|
| |||||||
| Rekisteröidy | Sivustokartta Spy | Käyttäjälista | Lahjoita | Haku | Today's Posts | Mark Forums Read | Foorumin säännöt |
 |
 |
| | Thread Tools |
|
#11
16 syyskuu 2008, 15:28
| |||
| |||
| Tarvitsetko apua salaperäinen desktop "bar" ComboFix 08-09-15.02 - Tomi Stratman 2008-09-16 16:53:08.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.184 [GMT -5:00] Running from: C: \ Documents and Settings \ Tomi Stratman \ Desktop \ ComboFix.exe * Luonut uuden palautuspisteen VAROITUS-Tämä kone ei ole RECOVERY CONSOLE asennettuna! . ((((((((((((((((((((((((((((((((((((((( Muut Poistetut ))))))))) )))))))))))))))))))))))))))))))))))))))) . C: \ Documents and Settings \ Tomi Stratman \ Application Data \ FNTS ~ 1 C: \ Documents and Settings \ Tomi Stratman \ Application Data \ FNTS ~ 1 \ F? Mukset \ C: \ Documents and Settings \ Tomi Stratman \ Application Data \ SSTEM ~ 1 C: \ Temp \ 1cb C: \ Temp \ 1cb \ syscheck.log C: \ Temp \ FSE C: \ Temp \ FSE \ tmpZTF.log C: \ test.txt C: \ WINDOWS \ system32 \ MSINET.oca C: \ WINDOWS \ SYSTEM32 \ rqtwa.bak1 C: \ WINDOWS \ SYSTEM32 \ rqtwa.bak2 C: \ WINDOWS \ SYSTEM32 \ rqtwa.ini C: \ WINDOWS \ system32 \ wnstsiit32.exe C: \ WINDOWS \ SYSTEM32 \ wyadd.bak1 C: \ WINDOWS \ SYSTEM32 \ wyadd.bak2 C: \ WINDOWS \ SYSTEM32 \ wyadd.ini C: \ WINDOWS \ SYSTEM32 \ wyadd.ini2 C: \ WINDOWS \ SYSTEM32 \ wyadd.tmp . ((((((((((((((((((((((((((((((((((((((( Ajurit / Palvelut )))))))) ))))))))))))))))))))))))))))))))))))))))) . ------- \ Legacy_DOMAINSERVICE ((((((((((((((((((((((((( Files luotu 2008-08-16 ja 2008-09-16 ))))))))))) )))))))))))))))))))) . 2008-09-16 06:36. 2008-09-16 06:36 <KANSIO> d -------- C: \ Program Files \ Trend Micro 2008-09-15 21:25. 2008-09-15 21:27 <KANSIO> d -------- C: \ Program Files \ Malwarebytes 'Anti-Malware 2008-09-15 21:25. 2008-09-15 21:25 <KANSIO> d -------- C: \ Documents and Settings \ Tomi Stratman \ Application Data \ Malwarebytes 2008-09-15 21:25. 2008-09-15 21:25 <KANSIO> d -------- C: \ Documents and Settings \ All Users \ Application Application Data \ Malwarebytes 2008-09-15 21:25. 2008-09-10 00:04 38.528 - a ------ C: \ WINDOWS \ system32 \ DRIVERS \ mbamswissarmy.sys 2008-09-15 21:25. 2008-09-10 00:03 17.200 - a ------ C: \ WINDOWS \ system32 \ DRIVERS \ mbam.sys 2008-09-14 11:13. 2008-09-14 11:13 107.888 - a ------ C: \ WINDOWS \ SYSTEM32 \ CmdLineExt.dll 2008-09-10 13:37. 2008-09-10 13:38 <KANSIO> d -------- C: \ Program Files \ iTunes 2008-09-10 13:37. 2008-09-10 13:38 <KANSIO> d -------- C: \ Documents and Settings \ All Users \ Application Data \ (3276BE95_AF08_429F_A64F_CA64CB79BCF6) 2008-09-10 13:35. 2008-09-10 13:35 <KANSIO> d -------- C: \ Program Files \ Bonjour 2008-09-10 13:29. 2008-09-05 22:16 1.900.544 - a ------ C: \ WINDOWS \ SYSTEM32 \ usbaaplrc.dll 2008-09-06 15:09. 2008-09-06 15:09 90.112 - a ------ C: \ WINDOWS \ SYSTEM32 \ QuickTimeVR.qtx 2008-09-06 15:09. 2008-09-06 15:09 57.344 - a ------ C: \ WINDOWS \ SYSTEM32 \ QuickTime.qts 2008-08-29 10:18. 2008-08-29 10:18 87.336 - a ------ C: \ WINDOWS \ system32 \ dns-sd.exe 2008-08-29 09:53. 2008-08-29 09:53 61.440 - a ------ C: \ WINDOWS \ SYSTEM32 \ dnssd.dll 2008-08-27 02:30. 2008-08-27 02:56 <KANSIO> d -------- C: \ WINDOWS \ SYSTEM32 \ CatRoot_bak 2008-08-25 19:08. 2008-08-25 19:08 <KANSIO> d -------- C: \ Program Files \ AviSynth 2,5 2008-08-25 19:07. 2008-08-25 19:07 <KANSIO> d -------- C: \ Program Files \ Red Kawa . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))) )))))))))))))))))))))))))))))))))))))))))))) . 2008-09-16 21:40 --------- d ----- w C: \ Documents and Settings \ Tomi Stratman \ Application Data \ uTorrent 2008-09-16 06:42 --------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ Google Updater 2008-09-15 20:53 --------- d - h - w C: \ Program Files \ InstallShield Installation Information 2008-09-15 20:53 --------- d ----- w C: \ Program Files \ Electronic Arts 2008-09-10 18:38 --------- d ----- w C: \ Program Files \ iPod 2008-09-10 18:34 --------- d ----- w C: \ Program Files \ QuickTime 2008-09-10 18:33 --------- d ----- w C: \ Program Files \ Common Files \ Apple 2008-09-06 03:16 36.864 ---- aw C: \ WINDOWS \ system32 \ drivers \ usbaapl.sys 2008-08-21 21:36 --------- d ----- w C: \ Program Files \ Apple Software Update 2008-08-11 21:22 --------- d ----- w C: \ Program Files \ Microsoft Silverlight 2008-08-07 16:37 --------- d ----- w C: \ Program Files \ Google 2008-03-01 20:28 75.496-c - aw C: \ Documents and Settings \ Tomi Stratman \ Application Data \ GDIPFONTCACHEV1.DAT 2007-09-26 01:26 45.422-c - aw C: \ Documents and Settings \ Tomi Stratman \ Application Data \ wklnhst.dat 2007-06-28 21:37 7.248-c - aw C: \ Documents and Settings \ All Users \ Application Data \ ypinfo.bin 2007-04-15 04:54 32-c - ar C: \ Documents and Settings \ All Users \ hash.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))) )))))))))))))))))))))))))))))))))))))))) . . * Note * empty entries & legit default merkinnät eivät näy REGEDIT4 [HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curre ntVersion \ Run] "DellSupport" = "C: \ Program Files \ DellSupport \ DSAgnt.exe" [2007-03-15 460784] "LDM" = "C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Program Files \ LogitechDesktopMessenger. Exe" [2007-02-23 67128] "MSMSGS" = "C: \ Program Files \ Messenger \ msmsgs.exe" [2004-10-13 1694208] "DellSupportCenter" = "C: \ Program Files \ Dell Support Center \ bin \ sprtcmd.exe" [2007-11-15 202544] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ curr entVersion \ Run] "PCMService" = "C: \ Program Files \ Dell \ mediakokemus \ PCMService.exe" [2004-04-11 290816] "DVDLauncher" = "C: \ Program Files \ CyberLink \ PowerDVD \ DVDLauncher.exe" [2004-08-23 57344] "dla" = "C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe" [2004-08-13 122939] "igfxtray" = "C: \ WINDOWS \ system32 \ igfxtray.exe" [2005-09-20 94208] "igfxhkcmd" = "C: \ WINDOWS \ system32 \ NvCpl.dll, NvStartup" [2005-09-20 77824] "igfxpers" = "C: \ WINDOWS \ system32 \ NvMcTray.dll, NvTaskbarInit" [2005-09-20 114688] "CanonMyPrinter" = "C: \ Program Files \ Canon \ MyPrinter \ BJMyPrt.exe" [2006-03-21 1191936] "SSBkgdUpdate" = "C: \ Program Files \ Common Files \ Scansoft Shared \ SSBkgdUpdate \ SSBkgdupdate.exe" [2003-09-30 155648] "OpwareSE4" = "C: \ Program Files \ ScanSoft \ OmniPageSE4.0 \ OpwareSE4.exe" [2006-03-21 69632] "IMJPMIG8.1" = "C: \ WINDOWS \ IME \ imjp8_1 \ IMJPMIG.E XE" [2004-08-04 208952] "MSPY2002" = "C: \ WINDOWS \ system32 \ IME \ PINTLGNT \ ImScI nst.exe" [2004-08-04 59392] "PHIME2002ASync" = "C: \ WINDOWS \ system32 \ IME \ TINTLGNT \ TINTSETP.EXE" [2004-08-04 455168] "PHIME2002A" = "C: \ WINDOWS \ system32 \ IME \ TINTLGNT \ TIN TSETP.EXE" [2004-08-04 455168] "SoundMAXPnP" = "C: \ Program Files \ Analog Devices \ Core \ smax4pnp.exe" [2004-10-14 1404928] "Adobe Reader Speed Launcher" = "C: \ Program Files \ Adobe \ Reader 8.0 \ Reader \ Reader_sl.exe" [2008-01-11 39792] "dscactivate" = "C: \ Program Files \ Dell Support Center \ gs_agent \ Custom \ dsca.exe" [2007-11-15 16384] "DellSupportCenter" = "C: \ Program Files \ Dell Support Center \ bin \ sprtcmd.exe" [2007-11-15 202544] "QuickTime Task" = "C: \ Program Files \ QuickTime \ QTTask.exe" [2008-09-06 413696] "ITunesHelper" = "C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleSyncNotifier.exe" [2008-09-03 111936] "CTFMON.EXE" = "C: \ Program Files \ iTunes \ iTunesHelper.exe" [2008-09-08 289576] "Logitech Hardware Abstraction Layer" = "KHALMNPR.EXE" [2008-02-29 C: \ WINDOWS \ KHALMNPR.Exe] "Kernel ja Hardware Abstraction Layer" = "KHALMNPR.EXE" [2008-02-29 C: \ WINDOWS \ KHALMNPR.Exe] [HKEY_USERS \. DEFAULT \ Software \ Microsoft \ Windows \ Cur rentVersion \ Run] "DWQueuedReporting" = "C: \ PROGRA ~ 1 \ Common ~ 1 \ mikros ~ 1 \ DW \ dwtrig20.exe" [2007-03-13 39264] C: \ Documents and Settings \ Tomi Stratman \ Start Menu \ Programs \ Startup \ SpywareGuard.lnk - C: \ Program Files \ SpywareGuard \ sgmain.exe [2003-08-29 360448] C: \ Documents and Settings \ All Users \ Start Menu \ Programs \ Startup \ Logitech Desktop Messenger.lnk - C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Program Files \ LogitechDesktopMessenger. Exe [2007-02-23 67128] CTFMON.EXE - C: \ Program Files \ Logitech \ SetPoint \ SetPoint.exe [2008-08-09 805392] Microsoft Office.lnk - C: \ Program Files \ Microsoft Office \ Office10 \ OSA.EXE [2001-02-13 83360] WinZip Quick Pick.lnk - C: \ Program Files \ WinZip \ WZQKPICK.EXE [2005-02-11 118784] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ ilmoitettava \ LBTWlgn] 2008-05-02 02:42 72208 C: \ Program Files \ Common Files \ Logitech \ Bluetooth \ LBTWLgn.dll [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Contro l \ SafeBoot \ Minimal \ WdfLoadGroup] @ = "" [HKLM \ ~ \ Services \ sharedaccess \ Parameters \ firewallpo licy \ standardprofile \ AuthorizedApplications \ List] "% windir% \ \ system32 \ \ sessmgr.exe" = "C: \ Program Files \ \ Windows Media Player \ \ wmplayer.exe" = "C: \ Program Files \ \ Common Files \ \ AOL \ \ Loader \ \ aolload.exe" = "C: \ Program Files \ \ PopCap Games \ \ lukutoukka Deluxe \ \ BookWorm.exe" = "C: \ Program Files \ \ AIM \ \ aim.exe" = "C: \ Program Files \ \ AIM6 \ \ aim6.exe" = "C: \ Program Files \ \ Logitech \ \ Desktop Messenger \ \ 8876480 \ \ Program \ \ LogitechDesktopMessen ger.exe" = "C: \ Program Files \ \ uTorrent \ \ uTorrent.exe" = "C: \ Program Files \ \ Bonjour \ \ mDNSResponder.exe" = "C: \ Program Files \ \ iTunes \ \ iTunes.exe" = [HKLM \ ~ \ Services \ sharedaccess \ Parameters \ firewallpo licy \ standardprofile \ GloballyOpenPorts \ List] "17770: TCP" = 17770: TCP: BitComet 17770 TCP: "17770: UDP" = 17770: UDP: BitComet 17770 UDP: R1 aswSP; avast! Self Protection; C: \ WINDOWS \ system32 \ drivers \ aswSP.sys [2008-07-19 78416] R2 aswFsBlk; aswFsBlk, C: \ WINDOWS \ system32 \ DRIVERS \ aswF sBlk.sys [2008-07-19 20560] R2 npkcmsvc, npkcmsvc, C: \ Nexon \ Mabinogi \ npkcmsvc.exe [2007-08-02 80528] R2 näkökulmasta Manager Service; näkökulmasta Manager Service, C: \ Program Files \ näkökulmasta \ Common \ ViewpointService.exe [2007-01-04 24652] S2 DP1112, DP1112, C: \ WINDOWS \ System32 \ Drivers \ DP.sys [] S3 FTD2XX; Outlaw Audio Model 990 Device Driver; C: \ WINDOWS \ System32 \ Drivers \ FTD2XX.sys [2003-01-24 24197] S3 XDva020, XDva020, C: \ WINDOWS \ system32 \ XDva020.sys [] . Contents of the 'Scheduled Tasks-kansioon . - - - - Orvolla poistettu - - - -- HKCU-Run-updateMgr - C: \ Program Files \ Adobe \ Acrobat 7.0 \ Reader \ AdobeUpdateManager.exe HKCU-Run-Aim6 - (no file) . ------- Supplementary Scan ------- . FireFox -: Profile - C: \ Documents and Settings \ Tomi Stratman \ Application Data \ Mozilla \ Firefox \ Profiles \ e41ez35c.default \ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp: / / dsl.sbc.yahoo.com / . ************************************************** ************************ catchme 0.3.1361 W2K/XP/Vista - rootkit / varkain haittaohjelmien detektori on Gmer, http://www.gmer.net Rootkit scan 2008-09-16 17:01:58 Windows 5.1.2600 Service Pack 2 NTFS skannaus piilotettu prosessien ... skannaus piilotettu Autostart merkinnät ... skannaus piilotetut tiedostot ... scan loppuun onnistuneesti piilotetut tiedostot: 0 ************************************************** ************************ . ------------------------ Other Running Processes ----------------------- -- . C: \ Program Files \ Windows Defender \ MsMpEng.exe C: \ Program Files \ ALWIL Software \ Avast4 \ aswUpdSv.exe C: \ Program Files \ ALWIL Software \ Avast4 \ ashServ.exe C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ Program Files \ Bonjour \ mDNSResponder.exe C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe C: \ Program Files \ Dell Support Center \ bin \ sprtsvc.exe C: \ PROGRA ~ 1 \ WinZip \ WZQKPICK.EXE C: \ Program Files \ ALWIL Software \ Avast4 \ ashMaiSv.exe C: \ Program Files \ ALWIL Software \ Avast4 \ ashWebSv.exe C: \ Program Files \ Common Files \ Logishrd \ KHAL2 \ KHALMNPR.exe C: \ Program Files \ iPod \ bin \ iPodService.exe . ************************************************** ************************ . Täydennys aika: 2008-09-16 17:13:41 - kone käynnistettiin uudelleen ComboFix-karanteenissa-files.txt 2008-09-16 22:13:22 Pre-Run: 263151616 tavua vapaana Post-Run: 674275328 tavua vapaana 180 --- EOF --- 2008-09-16 11:27:11 ============= END COMBO FOX ================================== Logfile ja Trend Micro HijackThis v2.0.2 Scan tallennettu 5:26:48 PM, on 9.16.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Käynnissä olevista prosesseista: C: \ WINDOWS \ System32 \ smss.exe C: \ WINDOWS \ system32 \ Winlogon.exe C: \ WINDOWS \ system32 \ Services.exe C: \ WINDOWS \ system32 \ Lsass.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ Program Files \ Windows Defender \ MsMpEng.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ Program Files \ ALWIL Software \ Avast4 \ aswUpdSv.exe C: \ Program Files \ ALWIL Software \ Avast4 \ ashServ.exe C: \ WINDOWS \ system32 \ spoolsv.exe C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ Program Files \ Bonjour \ mDNSResponder.exe C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe C: \ Nexon \ Mabinogi \ npkcmsvc.exe C: \ Program Files \ Dell \ Media Kokemus \ PCMService.exe C: \ Program Files \ Cyberlink \ PowerDVD \ DVDLauncher.exe C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe C: \ WINDOWS \ system32 \ hkcmd.exe C: \ WINDOWS \ system32 \ igfxpers.exe C: \ Program Files \ Canon \ MyPrinter \ BJMyPrt.exe C: \ Program Files \ ScanSoft \ OmniPageSE4.0 \ OpwareSE4.exe C: \ Program Files \ Dell Support Center \ bin \ sprtsvc.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ Program Files \ Analog Devices \ Core \ smax4pnp.exe C: \ Program Files \ näkökulmasta \ Common \ ViewpointService.exe C: \ Program Files \ Dell Support Center \ bin \ sprtcmd.exe C: \ Program Files \ QuickTime \ QTTask.exe C: \ Program Files \ iTunes \ iTunesHelper.exe C: \ Program Files \ DellSupport \ DSAgnt.exe C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Program \ LogitechDesktopMessenger. Exe C: \ Program Files \ Messenger \ msmsgs.exe C: \ Program Files \ Logitech \ SetPoint \ SetPoint.exe C: \ Program Files \ WinZip \ WZQKPICK.EXE C: \ Program Files \ SpywareGuard \ sgmain.exe C: \ Program Files \ ALWIL Software \ Avast4 \ ashMaiSv.exe C: \ Program Files \ ALWIL Software \ Avast4 \ ashWebSv.exe C: \ Program Files \ Common Files \ Logishrd \ KHAL2 \ KHALMNPR.EXE C: \ Program Files \ iPod \ bin \ iPodService.exe C: \ WINDOWS \ system32 \ wuauclt.exe C: \ WINDOWS \ explorer.exe C: \ Program Files \ Mozilla Firefox \ firefox.exe C: \ Program Files \ Trend Micro \ HijackThis \ HijackThis.exe R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://dsl.sbc.yahoo.com/ R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.dell4me.com/mywaybiz R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Settings, ProxyServer = 0.0.0.0 R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Asetukset, ProxyOverride = *. paikallisten R3 - URLSearchHook: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - (no file) O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C: \ Program Files \ Google \ GoogleToolbarNotifier \ 2.1.1119.1736 \ s wg.dll O3 - Toolbar: (no name) - (BA52B914-B692-46c4-B683-905236F6F655) - (no file) O3 - Toolbar: (no name) - (E0E899AB-F487-11D5-8D29-0050BA6940E3) - (no file) O4 - HKLM \ .. \ Run: [PCMService] "C: \ Program Files \ Dell \ Media Kokemus \ PCMService.exe" O4 - HKLM \ .. \ Run: [DVDLauncher] "C: \ Program Files \ Cyberlink \ PowerDVD \ DVDLauncher.exe" O4 - HKLM \ .. \ Run: [dla] C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe O4 - HKLM \ .. \ Run: [igfxtray] C: \ WINDOWS \ system32 \ igfxtray.exe O4 - HKLM \ .. \ Run: [igfxhkcmd] C: \ WINDOWS \ system32 \ hkcmd.exe O4 - HKLM \ .. \ Run: [igfxpers] C: \ WINDOWS \ system32 \ igfxpers.exe O4 - HKLM \ .. \ Run: [CanonMyPrinter] C: \ Program Files \ Canon \ MyPrinter \ BJMyPrt.exe / kirjautuminen O4 - HKLM \ .. \ Run: [SSBkgdUpdate] "C: \ Program Files \ Common Files \ ScanSoft Shared \ SSBkgdUpdate \ SSBkgdupdate.exe"-Embedding-boot O4 - HKLM \ .. \ Run: [OpwareSE4] "C: \ Program Files \ ScanSoft \ OmniPageSE4.0 \ OpwareSE4.exe" O4 - HKLM \ .. \ Run: [IMJPMIG8.1] "C: \ WINDOWS \ IME \ imjp8_1 \ IMJPMIG.EXE" / pilata / RemAdvDef / Migration32 O4 - HKLM \ .. \ Run: [MSPY2002] C: \ WINDOWS \ system32 \ IME \ PINTLGNT \ ImScInst.exe / SYNC O4 - HKLM \ .. \ Run: [PHIME2002ASync] C: \ WINDOWS \ system32 \ IME \ TINTLGNT \ TINTSETP.EXE / SYNC O4 - HKLM \ .. \ Run: [PHIME2002A] C: \ WINDOWS \ system32 \ IME \ TINTLGNT \ TINTSETP.EXE / IMEName O4 - HKLM \ .. \ Run: [SoundMAXPnP] C: \ Program Files \ Analog Devices \ Core \ smax4pnp.exe O4 - HKLM \ .. \ Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM \ .. \ Run: [Kernel ja Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM \ .. \ Run: [Adobe Reader Speed Launcher] "C: \ Program Files \ Adobe \ Reader 8.0 \ Reader \ Reader_sl.exe" O4 - HKLM \ .. \ Run: [dscactivate] "C: \ Program Files \ Dell Support Center \ gs_agent \ mukautetun \ dsca.exe" O4 - HKLM \ .. \ Run: [DellSupportCenter] "C: \ Program Files \ Dell Support Center \ bin \ sprtcmd.exe" / P DellSupportCenter O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime O4 - HKLM \ .. \ Run: [AppleSyncNotifier] C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleSyncNotifier.exe O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe" O4 - HKCU \ .. \ Run: [DellSupport] "C: \ Program Files \ DellSupport \ DSAgnt.exe" / käynnistys O4 - HKCU \ .. \ Run: [LDM] C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Program \ LogitechDesktopMessenger. Exe O4 - HKCU \ .. \ Run: [MSMSGS] "C: \ Program Files \ Messenger \ msmsgs.exe" / tausta O4 - HKCU \ .. \ Run: [DellSupportCenter] "C: \ Program Files \ Dell Support Center \ bin \ sprtcmd.exe" / P DellSupportCenter O4 - HKUS \ S-1-5-18 \ .. \ Run: [DWQueuedReporting] "C: \ PROGRA ~ 1 \ Common ~ 1 \ mikros ~ 1 \ DW \ dwtrig20.exe"-t (User 'SYSTEM') O4 - HKUS \. DEFAULT \ .. \ Run: [DWQueuedReporting] "C: \ PROGRA ~ 1 \ Common ~ 1 \ mikros ~ 1 \ DW \ dwtrig20.exe"-t (User 'Default user') O4 - Startup: SpywareGuard.lnk = C: \ Program Files \ SpywareGuard \ sgmain.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Program \ LogitechDesktopMessenger. Exe O4 - Global Startup: Logitech SetPoint.lnk = C: \ Program Files \ Logitech \ SetPoint \ SetPoint.exe O4 - Global Startup: Microsoft Office.lnk = C: \ Program Files \ Microsoft Office \ Office10 \ OSA.EXE O4 - Global Startup: WinZip Quick Pick.lnk = C: \ Program Files \ WinZip \ WZQKPICK.EXE O6 - HKCU \ Software \ Policies \ Microsoft \ Internet Explorer \ Control Panel läsnä O8 - Extra yhteydessä valikkotoimintoa: & AIM Search - res: / / C: \ Program Files \ AIM Toolbar \ AIMBar.dll / aimsearch.htm O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_01 \ bin \ ssv.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_01 \ bin \ ssv.dll (file missing) O9 - Extra button: AIM - (AC9E2541-2814-11d5-BC6D-00B0D0A1DE45) - C: \ Program Files \ AIM \ aim.exe O9 - Extra button: MusicMatch MX Web Player - (d81ca86b-ef63-42af-bee3-4502d9a03c2d) -- http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O9 - Extra button: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O16 - DPF: (149E45D8-163E-4189-86FC-45022AB2B6C9) (Spintop DRM Control) - file: / / C: \ Program Files \ Scrabble \ Images \ stg_drm.ocx O16 - DPF: (17492023-C23A-453E-A040-C7C580BBF700) (Windows Genuine Advantage Validation Tool) -- http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: (288C5F13-7E52-4ADA-A32E-F5BF9D125F98) (CR64Loader Object) -- http://miniclip.com/platypus/miniclipGameLoader.dll O16 - DPF: (30528230-99f7-4bb4-88d8-fa1d4f56a2ab) (Installation Support) - C: \ Program Files \ Yahoo! \ Common \ Yinsthelper.dll O16 - DPF: (406B5949-7190-4245-91A9-30A17DE16AD0) (Snapfish Activia) -- http://photo.walgreens.com/WalgreensActivia.cab O16 - DPF: (48884C41-EFAC-433D-958A-9FADAC41408E) (EGamesPlugin Class) -- https: / / www.e-games.com.my/com/EGamesPlugin.cab O16 - DPF: (5F5F9FB8-878E-4455-95E0-F64B2314288A) -- http://gamedownload.ijjimax.com/game...lugin11USA.cab O16 - DPF: (5F8469B4-B055-49DD-83F7-62B522420ECC) (Facebook Photo Uploader Control) -- http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: (CC450D71-CC90-424C-8638-1F2DBAC87A54) (ArmHelper Control) - file: / / C: \ Program Files \ Scrabble \ Images \ armhelper.ocx O16 - DPF: (CD995117-98E5-4169-9920-6C12D4C0B548) -- http://gamedownload.ijjimax.com/game...Plugin9USA.cab O18 - Protocol: bwfile-8876480 - (9462A756-7B47-47BC-8C80-C34B9B80B32B) - C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Program \ GAPlugProtocol-8876480.dll O23 - Service: Apple Mobile Device - Apple Inc. - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C: \ Program Files \ ALWIL Software \ Avast4 \ aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C: \ Program Files \ ALWIL Software \ Avast4 \ ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C: \ Program Files \ ALWIL Software \ Avast4 \ ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C: \ Program Files \ ALWIL Software \ Avast4 \ ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C: \ Program Files \ Bonjour \ mDNSResponder.exe O23 - Service: DSBrokerService - Unknown owner - C: \ Program Files \ DellSupport \ brkrsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C: \ Program Files \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C: \ Program Files \ iPod \ bin \ iPodService.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C: \ Program Files \ Common Files \ Logitech \ Bluetooth \ LBTServ.exe O23 - Service: Intel NCS NetServicen (NetSvc) - Intel (R) Corporation - C: \ Program Files \ Intel \ PROSetWired \ NCS \ Sync \ NetSvc.exe O23 - Service: npkcmsvc - INCA Internet Co, Ltd - C: \ Nexon \ Mabinogi \ npkcmsvc.exe O23 - Service: SupportSoft ketjupyörä Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C: \ Program Files \ Dell Support Center \ bin \ sprtsvc.exe O23 - Service: näkökulmasta Manager Service - näkökulmasta Corporation - C: \ Program Files \ näkökulmasta \ Common \ ViewpointService.exe -- End of file - 10675 bytes |
|
#12
16 syyskuu 2008, 16:03
| |||
| |||
Tarvitsetko apua salaperäinen desktop "bar"
---------- Ladata ViewpointKiller.zip
---------- Java on vanhentunut. Vanhemmat versiot ovat vulnerabilities että ilkivaltaisten sivustot voivat käyttää tartuttaa järjestelmään. Ensinnäkin asentaa uusi Sun Java Runtime Environment Muista sulkea kaikki selainikkunat ennen asennusta. Poista vanha versio (t)
---------- Ladata ATF Cleaner jonka Atribune teidän Desktopista. Alternate latauslinkki Huom: Vista-käyttäjien on käytettävä Suorita järjestelmänvalvojana
Huomaa, että järjestelmä ajaa hitaammin for a reboot tai kaksi sen jälkeen, kun käyttää tätä työkalua niin älä hermostu. Tärkeää: Käynnistä tietokone uudelleen, ennen kuin jatkat. ---------- Suorita online scan. Vaatii Internet Explorer Käytä ESET NOD32 Online Scanner 1. Valitse Kyllä, hyväksyn Käyttöehdot. 2. Valitse Alku 3. Kysyttäessä sallia ActiveX-komponentin asentaminen 4. Valitse Alku 5. Varmista, että vaihtoehto Poista löytyi uhkia ja mahdollisuus Scan ei-toivotut sovellukset on tarkistaa merkitty. 6. Valitse Scan 7. Odota skannauksen loppuun 8. Käytä notepad avaa logfile sijaitsevat C: \ Program Files \ EsetOnlineScanner \ Log.Txt 9. Lisää että C: \ Program Files \ EsetOnlineScanner \ Log.Txt kirjaudu seuraava vastaus
__________________  |
|
#13
17 syyskuu 2008, 04:20
| |||
| |||
| Tarvitsetko apua salaperäinen desktop "bar" # Version = 4 # OnlineScanner.ocx = 1.0.0.635 # OnlineScannerDLLA.dll = 1, 0, 0, 79 # OnlineScannerDLLW.dll = 1, 0, 0, 78 # OnlineScannerUninstaller.exe = 1, 0, 0, 49 # vers_standard_module = 3447 (20080916) # vers_arch_module = 1,064 (20080214) # vers_adv_heur_module = 1,064 (20070717) # EOSSerial = 8983b3a42701b342bf8e75ec7f82c98f # end = Valmis # remove_checked = true # unwanted_checked = true # utc_time = 2008-09-17 05:39:16 # local_time = 2008-09-17 12:39:16 (-0600, Keski kesäaika) # maa = "Yhdysvallat" # OSVer = 5.1.2600 NT Service Pack 2 # skannattu = 226155 # löytyi = 0 # scan_time = 4934 |
|
#14
17 syyskuu 2008, 08:40
| |||
| |||
| Tarvitsetko apua salaperäinen desktop "bar" Asettaa uuden palautuspisteen estää mahdollinen reinfection, joka vanhan Asettamalla uuden palautuspisteen puhdistuksen jälkeen järjestelmä mahdollistaa tietokoneen nimenhuutoäänestystä takaisin puhtaan työntekovaltiossa tarvittaessa.
Windows XP: n Järjestelmän palauttaminen-opas tai Windows Vista System Restore-opas ---------- Käytä Secunia Software Inspector tarkistaa vanhentunut ohjelmisto. Vanhentunut ohjelmisto on suojausheikkoutta että haittaohjelmat voivat hyödyntää.
Siirry Microsoft Windows Update ja saada kaikki kriittiset päivitykset. ---------- Seuraavassa on joitakin suuria VAPAA-työkaluja, joiden avulla voit estää saada tartunnan uudelleen. Näiden työkalujen käyttö on vain vähän tai ei resurssit, jotta ei hidastaa tietokoneen. Huolissaan Selaimen turvallisuutta? Käyttää Mozilla Firefox 3.0. Jos haluat estää tuntemattomia sovelluksia on asennettu tietokoneeseen asentaa WinPatrol 2008 * Käyttämällä Winpatrol suojella tietokonetta haittaohjelmilta Ehdotan, että käytät SiteAdvisor. SiteAdvisorin hinnat sivustoja liiketapoja ja roskapostia. Turvallisuusluokitukset McAfee SiteAdvisor perustuvat automatisoitu turvallisuuskokeet Web-sivustoissa. SpywareBlaster - Secure Internet Explorerin vaikeuttaa näiden ActiveX-ohjelmien suorittamisen tietokoneessa. Myös lopettaa tietyt evästeet lisätään tietokoneeseen, kun käynnissä Mozilla-pohjaiset selaimet, kuten Firefox. * Käyttämällä SpywareBlaster suojella tietokonetta vakoilu-ja haittaohjelmien * Jos et tiedä mitä ActiveX ovat, katso tässä Check out Keeping Yourself turvallinen On The Web vinkit ja ilmaisia työkaluja pitää sinut turvassa myös tulevaisuudessa. Katso myös Hidas tietokone? Se ei voi olla Malware ilmaiseksi puhdistus / huolto-työkaluja, joiden avulla voit pitää tietokoneen hallintaansa sileä. Käytä vain luotettavia tietoturvaohjelmistot kuten luetelluista ohjelmista tällä sivulla. Luotetut tietoturvatyökalut & resurssit
__________________ |
|
#15
17 syyskuu 2008, 14:24
| |||
| |||
| Tarvitsetko apua salaperäinen desktop "bar" En voi kiittää sinua tarpeeksi. Mielestäni paljon turvallisempi minun tietokone nyt kiittää teitä. Olen erittäin vaikuttunut lukuisat tietoa tällä sivustolla ja jatkossakin käyttää sitä minun Computing tarpeisiin.  |
|
#16
17 syyskuu 2008, 14:27
| |||
| |||
| Tarvitsetko apua salaperäinen desktop "bar" Glad se toimi. Safe surfing ... 
__________________ |
