53 . 2008-08-22 21:53      d--------   C:\Documents and Settings\NetworkService\Application Data\Xfire
  2008-08-22 21:52 . 2008-08-22 21:53      d--------   C:\Program Files\Xfire
  2008-08-22 21:52 . 2008-08-25 19:05      d--------   C:\Documents and Settings\Butu\Application Data\Xfire
  2008-08-22 21:51 . 2008-08-23 18:29      d--h-----   C:\Program Files\InstallShield Installation Information
  2008-08-22 21:51 . 2008-08-22 21:51      d--------   C:\Program Files\EA GAMES
  2008-08-22 21:30 . 2008-08-22 21:30      d--------   C:\Program Files\yatzy
  2008-08-22 21:29 . 2008-08-22 21:29      d--------   C:\Program Files\ventrilo_2_1_2_server
  2008-08-22 21:15 . 2008-08-22 21:15      d--------   C:\Program Files\Windows Media Connect 2
  2008-08-22 21:14 . 2008-08-22 21:14      d--------   C:\WINDOWS\system32\LogFiles
  2008-08-22 21:14 . 2008-08-22 21:14      d--------   C:\WINDOWS\system32\drivers\UMDF
  2008-08-22 21:13 . 2008-06-14 20:34   272,128   ---------   C:\WINDOWS\system32\drivers\bthport.sys
  2008-08-22 21:13 . 2008-06-14 20:34   272,128   -----c---   C:\WINDOWS\system32\dllcache\bthport.sys
  2008-08-22 21:13 . 2008-08-22 21:13   0   --a------   C:\WINDOWS\nsreg.dat
  2008-08-22 21:12 . 2008-08-22 21:12      d--------   C:\WINDOWS\system32\Adobe
  2008-08-22 21:09 . 2008-08-27 13:05      d--h-----   C:\WINDOWS\$hf_mig$
  2008-08-22 21:09 . 2006-09-25 17:58   23,856   --a------   C:\WINDOWS\system32\spupdsvc.exe
  2008-08-22 21:07 . 2008-08-28 18:30      d--------   C:\Program Files\Unlocker
  2008-08-22 21:06 . 2008-08-22 21:06      d--------   C:\Program Files\ffdshow
  2008-08-22 21:06 . 2008-08-22 21:06      d--------   C:\Program Files\AC3Filter
  2008-08-22 21:06 . 2006-12-10 23:32   499,712   --a------   C:\WINDOWS\system32\msvcp71.dll
  2008-08-22 21:06 . 2007-08-09 14:27   380,928   --a------   C:\WINDOWS\system32\ac3filter.acm
  2008-08-22 21:06 . 2006-12-10 23:32   348,160   --a------   C:\WINDOWS\system32\msvcr71.dll
  2008-08-22 21:06 . 2007-04-24 17:30   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
  2008-08-22 21:06 . 2008-03-28 19:41   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
  2008-08-22 21:06 . 2007-07-10 18:10   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest
  2008-08-22 21:05 . 2008-08-22 21:05      d--hs----   C:\Documents and Settings\Butu\UserData
  2008-08-22 21:05 . 2008-07-18 22:10   45,768   --a------   C:\WINDOWS\system32\wups2.dll
  2008-08-22 21:05 . 2008-07-18 22:10   33,992   --a------   C:\WINDOWS\system32\wucltui.dll.mui
  2008-08-22 21:05 . 2008-07-18 22:09   29,896   --a------   C:\WINDOWS\system32\wuaucpl.cpl.mui
  2008-08-22 21:05 . 2008-07-18 22:08   25,800   --a------   C:\WINDOWS\system32\wuapi.dll.mui
  2008-08-22 21:05 . 2008-07-18 22:08   21,192   --a------   C:\WINDOWS\system32\wuaueng.dll.mui
  2008-08-22 21:03 . 2008-08-22 21:03   592   --a------   C:\WINDOWS\chgkey.vbs
  2008-08-13 01:07 . 2008-08-13 01:07   42,320   --a------   C:\WINDOWS\system32\xfcodec.dll
  
  .
  (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-08-23 20:07   111,928   ----a-w   C:\WINDOWS\system32\PnkBstrB.exe
  2008-08-23 19:57   139,600   ----a-w   C:\WINDOWS\system32\drivers\PnkBstrK.sys
  2008-08-23 17:34   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\vsosdk
  2008-08-23 17:33   ---------   d-----w   C:\Documents and Settings\Butu\Application Data\Vso
  2008-08-23 15:29   ---------   d-----w   C:\Program Files\Common Files\InstallShield
  2008-08-23 13:00   315,392   ----a-w   C:\WINDOWS\HideWin.exe
  2008-08-22 20:08   66,872   ----a-w   C:\WINDOWS\system32\PnkBstrA.exe
  2008-08-22 20:04   ---------   d-----w   C:\Documents and Settings\LocalService\Application Data\Xfire
  2008-08-22 17:49   ---------   d-----w   C:\Program Files\microsoft frontpage
  2008-07-31 07:41   68,616   ----a-w   C:\WINDOWS\system32\XAPOFX1_1.dll
  2008-07-31 07:41   238,088   ----a-w   C:\WINDOWS\system32\xactengine3_2.dll
  2008-07-31 07:40   509,448   ----a-w   C:\WINDOWS\system32\XAudio2_2.dll
  2008-07-18 19:10   94,920   ----a-w   C:\WINDOWS\system32\cdm.dll
  2008-07-18 19:10   53,448   ----a-w   C:\WINDOWS\system32\wuauclt.exe
  2008-07-18 19:10   36,552   ----a-w   C:\WINDOWS\system32\wups.dll
  2008-07-18 19:09   563,912   ----a-w   C:\WINDOWS\system32\wuapi.dll
  2008-07-18 19:09   325,832   ----a-w   C:\WINDOWS\system32\wucltui.dll
  2008-07-18 19:09   205,000   ----a-w   C:\WINDOWS\system32\wuweb.dll
  2008-07-18 19:09   1,811,656   ----a-w   C:\WINDOWS\system32\wuaueng.dll
  2008-07-12 05:18   467,984   ----a-w   C:\WINDOWS\system32\d3dx10_39.dll
  2008-07-12 05:18   3,851,784   ----a-w   C:\WINDOWS\system32\D3DX9_39.dll
  2008-07-12 05:18   1,493,528   ----a-w   C:\WINDOWS\system32\D3DCompiler_39.dll
  2008-07-07 20:28   253,952   ----a-w   C:\WINDOWS\system32\es.dll
  2008-07-03 14:03   4,745,216   ------r   C:\WINDOWS\system32\drivers\RtkHDAud.sys
  2008-07-03 13:51   16,876,032   ------r   C:\WINDOWS\RTHDCPL.exe
  2008-06-24 16:44   74,240   ----a-w   C:\WINDOWS\system32\mscms.dll
  2008-06-24 13:06   972,072   ----a-w   C:\WINDOWS\UNNeroMediaHome.exe
  2008-06-23 16:29   826,368   ----a-w   C:\WINDOWS\system32\wininet.dll
  2008-06-20 17:47   246,784   ----a-w   C:\WINDOWS\system32\mswsock.dll
  2008-06-19 13:42   2,808,832   ------r   C:\WINDOWS\alcwzrd.exe
  2008-06-19 13:27   9,715,200   ------r   C:\WINDOWS\RTLCPL.exe
  2008-06-19 13:20   57,344   ------r   C:\WINDOWS\Alcmtr.exe
  2008-06-18 15:01   77,824   ------r   C:\WINDOWS\SoundMan.exe
  2008-06-06 11:54   972,072   ----a-w   C:\WINDOWS\UNRecode.exe
  2008-06-06 11:54   95,600   ----a-w   C:\WINDOWS\system32\NeroCo.dll
  2008-06-04 13:29   446,464   ----a-w   C:\WINDOWS\system32\NVUNINST.EXE
  2008-05-30 11:19   507,400   ----a-w   C:\WINDOWS\system32\XAudio2_1.dll
  2008-05-30 11:18   238,088   ----a-w   C:\WINDOWS\system32\xactengine3_1.dll
  2008-05-30 11:17   65,032   ----a-w   C:\WINDOWS\system32\XAPOFX1_0.dll
  2008-05-30 11:17   25,608   ----a-w   C:\WINDOWS\system32\X3DAudio1_4.dll
  2008-05-30 11:11   467,984   ----a-w   C:\WINDOWS\system32\d3dx10_38.dll
  2008-05-30 11:11   3,850,760   ----a-w   C:\WINDOWS\system32\D3DX9_38.dll
  2008-05-30 11:11   1,491,992   ----a-w   C:\WINDOWS\system32\D3DCompiler_38.dll
  .
  
  ((((((((((((((((((((((((((((( snapshot@2008-08-28_19.37.34.54 )))))))))))))))))))))))))))))))))))))))))
  .
  2008-08-07 13:27:04   163,328   ----a-w   C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
  2008-08-29 00:54:51   2,134,016   ----a-w   C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
  2008-08-29 00:54:51   24,576   ----a-w   C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
  2008-08-07 13:27:04   163,328   ----a-w   C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
  2008-08-29 00:54:50   2,134,016   ----a-w   C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
  2008-08-29 00:54:50   24,576   ----a-w   C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
  .
  (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
  REGEDIT4
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 09:12 15360]
  "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
  "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 16:06 1840424]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
  "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
  "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2005-06-06 18:05 2614496]
  "OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-05-11 02:08 2512392]
  "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 09:31 2221352]
  "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 18:52 1447168]
  "RTHDCPL"="RTHDCPL.EXE" [2008-07-03 16:51 16876032 C:\WINDOWS\RTHDCPL.exe]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 09:12 15360]
  
  C:\Documents and Settings\Butu\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
  MailWasherPro.lnk - C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe [2008-08-23 18:23:56 16667786]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
  "msacm.ac3filter"= ac3filter.acm
  "VIDC.XFR1"= xfcodec.dll
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
  SecurityProviders   msapsspc.dllschannel.dlldigest.dllmsnsspc.dll
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
  "EnableFirewall"= 0 (0x0)
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "%windir%\\system32\\sessmgr.exe"=
  "C:\\Program Files\\ventrilo_2_1_2_server\\ventrilo_srv.exe"=
  "C:\\Program Files\\Xfire\\xfire.exe"=
  "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
  "C:\\Program Files\\uTorrent\\uTorrent.exe"=
  
  R0 nvgts;nvgts;C:\WINDOWS\system32\DRIVERS\nvgts.sys [2008-01-25 20:01]
  R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 18:56]
  .
  .
  ------- Supplementary Scan -------
  .
  FireFox -: Profile - C:\Documents and Settings\Butu\Application Data\Mozilla\Firefox\Profiles\lret89u2.default\
  FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fi/
  .
  
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-08-29 14:19:18
  Windows 5.1.2600 Service Pack 3 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  
  [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\vsdatant]
  "ImagePath"=""
  .
  Completion time: 2008-08-29 14:19:45
  ComboFix-quarantined-files.txt 2008-08-29 11:19:42
  ComboFix2.txt 2008-08-28 17:19:57
  ComboFix3.txt 2008-08-28 16:37:47
  
  Pre-Run: 225,042,194,432 tavua vapaana
  Post-Run: 225,032,466,432 tavua vapaana
  
  247   --- E O F ---   2008-08-27 10:05:09
- 123321
  2008-08-29 14:24:12
  ihmettelijä2 kirjoitti:
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 14:15:15, on 29.8.2008
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16705)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
  C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
  C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\oodag.exe
  C:\WINDOWS\system32\IoctlSvc.exe
  C:\WINDOWS\system32\PnkBstrA.exe
  C:\Program Files\Sygate\SPF\smc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\WINDOWS\RTHDCPL.EXE
  C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
  C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
  C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
  C:\Program Files\uTorrent\uTorrent.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\HJT\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
  O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
  O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
  O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219428325796
  O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
  O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
  O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
  O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
  O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
  O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
  
  --
  End of file - 4839 bytes
  hyvin korjailtu :D
ihmettelijä2
2008-08-29 14:50:55
ComboFix 08-08-28.06 - Butu 2008-08-29 14:18:41.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1035.18.2603 [GMT 3:00]
Running from: C:\Documents and Settings\Butu\Työpöytä\ComboFix.exe
* Created a new restore point
* Resident AV is active

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-07-28 to 2008-08-29 )))))))))))))))))
.

2008-08-29 03:54 . 2008-08-29 03:54 d-------- C:\WINDOWS\ERUNT
2008-08-28 19:40 . 2008-08-28 19:40 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-28 19:40 . 2008-08-28 19:40 d-------- C:\Documents and Settings\Butu\Application Data\Malwarebytes
2008-08-28 19:40 . 2008-08-28 19:40 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-28 19:40 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-28 19:40 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-28 18:18 . 2008-08-29 14:15 d-------- C:\HJT
2008-08-28 18:13 . 2008-08-28 18:14 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-28 18:03 . 2008-08-28 18:03 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-08-28 18:00 . 2008-08-28 18:13 d-------- C:\Documents and Settings\Butu\Application Data\Lavasoft
2008-08-28 17:53 . 2008-08-28 17:53 d-------- C:\Documents and Settings\Butu\Application Data\PC Tools
2008-08-28 17:34 . 2008-08-28 17:34 d-------- C:\Documents and Settings\All Users\Application Data\ESET
2008-08-27 16:41 . 2008-08-28 18:57 d-------- C:\Program Files\mIRC
2008-08-27 16:41 . 2008-08-27 16:42 d-------- C:\Documents and Settings\Butu\Application Data\mIRC
2008-08-25 18:33 . 1998-10-02 19:00 327,168 --a------ C:\WINDOWS\IsUninst.exe
2008-08-24 20:00 . 2008-08-24 20:00 d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-08-24 19:54 . 2008-08-24 19:54 d-------- C:\Program Files\Microsoft Works
2008-08-24 19:53 . 2008-08-24 19:53 d-------- C:\WINDOWS\SHELLNEW
2008-08-24 19:53 . 2008-08-24 19:53 dr-h----- C:\MSOCache
2008-08-24 19:53 . 2008-08-24 20:13 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-23 20:34 . 2008-08-23 20:34 d-------- C:\Documents and Settings\All Users\Application Data\vsosdk
2008-08-23 20:31 . 2008-08-23 20:40 d-------- C:\Program Files\DVDFab Platinum 4
2008-08-23 20:28 . 2008-08-23 20:28 d-------- C:\Documents and Settings\Butu\Application Data\Canon
2008-08-23 20:27 . 2008-08-23 20:31 d-------- C:\Program Files\DVDFab 5
2008-08-23 20:27 . 2008-08-23 20:33 d-------- C:\Documents and Settings\Butu\Application Data\Vso
2008-08-23 20:27 . 2008-08-23 20:31 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2008-08-23 20:27 . 2008-08-23 20:31 47,360 --a------ C:\Documents and Settings\Butu\Application Data\pcouffin.sys
2008-08-23 20:23 . 2008-08-23 20:23 d--h----- C:\Program Files\CanonBJ
2008-08-23 20:23 . 2008-08-23 20:23 d-------- C:\Program Files\Canon
2008-08-23 20:23 . 2008-08-23 20:23 d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-08-23 19:05 . 2008-08-29 03:58 15,324 --a------ C:\WINDOWS\system32\oodbs.lor
2008-08-23 19:01 . 2008-08-23 19:01 d-------- C:\Program Files\Nero
2008-08-23 18:58 . 2008-02-28 13:26 1,414,440 --a------ C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-08-23 18:58 . 2008-02-28 13:01 774,144 --a------ C:\WINDOWS\system32\NEROINSTAEC43759.DB
2008-08-23 18:58 . 2008-08-23 18:58 0 --a------ C:\WINDOWS\Irremote.ini
2008-08-23 18:51 . 2008-08-23 18:51 d-------- C:\Program Files\NeroInstall.bak
2008-08-23 18:51 . 2008-08-23 18:51 d-------- C:\Documents and Settings\Butu\Application Data\Nero
2008-08-23 18:49 . 2008-08-23 18:49 d-------- C:\Program Files\Foxit Software
2008-08-23 18:49 . 2008-08-23 19:02 d-------- C:\Program Files\Common Files\Nero
2008-08-23 18:49 . 2008-08-23 19:01 d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-08-23 18:33 . 2008-08-23 18:33 d-------- C:\Program Files\MSXML 4.0
2008-08-23 18:30 . 2008-08-23 18:30 d-------- C:\Documents and Settings\Butu\Application Data\InterVideo
2008-08-23 18:29 . 2008-08-23 18:29 d-------- C:\Program Files\InterVideo Information Service
2008-08-23 18:29 . 2008-08-23 18:29 d-------- C:\Program Files\Common Files\Ulead
2008-08-23 18:29 . 2008-08-23 20:21 d-------- C:\Documents and Settings\Butu\Application Data\Ventrilo
2008-08-23 18:29 . 2008-08-23 18:29 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-23 18:29 . 2006-05-11 18:41 654 --------- C:\WINDOWS\remove.iss
2008-08-23 18:28 . 2008-08-23 18:28 d-------- C:\Program Files\VentriloMIX
2008-08-23 18:28 . 2008-08-23 18:28 d-------- C:\Program Files\InterVideo
2008-08-23 18:28 . 2008-08-23 18:28 d-------- C:\Program Files\Common Files\InterVideo
2008-08-23 18:28 . 2008-08-23 18:28 d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2008-08-23 18:26 . 2008-08-23 18:26 d-------- C:\WINDOWS\Logs
2008-08-23 18:24 . 2008-08-29 14:16 d-------- C:\Documents and Settings\Butu\Application Data\MailWasherPro
2008-08-23 18:23 . 2008-08-23 18:23 d-------- C:\Program Files\FireTrust
2008-08-23 18:22 . 2008-08-23 18:22 d-------- C:\Program Files\OO Software
2008-08-23 16:23 . 2008-08-23 16:23 d-------- C:\Program Files\uTorrent
2008-08-23 16:23 . 2008-08-29 14:15 d-------- C:\Documents and Settings\Butu\Application Data\uTorrent
2008-08-23 16:11 . 2008-08-23 16:11 d-------- C:\Program Files\Sygate
2008-08-23 16:11 . 2008-08-28 18:26 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-23 16:11 . 2005-06-06 18:05 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
2008-08-23 16:11 . 2005-06-06 17:32 61,008 --a------ C:\WINDOWS\system32\drivers\Teefer.sys
2008-08-23 16:11 . 2005-06-06 17:34 21,075 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys
2008-08-23 16:11 . 2005-06-06 18:06 14,448 --a------ C:\WINDOWS\system32\drivers\wg6n.sys
2008-08-23 16:11 . 2005-06-06 18:06 14,448 --a------ C:\WINDOWS\system32\drivers\wg5n.sys
2008-08-23 16:11 . 2005-06-06 18:05 14,448 --a------ C:\WINDOWS\system32\drivers\wg4n.sys
2008-08-23 16:11 . 2005-06-06 18:05 14,448 --a------ C:\WINDOWS\system32\drivers\wg3n.sys
2008-08-23 16:10 . 2008-08-28 17:37 d-------- C:\Program Files\ESET
2008-08-23 16:01 . 2008-08-23 16:01 d-------- C:\WINDOWS\system32\Lang
2008-08-23 16:01 . 2008-08-23 16:01 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-08-23 16:01 . 2008-08-23 16:01 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-08-23 16:00 . 2008-08-23 16:00 d-------- C:\Program Files\Realtek
2008-08-23 15:47 . 2008-08-23 15:47 d-------- C:\Program Files\FileZilla FTP Client
2008-08-23 15:47 . 2008-08-29 03:50 d-------- C:\Documents and Settings\Butu\Application Data\FileZilla
2008-08-23 15:21 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
2008-08-23 15:21 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll
2008-08-23 15:21 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-08-23 03:13 . 2008-08-25 17:45 d-------- C:\Documents and Settings\Butu\Contacts
2008-08-23 03:12 . 2008-08-23 03:12 d----c--- C:\WINDOWS\system32\DRVSTORE
2008-08-23 03:07 . 2008-08-23 03:11 d-------- C:\Program Files\Windows Live
2008-08-23 03:07 . 2008-08-23 03:11 d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-23 03:07 . 2008-08-23 03:07 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-08-22 22:14 . 2008-08-22 22:14 d-------- C:\Program Files\DAEMON Tools Lite
2008-08-22 21:58 . 2008-08-22 21:58 d-------- C:\Documents and Settings\Butu\Application Data\DAEMON Tools
2008-08-22 21:58 . 2008-08-22 21:58 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-08-22 21:53 . 2008-08-22 21:53 d-------- C:\Documents and Settings\NetworkService\Application Data\Xfire
2008-08-22 21:52 . 2008-08-22 21:53 d-------- C:\Program Files\Xfire
2008-08-22 21:52 . 2008-08-25 19:05 d-------- C:\Documents and Settings\Butu\Application Data\Xfire
2008-08-22 21:51 . 2008-08-23 18:29 d--h----- C:\Program Files\InstallShield Installation Information
2008-08-22 21:51 . 2008-08-22 21:51 d-------- C:\Program Files\EA GAMES
2008-08-22 21:30 . 2008-08-22 21:30 d-------- C:\Program Files\yatzy
2008-08-22 21:29 . 2008-08-22 21:29 d-------- C:\Program Files\ventrilo_2_1_2_server
2008-08-22 21:15 . 2008-08-22 21:15 d-------- C:\Program Files\Windows Media Connect 2
2008-08-22 21:14 . 2008-08-22 21:14 d-------- C:\WINDOWS\system32\LogFiles
2008-08-22 21:14 . 2008-08-22 21:14 d-------- C:\WINDOWS\system32\drivers\UMDF
2008-08-22 21:13 . 2008-06-14 20:34 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-08-22 21:13 . 2008-06-14 20:34 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-08-22 21:13 . 2008-08-22 21:13 0 --a------ C:\WINDOWS\nsreg.dat
2008-08-22 21:12 . 2008-08-22 21:12 d-------- C:\WINDOWS\system32\Adobe
2008-08-22 21:09 . 2008-08-27 13:05 d--h----- C:\WINDOWS\$hf_mig$
2008-08-22 21:09 . 2006-09-25 17:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-08-22 21:07 . 2008-08-28 18:30 d-------- C:\Program Files\Unlocker
2008-08-22 21:06 . 2008-08-22 21:06 d-------- C:\Program Files\ffdshow
2008-08-22 21:06 . 2008-08-22 21:06 d-------- C:\Program Files\AC3Filter
2008-08-22 21:06 . 2006-12-10 23:32 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-08-22 21:06 . 2007-08-09 14:27 380,928 --a------ C:\WINDOWS\system32\ac3filter.acm
2008-08-22 21:06 . 2006-12-10 23:32 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-08-22 21:06 . 2007-04-24 17:30 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
2008-08-22 21:06 . 2008-03-28 19:41 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2008-08-22 21:06 . 2007-07-10 18:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-08-22 21:05 . 2008-08-22 21:05 d--hs---- C:\Documents and Settings\Butu\UserData
2008-08-22 21:05 . 2008-07-18 22:10 45,768 --a------ C:\WINDOWS\system32\wups2.dll
2008-08-22 21:05 . 2008-07-18 22:10 33,992 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-08-22 21:05 . 2008-07-18 22:09 29,896 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-08-22 21:05 . 2008-07-18 22:08 25,800 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-08-22 21:05 . 2008-07-18 22:08 21,192 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-08-22 21:03 . 2008-08-22 21:03 592 --a------ C:\WINDOWS\chgkey.vbs
2008-08-13 01:07 . 2008-08-13 01:07 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-23 20:07 111,928 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-08-23 19:57 139,600 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-08-23 17:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\vsosdk
2008-08-23 17:33 --------- d-----w C:\Documents and Settings\Butu\Application Data\Vso
2008-08-23 15:29 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-23 13:00 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-08-22 20:08 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-08-22 20:04 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Xfire
2008-08-22 17:49 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-31 07:41 68,616 ----a-w C:\WINDOWS\system32\XAPOFX1_1.dll
2008-07-31 07:41 238,088 ----a-w C:\WINDOWS\system32\xactengine3_2.dll
2008-07-31 07:40 509,448 ----a-w C:\WINDOWS\system32\XAudio2_2.dll
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-12 05:18 467,984 ----a-w C:\WINDOWS\system32\d3dx10_39.dll
2008-07-12 05:18 3,851,784 ----a-w C:\WINDOWS\system32\D3DX9_39.dll
2008-07-12 05:18 1,493,528 ----a-w C:\WINDOWS\system32\D3DCompiler_39.dll
2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-03 14:03 4,745,216 ------r C:\WINDOWS\system32\drivers\RtkHDAud.sys
2008-07-03 13:51 16,876,032 ------r C:\WINDOWS\RTHDCPL.exe
2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 13:06 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2008-06-23 16:29 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:47 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-19 13:42 2,808,832 ------r C:\WINDOWS\alcwzrd.exe
2008-06-19 13:27 9,715,200 ------r C:\WINDOWS\RTLCPL.exe
2008-06-19 13:20 57,344 ------r C:\WINDOWS\Alcmtr.exe
2008-06-18 15:01 77,824 ------r C:\WINDOWS\SoundMan.exe
2008-06-06 11:54 972,072 ----a-w C:\WINDOWS\UNRecode.exe
2008-06-06 11:54 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll
2008-06-04 13:29 446,464 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2008-05-30 11:19 507,400 ----a-w C:\WINDOWS\system32\XAudio2_1.dll
2008-05-30 11:18 238,088 ----a-w C:\WINDOWS\system32\xactengine3_1.dll
2008-05-30 11:17 65,032 ----a-w C:\WINDOWS\system32\XAPOFX1_0.dll
2008-05-30 11:17 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_4.dll
2008-05-30 11:11 467,984 ----a-w C:\WINDOWS\system32\d3dx10_38.dll
2008-05-30 11:11 3,850,760 ----a-w C:\WINDOWS\system32\D3DX9_38.dll
2008-05-30 11:11 1,491,992 ----a-w C:\WINDOWS\system32\D3DCompiler_38.dll
.

((((((((((((((((((((((((((((( snapshot@2008-08-28_19.37.34.54 )))))))))))))))))))))))))))))))))))))))))
.
2008-08-07 13:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
2008-08-29 00:54:51 2,134,016 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
2008-08-29 00:54:51 24,576 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
2008-08-07 13:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
2008-08-29 00:54:50 2,134,016 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
2008-08-29 00:54:50 24,576 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 09:12 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 16:06 1840424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2005-06-06 18:05 2614496]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-05-11 02:08 2512392]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 09:31 2221352]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 18:52 1447168]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-03 16:51 16876032 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 09:12 15360]

C:\Documents and Settings\Butu\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
MailWasherPro.lnk - C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe [2008-08-23 18:23:56 16667786]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\ventrilo_2_1_2_server\\ventrilo_srv.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

R0 nvgts;nvgts;C:\WINDOWS\system32\DRIVERS\nvgts.sys [2008-01-25 20:01]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 18:56]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Butu\Application Data\Mozilla\Firefox\Profiles\lret89u2.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fi/
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 14:19:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\vsdatant]
"ImagePath"=""
.
Completion time: 2008-08-29 14:19:45
ComboFix-quarantined-files.txt 2008-08-29 11:19:42
ComboFix2.txt 2008-08-28 17:19:57
ComboFix3.txt 2008-08-28 16:37:47

Pre-Run: 225,042,194,432 tavua vapaana
Post-Run: 225,032,466,432 tavua vapaana

247 --- E O F --- 2008-08-27 10:05:09
- 123321
  2008-08-29 15:35:38
  he loki kunossa
  
  Lataa http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
  OTMoveIt ja tallenna se työpöydällesi.
  
  Tuplaklikkaa OTMoveIt.exe.
  Klikkaa CleanUp!.
  Valitse Yes kun kysytään "Begin cleanup Process?".
  Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.
  
  HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.
- ihmettelijä2
  2008-08-29 17:08:04
  123321 kirjoitti:
  he loki kunossa
  
  Lataa http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
  OTMoveIt ja tallenna se työpöydällesi.
  
  Tuplaklikkaa OTMoveIt.exe.
  Klikkaa CleanUp!.
  Valitse Yes kun kysytään "Begin cleanup Process?".
  Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.
  
  HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.
  tehty on :)
- ihmettelijä2
  2008-08-29 17:25:01
  123321 kirjoitti:
  he loki kunossa
  
  Lataa http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
  OTMoveIt ja tallenna se työpöydällesi.
  
  Tuplaklikkaa OTMoveIt.exe.
  Klikkaa CleanUp!.
  Valitse Yes kun kysytään "Begin cleanup Process?".
  Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.
  
  HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.
  mikähän olisi noin tulevaisuutta aatellen hyvä suoja tommosia vastaan? nyttekään ei aavistustakaan mistä moiset olivat tullu.. yleensä en käy edes missään epäilyttävil sivuil enkä lataile ihme tiedostoja.. eilen töistä tullessani kone oli aivan juntturassa.. eikä muut käytä tätä konetta.. ei vaan ymmärrä... :P
- 123321
  2008-08-29 20:04:51
  ihmettelijä2 kirjoitti:
  mikähän olisi noin tulevaisuutta aatellen hyvä suoja tommosia vastaan? nyttekään ei aavistustakaan mistä moiset olivat tullu.. yleensä en käy edes missään epäilyttävil sivuil enkä lataile ihme tiedostoja.. eilen töistä tullessani kone oli aivan juntturassa.. eikä muut käytä tätä konetta.. ei vaan ymmärrä... :P
  ropsahtelee sellainen netti on.

Ketjusta on poistettu 0 sääntöjenvastaista viestiä.

Takaisin ylös

Luetuimmat keskustelut

Miksi jollain jää "talvi päälle"
Huvittaa kastoa ullkona jotain vahempaa äijää joka pukeutuu edelleen kun olisi +5 astetta lämmittä vaikka on helle keli
16.05.2024 12:52Maailman menoa
239
2095
Mitä et hyväksy miehessä/naisessa josta olet kiinnostunut?
Itse en halua, että miehellä olisi lapsia!
16.05.2024 20:33Ikävä
153
1355
Se katse silloin
Oli hetki, jolloin katseemme kohtasivat. Oli talvi vielä. Kerta toisensa jälkeen palaan tuohon jaettuun katseeseen. Tunt
16.05.2024 17:57Ikävä
52
1246
Kaipaaville
Kerro sun tunteesi ja ajatukset tähän jos et uskalla irl!
16.05.2024 21:47Ikävä
74
1025
Tiesitkö? Farmi Suomi Kirsikka Simberg on tämän julkkisnaisen tytär - Katso tyrmäävät mallikuvat!
Oho, aikamoinen ylläri. Tiesitkö?! Kirsikka Simberg on yksi tämän kauden Farmi Suomi -kisaajista. Hänellä ei ole tuttu t
16.05.2024 09:29Suomalaiset julkkikset
3
989
Miten haluaisit
Että reagoisin jos näkisin sinut nyt?
16.05.2024 20:47Ikävä
78
930
Tuhdit oluet kauppoihin. Miksi vastustaa?
8% oluet kauppoihin mutta mikä siinä on että osa politikoista vstustaa ? Kauppa kuitenkin hinnoittelee vahvan oluen ni
16.05.2024 07:23Maailman menoa
211
923
Sinua tulen kyllä ikävöimään pitkään nainen
mutta oli pakko tehdä päätös oman mielenrauhan vuoksi. Toivottavasti saat elämältä kaiken mitä haluat.
16.05.2024 20:22Ikävä
45
825
Kärsämäki rosvojen ja tuhopolttajien kylä?
Poliisi ampui uhkaava miestä Kärsämäellä. Ja vasta joku poltti rivitalon. Mikä riivaa Kärsämäkisiä? Joko tuulimyllyjen
16.05.2024 19:45Kärsämäki
15
640
Kohta me ei enää nähdä :(
En pääse enää uppoutumaan silmiisi enkä kuunnella ihanaa ääntäsi. Elämä on pstä.
16.05.2024 21:03Ikävä
39
639

Jotain pielessä?

Vastaukset

123321 kirjoitti:

123321 kirjoitti:

123321 kirjoitti:

123321 kirjoitti:

ihmettelijä2 kirjoitti:

123321 kirjoitti:

ihmettelijä2 kirjoitti:

123321 kirjoitti:

ihmettelijä2 kirjoitti:

123321 kirjoitti:

123321 kirjoitti:

ihmettelijä2 kirjoitti:

Luetuimmat keskustelut

Miksi jollain jää "talvi päälle"

Mitä et hyväksy miehessä/naisessa josta olet kiinnostunut?

Se katse silloin

Kaipaaville

Tiesitkö? Farmi Suomi Kirsikka Simberg on tämän julkkisnaisen tytär - Katso tyrmäävät mallikuvat!

Miten haluaisit

Tuhdit oluet kauppoihin. Miksi vastustaa?

Sinua tulen kyllä ikävöimään pitkään nainen

Kärsämäki rosvojen ja tuhopolttajien kylä?

Kohta me ei enää nähdä :(

Suomen Pallolitto: Tasoryhmät lasten jalkapallossa - Erätauko-tilaisuus ma 20.5.2024

Jennika Vikman avoimena - Isosisko Erika Vikman ohjeisti napakasti Tähdet, tähdet -kisaan: "Älä.."

Tähdet, tähdet -tippuja Sara Chafak uskoo tähän yliluonnolliseen: "Se on niinkin yksinkertaista..."

Tiesitkö? Farmi Suomi Kirsikka Simberg on tämän julkkisnaisen tytär - Katso tyrmäävät mallikuvat!

Tuhdit oluet kauppoihin. Miksi vastustaa?

Miksi jollain jää "talvi päälle"

Seiska: Teemu Roivainen paljastaa, miten käytti Selviytyjät 30 000 voittorahat: "Menivät..."

Tuhoaako tekoäly maailman?

Miksi koulut pakottavat

Oi, mikä upea luksusmökki! Hanna Kinnunen avaa ovet Lapin huvilalle - Katso kuvat tästä!