|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
logi tarkastettavaksi
|
|
|
jabexi
Newbie
|
18. maaliskuuta 2008 @ 22:13 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:05:59, on 18.3.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Windows\ASScrPro.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Apoint2K\Apvfb.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Windows\explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\Windows\System32\StkCSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
--
End of file - 8135 bytes
Onkohan mitään huolestuttavaa?
|
|
Hujo
Suspended permanently
|
19. maaliskuuta 2008 @ 01:14 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Voiko tietsikka koskaan toimia?
|
|
jabexi
Newbie
|
19. maaliskuuta 2008 @ 14:26 |
Linkki tähän viestiin
|
combofix:n logi:
ComboFix 08-03-18.1 - Jape 2008-03-19 14:05:00.1 - NTFSx86
Microsoft® Windows Vista? Home Premium 6.0.6000.0.1252.1.1035.18.1258 [GMT 2:00]
Running from: C:\Users\Jape\Downloads\ComboFix.exe
* Created a new restore point
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-02-19 to 2008-03-19 )))))))))))))))))
.
Tiedostoja ei ole luotu tällä aikavälillä
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-19 12:05 --------- d-----w C:\Users\Jape\AppData\Roaming\uTorrent
2008-03-19 11:57 12,978 ----a-w C:\Users\Jape\AppData\Roaming\nvModes.dat
2008-03-18 20:05 --------- d-----w C:\Program Files\Trend Micro
2008-03-18 17:10 --------- d-----w C:\Users\Jape\AppData\Roaming\foobar2000
2008-03-12 13:05 45,056 ----a-w C:\Windows\System32\acovcnt.exe
2008-03-12 13:02 --------- d-----w C:\Program Files\Windows Mail
2008-03-12 07:52 --------- d-----w C:\ProgramData\Microsoft Help
2008-03-10 11:55 --------- d-----w C:\Program Files\iTunes
2008-03-10 11:55 --------- d-----w C:\Program Files\iPod
2008-03-10 11:52 --------- d-----w C:\Program Files\QuickTime
2008-03-08 17:47 --------- d-----w C:\Program Files\Google
2008-03-08 07:54 --------- d-----w C:\Program Files\Java
2008-03-06 07:56 --------- d-----w C:\Program Files\MediaInfo
2008-03-04 19:12 --------- d-----w C:\Users\Jape\AppData\Roaming\ImgBurn
2008-03-04 18:59 --------- d-----w C:\Program Files\ImgBurn
2008-03-04 16:12 --------- d-----w C:\Users\Jape\AppData\Roaming\dvdcss
2008-03-01 14:46 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-03-01 14:31 --------- d-----w C:\Program Files\FlashFXP
2008-03-01 14:27 --------- d-----w C:\ProgramData\FlashFXP
2008-03-01 07:48 413,696 ----a-w C:\Windows\System32\wrap_oal.dll
2008-03-01 07:48 110,592 ----a-w C:\Windows\System32\OpenAL32.dll
2008-02-29 21:55 --------- d-----w C:\ProgramData\Media Center Programs
2008-02-29 19:17 --------- d-----w C:\Program Files\Nokia
2008-02-29 19:05 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-27 11:58 --------- d-----w C:\ProgramData\Apple Computer
2008-02-27 01:01 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-02-26 09:25 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-26 09:25 --------- d-----w C:\Program Files\Windows Live
2008-02-26 09:23 --------- d-----w C:\ProgramData\WLInstaller
2008-02-20 05:47 765,440 ----a-w C:\Windows\system32\drivers\athr.sys
2008-02-14 05:52 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-02-14 05:52 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-02-14 05:50 943,800 ----a-w C:\Windows\System32\winload.exe
2008-02-14 05:50 905,400 ----a-w C:\Windows\System32\winresume.exe
2008-02-14 05:50 595,456 ----a-w C:\Windows\System32\schedsvc.dll
2008-02-14 05:50 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
2008-02-14 05:50 39,424 ----a-w C:\Windows\System32\lodctr.exe
2008-02-14 05:50 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
2008-02-14 05:50 32,256 ----a-w C:\Windows\System32\unlodctr.exe
2008-02-14 05:50 23,552 ----a-w C:\Windows\System32\nshhttp.dll
2008-02-14 05:50 17,408 ----a-w C:\Windows\System32\prflbmsg.dll
2008-02-14 05:50 115,200 ----a-w C:\Windows\System32\loadperf.dll
2008-02-14 05:48 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-14 05:48 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-14 05:48 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-02-14 05:48 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-02-14 05:48 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-02-14 05:48 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-02-14 05:48 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-02-14 05:48 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-02-14 05:48 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-02-14 05:48 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-14 05:48 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
2008-02-14 05:48 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-02-14 05:47 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-14 05:47 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-14 05:47 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-14 05:47 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-14 05:47 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-14 05:47 1,686,528 ----a-w C:\Windows\System32\gameux.dll
2008-02-14 05:44 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-02-14 05:44 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-14 05:44 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-14 05:44 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-11 18:05 --------- d-----w C:\Program Files\ffdshow
2008-02-04 18:18 --------- d-----w C:\Users\Jape\AppData\Roaming\Autodesk
2008-02-04 18:18 --------- d-----w C:\ProgramData\Autodesk
2008-02-01 16:53 --------- d-----w C:\Program Files\AutoCAD 2008
2008-02-01 16:52 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-02-01 16:46 --------- d-----w C:\Program Files\Autodesk
2008-01-31 20:27 --------- d-----w C:\ProgramData\Installations
2008-01-31 18:03 715,248 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-01-26 10:45 229,888 ----a-w C:\Windows\System32\msshsq.dll
2008-01-26 10:25 --------- d-----w C:\Users\Jape\AppData\Roaming\Logitech
2008-01-26 10:25 --------- d-----w C:\ProgramData\LogiShrd
2008-01-26 10:24 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2008-01-26 10:24 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-01-26 10:22 --------- d-----w C:\Program Files\Common Files\Logitech
2008-01-26 10:21 --------- d-----w C:\ProgramData\Logitech
2008-01-26 10:21 --------- d-----w C:\Program Files\Logitech
2008-01-20 11:00 --------- d-----w C:\Program Files\CCleaner
2008-01-10 05:50 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
2008-01-08 19:09 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2007-09-03 19:28 174 --sha-w C:\Program Files\desktop.ini
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-08 21:09 1232896]
"NB Probe"="" []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-09-03 20:23 1006264]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-01-19 08:19 90191]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-01-19 08:19 7770112]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-01-19 08:19 81920]
"RtHDVCpl"="RtHDVCpl.exe" [2007-02-15 11:07 4390912 C:\Windows\RtHDVCpl.exe]
"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 11:31 630784]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2006-09-12 03:22 155648]
"ATKMEDIA"="C:\Program Files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 17:27 61440]
"ASUS Screen Saver Protector"="C:\Windows\ASScrPro.exe" [2007-09-04 05:51 33136]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 56080 C:\Windows\KHALMNPR.Exe]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [ ]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-01-18 23:48:42 2752512]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-01-26 12:21:39 692224]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List]
"C:\\Program Files\\FlashFXP\\FlashFXP.exe"= C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{26E2FF19-AAC6-43CB-8CD0-B6C9063A51DB}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{9442B277-9936-490C-A4E0-BE524DB33A02}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{90F8B5B9-AF4F-4180-BF2E-469E3B7D9F88}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{EECD0B43-9C06-4210-AA46-2CDAD1A34867}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"{022B64ED-1C0D-4D33-BCA3-508A7658162C}"= UDP:D:\Games\BF2\BF2.exe:Battlefield 2
"{50CFA6CA-2017-4B86-93DB-9158C434E20A}"= TCP:D:\Games\BF2\BF2.exe:Battlefield 2
"TCP Query User{5549EC58-FB06-499A-8794-444E8305D150}D:\\games\\css\\hl2.exe"= UDP:D:\games\css\hl2.exe:hl2
"UDP Query User{A36F1148-704F-438B-A010-95F15F433078}D:\\games\\css\\hl2.exe"= TCP:D:\games\css\hl2.exe:hl2
"{8CF92D72-00B8-4131-B4E7-58000F0CB414}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{47FE3C0A-0F3C-4921-AC2E-CF103D28DF9C}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{4AE6D93C-8BC5-49AD-909B-65E83D52B8E3}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{2BF8B31E-96F7-4F5B-B496-7E74092A3CFB}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{A847D3C8-154C-4EED-B201-54D6F6D5768F}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{186A9C91-FF37-4DA5-9115-9B8E0C042B93}D:\\games\\counter strike source\\counter-strike source\\hl2.exe"= UDP:D:\games\counter strike source\counter-strike source\hl2.exe:hl2
"UDP Query User{0D82FB0A-1162-4397-8FD1-A39296443CE4}D:\\games\\counter strike source\\counter-strike source\\hl2.exe"= TCP:D:\games\counter strike source\counter-strike source\hl2.exe:hl2
"TCP Query User{2D748A03-53FB-4655-9580-BF7A281DE80C}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= UDP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"UDP Query User{4368A9FC-E61C-45F8-B4EB-9181A62C42AF}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= TCP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"TCP Query User{2DBA2FD2-7BEE-4BE3-A2DA-0B65C9F52221}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= UDP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"UDP Query User{E3D25E7B-70AB-463F-B928-B0A76DDB588A}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= TCP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"TCP Query User{B0435664-FAE9-497C-AA1A-E0ED86593263}C:\\users\\jape\\downloads\\wowclient-downloader.exe"= UDP:C:\users\jape\downloads\wowclient-downloader.exe:wowclient-downloader.exe
"UDP Query User{7A33FB66-426F-4083-90D7-855F27CF3F71}C:\\users\\jape\\downloads\\wowclient-downloader.exe"= TCP:C:\users\jape\downloads\wowclient-downloader.exe:wowclient-downloader.exe
"{D1629AE5-16E2-42F0-B8E0-A4B0E5AF4387}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{834CD6EE-1FAF-44ED-A982-220683592620}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{1EF7528A-26AE-42DB-BD51-606908521169}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"{9D38333E-8194-4D52-AB10-8BE5271839AE}"= UDP:D:\Games\Kane & Lynch - Dead Men\kaneandlynch.exe:Kane & Lynch: Dead Men
"{88E27718-B1AD-4BE9-8522-B7FCD132056C}"= TCP:D:\Games\Kane & Lynch - Dead Men\kaneandlynch.exe:Kane & Lynch: Dead Men
"{6739A55C-ADE5-4EA3-BA30-8EF21E4449F0}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{0FDBECBE-48E1-4745-8D45-41A9A9755BAF}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\FlashFXP\\FlashFXP.exe"= C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 16:52]
R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;C:\Windows\System32\StkCSrv.exe [2006-12-10 18:31]
R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service;C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2006-11-01 07:40]
R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2008-02-20 07:47]
R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;C:\Windows\system32\Drivers\StkCMini.sys [2007-01-19 17:19]
R3 WCPU;WCPU;C:\Program Files\P4G\WCPU.sys [2007-01-03 00:37]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e22f3c1c-921d-11dc-9603-001a92c82b24}]
\shell\AutoRun\command - G:\LaunchU3.exe -a
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-19 14:08:01
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-03-19 14:09:12
.
2008-03-12 07:52:36 --- E O F ---
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
19. maaliskuuta 2008 @ 14:34 |
Linkki tähän viestiin
|
|
scannaa hjt:llä merkkaa paina Fix checked
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
===
Kopioi / liitä seuraava teksti alapuolella tyhjään muistioFiluun
Varmista että tiedoston tyyppi on ?all Files? ja tallenna se Poisto.bat. nimisenä
työpöydällesi.
@echo off
sc stop CLTNetCnService
sc delete CLTNetCnService
Tupla-klikkaa Poisto.bat. filua työpöydälläsi , ikkuna avautuu ja Sulkeutuu tämä on normaalia.
Poista kansio vikasiedossa
:\Program Files\Common Files\Symantec Shared
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 19. maaliskuuta 2008 @ 14:35
|
|
