|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
HJT-logi tarkistettavaksi
|
|
Junior Member
2 tuotearviota
|
25. maaliskuuta 2008 @ 18:48 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:45:13, on 25.3.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\Program Files\ThreatFire\TFService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {a33fa729-d155-4b23-842b-2c665ecabdb6} - (no file)
O2 - BHO: Burn4Free Toolbar Helper - {D187A56B-A33F-4CBE-9D77-459FC0BAE012} - C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll
O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O3 - Toolbar: Burn4Free Toolbar - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - .DEFAULT User Startup: OP_CACHE.ATR (User 'Default user')
O4 - .DEFAULT User Startup: OP_CACHE.IDX (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: ,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SiteAdvisor-palvelu (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 10554 bytes
|
|
Hujo
Suspended permanently
|
25. maaliskuuta 2008 @ 19:02 |
Linkki tähän viestiin
|
Poista lisää poista sovelutuksesta
Burn4Free Toolbar Helper
Burn4Free Toolbar
ThreatFire
Poista vikasiedossa kansiot
C:\Program Files\Burn4Free Toolbar
C:\Program Files\Burn4Free Toolbar
C:\Program Files\ThreatFire
Scannaaa hjt:llä merkkaa paina Fix checked
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {a33fa729-d155-4b23-842b-2c665ecabdb6} - (no file)
O2 - BHO: Burn4Free Toolbar Helper - {D187A56B-A33F-4CBE-9D77-459FC0BAE012} - C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll
O3 - Toolbar: Burn4Free Toolbar - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll
O4 - .DEFAULT User Startup: OP_CACHE.ATR (User 'Default user')
O4 - .DEFAULT User Startup: OP_CACHE.IDX (User 'Default user')
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
=============
Kopioi / liitä seuraava teksti alapuolella tyhjään muistioFiluun
Varmista että tiedoston tyyppi on ?all Files? ja tallenna se Poisto.bat. nimisenä
työpöydällesi.
@echo off
sc stop ThreatFire
sc delete ThreatFire
Tupla-klikkaa Poisto.bat. filua työpöydälläsi , ikkuna avautuu ja Sulkeutuu tämä on normaalia.
=========
scannaa uusi hjt:n loki
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 25. maaliskuuta 2008 @ 19:03
|
Junior Member
2 tuotearviota
|
26. maaliskuuta 2008 @ 11:49 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:49:01, on 26.3.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {a33fa729-d155-4b23-842b-2c665ecabdb6} - (no file)
O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - .DEFAULT User Startup: OP_CACHE.ATR (User 'Default user')
O4 - .DEFAULT User Startup: OP_CACHE.IDX (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: ,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SiteAdvisor-palvelu (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 9510 bytes
tos olis uusin logi
|
|
Hujo
Suspended permanently
|
26. maaliskuuta 2008 @ 14:27 |
Linkki tähän viestiin
|
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan:
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä
Jossakin koneissa hakataan F8:sin sijasta F5:tä
" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
Voiko tietsikka koskaan toimia?
|
Junior Member
2 tuotearviota
|
26. maaliskuuta 2008 @ 15:26 |
Linkki tähän viestiin
|
SDFix: Version 1.162
Run by Atte on ke 26.03.2008 at 14:58
Microsoft Windows XP [versio 5.1.2600]
Running From: C:\DOCUME~1\Atte\TYPYT~1\SDFix
Checking Services :
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
Checking Files :
No Trojan Files Found
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 15:06:14
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000003
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:a8,58,8b,85,b0,cb,b9,db,5e,08,2b,3c,e2,80,de,d6,04,18,66,81,f3,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:6c,00,d0,54,e6,70,76,4c,bd,3a,16,3c,6d,e4,fd,68,cc,5f,52,fe,fe,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000002
"khjeh"=hex:19,4b,64,c5,d1,1f,2d,e6,cc,c6,ab,b1,bc,18,20,36,cd,06,7e,bd,37,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:a8,58,8b,85,b0,cb,b9,db,5e,08,2b,3c,e2,80,de,d6,04,18,66,81,f3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000001
"hdf12"=hex:6c,00,d0,54,e6,70,76,4c,bd,3a,16,3c,6d,e4,fd,68,cc,5f,52,fe,fe,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000002
"khjeh"=hex:19,4b,64,c5,d1,1f,2d,e6,cc,c6,ab,b1,bc,18,20,36,cd,06,7e,bd,37,..
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xfe\xbb\xd3w\2]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb"
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray"
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\Win32\\RpcDataSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\Win32\\RpcDataSrv.exe:*:Enabled:SiSoftware Database Agent Service"
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\RpcSandraSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service"
"C:\\Program Files\\Freeciv-2.1.1-gtk2\\civserver.exe"="C:\\Program Files\\Freeciv-2.1.1-gtk2\\civserver.exe:*:Enabled:civserver"
"C:\\Program Files\\Microsoft XNA\\XNA Game Studio Express\\v1.0\\Bin\\XnaTrans.exe"="C:\\Program Files\\Microsoft XNA\\XNA Game Studio Express\\v1.0\\Bin\\XnaTrans.exe:LocalSubNet:Enabled:XNA Game Studio Transport"
"C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DC++"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
Remaining Files :
File Backups: - C:\DOCUME~1\Atte\TYPYT~1\SDFix\backups\backups.zip
Files with Hidden Attributes :
Sat 9 Feb 2008 24 A.SH. --- "C:\WINDOWS\S5AB6BC3A.tmp"
Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Mon 7 Jan 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 7 Jan 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Tue 5 Jul 2005 241,664 A..H. --- "C:\Sovellukset\Ajuri\Audio\EXERUN\EXERUN.exe"
Wed 20 Jul 2005 122,880 A..H. --- "C:\Sovellukset\Ajuri\Audio\EXERUN\Fxdrv.dll"
Sat 3 Jul 2004 13,440 A..H. --- "C:\Sovellukset\Ajuri\Audio\EXERUN\Fxdrv.sys"
Mon 27 Sep 2004 62,976 A..H. --- "C:\Sovellukset\Ajuri\Chipset\exerun\DSETUP.dll"
Sat 23 Jul 2005 241,664 A..H. --- "C:\Sovellukset\Ajuri\Chipset\exerun\EXERUN.exe"
Wed 20 Jul 2005 122,880 A..H. --- "C:\Sovellukset\Ajuri\Chipset\exerun\Fxdrv.dll"
Sat 3 Jul 2004 13,440 A..H. --- "C:\Sovellukset\Ajuri\Chipset\exerun\Fxdrv.sys"
Tue 5 Jul 2005 241,664 A..H. --- "C:\Sovellukset\Ajuri\Lan\EXERUN\EXERUN.exe"
Wed 20 Jul 2005 122,880 A..H. --- "C:\Sovellukset\Ajuri\Lan\EXERUN\Fxdrv.dll"
Sat 3 Jul 2004 13,440 A..H. --- "C:\Sovellukset\Ajuri\Lan\EXERUN\Fxdrv.sys"
Tue 5 Jul 2005 241,664 A..H. --- "C:\Sovellukset\Ajuri\usb20\EXERUN\EXERUN.exe"
Wed 20 Jul 2005 122,880 A..H. --- "C:\Sovellukset\Ajuri\usb20\EXERUN\Fxdrv.dll"
Sat 3 Jul 2004 13,440 A..H. --- "C:\Sovellukset\Ajuri\usb20\EXERUN\Fxdrv.sys"
Tue 5 Jul 2005 241,664 A..H. --- "C:\Sovellukset\Ajuri\VGA\EXERUN\EXERUN.exe"
Wed 20 Jul 2005 122,880 A..H. --- "C:\Sovellukset\Ajuri\VGA\EXERUN\Fxdrv.dll"
Sat 3 Jul 2004 13,440 A..H. --- "C:\Sovellukset\Ajuri\VGA\EXERUN\Fxdrv.sys"
Sat 12 Jan 2008 857 ...HR --- "C:\Documents and Settings\Atte\Application Data\SecuROM\UserData\securom_v7_01.bak"
Finished!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:24:31, on 26.3.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {a33fa729-d155-4b23-842b-2c665ecabdb6} - (no file)
O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - .DEFAULT User Startup: OP_CACHE.ATR (User 'Default user')
O4 - .DEFAULT User Startup: OP_CACHE.IDX (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: ,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SiteAdvisor-palvelu (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 9828 bytes
|
|
Hujo
Suspended permanently
|
26. maaliskuuta 2008 @ 19:37 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Voiko tietsikka koskaan toimia?
|
Junior Member
2 tuotearviota
|
26. maaliskuuta 2008 @ 20:04 |
Linkki tähän viestiin
|
ComboFix 08-03-25.4 - Atte 2008-03-26 19:43:54.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.123 [GMT 2:00]
Running from: C:\Documents and Settings\Atte\Työpöytä\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
TimedOut: progfile.dat
-- Script messages for sUBs --
Findstr -MIF:/ "\\TTC\.pdb InsertAdvertisement"
GREP -Eisf temp00
VFind -tf -s282624 "C:\Program Files\????????*[0-9].dll"
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\ShoppingReport
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-02-26 to 2008-03-26 )))))))))))))))))
.
2008-03-26 19:06 . 2008-03-26 19:06 <KANSIO> d-------- C:\Program Files\TVUPlayer
2008-03-26 19:06 . 2008-03-26 19:06 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\TVU Networks
2008-03-26 13:24 . 2008-03-26 13:25 <KANSIO> d-ahs---- C:\WINDOWS\Repair
2008-03-26 13:07 . 2008-03-26 13:07 <KANSIO> d-------- C:\Program Files\XeroBank
2008-03-26 13:07 . 2008-03-26 13:07 <KANSIO> d-------- C:\Program Files\Runtime Software
2008-03-25 13:03 . 2002-11-02 09:53 57,344 --a------ C:\WINDOWS\system32\WNASPINT.DLL
2008-03-25 10:23 . 2008-03-25 11:39 <KANSIO> d-------- C:\Program Files\HalfLife2
2008-03-24 18:03 . 2008-03-24 18:03 <KANSIO> d-------- C:\Program Files\Lavasoft
2008-03-24 17:51 . 2008-03-24 17:51 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\ImgBurn
2008-03-24 00:07 . 2008-03-24 00:07 <KANSIO> d-------- C:\Program Files\MagicDisc
2008-03-24 00:07 . 2008-02-18 17:29 96,256 --a------ C:\WINDOWS\system32\drivers\mcdbus.sys
2008-03-23 19:28 . 2008-03-23 19:28 <KANSIO> d-------- C:\Program Files\DVD Decrypter
2008-03-23 15:29 . 2008-03-23 15:29 <KANSIO> d-------- C:\eJay
2008-03-23 13:25 . 2008-03-23 13:25 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-23 13:25 . 2008-03-23 13:25 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-22 19:36 . 2008-03-22 19:36 <KANSIO> d-------- C:\Documents and Settings\LocalService\Käynnistä-valikko
2008-03-22 17:22 . 2008-03-22 17:26 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\VersionTracker Pro
2008-03-22 15:54 . 2008-03-22 22:14 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Crystal Player
2008-03-22 15:47 . 2008-03-22 15:47 <KANSIO> d-------- C:\Program Files\TechTracker
2008-03-21 20:28 . 2008-03-21 20:28 <KANSIO> d-------- C:\Program Files\Eraser
2008-03-21 20:28 . 2008-03-21 20:28 <KANSIO> d--h----- C:\Documents and Settings\All Users\Application Data\{A25FEDC1-F6D7-440C-BCE2-B71F595F6646}
2008-03-21 20:12 . 2008-03-21 20:12 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\SUPERAntiSpyware.com
2008-03-21 20:08 . 2008-03-21 20:08 <KANSIO> d-------- C:\Program Files\Axon Data
2008-03-21 19:48 . 2008-03-21 19:48 <KANSIO> d-------- C:\Disney
2008-03-21 19:48 . 2008-03-23 09:30 626 --a------ C:\WINDOWS\7ThLevel.ini
2008-03-20 21:45 . 2008-03-20 22:41 <KANSIO> d-------- C:\eJay_se
2008-03-20 21:45 . 2008-03-20 22:41 118 --a------ C:\WINDOWS\eJay_se.inf
2008-03-20 21:35 . 2008-03-26 19:50 3,594,272 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-20 21:35 . 2008-03-26 16:46 41,852 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-20 21:31 . 2007-09-06 16:14 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-03-20 21:30 . 2007-09-06 16:14 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll
2008-03-20 21:30 . 2008-03-26 18:33 353,247 --a------ C:\WINDOWS\system32\vsconfig.xml
2008-03-20 19:52 . 2008-03-20 19:52 <KANSIO> d-------- C:\Program Files\Bluetack
2008-03-19 17:06 . 2008-03-19 17:06 25,736 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-03-19 16:55 . 2008-03-19 16:56 <KANSIO> d-------- C:\Program Files\Safari
2008-03-19 16:55 . 2008-03-19 16:55 <KANSIO> d-------- C:\Program Files\Bonjour
2008-03-17 12:21 . 2007-12-04 15:04 837,496 --a--c--- C:\WINDOWS\system32\aswBoot.exe
2008-03-17 12:21 . 2004-01-09 11:13 380,928 --a--c--- C:\WINDOWS\system32\actskin4.ocx
2008-03-17 12:21 . 2007-12-04 14:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-03-17 12:21 . 2007-12-04 16:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-03-17 12:21 . 2007-12-04 16:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-03-17 12:21 . 2007-12-04 16:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-03-17 12:21 . 2007-12-04 16:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-03-17 12:21 . 2007-12-04 16:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-03-15 14:50 . 2008-03-17 12:16 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-15 10:34 . 2008-03-15 10:34 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Grisoft
2008-03-15 10:34 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-11 18:08 . 2008-03-11 18:08 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
2008-03-11 18:08 . 2008-03-11 18:08 <KANSIO> d-------- C:\Program Files\Common Files\Nokia
2008-03-11 18:07 . 2008-03-11 18:07 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
2008-03-08 23:54 . 2008-03-08 23:54 <KANSIO> d-------- C:\Program Files\Microsoft XNA
2008-03-08 23:51 . 2008-03-08 23:51 <KANSIO> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-08 23:21 . 2008-03-08 23:31 <KANSIO> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-03-08 19:25 . 2008-03-09 20:07 <KANSIO> d-------- C:\Program Files\Netcraft Toolbar
2008-03-07 09:34 . 2008-03-15 14:40 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Comodo
2008-03-07 09:34 . 2008-03-15 14:26 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\comodo
2008-03-07 08:43 . 2008-03-07 08:43 <KANSIO> d-------- C:\Program Files\ToniArts
2008-03-06 21:19 . 2008-03-07 17:33 <KANSIO> d-------- C:\Program Files\Freeciv-2.1.1-gtk2
2008-03-06 21:17 . 2008-03-06 21:17 <KANSIO> d-------- C:\Program Files\SiSoftware
2008-03-06 17:36 . 2008-03-06 17:36 <KANSIO> d-------- C:\Program Files\Tall Emu
2008-03-06 17:36 . 2008-03-06 17:36 <KANSIO> d-------- C:\OnlineArmor
2008-03-05 17:03 . 2008-03-05 17:03 4,212 ---h----- C:\WINDOWS\system32\imlictbl.dat
2008-03-04 20:55 . 2008-03-04 20:55 <KANSIO> d-------- C:\Documents and Settings\NetworkService\Käynnistä-valikko
2008-03-03 16:48 . 2008-03-03 16:48 <KANSIO> d-------- C:\Program Files\Team MediaPortal
2008-03-03 14:53 . 2008-03-03 14:53 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Talkback
2008-03-02 20:21 . 2008-03-02 20:21 <KANSIO> d-------- C:\Documents and Settings\Atte\Incomplete
2008-03-02 20:21 . 2008-03-02 20:31 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\FrostWire
2008-03-02 20:20 . 2008-03-05 18:35 <KANSIO> d-------- C:\Program Files\FrostWire
2008-03-02 13:38 . 2008-03-02 13:38 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-03-01 19:18 . 2007-06-26 16:17 87,504 --a------ C:\WINDOWS\system32\drivers\csfpc.sys
2008-03-01 19:17 . 2008-03-01 19:22 <KANSIO> d-------- C:\Program Files\CE-Infosys
2008-03-01 19:17 . 2008-03-01 19:17 <KANSIO> d-------- C:\log data
2008-03-01 19:17 . 2008-03-01 19:17 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\CE-Infosys
2008-03-01 10:45 . 2008-03-01 10:45 <KANSIO> d-------- C:\Program Files\Innovative Solutions
2008-03-01 10:23 . 2008-03-01 10:24 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\TrueCrypt
2008-02-29 23:13 . 2008-02-29 23:13 <KANSIO> d-------- C:\Program Files\TrueCrypt
2008-02-29 23:13 . 2008-03-20 18:24 223,424 --a------ C:\WINDOWS\system32\drivers\truecrypt.sys
2008-02-29 22:02 . 2008-03-21 22:29 <KANSIO> d-------- C:\Program Files\SUPERAntiSpyware
2008-02-29 22:02 . 2008-02-29 22:02 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-02-29 20:25 . 2008-03-23 19:50 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
2008-02-29 20:19 . 2008-02-29 20:19 <KANSIO> d-------- C:\Program Files\ImgBurn
2008-02-29 20:19 . 2008-02-29 20:19 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\DAEMON Tools
2008-02-29 19:33 . 2008-02-29 19:37 <KANSIO> d-------- C:\Program Files\MediaCoder
2008-02-29 13:11 . 2008-02-29 13:11 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\F-Secure
2008-02-29 13:01 . 2008-03-06 15:15 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2008-02-29 13:00 . 2008-02-29 13:00 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\fssg
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-26 17:43 --------- d-----w C:\Documents and Settings\Atte\Application Data\BitTorrent
2008-03-26 16:35 --------- d-----w C:\Program Files\lg_fwupdate
2008-03-26 09:26 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-25 17:36 --------- d-----w C:\Program Files\DC++
2008-03-24 20:48 --------- d-----w C:\Program Files\EvilLyrics
2008-03-24 16:02 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-24 13:17 --------- d-----w C:\Documents and Settings\Atte\Application Data\uTorrent
2008-03-23 13:38 --------- d-----w C:\Documents and Settings\Atte\Application Data\Ahead
2008-03-23 13:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-23 13:23 --------- d-----w C:\Program Files\Google
2008-03-22 13:59 --------- d-----w C:\Documents and Settings\Atte\Application Data\OpenOffice.org2
2008-03-21 20:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-21 18:35 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-20 14:13 --------- d-----w C:\Program Files\Java
2008-03-19 15:18 --------- d-----w C:\Program Files\Winamp
2008-03-19 14:56 --------- d-----w C:\Documents and Settings\Atte\Application Data\Apple Computer
2008-03-15 19:57 --------- d-----w C:\Documents and Settings\Atte\Application Data\JDiskReport
2008-03-15 14:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-15 12:35 --------- d-----w C:\Program Files\Windows Live
2008-03-15 12:33 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-03-15 12:29 --------- d-----w C:\Program Files\Wolfenstein 3D
2008-03-15 08:50 --------- d-----w C:\Documents and Settings\Atte\Application Data\Skype
2008-03-15 08:44 --------- d-----w C:\Documents and Settings\Atte\Application Data\skypePM
2008-03-11 16:07 --------- d-----w C:\Program Files\Nokia
2008-03-09 18:09 --------- d-----w C:\Program Files\Opera 9.5 beta
2008-03-08 21:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-03-06 14:52 --------- d-----w C:\Program Files\Counter-Strike 1.6
2008-03-02 18:31 --------- d-----w C:\Documents and Settings\Atte\Application Data\Winamp
2008-02-29 18:20 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-25 16:00 --------- d-----w C:\Program Files\Wolfenstein - Enemy Territory
2008-02-24 19:03 --------- d-----w C:\Documents and Settings\Atte\Application Data\LaCie
2008-02-24 18:16 --------- d-----w C:\Program Files\LaCie
2008-02-24 12:38 --------- d-----w C:\Program Files\Winamp Remote
2008-02-24 12:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\OrbNetworks
2008-02-24 10:39 --------- d-----w C:\Program Files\Activision
2008-02-23 13:02 --------- d-----w C:\Program Files\Futuremark
2008-02-23 10:04 --------- d-----w C:\Program Files\TitanTV
2008-02-23 10:02 --------- d-----w C:\Program Files\Windows Media Components
2008-02-23 09:15 --------- d-----w C:\Program Files\VIA
2008-02-22 15:22 --------- d-----w C:\Program Files\Infogrames
2008-02-21 21:56 --------- d-----w C:\Documents and Settings\Atte\Application Data\SiteAdvisor
2008-02-21 11:27 --------- d-----w C:\Program Files\FDRLab
2008-02-21 11:22 --------- d-----w C:\Program Files\JGoodies
2008-02-20 22:15 --------- d-----w C:\Program Files\Burn4Free
2008-02-20 22:14 --------- d-----w C:\Program Files\Notepad X
2008-02-20 22:14 --------- d-----w C:\Documents and Settings\Atte\Application Data\Notepad X
2008-02-20 22:13 --------- d-----w C:\Documents and Settings\Atte\Application Data\FDRLab
2008-02-19 22:30 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-17 13:38 --------- d-----w C:\Program Files\YourWare Solutions
2008-02-15 09:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-14 12:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-02-14 12:18 --------- d-----w C:\Program Files\Zone Labs
2008-02-09 22:01 --------- d-----w C:\Program Files\SlySoft
2008-02-09 22:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\SlySoft
2008-02-09 18:37 --------- d-----w C:\Documents and Settings\Atte\Application Data\vlc
2008-02-09 18:34 --------- d-----w C:\Program Files\VideoLAN
2008-02-06 13:41 --------- d-----w C:\Documents and Settings\Atte\Application Data\Uniblue
2008-02-06 13:40 --------- d-----w C:\Program Files\Uniblue
2008-02-05 16:45 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-02-03 16:14 --------- d-----w C:\Documents and Settings\Atte\Application Data\dvdcss
2008-02-01 18:25 --------- d-----w C:\Program Files\QuickTime
2008-02-01 18:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-02-01 18:23 --------- d-----w C:\Program Files\Apple Software Update
2008-02-01 18:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-02-01 12:35 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-01-27 18:18 --------- d-----w C:\Program Files\Common Files\DirectX
2008-01-27 18:17 --------- d-----w C:\Program Files\directx
2008-01-27 18:10 --------- d-----w C:\Program Files\Warthog
2008-01-27 14:06 --------- d-----w C:\Program Files\uTorrent
2008-01-26 19:51 23,600 -c--a-w C:\WINDOWS\system32\drivers\TVICHW32.SYS
2008-01-26 19:48 --------- d-----w C:\Program Files\Lavalys
2008-01-26 19:08 --------- d-----w C:\Program Files\Blender Foundation
2008-01-26 18:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-01-26 17:53 --------- d-----w C:\Documents and Settings\Atte\Application Data\DAEMON Tools Pro
2008-01-26 16:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-26 11:51 --------- d-----w C:\Program Files\PhishGuard
2008-01-26 11:50 624 -csha-r C:\WINDOWS\system32\drivers\OP_CACHE.ATR
2008-01-26 11:50 312 -csha-r C:\WINDOWS\system32\drivers\OP_CACHE.IDX
2008-01-26 11:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\PhishGuard
2008-01-26 11:37 --------- d-----w C:\Program Files\Oca History Tool
2008-01-26 11:32 --------- d-----w C:\Program Files\Common Files\Skype
2008-01-26 11:11 --------- d-----w C:\Documents and Settings\Atte\Application Data\WinPatrol
2008-01-26 11:05 --------- d-----w C:\Documents and Settings\Atte\Application Data\AdobeUM
2008-01-26 11:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2008-01-26 11:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-01-26 11:02 --------- d-----w C:\Program Files\Alwil Software
2008-01-26 10:54 1,944 -csha-r C:\WINDOWS\Fonts\OP_CACHE.IDX
2008-01-26 10:50 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-01-26 10:50 --------- d-----w C:\Program Files\Paint.NET
2008-01-26 10:49 --------- d-----w C:\Program Files\GameSpy Arcade
2008-01-26 10:49 --------- d-----w C:\Program Files\EMCO Malware Destroyer
2008-01-26 10:49 --------- d-----w C:\Program Files\DNA
2008-01-26 10:49 --------- d-----w C:\Program Files\Darkeden
2008-01-26 10:49 --------- d-----w C:\Program Files\BitTorrent
2008-01-26 10:49 --------- d-----w C:\Program Files\BitComet
2008-01-26 10:49 --------- d-----w C:\Program Files\AvRack
2008-01-26 10:42 --------- d-----w C:\Program Files\McAfee.com
2008-01-26 10:36 --------- d-----w C:\Documents and Settings\Atte\Application Data\McAfee
2008-01-26 10:35 --------- d-----w C:\Documents and Settings\Atte\Application Data\Lavasoft
2008-01-25 16:05 32 -c--a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a33fa729-d155-4b23-842b-2c665ecabdb6}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 05:00 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2008-03-20 16:14 587568]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 14:42 212992]
"SoundMan"="SOUNDMAN.EXE" [2005-08-17 12:39 90112 C:\WINDOWS\SOUNDMAN.EXE]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 15:10 56928]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55 54832]
"LGODDFU"="C:\Program Files\lg_fwupdate\fwupdate.exe" [2008-01-11 00:47 249856]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14 919016]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 05:00 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38 39264]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\Win32\\RpcDataSrv.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\RpcSandraSrv.exe"=
"C:\\Program Files\\Freeciv-2.1.1-gtk2\\civserver.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8117:TCP"= 8117:TCP:BitComet 8117 TCP
"8117:UDP"= 8117:UDP:BitComet 8117 UDP
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 ViBus;ViBus;C:\WINDOWS\system32\DRIVERS\ViBus.sys [2007-12-07 11:13]
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2007-09-21 17:49]
R0 ViPrt;VIA SATA IDE Device Driver;C:\WINDOWS\system32\DRIVERS\ViPrt.sys [2007-12-07 11:10]
S3 0e46;0e46;C:\WINDOWS\system32\0e46.sys [2008-01-19 20:14]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [2005-08-18 00:00]
S3 FXDRV;FXDRV;D:\Fxdrv.sys []
S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-03-22 22:56]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-03-26 10:50:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-26 16:36:33 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 19:49:58
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\SiteAdvisor\6253\saHook.dll
.
Completion time: 2008-03-26 19:54:16
ComboFix-quarantined-files.txt 2008-03-26 17:54:07
.
2008-03-26 09:15:46 --- E O F ---
|
|
Hujo
Suspended permanently
|
26. maaliskuuta 2008 @ 20:16 |
Linkki tähän viestiin
|
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
Lainaus:
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a33fa729-d155-4b23-842b-2c665ecabdb6}]
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 26. maaliskuuta 2008 @ 20:17
|
Junior Member
2 tuotearviota
|
27. maaliskuuta 2008 @ 12:33 |
Linkki tähän viestiin
|
ComboFix 08-03-25.4 - Atte 2008-03-27 12:16:05.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.128 [GMT 2:00]
Running from: C:\Documents and Settings\Atte\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Atte\Työpöytä\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
TimedOut: progfile.dat
-- Script messages for sUBs --
Findstr -MIF:/ "\\TTC\.pdb InsertAdvertisement"
GREP -Eisf temp00
VFind -tf -s282624 "C:\Program Files\????????*[0-9].dll"
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-02-27 to 2008-03-27 )))))))))))))))))
.
2008-03-26 19:06 . 2008-03-26 21:55 <KANSIO> d-------- C:\Program Files\TVUPlayer
2008-03-26 19:06 . 2008-03-26 21:54 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\TVU Networks
2008-03-26 13:24 . 2008-03-26 13:25 <KANSIO> d-ahs---- C:\WINDOWS\Repair
2008-03-26 13:07 . 2008-03-26 13:07 <KANSIO> d-------- C:\Program Files\XeroBank
2008-03-26 13:07 . 2008-03-26 13:07 <KANSIO> d-------- C:\Program Files\Runtime Software
2008-03-25 13:03 . 2002-11-02 09:53 57,344 --a------ C:\WINDOWS\system32\WNASPINT.DLL
2008-03-25 10:23 . 2008-03-25 11:39 <KANSIO> d-------- C:\Program Files\HalfLife2
2008-03-24 18:03 . 2008-03-24 18:03 <KANSIO> d-------- C:\Program Files\Lavasoft
2008-03-24 17:51 . 2008-03-24 17:51 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\ImgBurn
2008-03-24 00:07 . 2008-03-24 00:07 <KANSIO> d-------- C:\Program Files\MagicDisc
2008-03-24 00:07 . 2008-02-18 17:29 96,256 --a------ C:\WINDOWS\system32\drivers\mcdbus.sys
2008-03-23 19:28 . 2008-03-23 19:28 <KANSIO> d-------- C:\Program Files\DVD Decrypter
2008-03-23 15:29 . 2008-03-23 15:29 <KANSIO> d-------- C:\eJay
2008-03-23 13:25 . 2008-03-23 13:25 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-23 13:25 . 2008-03-23 13:25 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-22 19:36 . 2008-03-22 19:36 <KANSIO> d-------- C:\Documents and Settings\LocalService\Käynnistä-valikko
2008-03-22 17:22 . 2008-03-22 17:26 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\VersionTracker Pro
2008-03-22 15:54 . 2008-03-22 22:14 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Crystal Player
2008-03-22 15:47 . 2008-03-22 15:47 <KANSIO> d-------- C:\Program Files\TechTracker
2008-03-21 20:28 . 2008-03-21 20:28 <KANSIO> d-------- C:\Program Files\Eraser
2008-03-21 20:28 . 2008-03-21 20:28 <KANSIO> d--h----- C:\Documents and Settings\All Users\Application Data\{A25FEDC1-F6D7-440C-BCE2-B71F595F6646}
2008-03-21 20:12 . 2008-03-21 20:12 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\SUPERAntiSpyware.com
2008-03-21 20:08 . 2008-03-21 20:08 <KANSIO> d-------- C:\Program Files\Axon Data
2008-03-21 19:48 . 2008-03-21 19:48 <KANSIO> d-------- C:\Disney
2008-03-21 19:48 . 2008-03-23 09:30 626 --a------ C:\WINDOWS\7ThLevel.ini
2008-03-20 21:45 . 2008-03-20 22:41 <KANSIO> d-------- C:\eJay_se
2008-03-20 21:45 . 2008-03-20 22:41 118 --a------ C:\WINDOWS\eJay_se.inf
2008-03-20 21:35 . 2008-03-27 12:21 3,969,056 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-20 21:35 . 2008-03-26 23:37 46,196 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-20 21:31 . 2007-09-06 16:14 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-03-20 21:30 . 2007-09-06 16:14 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll
2008-03-20 21:30 . 2008-03-27 09:48 353,247 --a------ C:\WINDOWS\system32\vsconfig.xml
2008-03-20 19:52 . 2008-03-20 19:52 <KANSIO> d-------- C:\Program Files\Bluetack
2008-03-19 17:06 . 2008-03-19 17:06 25,736 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-03-19 16:55 . 2008-03-19 16:56 <KANSIO> d-------- C:\Program Files\Safari
2008-03-19 16:55 . 2008-03-19 16:55 <KANSIO> d-------- C:\Program Files\Bonjour
2008-03-17 12:21 . 2007-12-04 15:04 837,496 --a--c--- C:\WINDOWS\system32\aswBoot.exe
2008-03-17 12:21 . 2004-01-09 11:13 380,928 --a--c--- C:\WINDOWS\system32\actskin4.ocx
2008-03-17 12:21 . 2007-12-04 14:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-03-17 12:21 . 2007-12-04 16:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-03-17 12:21 . 2007-12-04 16:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-03-17 12:21 . 2007-12-04 16:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-03-17 12:21 . 2007-12-04 16:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-03-17 12:21 . 2007-12-04 16:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-03-15 14:50 . 2008-03-17 12:16 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-15 10:34 . 2008-03-15 10:34 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Grisoft
2008-03-15 10:34 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-11 18:08 . 2008-03-11 18:08 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
2008-03-11 18:08 . 2008-03-11 18:08 <KANSIO> d-------- C:\Program Files\Common Files\Nokia
2008-03-11 18:07 . 2008-03-11 18:07 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
2008-03-08 23:54 . 2008-03-08 23:54 <KANSIO> d-------- C:\Program Files\Microsoft XNA
2008-03-08 23:51 . 2008-03-08 23:51 <KANSIO> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-08 23:21 . 2008-03-08 23:31 <KANSIO> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-03-08 19:25 . 2008-03-09 20:07 <KANSIO> d-------- C:\Program Files\Netcraft Toolbar
2008-03-07 09:34 . 2008-03-15 14:40 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Comodo
2008-03-07 09:34 . 2008-03-15 14:26 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\comodo
2008-03-07 08:43 . 2008-03-07 08:43 <KANSIO> d-------- C:\Program Files\ToniArts
2008-03-06 21:19 . 2008-03-07 17:33 <KANSIO> d-------- C:\Program Files\Freeciv-2.1.1-gtk2
2008-03-06 21:17 . 2008-03-06 21:17 <KANSIO> d-------- C:\Program Files\SiSoftware
2008-03-06 17:36 . 2008-03-06 17:36 <KANSIO> d-------- C:\Program Files\Tall Emu
2008-03-06 17:36 . 2008-03-06 17:36 <KANSIO> d-------- C:\OnlineArmor
2008-03-05 17:03 . 2008-03-05 17:03 4,212 ---h----- C:\WINDOWS\system32\imlictbl.dat
2008-03-04 20:55 . 2008-03-04 20:55 <KANSIO> d-------- C:\Documents and Settings\NetworkService\Käynnistä-valikko
2008-03-03 16:48 . 2008-03-03 16:48 <KANSIO> d-------- C:\Program Files\Team MediaPortal
2008-03-03 14:53 . 2008-03-03 14:53 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\Talkback
2008-03-02 20:21 . 2008-03-02 20:21 <KANSIO> d-------- C:\Documents and Settings\Atte\Incomplete
2008-03-02 20:21 . 2008-03-02 20:31 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\FrostWire
2008-03-02 20:20 . 2008-03-05 18:35 <KANSIO> d-------- C:\Program Files\FrostWire
2008-03-02 13:38 . 2008-03-02 13:38 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-03-01 19:18 . 2007-06-26 16:17 87,504 --a------ C:\WINDOWS\system32\drivers\csfpc.sys
2008-03-01 19:17 . 2008-03-01 19:22 <KANSIO> d-------- C:\Program Files\CE-Infosys
2008-03-01 19:17 . 2008-03-01 19:17 <KANSIO> d-------- C:\log data
2008-03-01 19:17 . 2008-03-01 19:17 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\CE-Infosys
2008-03-01 10:45 . 2008-03-01 10:45 <KANSIO> d-------- C:\Program Files\Innovative Solutions
2008-03-01 10:23 . 2008-03-01 10:24 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\TrueCrypt
2008-02-29 23:13 . 2008-02-29 23:13 <KANSIO> d-------- C:\Program Files\TrueCrypt
2008-02-29 23:13 . 2008-03-20 18:24 223,424 --a------ C:\WINDOWS\system32\drivers\truecrypt.sys
2008-02-29 22:02 . 2008-03-21 22:29 <KANSIO> d-------- C:\Program Files\SUPERAntiSpyware
2008-02-29 22:02 . 2008-02-29 22:02 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-02-29 20:25 . 2008-03-23 19:50 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
2008-02-29 20:19 . 2008-02-29 20:19 <KANSIO> d-------- C:\Program Files\ImgBurn
2008-02-29 20:19 . 2008-02-29 20:19 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\DAEMON Tools
2008-02-29 19:33 . 2008-02-29 19:37 <KANSIO> d-------- C:\Program Files\MediaCoder
2008-02-29 13:11 . 2008-02-29 13:11 <KANSIO> d-------- C:\Documents and Settings\Atte\Application Data\F-Secure
2008-02-29 13:01 . 2008-03-06 15:15 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2008-02-29 13:00 . 2008-02-29 13:00 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\fssg
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-27 10:20 --------- d-----w C:\Documents and Settings\Atte\Application Data\BitTorrent
2008-03-27 08:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-27 07:50 --------- d-----w C:\Program Files\lg_fwupdate
2008-03-26 21:14 --------- d-----w C:\Program Files\DC++
2008-03-26 09:27 453,120 ----a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2008-03-26 09:27 1,380,352 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp
2008-03-26 09:26 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-25 10:15 98,304 -c--a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-03-24 20:48 --------- d-----w C:\Program Files\EvilLyrics
2008-03-24 16:02 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-24 13:17 --------- d-----w C:\Documents and Settings\Atte\Application Data\uTorrent
2008-03-23 13:38 --------- d-----w C:\Documents and Settings\Atte\Application Data\Ahead
2008-03-23 13:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-23 13:23 --------- d-----w C:\Program Files\Google
2008-03-23 12:33 267,776 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2008-03-23 12:33 1,361,920 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2008-03-22 13:59 --------- d-----w C:\Documents and Settings\Atte\Application Data\OpenOffice.org2
2008-03-21 22:11 173,568 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-03-21 22:11 1,347,072 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-03-21 18:35 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-21 10:07 1,918,464 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-03-21 10:07 1,325,056 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-03-20 21:11 1,396,224 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-03-20 21:11 1,323,008 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-03-20 14:13 --------- d-----w C:\Program Files\Java
2008-03-19 15:18 --------- d-----w C:\Program Files\Winamp
2008-03-19 14:56 --------- d-----w C:\Documents and Settings\Atte\Application Data\Apple Computer
2008-03-15 19:57 --------- d-----w C:\Documents and Settings\Atte\Application Data\JDiskReport
2008-03-15 14:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-15 12:35 --------- d-----w C:\Program Files\Windows Live
2008-03-15 12:33 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-03-15 12:29 --------- d-----w C:\Program Files\Wolfenstein 3D
2008-03-15 08:50 --------- d-----w C:\Documents and Settings\Atte\Application Data\Skype
2008-03-15 08:44 --------- d-----w C:\Documents and Settings\Atte\Application Data\skypePM
2008-03-11 16:07 --------- d-----w C:\Program Files\Nokia
2008-03-09 18:09 --------- d-----w C:\Program Files\Opera 9.5 beta
2008-03-08 21:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-03-06 14:52 --------- d-----w C:\Program Files\Counter-Strike 1.6
2008-03-02 18:31 --------- d-----w C:\Documents and Settings\Atte\Application Data\Winamp
2008-02-29 18:20 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-25 16:00 --------- d-----w C:\Program Files\Wolfenstein - Enemy Territory
2008-02-24 19:03 --------- d-----w C:\Documents and Settings\Atte\Application Data\LaCie
2008-02-24 18:16 --------- d-----w C:\Program Files\LaCie
2008-02-24 12:38 --------- d-----w C:\Program Files\Winamp Remote
2008-02-24 12:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\OrbNetworks
2008-02-24 10:39 --------- d-----w C:\Program Files\Activision
2008-02-23 13:02 --------- d-----w C:\Program Files\Futuremark
2008-02-23 10:04 --------- d-----w C:\Program Files\TitanTV
2008-02-23 10:02 --------- d-----w C:\Program Files\Windows Media Components
2008-02-23 09:15 --------- d-----w C:\Program Files\VIA
2008-02-22 15:22 --------- d-----w C:\Program Files\Infogrames
2008-02-21 21:56 --------- d-----w C:\Documents and Settings\Atte\Application Data\SiteAdvisor
2008-02-21 11:27 --------- d-----w C:\Program Files\FDRLab
2008-02-21 11:22 --------- d-----w C:\Program Files\JGoodies
2008-02-20 22:15 --------- d-----w C:\Program Files\Burn4Free
2008-02-20 22:14 --------- d-----w C:\Program Files\Notepad X
2008-02-20 22:14 --------- d-----w C:\Documents and Settings\Atte\Application Data\Notepad X
2008-02-20 22:13 --------- d-----w C:\Documents and Settings\Atte\Application Data\FDRLab
2008-02-20 20:21 29,395 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_02_20_22_18_12_small.dmp.zip
2008-02-19 22:30 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-17 13:38 --------- d-----w C:\Program Files\YourWare Solutions
2008-02-15 09:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-14 12:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-02-14 12:18 --------- d-----w C:\Program Files\Zone Labs
2008-02-09 22:01 --------- d-----w C:\Program Files\SlySoft
2008-02-09 22:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\SlySoft
2008-02-09 18:37 --------- d-----w C:\Documents and Settings\Atte\Application Data\vlc
2008-02-09 18:34 --------- d-----w C:\Program Files\VideoLAN
2008-02-06 13:41 --------- d-----w C:\Documents and Settings\Atte\Application Data\Uniblue
2008-02-06 13:40 --------- d-----w C:\Program Files\Uniblue
2008-02-05 16:45 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-02-03 16:14 --------- d-----w C:\Documents and Settings\Atte\Application Data\dvdcss
2008-02-01 18:25 --------- d-----w C:\Program Files\QuickTime
2008-02-01 18:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-02-01 18:23 --------- d-----w C:\Program Files\Apple Software Update
2008-02-01 18:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-02-01 12:35 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-01-27 18:18 --------- d-----w C:\Program Files\Common Files\DirectX
2008-01-27 18:17 21,840 -c--a-w C:\WINDOWS\system32\SIntfNT.dll
2008-01-27 18:17 17,212 -c--a-w C:\WINDOWS\system32\SIntf32.dll
2008-01-27 18:17 12,067 -c--a-w C:\WINDOWS\system32\SIntf16.dll
2008-01-27 18:17 --------- d-----w C:\Program Files\directx
2008-01-27 18:10 --------- d-----w C:\Program Files\Warthog
2008-01-27 14:06 --------- d-----w C:\Program Files\uTorrent
2008-01-26 10:54 1,944 -csha-r C:\WINDOWS\Fonts\OP_CACHE.IDX
2008-01-25 16:05 32 -c--a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-19 18:14 185,824 -c--a-w C:\WINDOWS\system32\0e46.sys
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 05:00 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2008-03-20 16:14 587568]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 14:42 212992]
"SoundMan"="SOUNDMAN.EXE" [2005-08-17 12:39 90112 C:\WINDOWS\SOUNDMAN.EXE]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 15:10 56928]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55 54832]
"LGODDFU"="C:\Program Files\lg_fwupdate\fwupdate.exe" [2008-01-11 00:47 249856]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14 919016]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 05:00 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38 39264]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\Win32\\RpcDataSrv.exe"=
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XIIc\\RpcSandraSrv.exe"=
"C:\\Program Files\\Freeciv-2.1.1-gtk2\\civserver.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8117:TCP"= 8117:TCP:BitComet 8117 TCP
"8117:UDP"= 8117:UDP:BitComet 8117 UDP
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 ViBus;ViBus;C:\WINDOWS\system32\DRIVERS\ViBus.sys [2007-12-07 11:13]
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2007-09-21 17:49]
R0 ViPrt;VIA SATA IDE Device Driver;C:\WINDOWS\system32\DRIVERS\ViPrt.sys [2007-12-07 11:10]
S3 0e46;0e46;C:\WINDOWS\system32\0e46.sys [2008-01-19 20:14]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [2005-08-18 00:00]
S3 FXDRV;FXDRV;D:\Fxdrv.sys []
S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-03-22 22:56]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-03-26 10:50:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-27 07:51:54 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-27 12:21:51
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\SiteAdvisor\6253\saHook.dll
.
Completion time: 2008-03-27 12:26:08
ComboFix-quarantined-files.txt 2008-03-27 10:26:01
ComboFix2.txt 2008-03-26 17:54:17
.
2008-03-26 09:15:46 --- E O F ---
|
|
Hujo
Suspended permanently
|
27. maaliskuuta 2008 @ 13:40 |
Linkki tähän viestiin
|
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
============
scannaa uusi hjt:n loki
Voiko tietsikka koskaan toimia?
|
Junior Member
2 tuotearviota
|
27. maaliskuuta 2008 @ 16:32 |
Linkki tähän viestiin
|
Malwarebytes' Anti-Malware 1.09
Tietokantaversio: 552
Tarkistustyyppi: Täysi tarkistus (C:\|G:\|)
Tarkistetut kohteet: 169673
Kulunut aika: 1 hour(s), 26 minute(s), 33 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 1
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 1
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
HKEY_CLASSES_ROOT\CLSID\{c4ee31f3-4768-11d2-be5c-00a0c9a83da1} (Rogue.WinFixer) -> Quarantined and deleted successfully.
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
C:\Documents and Settings\Atte\Työpöytä\ohjelmia\Uusi kansio\Uusi kansio (3)\English_Free_CompuSec\English_Free_CompuSec\compusec installation\installation container\sqlite3.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:31:41, on 27.3.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - .DEFAULT User Startup: OP_CACHE.ATR (User 'Default user')
O4 - .DEFAULT User Startup: OP_CACHE.IDX (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SiteAdvisor-palvelu (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 9788 bytes
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
27. maaliskuuta 2008 @ 16:55 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
|
|
