Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    Jotain pielessä?

    Kaiken maailman ikkunoita rupes aukeilemaan yhtäkkiä. Ajoin joitakin puhdistusohjelmia läpi ja löytyikin jotain mutta vieläkös olisi jotain?
    Kiitos jo etukäteen!!

    Logfile of HijackThis v1.99.1
    Scan saved at 18:21:05, on 28.8.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\oodag.exe
    C:\WINDOWS\system32\IoctlSvc.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\Program Files\Spyware Doctor\swdoctor.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
    O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
    O4 - HKLM\..\Run: [BM574e09e9] Rundll32.exe "C:\WINDOWS\system32\rksqaplg.dll",s
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [THGuard] C:\Program Files\TrojanHunter 4.2\THGuard.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
    O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219428325796
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
    O20 - AppInit_DLLs: hupbrd.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
    O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
    O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
    O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
    221322
    Äänestä

    Muut lukivat myös

    Vastaukset 22

    Vanhimmat

    Sen verran että molemmat nettiselaimet (IE 7 ja FirFox 3) takkuaa ja sekoilevat edelleen ja pompahtelee jotain mainos ikkunoita auki.

    Äänestä

    scannaa hjt:llä merkkaa paina Fix checked

    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
    O4 - HKLM\..\Run: [BM574e09e9] Rundll32.exe "C:\WINDOWS\system32\rksqaplg.dll",s
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [THGuard] C:\Program Files\TrojanHunter 4.2\THGuard.exe

    ==================

    1.Lataa combofix.exe työpöydällesi yhdestä, kahdesta klinkistä:
    http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    http://subs.geekstogo.com/ComboFix.exe

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    ===============

    Lataa Malwarebytes' Anti-Malware työpöydällesi.
    http://www.besttechie.net/tools/mbam-setup.exe
    •   Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    •   Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes' Anti-Malware ja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Finish.
    •   Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    •   Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    •   Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    •   Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    •   Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    •   Lähetä lokin sisältö seuraavassa viestissäsi.

    Äänestä

    ComboFix 08-08-27.06 - Butu 2008-08-28 19:34:26.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1035.18.2598 [GMT 3:00]
    Running from: C:\Documents and Settings\Butu\Työpöytä\ComboFix.exe
    * Created a new restore point
    * Resident AV is active


    [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Butu\Application Data\inst.exe
    C:\WINDOWS\BM574e09e9.txt
    C:\WINDOWS\BM574e09e9.xml
    C:\WINDOWS\cookies.ini
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\system32\awtqnNDu.dll
    C:\WINDOWS\system32\cbXPhfCS.dll
    C:\WINDOWS\system32\crasdsiv.ini
    C:\WINDOWS\system32\hupbrd.dll
    C:\WINDOWS\system32\jkkKeFXn.dll
    C:\WINDOWS\system32\nXFeKkkj.ini
    C:\WINDOWS\system32\nXFeKkkj.ini2
    C:\WINDOWS\system32\opnLdedd.dll
    C:\WINDOWS\system32\rksqaplg.dll
    C:\WINDOWS\system32\ssqRICuT.dll
    C:\WINDOWS\system32\tuvwXpQK.dll
    C:\WINDOWS\system32\tuxmaemp.dll
    C:\WINDOWS\system32\urqPFxYr.dll
    C:\WINDOWS\system32\visdsarc.dll

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-07-28 to 2008-08-28 )))))))))))))))))
    .

    2008-08-28 18:18 . 2008-08-28 19:31      d--------   C:\HJT
    2008-08-28 18:13 . 2008-08-28 18:14      d--------   C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-28 18:03 . 2008-08-28 18:03      d--------   C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-08-28 18:00 . 2008-08-28 18:13      d--------   C:\Documents and Settings\Butu\Application Data\Lavasoft
    2008-08-28 17:53 . 2008-08-28 17:53      d--------   C:\Documents and Settings\Butu\Application Data\PC Tools
    2008-08-28 17:34 . 2008-08-28 17:34      d--------   C:\Documents and Settings\All Users\Application Data\ESET
    2008-08-27 16:41 . 2008-08-28 18:57      d--------   C:\Program Files\mIRC
    2008-08-27 16:41 . 2008-08-27 16:42      d--------   C:\Documents and Settings\Butu\Application Data\mIRC
    2008-08-26 21:21 . 2008-08-28 18:15      d--hs----   C:\Program Files\POL
    2008-08-25 18:33 . 1998-10-02 19:00   327,168   --a------   C:\WINDOWS\IsUninst.exe
    2008-08-24 20:00 . 2008-08-24 20:00      d--------   C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
    2008-08-24 19:54 . 2008-08-24 19:54      d--------   C:\Program Files\Microsoft Works
    2008-08-24 19:53 . 2008-08-24 19:53      d--------   C:\WINDOWS\SHELLNEW
    2008-08-24 19:53 . 2008-08-24 19:53      dr-h-----   C:\MSOCache
    2008-08-24 19:53 . 2008-08-24 20:13      d--------   C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-08-23 20:34 . 2008-08-23 20:34      d--------   C:\Documents and Settings\All Users\Application Data\vsosdk
    2008-08-23 20:31 . 2008-08-23 20:40      d--------   C:\Program Files\DVDFab Platinum 4
    2008-08-23 20:28 . 2008-08-23 20:28      d--------   C:\Documents and Settings\Butu\Application Data\Canon
    2008-08-23 20:27 . 2008-08-23 20:31      d--------   C:\Program Files\DVDFab 5
    2008-08-23 20:27 . 2008-08-23 20:33      d--------   C:\Documents and Settings\Butu\Application Data\Vso
    2008-08-23 20:27 . 2008-08-23 20:31   47,360   --a------   C:\WINDOWS\system32\drivers\pcouffin.sys
    2008-08-23 20:27 . 2008-08-23 20:31   47,360   --a------   C:\Documents and Settings\Butu\Application Data\pcouffin.sys
    2008-08-23 20:23 . 2008-08-23 20:23      d--h-----   C:\Program Files\CanonBJ
    2008-08-23 20:23 . 2008-08-23 20:23      d--------   C:\Program Files\Canon
    2008-08-23 20:23 . 2008-08-23 20:23      d--h-----   C:\Documents and Settings\All Users\Application Data\CanonBJ
    2008-08-23 19:05 . 2008-08-28 19:36   12,770   --a------   C:\WINDOWS\system32\oodbs.lor
    2008-08-23 19:01 . 2008-08-23 19:01      d--------   C:\Program Files\Nero
    2008-08-23 18:58 . 2008-02-28 13:26   1,414,440   --a------   C:\WINDOWS\system32\ShellManager310E2D762.dll
    2008-08-23 18:58 . 2008-02-28 13:01   774,144   --a------   C:\WINDOWS\system32\NEROINSTAEC43759.DB
    2008-08-23 18:58 . 2008-08-23 18:58   0   --a------   C:\WINDOWS\Irremote.ini
    2008-08-23 18:51 . 2008-08-23 18:51      d--------   C:\Program Files\NeroInstall.bak
    2008-08-23 18:51 . 2008-08-23 18:51      d--------   C:\Documents and Settings\Butu\Application Data\Nero
    2008-08-23 18:49 . 2008-08-23 18:49      d--------   C:\Program Files\Foxit Software
    2008-08-23 18:49 . 2008-08-23 19:02      d--------   C:\Program Files\Common Files\Nero
    2008-08-23 18:49 . 2008-08-23 19:01      d--------   C:\Documents and Settings\All Users\Application Data\Nero
    2008-08-23 18:33 . 2008-08-23 18:33      d--------   C:\Program Files\MSXML 4.0
    2008-08-23 18:30 . 2008-08-23 18:30      d--------   C:\Documents and Settings\Butu\Application Data\InterVideo
    2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Program Files\InterVideo Information Service
    2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Program Files\Common Files\Ulead
    2008-08-23 18:29 . 2008-08-23 20:21      d--------   C:\Documents and Settings\Butu\Application Data\Ventrilo
    2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-08-23 18:29 . 2006-05-11 18:41   654   ---------   C:\WINDOWS\remove.iss
    2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\VentriloMIX
    2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\InterVideo
    2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\Common Files\InterVideo
    2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Documents and Settings\All Users\Application Data\InstallShield
    2008-08-23 18:26 . 2008-08-23 18:26      d--------   C:\WINDOWS\Logs
    2008-08-23 18:24 . 2008-08-28 18:58      d--------   C:\Documents and Settings\Butu\Application Data\MailWasherPro
    2008-08-23 18:23 . 2008-08-23 18:23      d--------   C:\Program Files\FireTrust
    2008-08-23 18:22 . 2008-08-23 18:22      d--------   C:\Program Files\OO Software
    2008-08-23 16:23 . 2008-08-23 16:23      d--------   C:\Program Files\uTorrent
    2008-08-23 16:23 . 2008-08-28 18:40      d--------   C:\Documents and Settings\Butu\Application Data\uTorrent
    2008-08-23 16:11 . 2008-08-23 16:11      d--------   C:\Program Files\Sygate
    2008-08-23 16:11 . 2008-08-28 18:26      d--------   C:\Program Files\Common Files\Wise Installation Wizard
    2008-08-23 16:11 . 2005-06-06 18:05   83,096   --a------   C:\WINDOWS\system32\SSSensor.dll
    2008-08-23 16:11 . 2005-06-06 17:32   61,008   --a------   C:\WINDOWS\system32\drivers\Teefer.sys
    2008-08-23 16:11 . 2005-06-06 17:34   21,075   --a------   C:\WINDOWS\system32\drivers\wpsdrvnt.sys
    2008-08-23 16:11 . 2005-06-06 18:06   14,448   --a------   C:\WINDOWS\system32\drivers\wg6n.sys
    2008-08-23 16:11 . 2005-06-06 18:06   14,448   --a------   C:\WINDOWS\system32\drivers\wg5n.sys
    2008-08-23 16:11 . 2005-06-06 18:05   14,448   --a------   C:\WINDOWS\system32\drivers\wg4n.sys
    2008-08-23 16:11 . 2005-06-06 18:05   14,448   --a------   C:\WINDOWS\system32\drivers\wg3n.sys
    2008-08-23 16:10 . 2008-08-28 17:37      d--------   C:\Program Files\ESET
    2008-08-23 16:01 . 2008-08-23 16:01      d--------   C:\WINDOWS\system32\Lang
    2008-08-23 16:01 . 2008-08-23 16:01   940,794   --a------   C:\WINDOWS\system32\LoopyMusic.wav
    2008-08-23 16:01 . 2008-08-23 16:01   146,650   --a------   C:\WINDOWS\system32\BuzzingBee.wav
    2008-08-23 16:00 . 2008-08-23 16:00      d--------   C:\Program Files\Realtek
    2008-08-23 15:47 . 2008-08-23 15:47      d--------   C:\Program Files\FileZilla FTP Client
    2008-08-23 15:47 . 2008-08-28 18:42      d--------   C:\Documents and Settings\Butu\Application Data\FileZilla
    2008-08-23 15:21 . 2008-07-18 22:07   270,880   --a------   C:\WINDOWS\system32\mucltui.dll
    2008-08-23 15:21 . 2008-07-18 22:07   210,976   --a------   C:\WINDOWS\system32\muweb.dll
    2008-08-23 15:21 . 2008-07-18 22:07   29,728   --a------   C:\WINDOWS\system32\mucltui.dll.mui
    2008-08-23 03:13 . 2008-08-25 17:45      d--------   C:\Documents and Settings\Butu\Contacts
    2008-08-23 03:12 . 2008-08-23 03:12      d----c---   C:\WINDOWS\system32\DRVSTORE
    2008-08-23 03:07 . 2008-08-23 03:11      d--------   C:\Program Files\Windows Live
    2008-08-23 03:07 . 2008-08-23 03:11      d--hsc---   C:\Program Files\Common Files\WindowsLiveInstaller
    2008-08-23 03:07 . 2008-08-23 03:07      d--------   C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-08-22 22:14 . 2008-08-22 22:14      d--------   C:\Program Files\DAEMON Tools Lite
    2008-08-22 21:58 . 2008-08-22 21:58      d--------   C:\Documents and Settings\Butu\Application Data\DAEMON Tools
    2008-08-22 21:58 . 2008-08-22 21:58   717,296   --a------   C:\WINDOWS\system32\drivers\sptd.sys
    2008-08-22 21:53 . 2008-08-22 21:53      d--------   C:\Documents and Settings\NetworkService\Application Data\Xfire
    2008-08-22 21:52 . 2008-08-22 21:53      d--------   C:\Program Files\Xfire
    2008-08-22 21:52 . 2008-08-25 19:05      d--------   C:\Documents and Settings\Butu\Application Data\Xfire
    2008-08-22 21:51 . 2008-08-23 18:29      d--h-----   C:\Program Files\InstallShield Installation Information
    2008-08-22 21:51 . 2008-08-22 21:51      d--------   C:\Program Files\EA GAMES
    2008-08-22 21:30 . 2008-08-22 21:30      d--------   C:\Program Files\yatzy
    2008-08-22 21:29 . 2008-08-22 21:29      d--------   C:\Program Files\ventrilo_2_1_2_server
    2008-08-22 21:15 . 2008-08-22 21:15      d--------   C:\Program Files\Windows Media Connect 2
    2008-08-22 21:14 . 2008-08-22 21:14      d--------   C:\WINDOWS\system32\LogFiles
    2008-08-22 21:14 . 2008-08-22 21:14      d--------   C:\WINDOWS\system32\drivers\UMDF
    2008-08-22 21:13 . 2008-06-14 20:34   272,128   ---------   C:\WINDOWS\system32\drivers\bthport.sys
    2008-08-22 21:13 . 2008-06-14 20:34   272,128   -----c---   C:\WINDOWS\system32\dllcache\bthport.sys
    2008-08-22 21:13 . 2008-08-22 21:13   0   --a------   C:\WINDOWS\nsreg.dat
    2008-08-22 21:12 . 2008-08-22 21:12      d--------   C:\WINDOWS\system32\Adobe
    2008-08-22 21:09 . 2008-08-27 13:05      d--h-----   C:\WINDOWS\$hf_mig$
    2008-08-22 21:09 . 2006-09-25 17:58   23,856   --a------   C:\WINDOWS\system32\spupdsvc.exe
    2008-08-22 21:07 . 2008-08-28 18:30      d--------   C:\Program Files\Unlocker
    2008-08-22 21:06 . 2008-08-22 21:06      d--------   C:\Program Files\ffdshow
    2008-08-22 21:06 . 2008-08-22 21:06      d--------   C:\Program Files\AC3Filter
    2008-08-22 21:06 . 2006-12-10 23:32   499,712   --a------   C:\WINDOWS\system32\msvcp71.dll
    2008-08-22 21:06 . 2007-08-09 14:27   380,928   --a------   C:\WINDOWS\system32\ac3filter.acm
    2008-08-22 21:06 . 2006-12-10 23:32   348,160   --a------   C:\WINDOWS\system32\msvcr71.dll
    2008-08-22 21:06 . 2007-04-24 17:30   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
    2008-08-22 21:06 . 2008-03-28 19:41   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
    2008-08-22 21:06 . 2007-07-10 18:10   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest
    2008-08-22 21:05 . 2008-08-22 21:05      d--hs----   C:\Documents and Settings\Butu\UserData
    2008-08-22 21:05 . 2008-07-18 22:10   45,768   --a------   C:\WINDOWS\system32\wups2.dll
    2008-08-22 21:05 . 2008-07-18 22:10   33,992   --a------   C:\WINDOWS\system32\wucltui.dll.mui
    2008-08-22 21:05 . 2008-07-18 22:09   29,896   --a------   C:\WINDOWS\system32\wuaucpl.cpl.mui
    2008-08-22 21:05 . 2008-07-18 22:08   25,800   --a------   C:\WINDOWS\system32\wuapi.dll.mui
    2008-08-22 21:05 . 2008-07-18 22:08   21,192   --a------   C:\WINDOWS\system32\wuaueng.dll.mui
    2008-08-22 21:03 . 2008-08-22 21:03   592   --a------   C:\WINDOWS\chgkey.vbs
    2008-08-13 01:07 . 2008-08-13 01:07   42,320   --a------   C:\WINDOWS\system32\xfcodec.dll

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-23 20:07   111,928   ----a-w   C:\WINDOWS\system32\PnkBstrB.exe
    2008-08-23 19:57   139,600   ----a-w   C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-08-23 17:34   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\vsosdk
    2008-08-23 17:33   ---------   d-----w   C:\Documents and Settings\Butu\Application Data\Vso
    2008-08-23 15:29   ---------   d-----w   C:\Program Files\Common Files\InstallShield
    2008-08-23 13:00   315,392   ----a-w   C:\WINDOWS\HideWin.exe
    2008-08-22 20:08   66,872   ----a-w   C:\WINDOWS\system32\PnkBstrA.exe
    2008-08-22 20:04   ---------   d-----w   C:\Documents and Settings\LocalService\Application Data\Xfire
    2008-08-22 17:49   ---------   d-----w   C:\Program Files\microsoft frontpage
    2008-07-31 07:41   68,616   ----a-w   C:\WINDOWS\system32\XAPOFX1_1.dll
    2008-07-31 07:41   238,088   ----a-w   C:\WINDOWS\system32\xactengine3_2.dll
    2008-07-31 07:40   509,448   ----a-w   C:\WINDOWS\system32\XAudio2_2.dll
    2008-07-18 19:10   94,920   ----a-w   C:\WINDOWS\system32\cdm.dll
    2008-07-18 19:10   53,448   ----a-w   C:\WINDOWS\system32\wuauclt.exe
    2008-07-18 19:10   36,552   ----a-w   C:\WINDOWS\system32\wups.dll
    2008-07-18 19:09   563,912   ----a-w   C:\WINDOWS\system32\wuapi.dll
    2008-07-18 19:09   325,832   ----a-w   C:\WINDOWS\system32\wucltui.dll
    2008-07-18 19:09   205,000   ----a-w   C:\WINDOWS\system32\wuweb.dll
    2008-07-18 19:09   1,811,656   ----a-w   C:\WINDOWS\system32\wuaueng.dll
    2008-07-12 05:18   467,984   ----a-w   C:\WINDOWS\system32\d3dx10_39.dll
    2008-07-12 05:18   3,851,784   ----a-w   C:\WINDOWS\system32\D3DX9_39.dll
    2008-07-12 05:18   1,493,528   ----a-w   C:\WINDOWS\system32\D3DCompiler_39.dll
    2008-07-07 20:28   253,952   ----a-w   C:\WINDOWS\system32\es.dll
    2008-07-03 14:03   4,745,216   ------r   C:\WINDOWS\system32\drivers\RtkHDAud.sys
    2008-07-03 13:51   16,876,032   ------r   C:\WINDOWS\RTHDCPL.exe
    2008-06-24 16:44   74,240   ----a-w   C:\WINDOWS\system32\mscms.dll
    2008-06-24 13:06   972,072   ----a-w   C:\WINDOWS\UNNeroMediaHome.exe
    2008-06-23 16:29   826,368   ----a-w   C:\WINDOWS\system32\wininet.dll
    2008-06-20 17:47   246,784   ----a-w   C:\WINDOWS\system32\mswsock.dll
    2008-06-19 13:42   2,808,832   ------r   C:\WINDOWS\alcwzrd.exe
    2008-06-19 13:27   9,715,200   ------r   C:\WINDOWS\RTLCPL.exe
    2008-06-19 13:20   57,344   ------r   C:\WINDOWS\Alcmtr.exe
    2008-06-18 15:01   77,824   ------r   C:\WINDOWS\SoundMan.exe
    2008-06-06 11:54   972,072   ----a-w   C:\WINDOWS\UNRecode.exe
    2008-06-06 11:54   95,600   ----a-w   C:\WINDOWS\system32\NeroCo.dll
    2008-06-04 13:29   446,464   ----a-w   C:\WINDOWS\system32\NVUNINST.EXE
    2008-05-30 11:19   507,400   ----a-w   C:\WINDOWS\system32\XAudio2_1.dll
    2008-05-30 11:18   238,088   ----a-w   C:\WINDOWS\system32\xactengine3_1.dll
    2008-05-30 11:17   65,032   ----a-w   C:\WINDOWS\system32\XAPOFX1_0.dll
    2008-05-30 11:17   25,608   ----a-w   C:\WINDOWS\system32\X3DAudio1_4.dll
    2008-05-30 11:11   467,984   ----a-w   C:\WINDOWS\system32\d3dx10_38.dll
    2008-05-30 11:11   3,850,760   ----a-w   C:\WINDOWS\system32\D3DX9_38.dll
    2008-05-30 11:11   1,491,992   ----a-w   C:\WINDOWS\system32\D3DCompiler_38.dll
    .

    (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 09:12 15360]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
    "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 16:06 1840424]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
    "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2005-06-06 18:05 2614496]
    "OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-05-11 02:08 2512392]
    "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 09:31 2221352]
    "POL Agent"="C:\Program Files\POL\POL.exe" [2008-08-15 23:57 933888]
    "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 18:52 1447168]
    "RTHDCPL"="RTHDCPL.EXE" [2008-07-03 16:51 16876032 C:\WINDOWS\RTHDCPL.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 09:12 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=hupbrd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.ac3filter"= ac3filter.acm
    "VIDC.XFR1"= xfcodec.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001
    "UpdatesDisableNotify"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\ventrilo_2_1_2_server\\ventrilo_srv.exe"=
    "C:\\Program Files\\Xfire\\xfire.exe"=
    "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=

    R0 nvgts;nvgts;C:\WINDOWS\system32\DRIVERS\nvgts.sys [2008-01-25 20:01]
    R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 18:56]
    .
    - - - - ORPHANS REMOVED - - - -

    HKLM-Run-BM574e09e9 - C:\WINDOWS\system32\rksqaplg.dll


    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Butu\Application Data\Mozilla\Firefox\Profiles\lret89u2.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fi/
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-08-28 19:36:49
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]
    "ImagePath"=""
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\oodag.exe
    C:\WINDOWS\system32\IoctlSvc.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    .
    **************************************************************************
    .
    Completion time: 2008-08-28 19:37:46 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-08-28 16:37:44

    Pre-Run: 223,593,615,360 tavua vapaana
    Post-Run: 225,137,717,248 tavua vapaana

    272   --- E O F ---   2008-08-27 10:05:09

    Äänestä

    • menemään

      Äänestä

    • 123321 kirjoitti:

      menemään

      samalla ohjelmalla uusi skanni?

      Äänestä

    Malwarebytes' Anti-Malware 1.25
    Tietokantaversio: 1092
    Windows 5.1.2600 Service Pack 3

    20:13:19 28.8.2008
    mbam-log-08-28-2008 (20-13-19).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|I:\|)
    Tarkistetut kohteet: 110819
    Kulunut aika: 31 minute(s), 6 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 23

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    C:\QooBox\Quarantine\C\WINDOWS\system32\awtqnNDu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\cbXPhfCS.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\hupbrd.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\jkkKeFXn.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\opnLdedd.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\rksqaplg.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\ssqRICuT.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\tuvwXpQK.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\tuxmaemp.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\urqPFxYr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\visdsarc.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002369.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002370.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002371.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002372.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002373.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002374.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002375.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002376.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002377.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002378.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{45655DC5-DCCB-4D32-B901-61B2FF5FFFDF}\RP31\A0002379.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    I:\System Volume Information\_restore{4112482E-24B9-4B0F-B806-7A0DD1FA5798}\RP194\A0039666.EXE (Trojan.Agent) -> Quarantined and deleted successfully.

    Äänestä

    Tässä toisen ajon jälkeinen loki.

    ComboFix 08-08-27.06 - Butu 2008-08-28 20:18:40.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1035.18.2539 [GMT 3:00]
    Running from: C:\Documents and Settings\Butu\Työpöytä\ComboFix.exe
    * Resident AV is active


    [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-07-28 to 2008-08-28 )))))))))))))))))
    .

    2008-08-28 19:40 . 2008-08-28 19:40      d--------   C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-28 19:40 . 2008-08-28 19:40      d--------   C:\Documents and Settings\Butu\Application Data\Malwarebytes
    2008-08-28 19:40 . 2008-08-28 19:40      d--------   C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-28 19:40 . 2008-08-17 15:01   38,472   --a------   C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-08-28 19:40 . 2008-08-17 15:01   17,144   --a------   C:\WINDOWS\system32\drivers\mbam.sys
    2008-08-28 18:18 . 2008-08-28 19:31      d--------   C:\HJT
    2008-08-28 18:13 . 2008-08-28 18:14      d--------   C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-28 18:03 . 2008-08-28 18:03      d--------   C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-08-28 18:00 . 2008-08-28 18:13      d--------   C:\Documents and Settings\Butu\Application Data\Lavasoft
    2008-08-28 17:53 . 2008-08-28 17:53      d--------   C:\Documents and Settings\Butu\Application Data\PC Tools
    2008-08-28 17:34 . 2008-08-28 17:34      d--------   C:\Documents and Settings\All Users\Application Data\ESET
    2008-08-27 16:41 . 2008-08-28 18:57      d--------   C:\Program Files\mIRC
    2008-08-27 16:41 . 2008-08-27 16:42      d--------   C:\Documents and Settings\Butu\Application Data\mIRC
    2008-08-26 21:21 . 2008-08-28 18:15      d--hs----   C:\Program Files\POL
    2008-08-25 18:33 . 1998-10-02 19:00   327,168   --a------   C:\WINDOWS\IsUninst.exe
    2008-08-24 20:00 . 2008-08-24 20:00      d--------   C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
    2008-08-24 19:54 . 2008-08-24 19:54      d--------   C:\Program Files\Microsoft Works
    2008-08-24 19:53 . 2008-08-24 19:53      d--------   C:\WINDOWS\SHELLNEW
    2008-08-24 19:53 . 2008-08-24 19:53      dr-h-----   C:\MSOCache
    2008-08-24 19:53 . 2008-08-24 20:13      d--------   C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-08-23 20:34 . 2008-08-23 20:34      d--------   C:\Documents and Settings\All Users\Application Data\vsosdk
    2008-08-23 20:31 . 2008-08-23 20:40      d--------   C:\Program Files\DVDFab Platinum 4
    2008-08-23 20:28 . 2008-08-23 20:28      d--------   C:\Documents and Settings\Butu\Application Data\Canon
    2008-08-23 20:27 . 2008-08-23 20:31      d--------   C:\Program Files\DVDFab 5
    2008-08-23 20:27 . 2008-08-23 20:33      d--------   C:\Documents and Settings\Butu\Application Data\Vso
    2008-08-23 20:27 . 2008-08-23 20:31   47,360   --a------   C:\WINDOWS\system32\drivers\pcouffin.sys
    2008-08-23 20:27 . 2008-08-23 20:31   47,360   --a------   C:\Documents and Settings\Butu\Application Data\pcouffin.sys
    2008-08-23 20:23 . 2008-08-23 20:23      d--h-----   C:\Program Files\CanonBJ
    2008-08-23 20:23 . 2008-08-23 20:23      d--------   C:\Program Files\Canon
    2008-08-23 20:23 . 2008-08-23 20:23      d--h-----   C:\Documents and Settings\All Users\Application Data\CanonBJ
    2008-08-23 19:05 . 2008-08-28 19:36   12,770   --a------   C:\WINDOWS\system32\oodbs.lor
    2008-08-23 19:01 . 2008-08-23 19:01      d--------   C:\Program Files\Nero
    2008-08-23 18:58 . 2008-02-28 13:26   1,414,440   --a------   C:\WINDOWS\system32\ShellManager310E2D762.dll
    2008-08-23 18:58 . 2008-02-28 13:01   774,144   --a------   C:\WINDOWS\system32\NEROINSTAEC43759.DB
    2008-08-23 18:58 . 2008-08-23 18:58   0   --a------   C:\WINDOWS\Irremote.ini
    2008-08-23 18:51 . 2008-08-23 18:51      d--------   C:\Program Files\NeroInstall.bak
    2008-08-23 18:51 . 2008-08-23 18:51      d--------   C:\Documents and Settings\Butu\Application Data\Nero
    2008-08-23 18:49 . 2008-08-23 18:49      d--------   C:\Program Files\Foxit Software
    2008-08-23 18:49 . 2008-08-23 19:02      d--------   C:\Program Files\Common Files\Nero
    2008-08-23 18:49 . 2008-08-23 19:01      d--------   C:\Documents and Settings\All Users\Application Data\Nero
    2008-08-23 18:33 . 2008-08-23 18:33      d--------   C:\Program Files\MSXML 4.0
    2008-08-23 18:30 . 2008-08-23 18:30      d--------   C:\Documents and Settings\Butu\Application Data\InterVideo
    2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Program Files\InterVideo Information Service
    2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Program Files\Common Files\Ulead
    2008-08-23 18:29 . 2008-08-23 20:21      d--------   C:\Documents and Settings\Butu\Application Data\Ventrilo
    2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-08-23 18:29 . 2006-05-11 18:41   654   ---------   C:\WINDOWS\remove.iss
    2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\VentriloMIX
    2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\InterVideo
    2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\Common Files\InterVideo
    2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Documents and Settings\All Users\Application Data\InstallShield
    2008-08-23 18:26 . 2008-08-23 18:26      d--------   C:\WINDOWS\Logs
    2008-08-23 18:24 . 2008-08-28 18:58      d--------   C:\Documents and Settings\Butu\Application Data\MailWasherPro
    2008-08-23 18:23 . 2008-08-23 18:23      d--------   C:\Program Files\FireTrust
    2008-08-23 18:22 . 2008-08-23 18:22      d--------   C:\Program Files\OO Software
    2008-08-23 16:23 . 2008-08-23 16:23      d--------   C:\Program Files\uTorrent
    2008-08-23 16:23 . 2008-08-28 18:40      d--------   C:\Documents and Settings\Butu\Application Data\uTorrent
    2008-08-23 16:11 . 2008-08-23 16:11      d--------   C:\Program Files\Sygate
    2008-08-23 16:11 . 2008-08-28 18:26      d--------   C:\Program Files\Common Files\Wise Installation Wizard
    2008-08-23 16:11 . 2005-06-06 18:05   83,096   --a------   C:\WINDOWS\system32\SSSensor.dll
    2008-08-23 16:11 . 2005-06-06 17:32   61,008   --a------   C:\WINDOWS\system32\drivers\Teefer.sys
    2008-08-23 16:11 . 2005-06-06 17:34   21,075   --a------   C:\WINDOWS\system32\drivers\wpsdrvnt.sys
    2008-08-23 16:11 . 2005-06-06 18:06   14,448   --a------   C:\WINDOWS\system32\drivers\wg6n.sys
    2008-08-23 16:11 . 2005-06-06 18:06   14,448   --a------   C:\WINDOWS\system32\drivers\wg5n.sys
    2008-08-23 16:11 . 2005-06-06 18:05   14,448   --a------   C:\WINDOWS\system32\drivers\wg4n.sys
    2008-08-23 16:11 . 2005-06-06 18:05   14,448   --a------   C:\WINDOWS\system32\drivers\wg3n.sys
    2008-08-23 16:10 . 2008-08-28 17:37      d--------   C:\Program Files\ESET
    2008-08-23 16:01 . 2008-08-23 16:01      d--------   C:\WINDOWS\system32\Lang
    2008-08-23 16:01 . 2008-08-23 16:01   940,794   --a------   C:\WINDOWS\system32\LoopyMusic.wav
    2008-08-23 16:01 . 2008-08-23 16:01   146,650   --a------   C:\WINDOWS\system32\BuzzingBee.wav
    2008-08-23 16:00 . 2008-08-23 16:00      d--------   C:\Program Files\Realtek
    2008-08-23 15:47 . 2008-08-23 15:47      d--------   C:\Program Files\FileZilla FTP Client
    2008-08-23 15:47 . 2008-08-28 18:42      d--------   C:\Documents and Settings\Butu\Application Data\FileZilla
    2008-08-23 15:21 . 2008-07-18 22:07   270,880   --a------   C:\WINDOWS\system32\mucltui.dll
    2008-08-23 15:21 . 2008-07-18 22:07   210,976   --a------   C:\WINDOWS\system32\muweb.dll
    2008-08-23 15:21 . 2008-07-18 22:07   29,728   --a------   C:\WINDOWS\system32\mucltui.dll.mui
    2008-08-23 03:13 . 2008-08-25 17:45      d--------   C:\Documents and Settings\Butu\Contacts
    2008-08-23 03:12 . 2008-08-23 03:12      d----c---   C:\WINDOWS\system32\DRVSTORE
    2008-08-23 03:07 . 2008-08-23 03:11      d--------   C:\Program Files\Windows Live
    2008-08-23 03:07 . 2008-08-23 03:11      d--hsc---   C:\Program Files\Common Files\WindowsLiveInstaller
    2008-08-23 03:07 . 2008-08-23 03:07      d--------   C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-08-22 22:14 . 2008-08-22 22:14      d--------   C:\Program Files\DAEMON Tools Lite
    2008-08-22 21:58 . 2008-08-22 21:58      d--------   C:\Documents and Settings\Butu\Application Data\DAEMON Tools
    2008-08-22 21:58 . 2008-08-22 21:58   717,296   --a------   C:\WINDOWS\system32\drivers\sptd.sys
    2008-08-22 21:53 . 2008-08-22 21:53      d--------   C:\Documents and Settings\NetworkService\Application Data\Xfire
    2008-08-22 21:52 . 2008-08-22 21:53      d--------   C:\Program Files\Xfire
    2008-08-22 21:52 . 2008-08-25 19:05      d--------   C:\Documents and Settings\Butu\Application Data\Xfire
    2008-08-22 21:51 . 2008-08-23 18:29      d--h-----   C:\Program Files\InstallShield Installation Information
    2008-08-22 21:51 . 2008-08-22 21:51      d--------   C:\Program Files\EA GAMES
    2008-08-22 21:30 . 2008-08-22 21:30      d--------   C:\Program Files\yatzy
    2008-08-22 21:29 . 2008-08-22 21:29      d--------   C:\Program Files\ventrilo_2_1_2_server
    2008-08-22 21:15 . 2008-08-22 21:15      d--------   C:\Program Files\Windows Media Connect 2
    2008-08-22 21:14 . 2008-08-22 21:14      d--------   C:\WINDOWS\system32\LogFiles
    2008-08-22 21:14 . 2008-08-22 21:14      d--------   C:\WINDOWS\system32\drivers\UMDF
    2008-08-22 21:13 . 2008-06-14 20:34   272,128   ---------   C:\WINDOWS\system32\drivers\bthport.sys
    2008-08-22 21:13 . 2008-06-14 20:34   272,128   -----c---   C:\WINDOWS\system32\dllcache\bthport.sys
    2008-08-22 21:13 . 2008-08-22 21:13   0   --a------   C:\WINDOWS\nsreg.dat
    2008-08-22 21:12 . 2008-08-22 21:12      d--------   C:\WINDOWS\system32\Adobe
    2008-08-22 21:09 . 2008-08-27 13:05      d--h-----   C:\WINDOWS\$hf_mig$
    2008-08-22 21:09 . 2006-09-25 17:58   23,856   --a------   C:\WINDOWS\system32\spupdsvc.exe
    2008-08-22 21:07 . 2008-08-28 18:30      d--------   C:\Program Files\Unlocker
    2008-08-22 21:06 . 2008-08-22 21:06      d--------   C:\Program Files\ffdshow
    2008-08-22 21:06 . 2008-08-22 21:06      d--------   C:\Program Files\AC3Filter
    2008-08-22 21:06 . 2006-12-10 23:32   499,712   --a------   C:\WINDOWS\system32\msvcp71.dll
    2008-08-22 21:06 . 2007-08-09 14:27   380,928   --a------   C:\WINDOWS\system32\ac3filter.acm
    2008-08-22 21:06 . 2006-12-10 23:32   348,160   --a------   C:\WINDOWS\system32\msvcr71.dll
    2008-08-22 21:06 . 2007-04-24 17:30   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
    2008-08-22 21:06 . 2008-03-28 19:41   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
    2008-08-22 21:06 . 2007-07-10 18:10   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest
    2008-08-22 21:05 . 2008-08-22 21:05      d--hs----   C:\Documents and Settings\Butu\UserData
    2008-08-22 21:05 . 2008-07-18 22:10   45,768   --a------   C:\WINDOWS\system32\wups2.dll
    2008-08-22 21:05 . 2008-07-18 22:10   33,992   --a------   C:\WINDOWS\system32\wucltui.dll.mui
    2008-08-22 21:05 . 2008-07-18 22:09   29,896   --a------   C:\WINDOWS\system32\wuaucpl.cpl.mui
    2008-08-22 21:05 . 2008-07-18 22:08   25,800   --a------   C:\WINDOWS\system32\wuapi.dll.mui
    2008-08-22 21:05 . 2008-07-18 22:08   21,192   --a------   C:\WINDOWS\system32\wuaueng.dll.mui
    2008-08-22 21:03 . 2008-08-22 21:03   592   --a------   C:\WINDOWS\chgkey.vbs
    2008-08-13 01:07 . 2008-08-13 01:07   42,320   --a------   C:\WINDOWS\system32\xfcodec.dll

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-23 20:07   111,928   ----a-w   C:\WINDOWS\system32\PnkBstrB.exe
    2008-08-23 19:57   139,600   ----a-w   C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-08-23 17:34   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\vsosdk
    2008-08-23 17:33   ---------   d-----w   C:\Documents and Settings\Butu\Application Data\Vso
    2008-08-23 15:29   ---------   d-----w   C:\Program Files\Common Files\InstallShield
    2008-08-23 13:00   315,392   ----a-w   C:\WINDOWS\HideWin.exe
    2008-08-22 20:08   66,872   ----a-w   C:\WINDOWS\system32\PnkBstrA.exe
    2008-08-22 20:04   ---------   d-----w   C:\Documents and Settings\LocalService\Application Data\Xfire
    2008-08-22 17:49   ---------   d-----w   C:\Program Files\microsoft frontpage
    2008-07-31 07:41   68,616   ----a-w   C:\WINDOWS\system32\XAPOFX1_1.dll
    2008-07-31 07:41   238,088   ----a-w   C:\WINDOWS\system32\xactengine3_2.dll
    2008-07-31 07:40   509,448   ----a-w   C:\WINDOWS\system32\XAudio2_2.dll
    2008-07-18 19:10   94,920   ----a-w   C:\WINDOWS\system32\cdm.dll
    2008-07-18 19:10   53,448   ----a-w   C:\WINDOWS\system32\wuauclt.exe
    2008-07-18 19:10   36,552   ----a-w   C:\WINDOWS\system32\wups.dll
    2008-07-18 19:09   563,912   ----a-w   C:\WINDOWS\system32\wuapi.dll
    2008-07-18 19:09   325,832   ----a-w   C:\WINDOWS\system32\wucltui.dll
    2008-07-18 19:09   205,000   ----a-w   C:\WINDOWS\system32\wuweb.dll
    2008-07-18 19:09   1,811,656   ----a-w   C:\WINDOWS\system32\wuaueng.dll
    2008-07-12 05:18   467,984   ----a-w   C:\WINDOWS\system32\d3dx10_39.dll
    2008-07-12 05:18   3,851,784   ----a-w   C:\WINDOWS\system32\D3DX9_39.dll
    2008-07-12 05:18   1,493,528   ----a-w   C:\WINDOWS\system32\D3DCompiler_39.dll
    2008-07-07 20:28   253,952   ----a-w   C:\WINDOWS\system32\es.dll
    2008-07-03 14:03   4,745,216   ------r   C:\WINDOWS\system32\drivers\RtkHDAud.sys
    2008-07-03 13:51   16,876,032   ------r   C:\WINDOWS\RTHDCPL.exe
    2008-06-24 16:44   74,240   ----a-w   C:\WINDOWS\system32\mscms.dll
    2008-06-24 13:06   972,072   ----a-w   C:\WINDOWS\UNNeroMediaHome.exe
    2008-06-23 16:29   826,368   ----a-w   C:\WINDOWS\system32\wininet.dll
    2008-06-20 17:47   246,784   ----a-w   C:\WINDOWS\system32\mswsock.dll
    2008-06-19 13:42   2,808,832   ------r   C:\WINDOWS\alcwzrd.exe
    2008-06-19 13:27   9,715,200   ------r   C:\WINDOWS\RTLCPL.exe
    2008-06-19 13:20   57,344   ------r   C:\WINDOWS\Alcmtr.exe
    2008-06-18 15:01   77,824   ------r   C:\WINDOWS\SoundMan.exe
    2008-06-06 11:54   972,072   ----a-w   C:\WINDOWS\UNRecode.exe
    2008-06-06 11:54   95,600   ----a-w   C:\WINDOWS\system32\NeroCo.dll
    2008-06-04 13:29   446,464   ----a-w   C:\WINDOWS\system32\NVUNINST.EXE
    2008-05-30 11:19   507,400   ----a-w   C:\WINDOWS\system32\XAudio2_1.dll
    2008-05-30 11:18   238,088   ----a-w   C:\WINDOWS\system32\xactengine3_1.dll
    2008-05-30 11:17   65,032   ----a-w   C:\WINDOWS\system32\XAPOFX1_0.dll
    2008-05-30 11:17   25,608   ----a-w   C:\WINDOWS\system32\X3DAudio1_4.dll
    2008-05-30 11:11   467,984   ----a-w   C:\WINDOWS\system32\d3dx10_38.dll
    2008-05-30 11:11   3,850,760   ----a-w   C:\WINDOWS\system32\D3DX9_38.dll
    2008-05-30 11:11   1,491,992   ----a-w   C:\WINDOWS\system32\D3DCompiler_38.dll
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 09:12 15360]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
    "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 16:06 1840424]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
    "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2005-06-06 18:05 2614496]
    "OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-05-11 02:08 2512392]
    "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 09:31 2221352]
    "POL Agent"="C:\Program Files\POL\POL.exe" [2008-08-15 23:57 933888]
    "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 18:52 1447168]
    "RTHDCPL"="RTHDCPL.EXE" [2008-07-03 16:51 16876032 C:\WINDOWS\RTHDCPL.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 09:12 15360]

    C:\Documents and Settings\Butu\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    MailWasherPro.lnk - C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe [2008-08-23 18:23:56 16667786]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=hupbrd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.ac3filter"= ac3filter.acm
    "VIDC.XFR1"= xfcodec.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders   msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001
    "UpdatesDisableNotify"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\ventrilo_2_1_2_server\\ventrilo_srv.exe"=
    "C:\\Program Files\\Xfire\\xfire.exe"=
    "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=

    R0 nvgts;nvgts;C:\WINDOWS\system32\DRIVERS\nvgts.sys [2008-01-25 20:01]
    R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 18:56]
    .
    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Butu\Application Data\Mozilla\Firefox\Profiles\lret89u2.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fi/
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-08-28 20:19:31
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\vsdatant]
    "ImagePath"=""
    .
    Completion time: 2008-08-28 20:19:57
    ComboFix-quarantined-files.txt 2008-08-28 17:19:55
    ComboFix2.txt 2008-08-28 16:37:47

    Pre-Run: 225,111,269,376 tavua vapaana
    Post-Run: 225,102,176,256 tavua vapaana

    242   --- E O F ---   2008-08-27 10:05:09

    Äänestä

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:13:25, on 28.8.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\oodag.exe
    C:\WINDOWS\system32\IoctlSvc.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\uTorrent\uTorrent.exe
    C:\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219428325796
    O20 - AppInit_DLLs: hupbrd.dll
    O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
    O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
    O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

    --
    End of file - 4878 bytes

    Äänestä

    • Milles tämä kuuluu hupbrd.dll

      ==============

      Lataa SDFix by AndyManchesta
      http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
      ja tallenna se työpöydällesi.

      Käynnistä koneesi vikasietotilaan:
      sammuta ja käynnistä
      käynnistyksen yhteydessä hakkaa F8 nappia
      valitse nuolinäppäimellä vikasietotila
      paina enter ja enter
      valitse käyttäjätilisi
      paina kyllä

      Jossakin koneissa hakataan F8:sin sijasta F5:tä
      •   Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
      •   Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
      •   Paina Y käynnistääksesi skriptin.
      •   Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
      •   Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
      •   Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
      •   Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
      •   Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
      •   Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.

      Äänestä

    • 123321 kirjoitti:

      Milles tämä kuuluu hupbrd.dll

      ==============

      Lataa SDFix by AndyManchesta
      http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
      ja tallenna se työpöydällesi.

      Käynnistä koneesi vikasietotilaan:
      sammuta ja käynnistä
      käynnistyksen yhteydessä hakkaa F8 nappia
      valitse nuolinäppäimellä vikasietotila
      paina enter ja enter
      valitse käyttäjätilisi
      paina kyllä

      Jossakin koneissa hakataan F8:sin sijasta F5:tä
      •   Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
      •   Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
      •   Paina Y käynnistääksesi skriptin.
      •   Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
      •   Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
      •   Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
      •   Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
      •   Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
      •   Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.

      ei kyllä aavistustakaan mille tuo dll tiedosto kuuluu. winukan etsi toiminto ei löytänyt koneelta tuollaista tiedostoa.. eikä googlekaan auttanut :D

      Äänestä

    • 123321 kirjoitti:

      Milles tämä kuuluu hupbrd.dll

      ==============

      Lataa SDFix by AndyManchesta
      http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
      ja tallenna se työpöydällesi.

      Käynnistä koneesi vikasietotilaan:
      sammuta ja käynnistä
      käynnistyksen yhteydessä hakkaa F8 nappia
      valitse nuolinäppäimellä vikasietotila
      paina enter ja enter
      valitse käyttäjätilisi
      paina kyllä

      Jossakin koneissa hakataan F8:sin sijasta F5:tä
      •   Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
      •   Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
      •   Paina Y käynnistääksesi skriptin.
      •   Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
      •   Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
      •   Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
      •   Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
      •   Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
      •   Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.

      [b]SDFix: Version 1.219 [/b]
      Run by Butu on pe 29.08.2008 at 03:55

      Microsoft Windows XP [versio 5.1.2600]
      Running From: C:\Documents and Settings\Butu\Ty”p”yt„\SDFix

      [b]Checking Services [/b]:


      Restoring Default Security Values
      Restoring Default Hosts File

      Rebooting


      [b]Checking Files [/b]:

      No Trojan Files Found




      Folder C:\Documents and Settings\Butu\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#w*w.redtube.com - Removed


      Removing Temp Files

      [b]ADS Check [/b]:



      [b]Final Check [/b]:

      catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-08-29 03:59:19
      Windows 5.1.2600 Service Pack 3 NTFS

      scanning hidden processes ...

      scanning hidden services & system hive ...

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
      "s1"=dword:2df9c43f
      "s2"=dword:110480d0
      "h0"=dword:00000001

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
      "p0"="C:\Program Files\DAEMON Tools Lite\"
      "h0"=dword:00000000
      "khjeh"=hex:ec,c3,6e,50,ab,7e,db,ec,6e,20,94,2c,69,e2,b7,ce,fb,b5,f1,19,7c,..

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
      "a0"=hex:20,01,00,00,0b,8d,77,5b,e1,0f,d0,e2,cf,18,22,83,4d,60,fb,da,1d,..
      "khjeh"=hex:9c,21,cf,bc,e9,2f,aa,87,e6,78,ee,19,53,49,57,15,29,5e,f6,b0,47,..

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
      "khjeh"=hex:bc,e9,50,44,16,2e,8a,03,05,f5,43,95,6e,df,42,10,6e,44,c0,3c,c2,..
      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
      "p0"="C:\Program Files\DAEMON Tools Lite\"
      "h0"=dword:00000000
      "khjeh"=hex:ec,c3,6e,50,ab,7e,db,ec,6e,20,94,2c,69,e2,b7,ce,fb,b5,f1,19,7c,..

      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
      "a0"=hex:20,01,00,00,0b,8d,77,5b,e1,0f,d0,e2,cf,18,22,83,4d,60,fb,da,1d,..
      "khjeh"=hex:9c,21,cf,bc,e9,2f,aa,87,e6,78,ee,19,53,49,57,15,29,5e,f6,b0,47,..

      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
      "khjeh"=hex:bc,e9,50,44,16,2e,8a,03,05,f5,43,95,6e,df,42,10,6e,44,c0,3c,c2,..

      scanning hidden registry entries ...

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
      "OODEFRAG10.00.00.01WORKSTATION"="A52EFEBBDE85D6E953C370946F0593EDCA4848020687A89BB669687C4B4449C4E008793D7D48FB549FEF2802A05C60F3CDED759C41410391572E11DD49334DA6526CCB47DD45715229F5938C5788F3CDD87685EEBD8847A1B41F08DB610D6BB5C7907BE3F73728AC391EF8FD5469530F4D5FA09EA400A64C690FF61AC5D8268334BAD356272A979DBA46E3D6BCB00641B03A320982205D89B363C9700C740B122F466314A982BAD7BDDD24C699E497E1AAAAEA3C4AB4A5C1F41732EB3090A558F3A3FAFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667A2D97226D213B555C038D530D6EB345236E30F06BDF160D5C9F0BA7DEEDFA3A5C29DE7EAA9841A6A8DE10206D098F8E2B98E7AC597B168D0682250494CE52D65F628E94B77EA2FBF0A293BABC757C77CE0B64183CA6F5E52F6F1464B01766043FAB6FE933125FA5993CBEFCA9D97AFF1F1A3A613F962B425B93045283B27A2ABB0C5D359B24077E0468CF0897D7DE350E904C34DBA6AF256A994498B9FAC71CB2D346BB64DECB4467614651503D129E57669820F9687B2B573BAA5A2C362DB943B459A4D43FD593CA9EEC71BC000D8C87CC724390D62A159F61EFB1EB2C7843F57200BBC4D6B9C3B9B0DE8513A9B60501479BBB08EC28399C92447B36CFE22C1B3D03CAD98D1C97D39C369EDE8584017063DB15D0216AC943311521F634F025DB5C6FDC843704281A54AC12DB90F0F00D4B2C1ABC17009AA3011C09AFE230114F554F6BE62AB790CB7BDBA4F8E3D74AD33DEF98C1B8616027231846B9A8A14ABC232A0417E0BF8A2F99E7317BB82AE8887ACC0F5CFB16683DC63E7D48437422C9DFB4886913A5B912AD1E0CC0BA48FBC6E694CDF16F09F5B080087207F80A6673C2F124B8E89D2E6BB1E47BAB70C7A3AB64527C419E57CFAC140D41DC2626FEC87B0F0CAD6ECA17655B0C3B27447EA3565D634A875D5CB9988C2139C7AF961141E48AFC944FBA157509BC2066605EC263096A50EBEAA6FAC14895B73440C5476D09F6C8FA1F2BE663C50870EA49BA1C88362827E7874DDF4C97B1CFB33FCB17224481966AF31F73FDBA9AAA63E033F1EFD7BA70620E121F0C7621413CF5AF829D3347A9BA23CE347A463952E34D88D69F48744B4A04AD6E65E6D599B9350BE824C3A2C02A1B9A826C19C8688F95D6C33EE8FDCA1DDA8326091AFD27AEDB429A72E1899F149770445125B119D79764AC7A68248E3AC98792A9A9D4099C1FCF307D06B06452A63C55527879C5A10AC2EB60D2F3317D75E86D4E512AFE6E644EE533CB786D9C7935249486DE22C0F2CB054454C9C5D9DDE47B6134D8753A8C87C012EE4061319BDA0D6EE3DF1083AC67F39A6F3D8DA2E23BF67F7EE0054C3"

      scanning hidden files ...

      scan completed successfully
      hidden processes: 0
      hidden services: 0
      hidden files: 0


      [b]Remaining Services [/b]:




      Authorized Application Key Export:

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "C:\\Program Files\\ventrilo_2_1_2_server\\ventrilo_srv.exe"="C:\\Program Files\\ventrilo_2_1_2_server\\ventrilo_srv.exe:*:Enabled:ventrilo_srv"
      "C:\\Program Files\\Xfire\\xfire.exe"="C:\\Program Files\\Xfire\\xfire.exe:*:Enabled:Xfire"
      "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"="C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe:*:Enabled:Battlefield 2"
      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
      "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

      [b]Remaining Files [/b]:



      [b]Files with Hidden Attributes [/b]:

      Tue 19 Sep 2006 304,736 A..H. --- "C:\Program Files\Canon\MP Navigator 3.0\Maint.exe"
      Thu 26 Jan 2006 61,440 A..H. --- "C:\Program Files\Canon\MP Navigator 3.0\uinstrsc.dll"
      Fri 22 Aug 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

      [b]Finished![/b]

      Äänestä

    • 123321 kirjoitti:

      Milles tämä kuuluu hupbrd.dll

      ==============

      Lataa SDFix by AndyManchesta
      http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
      ja tallenna se työpöydällesi.

      Käynnistä koneesi vikasietotilaan:
      sammuta ja käynnistä
      käynnistyksen yhteydessä hakkaa F8 nappia
      valitse nuolinäppäimellä vikasietotila
      paina enter ja enter
      valitse käyttäjätilisi
      paina kyllä

      Jossakin koneissa hakataan F8:sin sijasta F5:tä
      •   Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
      •   Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
      •   Paina Y käynnistääksesi skriptin.
      •   Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
      •   Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
      •   Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
      •   Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
      •   Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
      •   Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 4:03:57, on 29.8.2008
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
      C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\WINDOWS\system32\oodag.exe
      C:\WINDOWS\system32\IoctlSvc.exe
      C:\WINDOWS\system32\PnkBstrA.exe
      C:\Program Files\Sygate\SPF\smc.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\WINDOWS\RTHDCPL.EXE
      C:\WINDOWS\system32\oodtray.exe
      C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
      C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
      C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
      C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\HJT\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
      O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
      O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
      O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219428325796
      O20 - AppInit_DLLs: hupbrd.dll
      O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
      O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
      O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
      O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
      O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
      O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

      --
      End of file - 4949 bytes

      Äänestä

    • ihmettelijä2 kirjoitti:

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 4:03:57, on 29.8.2008
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
      C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\WINDOWS\system32\oodag.exe
      C:\WINDOWS\system32\IoctlSvc.exe
      C:\WINDOWS\system32\PnkBstrA.exe
      C:\Program Files\Sygate\SPF\smc.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\WINDOWS\RTHDCPL.EXE
      C:\WINDOWS\system32\oodtray.exe
      C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
      C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
      C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
      C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\HJT\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
      O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
      O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
      O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219428325796
      O20 - AppInit_DLLs: hupbrd.dll
      O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
      O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
      O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
      O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
      O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
      O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

      --
      End of file - 4949 bytes

      merkkaa paina Fix checked

      O20 - AppInit_DLLs: hupbrd.dll

      scannaa uusi combofix loki

      Äänestä

    • 123321 kirjoitti:

      merkkaa paina Fix checked

      O20 - AppInit_DLLs: hupbrd.dll

      scannaa uusi combofix loki

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 14:15:15, on 29.8.2008
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
      C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\WINDOWS\system32\oodag.exe
      C:\WINDOWS\system32\IoctlSvc.exe
      C:\WINDOWS\system32\PnkBstrA.exe
      C:\Program Files\Sygate\SPF\smc.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\WINDOWS\RTHDCPL.EXE
      C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
      C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
      C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
      C:\Program Files\uTorrent\uTorrent.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\HJT\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
      O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
      O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
      O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219428325796
      O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
      O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
      O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
      O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
      O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
      O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

      --
      End of file - 4839 bytes

      Äänestä

    • ihmettelijä2 kirjoitti:

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 14:15:15, on 29.8.2008
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
      C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\WINDOWS\system32\oodag.exe
      C:\WINDOWS\system32\IoctlSvc.exe
      C:\WINDOWS\system32\PnkBstrA.exe
      C:\Program Files\Sygate\SPF\smc.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\WINDOWS\RTHDCPL.EXE
      C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
      C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
      C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
      C:\Program Files\uTorrent\uTorrent.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\HJT\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
      O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
      O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
      O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219428325796
      O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
      O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
      O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
      O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
      O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
      O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

      --
      End of file - 4839 bytes

      Lataa http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
      OTMoveIt ja tallenna se työpöydällesi.

      Tuplaklikkaa OTMoveIt.exe.
      Klikkaa CleanUp!.
      Valitse Yes kun kysytään "Begin cleanup Process?".
      Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.


      HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.

      Äänestä

    • 123321 kirjoitti:

      merkkaa paina Fix checked

      O20 - AppInit_DLLs: hupbrd.dll

      scannaa uusi combofix loki

      ComboFix 08-08-28.06 - Butu 2008-08-29 14:18:41.3 - NTFSx86
      Microsoft Windows XP Professional 5.1.2600.3.1252.1.1035.18.2603 [GMT 3:00]
      Running from: C:\Documents and Settings\Butu\Työpöytä\ComboFix.exe
      * Created a new restore point
      * Resident AV is active


      [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
      .

      ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-07-28 to 2008-08-29 )))))))))))))))))
      .

      2008-08-29 03:54 . 2008-08-29 03:54      d--------   C:\WINDOWS\ERUNT
      2008-08-28 19:40 . 2008-08-28 19:40      d--------   C:\Program Files\Malwarebytes' Anti-Malware
      2008-08-28 19:40 . 2008-08-28 19:40      d--------   C:\Documents and Settings\Butu\Application Data\Malwarebytes
      2008-08-28 19:40 . 2008-08-28 19:40      d--------   C:\Documents and Settings\All Users\Application Data\Malwarebytes
      2008-08-28 19:40 . 2008-08-17 15:01   38,472   --a------   C:\WINDOWS\system32\drivers\mbamswissarmy.sys
      2008-08-28 19:40 . 2008-08-17 15:01   17,144   --a------   C:\WINDOWS\system32\drivers\mbam.sys
      2008-08-28 18:18 . 2008-08-29 14:15      d--------   C:\HJT
      2008-08-28 18:13 . 2008-08-28 18:14      d--------   C:\Documents and Settings\All Users\Application Data\Lavasoft
      2008-08-28 18:03 . 2008-08-28 18:03      d--------   C:\Documents and Settings\All Users\Application Data\Grisoft
      2008-08-28 18:00 . 2008-08-28 18:13      d--------   C:\Documents and Settings\Butu\Application Data\Lavasoft
      2008-08-28 17:53 . 2008-08-28 17:53      d--------   C:\Documents and Settings\Butu\Application Data\PC Tools
      2008-08-28 17:34 . 2008-08-28 17:34      d--------   C:\Documents and Settings\All Users\Application Data\ESET
      2008-08-27 16:41 . 2008-08-28 18:57      d--------   C:\Program Files\mIRC
      2008-08-27 16:41 . 2008-08-27 16:42      d--------   C:\Documents and Settings\Butu\Application Data\mIRC
      2008-08-25 18:33 . 1998-10-02 19:00   327,168   --a------   C:\WINDOWS\IsUninst.exe
      2008-08-24 20:00 . 2008-08-24 20:00      d--------   C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
      2008-08-24 19:54 . 2008-08-24 19:54      d--------   C:\Program Files\Microsoft Works
      2008-08-24 19:53 . 2008-08-24 19:53      d--------   C:\WINDOWS\SHELLNEW
      2008-08-24 19:53 . 2008-08-24 19:53      dr-h-----   C:\MSOCache
      2008-08-24 19:53 . 2008-08-24 20:13      d--------   C:\Documents and Settings\All Users\Application Data\Microsoft Help
      2008-08-23 20:34 . 2008-08-23 20:34      d--------   C:\Documents and Settings\All Users\Application Data\vsosdk
      2008-08-23 20:31 . 2008-08-23 20:40      d--------   C:\Program Files\DVDFab Platinum 4
      2008-08-23 20:28 . 2008-08-23 20:28      d--------   C:\Documents and Settings\Butu\Application Data\Canon
      2008-08-23 20:27 . 2008-08-23 20:31      d--------   C:\Program Files\DVDFab 5
      2008-08-23 20:27 . 2008-08-23 20:33      d--------   C:\Documents and Settings\Butu\Application Data\Vso
      2008-08-23 20:27 . 2008-08-23 20:31   47,360   --a------   C:\WINDOWS\system32\drivers\pcouffin.sys
      2008-08-23 20:27 . 2008-08-23 20:31   47,360   --a------   C:\Documents and Settings\Butu\Application Data\pcouffin.sys
      2008-08-23 20:23 . 2008-08-23 20:23      d--h-----   C:\Program Files\CanonBJ
      2008-08-23 20:23 . 2008-08-23 20:23      d--------   C:\Program Files\Canon
      2008-08-23 20:23 . 2008-08-23 20:23      d--h-----   C:\Documents and Settings\All Users\Application Data\CanonBJ
      2008-08-23 19:05 . 2008-08-29 03:58   15,324   --a------   C:\WINDOWS\system32\oodbs.lor
      2008-08-23 19:01 . 2008-08-23 19:01      d--------   C:\Program Files\Nero
      2008-08-23 18:58 . 2008-02-28 13:26   1,414,440   --a------   C:\WINDOWS\system32\ShellManager310E2D762.dll
      2008-08-23 18:58 . 2008-02-28 13:01   774,144   --a------   C:\WINDOWS\system32\NEROINSTAEC43759.DB
      2008-08-23 18:58 . 2008-08-23 18:58   0   --a------   C:\WINDOWS\Irremote.ini
      2008-08-23 18:51 . 2008-08-23 18:51      d--------   C:\Program Files\NeroInstall.bak
      2008-08-23 18:51 . 2008-08-23 18:51      d--------   C:\Documents and Settings\Butu\Application Data\Nero
      2008-08-23 18:49 . 2008-08-23 18:49      d--------   C:\Program Files\Foxit Software
      2008-08-23 18:49 . 2008-08-23 19:02      d--------   C:\Program Files\Common Files\Nero
      2008-08-23 18:49 . 2008-08-23 19:01      d--------   C:\Documents and Settings\All Users\Application Data\Nero
      2008-08-23 18:33 . 2008-08-23 18:33      d--------   C:\Program Files\MSXML 4.0
      2008-08-23 18:30 . 2008-08-23 18:30      d--------   C:\Documents and Settings\Butu\Application Data\InterVideo
      2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Program Files\InterVideo Information Service
      2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Program Files\Common Files\Ulead
      2008-08-23 18:29 . 2008-08-23 20:21      d--------   C:\Documents and Settings\Butu\Application Data\Ventrilo
      2008-08-23 18:29 . 2008-08-23 18:29      d--------   C:\Documents and Settings\All Users\Application Data\Apple Computer
      2008-08-23 18:29 . 2006-05-11 18:41   654   ---------   C:\WINDOWS\remove.iss
      2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\VentriloMIX
      2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\InterVideo
      2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Program Files\Common Files\InterVideo
      2008-08-23 18:28 . 2008-08-23 18:28      d--------   C:\Documents and Settings\All Users\Application Data\InstallShield
      2008-08-23 18:26 . 2008-08-23 18:26      d--------   C:\WINDOWS\Logs
      2008-08-23 18:24 . 2008-08-29 14:16      d--------   C:\Documents and Settings\Butu\Application Data\MailWasherPro
      2008-08-23 18:23 . 2008-08-23 18:23      d--------   C:\Program Files\FireTrust
      2008-08-23 18:22 . 2008-08-23 18:22      d--------   C:\Program Files\OO Software
      2008-08-23 16:23 . 2008-08-23 16:23      d--------   C:\Program Files\uTorrent
      2008-08-23 16:23 . 2008-08-29 14:15      d--------   C:\Documents and Settings\Butu\Application Data\uTorrent
      2008-08-23 16:11 . 2008-08-23 16:11      d--------   C:\Program Files\Sygate
      2008-08-23 16:11 . 2008-08-28 18:26      d--------   C:\Program Files\Common Files\Wise Installation Wizard
      2008-08-23 16:11 . 2005-06-06 18:05   83,096   --a------   C:\WINDOWS\system32\SSSensor.dll
      2008-08-23 16:11 . 2005-06-06 17:32   61,008   --a------   C:\WINDOWS\system32\drivers\Teefer.sys
      2008-08-23 16:11 . 2005-06-06 17:34   21,075   --a------   C:\WINDOWS\system32\drivers\wpsdrvnt.sys
      2008-08-23 16:11 . 2005-06-06 18:06   14,448   --a------   C:\WINDOWS\system32\drivers\wg6n.sys
      2008-08-23 16:11 . 2005-06-06 18:06   14,448   --a------   C:\WINDOWS\system32\drivers\wg5n.sys
      2008-08-23 16:11 . 2005-06-06 18:05   14,448   --a------   C:\WINDOWS\system32\drivers\wg4n.sys
      2008-08-23 16:11 . 2005-06-06 18:05   14,448   --a------   C:\WINDOWS\system32\drivers\wg3n.sys
      2008-08-23 16:10 . 2008-08-28 17:37      d--------   C:\Program Files\ESET
      2008-08-23 16:01 . 2008-08-23 16:01      d--------   C:\WINDOWS\system32\Lang
      2008-08-23 16:01 . 2008-08-23 16:01   940,794   --a------   C:\WINDOWS\system32\LoopyMusic.wav
      2008-08-23 16:01 . 2008-08-23 16:01   146,650   --a------   C:\WINDOWS\system32\BuzzingBee.wav
      2008-08-23 16:00 . 2008-08-23 16:00      d--------   C:\Program Files\Realtek
      2008-08-23 15:47 . 2008-08-23 15:47      d--------   C:\Program Files\FileZilla FTP Client
      2008-08-23 15:47 . 2008-08-29 03:50      d--------   C:\Documents and Settings\Butu\Application Data\FileZilla
      2008-08-23 15:21 . 2008-07-18 22:07   270,880   --a------   C:\WINDOWS\system32\mucltui.dll
      2008-08-23 15:21 . 2008-07-18 22:07   210,976   --a------   C:\WINDOWS\system32\muweb.dll
      2008-08-23 15:21 . 2008-07-18 22:07   29,728   --a------   C:\WINDOWS\system32\mucltui.dll.mui
      2008-08-23 03:13 . 2008-08-25 17:45      d--------   C:\Documents and Settings\Butu\Contacts
      2008-08-23 03:12 . 2008-08-23 03:12      d----c---   C:\WINDOWS\system32\DRVSTORE
      2008-08-23 03:07 . 2008-08-23 03:11      d--------   C:\Program Files\Windows Live
      2008-08-23 03:07 . 2008-08-23 03:11      d--hsc---   C:\Program Files\Common Files\WindowsLiveInstaller
      2008-08-23 03:07 . 2008-08-23 03:07      d--------   C:\Documents and Settings\All Users\Application Data\WLInstaller
      2008-08-22 22:14 . 2008-08-22 22:14      d--------   C:\Program Files\DAEMON Tools Lite
      2008-08-22 21:58 . 2008-08-22 21:58      d--------   C:\Documents and Settings\Butu\Application Data\DAEMON Tools
      2008-08-22 21:58 . 2008-08-22 21:58   717,296   --a------   C:\WINDOWS\system32\drivers\sptd.sys
      2008-08-22 21:53 . 2008-08-22 21:53      d--------   C:\Documents and Settings\NetworkService\Application Data\Xfire
      2008-08-22 21:52 . 2008-08-22 21:53      d--------   C:\Program Files\Xfire
      2008-08-22 21:52 . 2008-08-25 19:05      d--------   C:\Documents and Settings\Butu\Application Data\Xfire
      2008-08-22 21:51 . 2008-08-23 18:29      d--h-----   C:\Program Files\InstallShield Installation Information
      2008-08-22 21:51 . 2008-08-22 21:51      d--------   C:\Program Files\EA GAMES
      2008-08-22 21:30 . 2008-08-22 21:30      d--------   C:\Program Files\yatzy
      2008-08-22 21:29 . 2008-08-22 21:29      d--------   C:\Program Files\ventrilo_2_1_2_server
      2008-08-22 21:15 . 2008-08-22 21:15      d--------   C:\Program Files\Windows Media Connect 2
      2008-08-22 21:14 . 2008-08-22 21:14      d--------   C:\WINDOWS\system32\LogFiles
      2008-08-22 21:14 . 2008-08-22 21:14      d--------   C:\WINDOWS\system32\drivers\UMDF
      2008-08-22 21:13 . 2008-06-14 20:34   272,128   ---------   C:\WINDOWS\system32\drivers\bthport.sys
      2008-08-22 21:13 . 2008-06-14 20:34   272,128   -----c---   C:\WINDOWS\system32\dllcache\bthport.sys
      2008-08-22 21:13 . 2008-08-22 21:13   0   --a------   C:\WINDOWS\nsreg.dat
      2008-08-22 21:12 . 2008-08-22 21:12      d--------   C:\WINDOWS\system32\Adobe
      2008-08-22 21:09 . 2008-08-27 13:05      d--h-----   C:\WINDOWS\$hf_mig$
      2008-08-22 21:09 . 2006-09-25 17:58   23,856   --a------   C:\WINDOWS\system32\spupdsvc.exe
      2008-08-22 21:07 . 2008-08-28 18:30      d--------   C:\Program Files\Unlocker
      2008-08-22 21:06 . 2008-08-22 21:06      d--------   C:\Program Files\ffdshow
      2008-08-22 21:06 . 2008-08-22 21:06      d--------   C:\Program Files\AC3Filter
      2008-08-22 21:06 . 2006-12-10 23:32   499,712   --a------   C:\WINDOWS\system32\msvcp71.dll
      2008-08-22 21:06 . 2007-08-09 14:27   380,928   --a------   C:\WINDOWS\system32\ac3filter.acm
      2008-08-22 21:06 . 2006-12-10 23:32   348,160   --a------   C:\WINDOWS\system32\msvcr71.dll
      2008-08-22 21:06 . 2007-04-24 17:30   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
      2008-08-22 21:06 . 2008-03-28 19:41   7,680   --a------   C:\WINDOWS\system32\ff_vfw.dll
      2008-08-22 21:06 . 2007-07-10 18:10   547   --a------   C:\WINDOWS\system32\ff_vfw.dll.manifest
      2008-08-22 21:05 . 2008-08-22 21:05      d--hs----   C:\Documents and Settings\Butu\UserData
      2008-08-22 21:05 . 2008-07-18 22:10   45,768   --a------   C:\WINDOWS\system32\wups2.dll
      2008-08-22 21:05 . 2008-07-18 22:10   33,992   --a------   C:\WINDOWS\system32\wucltui.dll.mui
      2008-08-22 21:05 . 2008-07-18 22:09   29,896   --a------   C:\WINDOWS\system32\wuaucpl.cpl.mui
      2008-08-22 21:05 . 2008-07-18 22:08   25,800   --a------   C:\WINDOWS\system32\wuapi.dll.mui
      2008-08-22 21:05 . 2008-07-18 22:08   21,192   --a------   C:\WINDOWS\system32\wuaueng.dll.mui
      2008-08-22 21:03 . 2008-08-22 21:03   592   --a------   C:\WINDOWS\chgkey.vbs
      2008-08-13 01:07 . 2008-08-13 01:07   42,320   --a------   C:\WINDOWS\system32\xfcodec.dll

      .
      (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2008-08-23 20:07   111,928   ----a-w   C:\WINDOWS\system32\PnkBstrB.exe
      2008-08-23 19:57   139,600   ----a-w   C:\WINDOWS\system32\drivers\PnkBstrK.sys
      2008-08-23 17:34   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\vsosdk
      2008-08-23 17:33   ---------   d-----w   C:\Documents and Settings\Butu\Application Data\Vso
      2008-08-23 15:29   ---------   d-----w   C:\Program Files\Common Files\InstallShield
      2008-08-23 13:00   315,392   ----a-w   C:\WINDOWS\HideWin.exe
      2008-08-22 20:08   66,872   ----a-w   C:\WINDOWS\system32\PnkBstrA.exe
      2008-08-22 20:04   ---------   d-----w   C:\Documents and Settings\LocalService\Application Data\Xfire
      2008-08-22 17:49   ---------   d-----w   C:\Program Files\microsoft frontpage
      2008-07-31 07:41   68,616   ----a-w   C:\WINDOWS\system32\XAPOFX1_1.dll
      2008-07-31 07:41   238,088   ----a-w   C:\WINDOWS\system32\xactengine3_2.dll
      2008-07-31 07:40   509,448   ----a-w   C:\WINDOWS\system32\XAudio2_2.dll
      2008-07-18 19:10   94,920   ----a-w   C:\WINDOWS\system32\cdm.dll
      2008-07-18 19:10   53,448   ----a-w   C:\WINDOWS\system32\wuauclt.exe
      2008-07-18 19:10   36,552   ----a-w   C:\WINDOWS\system32\wups.dll
      2008-07-18 19:09   563,912   ----a-w   C:\WINDOWS\system32\wuapi.dll
      2008-07-18 19:09   325,832   ----a-w   C:\WINDOWS\system32\wucltui.dll
      2008-07-18 19:09   205,000   ----a-w   C:\WINDOWS\system32\wuweb.dll
      2008-07-18 19:09   1,811,656   ----a-w   C:\WINDOWS\system32\wuaueng.dll
      2008-07-12 05:18   467,984   ----a-w   C:\WINDOWS\system32\d3dx10_39.dll
      2008-07-12 05:18   3,851,784   ----a-w   C:\WINDOWS\system32\D3DX9_39.dll
      2008-07-12 05:18   1,493,528   ----a-w   C:\WINDOWS\system32\D3DCompiler_39.dll
      2008-07-07 20:28   253,952   ----a-w   C:\WINDOWS\system32\es.dll
      2008-07-03 14:03   4,745,216   ------r   C:\WINDOWS\system32\drivers\RtkHDAud.sys
      2008-07-03 13:51   16,876,032   ------r   C:\WINDOWS\RTHDCPL.exe
      2008-06-24 16:44   74,240   ----a-w   C:\WINDOWS\system32\mscms.dll
      2008-06-24 13:06   972,072   ----a-w   C:\WINDOWS\UNNeroMediaHome.exe
      2008-06-23 16:29   826,368   ----a-w   C:\WINDOWS\system32\wininet.dll
      2008-06-20 17:47   246,784   ----a-w   C:\WINDOWS\system32\mswsock.dll
      2008-06-19 13:42   2,808,832   ------r   C:\WINDOWS\alcwzrd.exe
      2008-06-19 13:27   9,715,200   ------r   C:\WINDOWS\RTLCPL.exe
      2008-06-19 13:20   57,344   ------r   C:\WINDOWS\Alcmtr.exe
      2008-06-18 15:01   77,824   ------r   C:\WINDOWS\SoundMan.exe
      2008-06-06 11:54   972,072   ----a-w   C:\WINDOWS\UNRecode.exe
      2008-06-06 11:54   95,600   ----a-w   C:\WINDOWS\system32\NeroCo.dll
      2008-06-04 13:29   446,464   ----a-w   C:\WINDOWS\system32\NVUNINST.EXE
      2008-05-30 11:19   507,400   ----a-w   C:\WINDOWS\system32\XAudio2_1.dll
      2008-05-30 11:18   238,088   ----a-w   C:\WINDOWS\system32\xactengine3_1.dll
      2008-05-30 11:17   65,032   ----a-w   C:\WINDOWS\system32\XAPOFX1_0.dll
      2008-05-30 11:17   25,608   ----a-w   C:\WINDOWS\system32\X3DAudio1_4.dll
      2008-05-30 11:11   467,984   ----a-w   C:\WINDOWS\system32\d3dx10_38.dll
      2008-05-30 11:11   3,850,760   ----a-w   C:\WINDOWS\system32\D3DX9_38.dll
      2008-05-30 11:11   1,491,992   ----a-w   C:\WINDOWS\system32\D3DCompiler_38.dll
      .

      ((((((((((((((((((((((((((((( snapshot@2008-08-28_19.37.34.54 )))))))))))))))))))))))))))))))))))))))))
      .
      + 2008-08-07 13:27:04   163,328   ----a-w   C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
      + 2008-08-29 00:54:51   2,134,016   ----a-w   C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
      + 2008-08-29 00:54:51   24,576   ----a-w   C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
      + 2008-08-07 13:27:04   163,328   ----a-w   C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
      + 2008-08-29 00:54:50   2,134,016   ----a-w   C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
      + 2008-08-29 00:54:50   24,576   ----a-w   C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
      .
      (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
      REGEDIT4

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 09:12 15360]
      "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
      "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 16:06 1840424]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
      "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
      "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2005-06-06 18:05 2614496]
      "OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-05-11 02:08 2512392]
      "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 09:31 2221352]
      "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 18:52 1447168]
      "RTHDCPL"="RTHDCPL.EXE" [2008-07-03 16:51 16876032 C:\WINDOWS\RTHDCPL.exe]

      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 09:12 15360]

      C:\Documents and Settings\Butu\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
      MailWasherPro.lnk - C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe [2008-08-23 18:23:56 16667786]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
      "msacm.ac3filter"= ac3filter.acm
      "VIDC.XFR1"= xfcodec.dll

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
      SecurityProviders   msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
      "EnableFirewall"= 0 (0x0)

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
      "%windir%\\system32\\sessmgr.exe"=
      "C:\\Program Files\\ventrilo_2_1_2_server\\ventrilo_srv.exe"=
      "C:\\Program Files\\Xfire\\xfire.exe"=
      "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
      "C:\\Program Files\\uTorrent\\uTorrent.exe"=

      R0 nvgts;nvgts;C:\WINDOWS\system32\DRIVERS\nvgts.sys [2008-01-25 20:01]
      R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 18:56]
      .
      .
      ------- Supplementary Scan -------
      .
      FireFox -: Profile - C:\Documents and Settings\Butu\Application Data\Mozilla\Firefox\Profiles\lret89u2.default\
      FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fi/
      .

      **************************************************************************

      catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-08-29 14:19:18
      Windows 5.1.2600 Service Pack 3 NTFS

      scanning hidden processes ...

      scanning hidden autostart entries ...

      scanning hidden files ...

      scan completed successfully
      hidden files: 0

      **************************************************************************

      [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\vsdatant]
      "ImagePath"=""
      .
      Completion time: 2008-08-29 14:19:45
      ComboFix-quarantined-files.txt 2008-08-29 11:19:42
      ComboFix2.txt 2008-08-28 17:19:57
      ComboFix3.txt 2008-08-28 16:37:47

      Pre-Run: 225,042,194,432 tavua vapaana
      Post-Run: 225,032,466,432 tavua vapaana

      247   --- E O F ---   2008-08-27 10:05:09

      Äänestä

    • ihmettelijä2 kirjoitti:

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 14:15:15, on 29.8.2008
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
      C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\WINDOWS\system32\oodag.exe
      C:\WINDOWS\system32\IoctlSvc.exe
      C:\WINDOWS\system32\PnkBstrA.exe
      C:\Program Files\Sygate\SPF\smc.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\WINDOWS\RTHDCPL.EXE
      C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
      C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
      C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
      C:\Program Files\uTorrent\uTorrent.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\HJT\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
      O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
      O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
      O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219428325796
      O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
      O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
      O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
      O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
      O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
      O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

      --
      End of file - 4839 bytes

      hyvin korjailtu :D

      Äänestä

    ComboFix 08-08-28.06 - Butu 2008-08-29 14:18:41.3 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1035.18.2603 [GMT 3:00]
    Running from: C:\Documents and Settings\Butu\Työpöytä\ComboFix.exe
    * Created a new restore point
    * Resident AV is active


    [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-07-28 to 2008-08-29 )))))))))))))))))
    .

    2008-08-29 03:54 . 2008-08-29 03:54 d-------- C:\WINDOWS\ERUNT
    2008-08-28 19:40 . 2008-08-28 19:40 d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-28 19:40 . 2008-08-28 19:40 d-------- C:\Documents and Settings\Butu\Application Data\Malwarebytes
    2008-08-28 19:40 . 2008-08-28 19:40 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-28 19:40 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-08-28 19:40 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-08-28 18:18 . 2008-08-29 14:15 d-------- C:\HJT
    2008-08-28 18:13 . 2008-08-28 18:14 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-28 18:03 . 2008-08-28 18:03 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-08-28 18:00 . 2008-08-28 18:13 d-------- C:\Documents and Settings\Butu\Application Data\Lavasoft
    2008-08-28 17:53 . 2008-08-28 17:53 d-------- C:\Documents and Settings\Butu\Application Data\PC Tools
    2008-08-28 17:34 . 2008-08-28 17:34 d-------- C:\Documents and Settings\All Users\Application Data\ESET
    2008-08-27 16:41 . 2008-08-28 18:57 d-------- C:\Program Files\mIRC
    2008-08-27 16:41 . 2008-08-27 16:42 d-------- C:\Documents and Settings\Butu\Application Data\mIRC
    2008-08-25 18:33 . 1998-10-02 19:00 327,168 --a------ C:\WINDOWS\IsUninst.exe
    2008-08-24 20:00 . 2008-08-24 20:00 d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
    2008-08-24 19:54 . 2008-08-24 19:54 d-------- C:\Program Files\Microsoft Works
    2008-08-24 19:53 . 2008-08-24 19:53 d-------- C:\WINDOWS\SHELLNEW
    2008-08-24 19:53 . 2008-08-24 19:53 dr-h----- C:\MSOCache
    2008-08-24 19:53 . 2008-08-24 20:13 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-08-23 20:34 . 2008-08-23 20:34 d-------- C:\Documents and Settings\All Users\Application Data\vsosdk
    2008-08-23 20:31 . 2008-08-23 20:40 d-------- C:\Program Files\DVDFab Platinum 4
    2008-08-23 20:28 . 2008-08-23 20:28 d-------- C:\Documents and Settings\Butu\Application Data\Canon
    2008-08-23 20:27 . 2008-08-23 20:31 d-------- C:\Program Files\DVDFab 5
    2008-08-23 20:27 . 2008-08-23 20:33 d-------- C:\Documents and Settings\Butu\Application Data\Vso
    2008-08-23 20:27 . 2008-08-23 20:31 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
    2008-08-23 20:27 . 2008-08-23 20:31 47,360 --a------ C:\Documents and Settings\Butu\Application Data\pcouffin.sys
    2008-08-23 20:23 . 2008-08-23 20:23 d--h----- C:\Program Files\CanonBJ
    2008-08-23 20:23 . 2008-08-23 20:23 d-------- C:\Program Files\Canon
    2008-08-23 20:23 . 2008-08-23 20:23 d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
    2008-08-23 19:05 . 2008-08-29 03:58 15,324 --a------ C:\WINDOWS\system32\oodbs.lor
    2008-08-23 19:01 . 2008-08-23 19:01 d-------- C:\Program Files\Nero
    2008-08-23 18:58 . 2008-02-28 13:26 1,414,440 --a------ C:\WINDOWS\system32\ShellManager310E2D762.dll
    2008-08-23 18:58 . 2008-02-28 13:01 774,144 --a------ C:\WINDOWS\system32\NEROINSTAEC43759.DB
    2008-08-23 18:58 . 2008-08-23 18:58 0 --a------ C:\WINDOWS\Irremote.ini
    2008-08-23 18:51 . 2008-08-23 18:51 d-------- C:\Program Files\NeroInstall.bak
    2008-08-23 18:51 . 2008-08-23 18:51 d-------- C:\Documents and Settings\Butu\Application Data\Nero
    2008-08-23 18:49 . 2008-08-23 18:49 d-------- C:\Program Files\Foxit Software
    2008-08-23 18:49 . 2008-08-23 19:02 d-------- C:\Program Files\Common Files\Nero
    2008-08-23 18:49 . 2008-08-23 19:01 d-------- C:\Documents and Settings\All Users\Application Data\Nero
    2008-08-23 18:33 . 2008-08-23 18:33 d-------- C:\Program Files\MSXML 4.0
    2008-08-23 18:30 . 2008-08-23 18:30 d-------- C:\Documents and Settings\Butu\Application Data\InterVideo
    2008-08-23 18:29 . 2008-08-23 18:29 d-------- C:\Program Files\InterVideo Information Service
    2008-08-23 18:29 . 2008-08-23 18:29 d-------- C:\Program Files\Common Files\Ulead
    2008-08-23 18:29 . 2008-08-23 20:21 d-------- C:\Documents and Settings\Butu\Application Data\Ventrilo
    2008-08-23 18:29 . 2008-08-23 18:29 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-08-23 18:29 . 2006-05-11 18:41 654 --------- C:\WINDOWS\remove.iss
    2008-08-23 18:28 . 2008-08-23 18:28 d-------- C:\Program Files\VentriloMIX
    2008-08-23 18:28 . 2008-08-23 18:28 d-------- C:\Program Files\InterVideo
    2008-08-23 18:28 . 2008-08-23 18:28 d-------- C:\Program Files\Common Files\InterVideo
    2008-08-23 18:28 . 2008-08-23 18:28 d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
    2008-08-23 18:26 . 2008-08-23 18:26 d-------- C:\WINDOWS\Logs
    2008-08-23 18:24 . 2008-08-29 14:16 d-------- C:\Documents and Settings\Butu\Application Data\MailWasherPro
    2008-08-23 18:23 . 2008-08-23 18:23 d-------- C:\Program Files\FireTrust
    2008-08-23 18:22 . 2008-08-23 18:22 d-------- C:\Program Files\OO Software
    2008-08-23 16:23 . 2008-08-23 16:23 d-------- C:\Program Files\uTorrent
    2008-08-23 16:23 . 2008-08-29 14:15 d-------- C:\Documents and Settings\Butu\Application Data\uTorrent
    2008-08-23 16:11 . 2008-08-23 16:11 d-------- C:\Program Files\Sygate
    2008-08-23 16:11 . 2008-08-28 18:26 d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-08-23 16:11 . 2005-06-06 18:05 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
    2008-08-23 16:11 . 2005-06-06 17:32 61,008 --a------ C:\WINDOWS\system32\drivers\Teefer.sys
    2008-08-23 16:11 . 2005-06-06 17:34 21,075 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys
    2008-08-23 16:11 . 2005-06-06 18:06 14,448 --a------ C:\WINDOWS\system32\drivers\wg6n.sys
    2008-08-23 16:11 . 2005-06-06 18:06 14,448 --a------ C:\WINDOWS\system32\drivers\wg5n.sys
    2008-08-23 16:11 . 2005-06-06 18:05 14,448 --a------ C:\WINDOWS\system32\drivers\wg4n.sys
    2008-08-23 16:11 . 2005-06-06 18:05 14,448 --a------ C:\WINDOWS\system32\drivers\wg3n.sys
    2008-08-23 16:10 . 2008-08-28 17:37 d-------- C:\Program Files\ESET
    2008-08-23 16:01 . 2008-08-23 16:01 d-------- C:\WINDOWS\system32\Lang
    2008-08-23 16:01 . 2008-08-23 16:01 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
    2008-08-23 16:01 . 2008-08-23 16:01 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
    2008-08-23 16:00 . 2008-08-23 16:00 d-------- C:\Program Files\Realtek
    2008-08-23 15:47 . 2008-08-23 15:47 d-------- C:\Program Files\FileZilla FTP Client
    2008-08-23 15:47 . 2008-08-29 03:50 d-------- C:\Documents and Settings\Butu\Application Data\FileZilla
    2008-08-23 15:21 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-08-23 15:21 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll
    2008-08-23 15:21 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-08-23 03:13 . 2008-08-25 17:45 d-------- C:\Documents and Settings\Butu\Contacts
    2008-08-23 03:12 . 2008-08-23 03:12 d----c--- C:\WINDOWS\system32\DRVSTORE
    2008-08-23 03:07 . 2008-08-23 03:11 d-------- C:\Program Files\Windows Live
    2008-08-23 03:07 . 2008-08-23 03:11 d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-08-23 03:07 . 2008-08-23 03:07 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-08-22 22:14 . 2008-08-22 22:14 d-------- C:\Program Files\DAEMON Tools Lite
    2008-08-22 21:58 . 2008-08-22 21:58 d-------- C:\Documents and Settings\Butu\Application Data\DAEMON Tools
    2008-08-22 21:58 . 2008-08-22 21:58 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
    2008-08-22 21:53 . 2008-08-22 21:53 d-------- C:\Documents and Settings\NetworkService\Application Data\Xfire
    2008-08-22 21:52 . 2008-08-22 21:53 d-------- C:\Program Files\Xfire
    2008-08-22 21:52 . 2008-08-25 19:05 d-------- C:\Documents and Settings\Butu\Application Data\Xfire
    2008-08-22 21:51 . 2008-08-23 18:29 d--h----- C:\Program Files\InstallShield Installation Information
    2008-08-22 21:51 . 2008-08-22 21:51 d-------- C:\Program Files\EA GAMES
    2008-08-22 21:30 . 2008-08-22 21:30 d-------- C:\Program Files\yatzy
    2008-08-22 21:29 . 2008-08-22 21:29 d-------- C:\Program Files\ventrilo_2_1_2_server
    2008-08-22 21:15 . 2008-08-22 21:15 d-------- C:\Program Files\Windows Media Connect 2
    2008-08-22 21:14 . 2008-08-22 21:14 d-------- C:\WINDOWS\system32\LogFiles
    2008-08-22 21:14 . 2008-08-22 21:14 d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-08-22 21:13 . 2008-06-14 20:34 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
    2008-08-22 21:13 . 2008-06-14 20:34 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
    2008-08-22 21:13 . 2008-08-22 21:13 0 --a------ C:\WINDOWS\nsreg.dat
    2008-08-22 21:12 . 2008-08-22 21:12 d-------- C:\WINDOWS\system32\Adobe
    2008-08-22 21:09 . 2008-08-27 13:05 d--h----- C:\WINDOWS\$hf_mig$
    2008-08-22 21:09 . 2006-09-25 17:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
    2008-08-22 21:07 . 2008-08-28 18:30 d-------- C:\Program Files\Unlocker
    2008-08-22 21:06 . 2008-08-22 21:06 d-------- C:\Program Files\ffdshow
    2008-08-22 21:06 . 2008-08-22 21:06 d-------- C:\Program Files\AC3Filter
    2008-08-22 21:06 . 2006-12-10 23:32 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
    2008-08-22 21:06 . 2007-08-09 14:27 380,928 --a------ C:\WINDOWS\system32\ac3filter.acm
    2008-08-22 21:06 . 2006-12-10 23:32 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
    2008-08-22 21:06 . 2007-04-24 17:30 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
    2008-08-22 21:06 . 2008-03-28 19:41 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll
    2008-08-22 21:06 . 2007-07-10 18:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
    2008-08-22 21:05 . 2008-08-22 21:05 d--hs---- C:\Documents and Settings\Butu\UserData
    2008-08-22 21:05 . 2008-07-18 22:10 45,768 --a------ C:\WINDOWS\system32\wups2.dll
    2008-08-22 21:05 . 2008-07-18 22:10 33,992 --a------ C:\WINDOWS\system32\wucltui.dll.mui
    2008-08-22 21:05 . 2008-07-18 22:09 29,896 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
    2008-08-22 21:05 . 2008-07-18 22:08 25,800 --a------ C:\WINDOWS\system32\wuapi.dll.mui
    2008-08-22 21:05 . 2008-07-18 22:08 21,192 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
    2008-08-22 21:03 . 2008-08-22 21:03 592 --a------ C:\WINDOWS\chgkey.vbs
    2008-08-13 01:07 . 2008-08-13 01:07 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-23 20:07 111,928 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    2008-08-23 19:57 139,600 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-08-23 17:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\vsosdk
    2008-08-23 17:33 --------- d-----w C:\Documents and Settings\Butu\Application Data\Vso
    2008-08-23 15:29 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-08-23 13:00 315,392 ----a-w C:\WINDOWS\HideWin.exe
    2008-08-22 20:08 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
    2008-08-22 20:04 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Xfire
    2008-08-22 17:49 --------- d-----w C:\Program Files\microsoft frontpage
    2008-07-31 07:41 68,616 ----a-w C:\WINDOWS\system32\XAPOFX1_1.dll
    2008-07-31 07:41 238,088 ----a-w C:\WINDOWS\system32\xactengine3_2.dll
    2008-07-31 07:40 509,448 ----a-w C:\WINDOWS\system32\XAudio2_2.dll
    2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
    2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
    2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
    2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
    2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
    2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2008-07-12 05:18 467,984 ----a-w C:\WINDOWS\system32\d3dx10_39.dll
    2008-07-12 05:18 3,851,784 ----a-w C:\WINDOWS\system32\D3DX9_39.dll
    2008-07-12 05:18 1,493,528 ----a-w C:\WINDOWS\system32\D3DCompiler_39.dll
    2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
    2008-07-03 14:03 4,745,216 ------r C:\WINDOWS\system32\drivers\RtkHDAud.sys
    2008-07-03 13:51 16,876,032 ------r C:\WINDOWS\RTHDCPL.exe
    2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
    2008-06-24 13:06 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
    2008-06-23 16:29 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-06-20 17:47 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-19 13:42 2,808,832 ------r C:\WINDOWS\alcwzrd.exe
    2008-06-19 13:27 9,715,200 ------r C:\WINDOWS\RTLCPL.exe
    2008-06-19 13:20 57,344 ------r C:\WINDOWS\Alcmtr.exe
    2008-06-18 15:01 77,824 ------r C:\WINDOWS\SoundMan.exe
    2008-06-06 11:54 972,072 ----a-w C:\WINDOWS\UNRecode.exe
    2008-06-06 11:54 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll
    2008-06-04 13:29 446,464 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
    2008-05-30 11:19 507,400 ----a-w C:\WINDOWS\system32\XAudio2_1.dll
    2008-05-30 11:18 238,088 ----a-w C:\WINDOWS\system32\xactengine3_1.dll
    2008-05-30 11:17 65,032 ----a-w C:\WINDOWS\system32\XAPOFX1_0.dll
    2008-05-30 11:17 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_4.dll
    2008-05-30 11:11 467,984 ----a-w C:\WINDOWS\system32\d3dx10_38.dll
    2008-05-30 11:11 3,850,760 ----a-w C:\WINDOWS\system32\D3DX9_38.dll
    2008-05-30 11:11 1,491,992 ----a-w C:\WINDOWS\system32\D3DCompiler_38.dll
    .

    ((((((((((((((((((((((((((((( snapshot@2008-08-28_19.37.34.54 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-08-07 13:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
    + 2008-08-29 00:54:51 2,134,016 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
    + 2008-08-29 00:54:51 24,576 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
    + 2008-08-07 13:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
    + 2008-08-29 00:54:50 2,134,016 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
    + 2008-08-29 00:54:50 24,576 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 09:12 15360]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
    "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 16:06 1840424]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
    "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2005-06-06 18:05 2614496]
    "OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-05-11 02:08 2512392]
    "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 09:31 2221352]
    "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 18:52 1447168]
    "RTHDCPL"="RTHDCPL.EXE" [2008-07-03 16:51 16876032 C:\WINDOWS\RTHDCPL.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 09:12 15360]

    C:\Documents and Settings\Butu\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    MailWasherPro.lnk - C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe [2008-08-23 18:23:56 16667786]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.ac3filter"= ac3filter.acm
    "VIDC.XFR1"= xfcodec.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\ventrilo_2_1_2_server\\ventrilo_srv.exe"=
    "C:\\Program Files\\Xfire\\xfire.exe"=
    "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=

    R0 nvgts;nvgts;C:\WINDOWS\system32\DRIVERS\nvgts.sys [2008-01-25 20:01]
    R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 18:56]
    .
    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Butu\Application Data\Mozilla\Firefox\Profiles\lret89u2.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fi/
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-08-29 14:19:18
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\vsdatant]
    "ImagePath"=""
    .
    Completion time: 2008-08-29 14:19:45
    ComboFix-quarantined-files.txt 2008-08-29 11:19:42
    ComboFix2.txt 2008-08-28 17:19:57
    ComboFix3.txt 2008-08-28 16:37:47

    Pre-Run: 225,042,194,432 tavua vapaana
    Post-Run: 225,032,466,432 tavua vapaana

    247 --- E O F --- 2008-08-27 10:05:09

    Äänestä

    • he loki kunossa

      Lataa http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
      OTMoveIt ja tallenna se työpöydällesi.

      Tuplaklikkaa OTMoveIt.exe.
      Klikkaa CleanUp!.
      Valitse Yes kun kysytään "Begin cleanup Process?".
      Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.


      HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.

      Äänestä

    • 123321 kirjoitti:

      he loki kunossa

      Lataa http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
      OTMoveIt ja tallenna se työpöydällesi.

      Tuplaklikkaa OTMoveIt.exe.
      Klikkaa CleanUp!.
      Valitse Yes kun kysytään "Begin cleanup Process?".
      Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.


      HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.

      tehty on :)

      Äänestä

    • 123321 kirjoitti:

      he loki kunossa

      Lataa http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
      OTMoveIt ja tallenna se työpöydällesi.

      Tuplaklikkaa OTMoveIt.exe.
      Klikkaa CleanUp!.
      Valitse Yes kun kysytään "Begin cleanup Process?".
      Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.


      HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.

      mikähän olisi noin tulevaisuutta aatellen hyvä suoja tommosia vastaan? nyttekään ei aavistustakaan mistä moiset olivat tullu.. yleensä en käy edes missään epäilyttävil sivuil enkä lataile ihme tiedostoja.. eilen töistä tullessani kone oli aivan juntturassa.. eikä muut käytä tätä konetta.. ei vaan ymmärrä... :P

      Äänestä

    • ihmettelijä2 kirjoitti:

      mikähän olisi noin tulevaisuutta aatellen hyvä suoja tommosia vastaan? nyttekään ei aavistustakaan mistä moiset olivat tullu.. yleensä en käy edes missään epäilyttävil sivuil enkä lataile ihme tiedostoja.. eilen töistä tullessani kone oli aivan juntturassa.. eikä muut käytä tätä konetta.. ei vaan ymmärrä... :P

      ropsahtelee sellainen netti on.

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    ihmettelijä2 kirjoitti:

    Kaiken maailman ikkunoita rupes aukeilemaan yhtäkkiä. Ajoin joitakin puhdistusohjelmia läpi ja löytyikin jotain mutta vieläkös olisi jotain?
    Kiitos jo etukäteen!!

    Logfile of HijackThis v1.99.1
    Scan saved at 18:21:05, on 28.8.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\oodag.exe
    C:\WINDOWS\system32\IoctlSvc.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\Program Files\Spyware Doctor\swdoctor.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
    O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
    O4 - HKLM\..\Run: [BM574e09e9] Rundll32.exe "C:\WINDOWS\system32\rksqaplg.dll",s
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [THGuard] C:\Program Files\TrojanHunter 4.2\THGuard.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
    O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219428325796
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
    O20 - AppInit_DLLs: hupbrd.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
    O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
    O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
    O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu