|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Logi kunnossa?
|
|
Junior Member
|
9. huhtikuuta 2008 @ 13:48 |
Linkki tähän viestiin
|
Vainoharhaisuus iski, voisko joku kattella login läpi?
Työpöydälle tullu muutaman kerran itsestään "new folder" ilman mitää syytä...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:43:27, on 9.4.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [C6501Sound] RunDll32 c6501.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 9. huhtikuuta 2008 @ 13:58
|
|
Hujo
Suspended permanently
|
9. huhtikuuta 2008 @ 14:24 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
|
Junior Member
|
9. huhtikuuta 2008 @ 17:18 |
Linkki tähän viestiin
|
|
Muuten puhdasta näyttää mutta seuraava errori tulee:
Wed Apr 09 17:17:03 2008 => ***** Scanning Service Files *****
Wed Apr 09 17:17:03 2008 => Scanning HKLM\SYSTEM\CurrentControlSet\Services
Wed Apr 09 17:17:03 2008 => ERROR!!! Invalid Entry \??\C:\DOCUME~1\*käyttäjä*\LOCALS~1\Temp\catchme.sys in SYSTEM\CurrentControlSet\Services\catchme...
Wed Apr 09 17:17:07 2008 => ERROR!!! ScanFile Fails...
mikälie toi?
|
|
Hujo
Suspended permanently
|
9. huhtikuuta 2008 @ 17:21 |
Linkki tähän viestiin
|
|
noita tulee erroreita ohjelmien laitto ja sitten sen poisto eipä vaaralista
Voiko tietsikka koskaan toimia?
|
Junior Member
|
9. huhtikuuta 2008 @ 17:35 |
Linkki tähän viestiin
|
|
Eli kyseinen, mikälie catchme.sys ei pitäs olla vaarallinen?
|
|
Hujo
Suspended permanently
|
9. huhtikuuta 2008 @ 17:41 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Voiko tietsikka koskaan toimia?
|
Junior Member
|
9. huhtikuuta 2008 @ 18:01 |
Linkki tähän viestiin
|
ComboFix 08-04-08.10 - Kimmo 2008-04-09 17:54:49.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1311 [GMT 3:00]
Running from: C:\Documents and Settings\Kimmo\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-03-09 to 2008-04-09 )))))))))))))))))))))))))))))))
.
2008-04-09 17:40 . 2008-04-09 17:40 <DIR> d-------- C:\Documents and Settings\Kimmo\DoctorWeb
2008-04-09 17:05 . 2008-04-09 17:05 0 --a------ C:\23990098.$$$
2008-04-09 14:52 . 2008-04-09 14:52 <DIR> d-------- C:\WINDOWS\Sun
2008-04-09 14:41 . 2008-04-09 14:47 <DIR> d-------- C:\Downloads
2008-04-09 14:39 . 2008-04-09 14:47 <DIR> d-------- C:\Kaspersky
2008-04-09 14:37 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-04-09 14:34 . 2008-04-09 14:37 <DIR> d-------- C:\Program Files\Java
2008-04-09 14:33 . 2008-04-09 14:33 <DIR> d-------- C:\Program Files\Common Files\Java
2008-04-09 13:56 . 2008-04-09 13:56 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-04-09 13:56 . 2008-04-09 14:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-09 13:32 . 2008-04-09 13:32 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-09 13:29 . 2008-04-09 13:29 <DIR> d-------- C:\VundoFix Backups
2008-04-09 13:13 . 2008-04-09 13:13 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-09 13:03 . 2008-04-09 13:10 1,905 --a------ C:\WINDOWS\diagwrn.xml
2008-04-09 13:03 . 2008-04-09 13:10 1,905 --a------ C:\WINDOWS\diagerr.xml
2008-04-09 08:35 . 2008-04-09 08:36 1,355 --a------ C:\WINDOWS\imsins.BAK
2008-04-07 12:43 . 1996-07-25 16:13 295,424 --a------ C:\WINDOWS\unin0411.exe
2008-04-07 12:42 . 2008-04-07 12:42 <DIR> d-------- C:\Documents and Settings\Kimmo\WINDOWS
2008-04-06 11:17 . 2008-04-09 16:56 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-06 11:17 . 2008-04-06 11:17 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-05 22:51 . 2008-03-29 20:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-05 22:51 . 2008-03-29 20:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-04-03 14:58 . 2004-08-04 00:56 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-04-03 14:58 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-04-03 14:58 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-04-03 14:58 . 2001-08-17 22:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-04-03 12:15 . 2008-04-03 12:15 461 --a------ C:\WINDOWS\EAGRAPH.INI
2008-04-03 02:26 . 2008-04-03 02:26 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-04-02 17:29 . 2008-04-02 17:29 <DIR> d-------- C:\Programme
2008-04-01 13:44 . 2001-11-23 12:08 712,704 --a------ C:\WINDOWS\system32\c6501a3d.dll
2008-04-01 13:44 . 2001-11-23 12:08 712,704 --a------ C:\WINDOWS\system32\a3d.dll
2008-04-01 13:44 . 2006-06-27 14:54 32,768 --a------ C:\WINDOWS\system32\c6501p.dll
2008-04-01 13:44 . 2008-04-01 13:53 479 --a------ C:\WINDOWS\system\C6501.ini
2008-03-30 21:32 . 2008-03-30 21:32 <DIR> d-------- C:\Documents and Settings\Kimmo\Application Data\IrfanView
2008-03-25 11:55 . 2008-03-25 11:55 764,416 --a------ C:\WINDOWS\GPInstall.exe
2008-03-24 21:19 . 2008-03-24 21:19 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Xfire
2008-03-24 12:35 . 2008-03-24 12:35 12,666 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-03-24 11:52 . 2008-03-24 11:54 <DIR> d-------- C:\Program Files\Natural Mod
2008-03-20 21:09 . 2008-03-20 21:09 <DIR> d-------- C:\Program Files\Activision
2008-03-20 20:33 . 2008-03-20 21:21 319 --a------ C:\WINDOWS\game.ini
2008-03-20 20:20 . 2008-03-20 20:20 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-03-20 20:19 . 2008-03-20 20:33 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-03-20 01:41 . 2008-03-20 01:41 <DIR> d--h----- C:\WINDOWS\PIF
2008-03-19 16:52 . 2001-08-17 14:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-03-19 16:52 . 2001-08-17 14:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-03-19 16:52 . 2001-08-17 15:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-03-19 16:52 . 2001-08-17 15:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-03-19 13:15 . 2008-03-19 13:15 <DIR> d--hs---- C:\Documents and Settings\Kimmo\Phone Browser
2008-03-18 15:07 . 2008-03-18 16:34 <DIR> d-------- C:\Documents and Settings\Kimmo\Application Data\uTorrent
2008-03-17 22:23 . 2008-03-17 22:23 <DIR> d-------- C:\Program Files\DIFX
2008-03-17 22:23 . 2008-03-17 22:23 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-03-17 22:23 . 2008-03-17 22:25 <DIR> d-------- C:\Documents and Settings\Kimmo\Application Data\Nokia
2008-03-17 22:23 . 2008-03-17 22:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2008-03-17 22:22 . 2008-03-17 22:22 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-03-17 22:22 . 2008-03-17 22:23 <DIR> d-------- C:\Documents and Settings\Kimmo\Application Data\PC Suite
2008-03-17 22:22 . 2008-03-17 22:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-03-17 22:14 . 2008-03-17 22:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nokia
2008-03-17 22:14 . 2007-02-22 11:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2008-03-17 22:14 . 2007-02-22 11:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-03-17 22:14 . 2007-02-22 11:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-03-17 22:14 . 2007-02-22 11:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-03-17 22:14 . 2007-02-22 11:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys
2008-03-17 22:14 . 2007-02-22 11:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2008-03-17 22:13 . 2008-03-20 01:38 <DIR> d-------- C:\Program Files\Nokia
2008-03-17 22:13 . 2008-03-20 01:38 <DIR> d-------- C:\Program Files\Common Files\Nokia
2008-03-17 22:13 . 2008-03-17 22:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations
2008-03-10 22:45 . 2008-03-10 22:45 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Xfire
2008-03-10 22:26 . 2008-03-10 22:26 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2008-03-10 22:26 . 2008-03-10 22:26 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb
2008-03-10 16:15 . 2008-03-10 22:26 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-03-10 16:13 . 2008-03-17 22:26 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-03-10 15:49 . 2008-03-20 01:43 <DIR> d-------- C:\Program Files\FMOD SoundSystem
2008-03-10 13:50 . 2008-03-20 01:35 <DIR> d-------- C:\Program Files\DivX
2008-03-10 12:16 . 2008-03-10 12:16 <DIR> d-------- C:\Program Files\NVIDIA Corporation
2008-03-10 12:16 . 2007-11-01 18:23 499,712 --a------ C:\WINDOWS\system32\msvcc102.rra
2008-03-10 12:16 . 2007-11-01 18:23 348,160 --a------ C:\WINDOWS\system32\msvcc6ce.rra
2008-03-10 12:16 . 2008-03-10 12:15 151,552 --a------ C:\WINDOWS\system32\nvRegDev.dll
2008-03-10 11:56 . 2008-03-10 11:56 <DIR> d-------- C:\Program Files\IrfanView
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-09 09:49 --------- d-----w C:\Program Files\Xfire
2008-04-08 19:19 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\Xfire
2008-04-07 15:44 --------- d-----w C:\Program Files\Euroword2004
2008-04-01 10:44 --------- d-----w C:\Program Files\C-Media 6501 Sound
2008-03-29 17:45 1,146,232 ----a-w C:\WINDOWS\system32\aswBoot.exe
2008-03-29 17:35 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2008-03-29 17:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2008-03-29 17:27 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2008-03-29 17:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2008-03-29 17:23 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2008-03-28 07:23 85,752 ----a-w C:\WINDOWS\system32\drivers\cmdGuard.sys
2008-03-27 15:44 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-20 20:55 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-03-20 20:55 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-03-20 20:38 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-20 18:25 22,328 ----a-w C:\Documents and Settings\Kimmo\Application Data\PnkBstrK.sys
2008-03-19 22:38 --------- d-----w C:\Program Files\Hewlett-Packard
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-18 16:44 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-03-18 14:22 --------- d-----w C:\Program Files\Electronic Arts
2008-03-14 22:06 23,800 ----a-w C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-03-14 22:06 139,008 ----a-w C:\WINDOWS\system32\guard32.dll
2008-03-09 08:16 --------- d-----w C:\Program Files\Bonjour
2008-03-08 11:35 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-08 10:17 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\Winamp
2008-03-07 09:41 --------- d-----w C:\Program Files\AMD
2008-03-07 08:50 --------- d-----w C:\Program Files\HP
2008-03-05 13:31 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\Apple Computer
2008-03-05 13:29 --------- d-----w C:\Program Files\QuickTime
2008-03-05 13:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-04 19:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-03-04 19:07 --------- d-----w C:\Program Files\GIMP-2.0
2008-03-04 18:55 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-04 18:53 --------- d-----w C:\Program Files\Common Files\Control Panels
2008-03-04 18:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\ALM
2008-03-04 18:26 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-03-04 17:42 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-03-04 17:15 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\gtk-2.0
2008-03-04 08:50 --------- d-----w C:\Program Files\GoldWave
2008-03-01 09:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-02-29 19:40 --------- d-----w C:\Program Files\Codec Pack - All In 1
2008-02-29 19:37 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-02-29 19:34 --------- d-----w C:\Program Files\Webteh
2008-02-29 19:14 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-29 15:50 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\fretsonfire
2008-02-28 19:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\MsvThumbs
2008-02-28 19:14 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-02-28 19:14 389,120 ------w C:\WINDOWS\Setup1.exe
2008-02-28 17:29 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-02-28 17:29 262,144 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-02-28 17:28 --------- d-----w C:\Program Files\Futuremark
2008-02-26 21:56 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\InstallShield
2008-02-26 21:43 --------- d-----w C:\Program Files\AGEIA Technologies
2008-02-26 21:42 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-26 19:27 --------- d-----w C:\Program Files\CCleaner
2008-02-22 17:24 --------- d-----w C:\Program Files\MSXML 6.0
2008-02-22 12:51 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\Ahead
2008-02-22 11:03 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\Audacity
2008-02-22 07:21 --------- d-----w C:\Program Files\MSBuild
2008-02-22 07:18 --------- d-----w C:\Program Files\Reference Assemblies
2008-02-21 19:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\comodo
2008-02-21 19:43 --------- d-----w C:\Program Files\COMODO
2008-02-21 19:42 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\Comodo
2008-02-21 19:38 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\Grisoft
2008-02-21 19:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-21 18:07 --------- d-----w C:\Program Files\Windows Live
2008-02-21 18:05 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-21 18:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-21 17:51 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\AdobeUM
2008-02-21 17:46 --------- d-----w C:\Program Files\Microsoft.NET
2008-02-21 17:12 --------- d-----w C:\Program Files\MSXML 4.0
2008-02-21 15:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\LightScribe
2008-02-21 15:19 --------- d-----w C:\Program Files\Alwil Software
2008-02-21 15:15 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-02-21 15:15 --------- d-----w C:\Program Files\Common Files\Ahead
2008-02-21 15:13 --------- d-----w C:\Program Files\Nero
2008-02-21 15:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-02-21 15:01 --------- d-----w C:\Documents and Settings\Kimmo\Application Data\DAEMON Tools
2008-02-21 14:48 --------- d-----w C:\Program Files\Winamp
2008-02-21 14:15 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-16 08:59 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:56 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-01-17 19:51 486856]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C6501Sound"="c6501.cpl" []
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 20:37 79224]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-03-15 01:05 1503488]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]
"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 12:06 77824]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 10:56 15360]
"PcSync"="D:\Ohjelmat\PC Suite\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 18:15 1634304]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"D:\\Pelit\\Crysis\\Bin32\\Crysis.exe"=
"D:\\Pelit\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"D:\\Pelit\\World in Conflict\\wic.exe"=
"D:\\Pelit\\World in Conflict\\wic_ds.exe"=
"D:\\Pelit\\World in Conflict\\wic_online.exe"=
"D:\\Pelit\\HL2\\SteamApps\\kimpley\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"D:\\Pelit\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 20:31]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-03-28 10:23]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-03-15 01:06]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 20:35]
R3 c65013264;C-Media CM6501 Like Sound UDAX Interface;C:\WINDOWS\system32\drivers\c6501.sys [2007-01-25 15:18]
S3 zlportio;zlportio;G:\Games\UltraStar Deluxe\zlportio.sys []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca6787c3-e08f-11dc-ae54-806d6172696f}]
\Shell\AutoRun\command - F:\Bin\Assetup.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-09 17:57:40
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\guard32.dll
PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\guard32.dll
.
Completion time: 2008-04-09 17:57:57
ComboFix-quarantined-files.txt 2008-04-09 14:57:40
Pre-Run: 82,278,780,928 bytes free
Post-Run: 82,277,830,656 bytes free
.
2008-04-09 05:36:47 --- E O F ---
|
Junior Member
|
9. huhtikuuta 2008 @ 18:06 |
Linkki tähän viestiin
|
|
Eli tämä catchme olis vissiin malware tunnistin softa / osa softaa?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 9. huhtikuuta 2008 @ 18:06
|
|
Hujo
Suspended permanently
|
9. huhtikuuta 2008 @ 18:25 |
Linkki tähän viestiin
|
aja tuosta
Lataa: RegSeeker.zip työpöydälle:
Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman.
Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen.
Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri
Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken).
Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta
klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin.
Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet
Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK".
Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK".
Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen.
Voiko tietsikka koskaan toimia?
|
Junior Member
|
9. huhtikuuta 2008 @ 18:45 |
Linkki tähän viestiin
|
|
Ok, tehty on.
|
|
Hujo
Suspended permanently
|
9. huhtikuuta 2008 @ 19:27 |
Linkki tähän viestiin
|
|
ok hyvinkös vörkkii.
Voiko tietsikka koskaan toimia?
|
|
Mainos
|
|
|
Junior Member
|
9. huhtikuuta 2008 @ 19:30 |
Linkki tähän viestiin
|
Joo kyllä toi tuntu piristävän konetta ku sai vedettyä koko prosessin läpi. Vedin vielä AVG antispywaret ja Avastin eikä nekään mitään löytäneet... pakko kai se on uskoa et kone on kohtuu puhdas :D
Kiitosta paljon nopeista vastauksista!
|
|
