|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Kone takkuaa + hjt
|
|
Senior Member
5 tuotearviota
|
21. huhtikuuta 2008 @ 12:18 |
Linkki tähän viestiin
|
Kyseessä pari kk vanha läppis & vista.
Vähän aikaa sitten tuli sp1 tähän vistaan ja kone asensi sen automaattisesti, sen jälkeen takkuillu. Oli tässä joku viruskin, mutta ilmeisesti avast blokkasi sen ja avg poisti jäämät siitä.
Lokia seuraksi;
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:13:35, on 21.4.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\jakke\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fi.intl.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll (file missing)
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O13 - Gopher Prefix:
O20 - AppInit_DLLs: eNetHook.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\Asennustiedostot\Adaware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Asennustiedostot\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Oz128 Driver\o2flash.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
AMD FX-8320, AM3+, 3.5GHz, 8-core | Kingston HyperX 2x4GB, DDR3 1600MHz | Samsung F3 500GB | Asus M5A97 EVO R2.0, AM3+, AMD 970, DDR3, ATX | AMD Radeon HD 7750 | XFX 450W | Windows 7 Ultimate 64
Acer TM5520 Vista
Acer 7736ZG Windows 7
Samsung Note 4G
XBOX360 Elite 120Gb
|
|
Hujo
Suspended permanently
|
21. huhtikuuta 2008 @ 16:41 |
Linkki tähän viestiin
|
scannaa hjt:llä merkkaa paina Fix checked
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
==============
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
============
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
Voiko tietsikka koskaan toimia?
|
Senior Member
5 tuotearviota
|
24. huhtikuuta 2008 @ 21:26 |
Linkki tähän viestiin
|
Combofixi;
ComboFix 08-04-22.5 - jakke 2008-04-24 20:08:06.1 - NTFSx86
Microsoft® Windows Vista? Home Premium 6.0.6000.0.1252.1.1035.18.1448 [GMT 3:00]
Running from: C:\Users\jakke\Contacts\Desktop\ComboFix.exe
* Created a new restore point
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-03-24 to 2008-04-24 )))))))))))))))))
.
2008-04-24 07:10 . 2008-04-24 07:10 0 --a------ C:\Windows\System32\config.nt
2008-04-23 23:06 . 2008-04-24 19:06 419,814 --a------ C:\Windows\System32\PerfStringBackup.INI
2008-04-23 23:06 . 2006-11-02 12:20 287,440 --a------ C:\Windows\System32\perfi009.dat
2008-04-23 23:06 . 2006-11-02 12:20 30,674 --a------ C:\Windows\System32\perfd009.dat
2008-04-23 23:04 . 2008-04-24 19:06 53,522 --a------ C:\Windows\System32\perfh00B.dat
2008-04-23 23:04 . 2008-04-24 19:06 12,420 --a------ C:\Windows\System32\perfc00B.dat
2008-04-23 22:54 . 2008-04-23 22:54 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-04-23 22:52 . 2008-04-23 22:52 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2008-04-23 22:08 . 2008-04-24 19:00 65,536 --------- C:\Windows\System32\Ikeext.etl
2008-04-21 12:13 . 2008-04-21 12:13 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-04-20 21:26 . 2008-04-20 21:27 235,599,352 --a------ C:\BackupRegistry(20080420).reg
2008-04-20 21:16 . 2008-04-20 21:16 <KANSIO> d-------- C:\Program Files\Webteh
2008-04-20 12:43 . 2008-04-21 15:30 54,156 --ah----- C:\Windows\QTFont.qfn
2008-04-20 12:43 . 2008-04-20 12:43 1,409 --a------ C:\Windows\QTFont.for
2008-04-19 14:40 . 2008-04-19 14:40 <KANSIO> d-------- C:\Users\All Users\Apple Computer
2008-04-19 14:40 . 2008-04-19 14:40 <KANSIO> d-------- C:\ProgramData\Apple Computer
2008-04-19 14:40 . 2008-04-19 14:41 <KANSIO> d-------- C:\Program Files\QuickTime
2008-04-13 13:42 . 2008-02-15 02:19 944,184 --a------ C:\Windows\System32\winload.exe
2008-04-13 13:42 . 2008-02-19 08:10 620,088 --a------ C:\Windows\System32\ci.dll
2008-04-13 13:42 . 2008-02-29 09:39 371,712 --a------ C:\Windows\System32\srcore.dll
2008-04-13 13:42 . 2008-02-29 09:38 313,856 --a------ C:\Windows\System32\rstrui.exe
2008-04-13 13:42 . 2008-02-29 09:39 40,960 --a------ C:\Windows\System32\srclient.dll
2008-04-13 13:42 . 2008-02-29 09:51 19,000 --a------ C:\Windows\System32\kd1394.dll
2008-04-13 13:42 . 2008-02-29 09:38 16,384 --a------ C:\Windows\System32\srdelayed.exe
2008-04-13 13:42 . 2008-02-29 09:34 7,168 --a------ C:\Windows\System32\f3ahvoas.dll
2008-04-13 13:42 . 2008-02-29 09:35 6,656 --a------ C:\Windows\System32\kbd106n.dll
2008-04-13 13:40 . 2008-02-29 07:16 2,027,008 --a------ C:\Windows\System32\win32k.sys
2008-04-13 13:40 . 2008-02-21 07:43 296,448 --a------ C:\Windows\System32\gdi32.dll
2008-04-13 13:39 . 2007-12-16 14:42 83,968 --a------ C:\Windows\System32\dnsrslvr.dll
2008-04-13 13:39 . 2007-12-16 14:41 24,576 --a------ C:\Windows\System32\dnscacheugc.exe
2008-04-05 11:28 . 2008-04-05 11:28 <KANSIO> d-------- C:\Users\All Users\LightScribe
2008-04-05 11:28 . 2008-04-05 11:28 <KANSIO> d-------- C:\ProgramData\LightScribe
2008-03-29 14:53 . 2008-03-29 14:53 <KANSIO> d-------- C:\Sierra
2008-03-29 04:02 . 2008-03-29 04:02 <KANSIO> d-------- C:\Program Files\MSXML 4.0
2008-03-25 19:36 . 2008-04-20 12:55 69 --a------ C:\Windows\NeroDigital.ini
2008-03-24 20:25 . 2008-03-24 20:25 <KANSIO> d-------- C:\Users\jakke\AppData\Roaming\Nero
2008-03-24 20:22 . 2008-03-24 20:22 <KANSIO> d-------- C:\Users\All Users\Nero
2008-03-24 20:22 . 2008-03-24 20:22 <KANSIO> d-------- C:\ProgramData\Nero
2008-03-24 20:22 . 2008-03-24 20:24 <KANSIO> d-------- C:\Program Files\Common Files\Nero
2008-03-24 09:27 . 2008-03-24 09:27 <KANSIO> d-------- C:\Program Files\Valve
2008-03-24 01:19 . 1998-10-02 20:00 327,168 --a------ C:\Windows\IsUninst.exe
2008-03-24 01:00 . 2004-01-27 17:18 640,512 --a------ C:\Windows\system\WONAuth.dll
2008-03-24 00:51 . 2008-03-24 00:51 <KANSIO> d-------- C:\Program Files\MagicDisc
2008-03-24 00:51 . 2008-02-18 18:29 96,256 --a------ C:\Windows\System32\drivers\mcdbus.sys
2008-03-24 00:48 . 2008-03-24 00:48 <KANSIO> d-------- C:\Program Files\MagicISO
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-23 20:06 174 --sha-w C:\Program Files\desktop.ini
2008-04-23 19:57 --------- d-----w C:\Program Files\Windows Sidebar
2008-04-23 19:57 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-04-23 19:57 --------- d-----w C:\Program Files\Windows Mail
2008-04-23 19:57 --------- d-----w C:\Program Files\Windows Journal
2008-04-23 19:57 --------- d-----w C:\Program Files\Windows Defender
2008-04-23 19:57 --------- d-----w C:\Program Files\Windows Collaboration
2008-04-23 19:57 --------- d-----w C:\Program Files\Windows Calendar
2008-04-23 19:02 --------- d-----w C:\ProgramData\Microsoft Help
2008-04-20 18:31 --------- d-----w C:\Users\jakke\AppData\Roaming\BSplayer
2008-04-20 18:09 --------- d-----w C:\Users\jakke\AppData\Roaming\uTorrent
2008-04-09 18:53 --------- d-----w C:\Program Files\DC++
2008-04-09 18:15 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-03-29 17:32 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
2008-03-28 22:52 --------- d-----w C:\Program Files\Java
2008-03-24 17:22 --------- d-----w C:\Program Files\Nero
2008-03-23 19:14 --------- d-----w C:\Users\jakke\AppData\Roaming\BSplayer Pro
2008-03-23 15:59 --------- d-----w C:\Program Files\Alcohol Soft
2008-03-23 15:54 --------- d-----w C:\Program Files\WinISO
2008-03-23 15:41 --------- d-----w C:\Program Files\DAEMON Tools Lite
2008-03-23 15:39 717,296 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-03-23 15:38 --------- d-----w C:\Users\jakke\AppData\Roaming\DAEMON Tools
2008-03-15 12:42 319,456 ----a-w C:\Windows\DIFxAPI.dll
2008-03-15 12:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-15 12:41 --------- d-----w C:\Program Files\Realtek
2008-03-12 18:59 --------- d-----w C:\Program Files\Common Files\Borland
2008-03-02 15:09 --------- d-----w C:\ProgramData\Bluetooth
2008-03-02 15:07 --------- d-----w C:\Program Files\IVT Corporation
2008-03-01 05:33 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-21 04:43 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-02-21 04:43 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-21 04:43 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-21 04:43 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-15 18:47 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-02-15 18:42 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-02-15 18:42 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-02-15 18:41 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-02-15 18:41 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-02-15 18:41 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-02-15 18:40 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-15 18:40 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-15 18:40 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-15 18:40 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-02-15 18:40 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-15 18:40 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-15 18:40 1,686,528 ----a-w C:\Windows\System32\gameux.dll
2008-02-15 18:38 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
2008-02-03 04:04 86,016 ----a-w C:\Windows\System32\icfupgd.dll
2008-02-03 04:04 61,952 ----a-w C:\Windows\System32\cmifw.dll
2008-02-03 04:04 396,800 ----a-w C:\Windows\System32\MPSSVC.dll
2008-02-03 04:04 392,192 ----a-w C:\Windows\System32\FirewallAPI.dll
2008-02-03 04:04 374,456 ----a-w C:\Windows\System32\mcupdate_GenuineIntel.dll
2008-02-03 04:04 178,688 ----a-w C:\Windows\System32\iphlpsvc.dll
2008-02-03 04:04 16,896 ----a-w C:\Windows\System32\wfapigp.dll
2008-02-03 04:03 57,856 ----a-w C:\Windows\System32\SLUINotify.dll
2008-02-03 04:03 566,784 ----a-w C:\Windows\System32\SLCommDlg.dll
2008-02-03 04:03 39,936 ----a-w C:\Windows\System32\slcinst.dll
2008-02-03 04:03 351,232 ----a-w C:\Windows\System32\SLUI.exe
2008-02-03 04:03 33,280 ----a-w C:\Windows\System32\slwmi.dll
2008-02-03 04:03 268,288 ----a-w C:\Windows\System32\mcbuilder.exe
2008-02-03 04:03 223,232 ----a-w C:\Windows\System32\SLC.dll
2008-02-03 04:03 2,605,568 ----a-w C:\Windows\System32\SLsvc.exe
2008-02-03 04:03 186,368 ----a-w C:\Windows\System32\SLLUA.exe
2008-02-03 03:59 87,040 ----a-w C:\Windows\System32\msoert2.dll
2008-02-03 03:59 5,120 ----a-w C:\Windows\System32\wmi.dll
2008-02-03 03:59 49,664 ----a-w C:\Windows\System32\csrsrv.dll
2008-02-03 03:59 39,424 ----a-w C:\Windows\System32\ACCTRES.dll
2008-02-03 03:59 376,320 ----a-w C:\Windows\System32\winsrv.dll
2008-02-03 03:59 36,864 ----a-w C:\Windows\System32\wmdmps.dll
2008-02-03 03:59 311,296 ----a-w C:\Windows\System32\mswmdm.dll
2008-02-03 03:59 31,744 ----a-w C:\Windows\System32\wmdmlog.dll
2008-02-03 03:59 205,824 ----a-w C:\Windows\System32\msoeacct.dll
2008-02-03 03:59 152,576 ----a-w C:\Windows\System32\imagehlp.dll
2008-02-03 03:58 633,856 ----a-w C:\Windows\System32\user32.dll
2008-02-02 13:55 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-02-02 13:55 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-02-02 13:55 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-02-02 13:55 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-02-02 13:55 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-02-02 13:55 297,984 ----a-w C:\Windows\System32\wlansec.dll
2008-02-02 13:55 290,816 ----a-w C:\Windows\System32\wlanmsm.dll
2008-02-02 13:55 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2008-02-02 13:55 2,923,520 ----a-w C:\Windows\explorer.exe
2008-02-02 13:55 14,827 ----a-w C:\Windows\System32\gatherWirelessInfo.vbs
2008-02-02 13:52 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-02-02 13:52 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-02-02 13:52 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-02-02 13:51 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-02-02 13:48 8,704 ----a-w C:\Windows\System32\hcrstco.dll
2008-02-02 13:48 8,704 ----a-w C:\Windows\System32\hccoin.dll
2008-02-02 13:48 2,048 ----a-w C:\Windows\System32\msxml3r.dll
2008-02-02 13:48 1,191,936 ----a-w C:\Windows\System32\msxml3.dll
2008-02-02 13:47 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-02-02 13:46 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2008-02-02 13:46 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2008-02-02 13:46 2,048 ----a-w C:\Windows\System32\asferror.dll
2008-02-02 13:45 2,048 ----a-w C:\Windows\System32\msxml6r.dll
2008-02-02 13:45 1,335,296 ----a-w C:\Windows\System32\msxml6.dll
2008-02-02 13:44 61,440 ----a-w C:\Windows\System32\ntprint.exe
2008-02-02 13:44 269,824 ----a-w C:\Windows\System32\schannel.dll
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-09-20 16:35 202024]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-02-02 16:42 1232896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 20:37 79224]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 10:51 1836328]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 22:00 815104]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-23 16:51 4435968 C:\Windows\RtHDVCpl.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe
"ehTray.exe"=C:\Windows\ehome\ehTray.exe
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
"MSMSGS"="C:\Program Files\Messenger\Msmsgs.exe" /background
"Acer Tour Reminder"=C:\Acer\AcerTour\Reminder.exe
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe -hide
"RtHDVCpl"=RtHDVCpl.exe
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
"Adobe Reader Speed Launcher"="c:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"eDataSecurity Loader"=C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
"LManager"=C:\PROGRA~1\LAUNCH~1\LManager.exe
"WarReg_PopUp"=C:\Acer\WR_PopUp\WarReg_PopUp.exe
"Skytel"=Skytel.exe
"eRecoveryService"=
"Acer Tour Reminder"=C:\Acer\AcerTour\Reminder.exe
"NeroFilterCheck"=C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{71D75F7D-C7F3-48F3-8861-BD8D1B381E6C}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{3BDD7AFF-B453-47C4-9619-C0406DF55D9C}"= C:\Program Files\CyberLink\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD
"{32365688-6BE6-4130-9C75-426F5495C845}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{046ECC35-8EC0-4A76-888C-1971EA607C79}"= UDP:C:\Program Files\FirstClass\fcc32.exe:FirstClass
"{43E9FCBD-35EC-42B0-ADDF-85BF1391F9AC}"= TCP:C:\Program Files\FirstClass\fcc32.exe:FirstClass
"{11D1F375-2219-420B-9633-656FFD7406A0}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{415478EB-FD4A-460E-BC05-43D63708E656}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"TCP Query User{F20E8134-A0AF-45B7-955A-BC003FE20C1B}C:\\program files\\dc++\\dcplusplus.exe"= UDP:C:\program files\dc++\dcplusplus.exe:DC++
"UDP Query User{0E39683A-8CDE-4BDC-8E55-BC0FC04D88A2}C:\\program files\\dc++\\dcplusplus.exe"= TCP:C:\program files\dc++\dcplusplus.exe:DC++
"TCP Query User{70BDE4E8-55AD-4B5E-BB2A-2678DFC983D5}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{0DF9319C-24DD-4ECF-B602-675DC3CBFEA6}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"{EF1B383C-DEB9-4C09-A50B-E6D915745133}"= UDP:C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:BlueSoleil
"{01A3F828-65E8-4FA6-81EE-08CC6537804E}"= TCP:C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:BlueSoleil
"{9DF3E3F5-28CB-42E1-92D7-9AAFB179CDA4}"= UDP:C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:BlueSoleil
"{4CE73463-7F66-497E-BD80-36FD3EBD4C19}"= TCP:C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:BlueSoleil
"TCP Query User{5ED251A3-4C49-49CA-A2CA-E6698B751D88}C:\\program files\\messenger\\msmsgs.exe"= UDP:C:\Program Files\Messenger\Msmsgs.exe:Windows Messenger
"UDP Query User{AB7000F7-AD84-4083-85E2-9B3B8B3EAD23}C:\\program files\\messenger\\msmsgs.exe"= TCP:C:\Program Files\Messenger\Msmsgs.exe:Windows Messenger
"TCP Query User{291D40FF-3D1D-4C41-98D1-994D0BC22B94}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{3ECFA540-F1AB-4808-979F-7C1ACEAD1792}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"{E5822E07-0EED-4321-9ADE-F10DEA4B244B}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{A66C1209-53E2-4953-96EF-17FD528B83B8}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"TCP Query User{FE7BE31C-5C26-405F-97FC-B527F5D01B38}C:\\program files\\messenger\\msmsgs.exe"= UDP:C:\program files\messenger\msmsgs.exe:Windows Messenger
"UDP Query User{0B46B2A3-4903-4060-898D-543DFAA3B5AC}C:\\program files\\messenger\\msmsgs.exe"= TCP:C:\program files\messenger\msmsgs.exe:Windows Messenger
"{8277A90E-AAFD-4E07-9540-7BC2570CE94A}"= UDP:4000:dc
"TCP Query User{AAC09036-21C7-44F3-BD53-0112D1533E6D}C:\\program files\\dc++\\dcplusplus.exe"= UDP:C:\program files\dc++\dcplusplus.exe:DC++
"UDP Query User{0AD5F335-A64D-4925-9460-28069E2F261E}C:\\program files\\dc++\\dcplusplus.exe"= TCP:C:\program files\dc++\dcplusplus.exe:DC++
"{08DBB9A0-D8C1-49C2-B817-AB343EC11652}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{61D5B778-5A7E-474E-93F5-9C5B4005E432}C:\\program files\\valve\\half-life\\hl.exe"= UDP:C:\program files\valve\half-life\hl.exe:Half-Life Launcher
"UDP Query User{B5506BFC-124D-4C75-8846-813F2279BE72}C:\\program files\\valve\\half-life\\hl.exe"= TCP:C:\program files\valve\half-life\hl.exe:Half-Life Launcher
"TCP Query User{2CEB3971-794A-4605-9834-3D452010F217}D:\\pelit\\empire earth\\empire earth.exe"= UDP:D:\pelit\empire earth\empire earth.exe:Empire Earth
"UDP Query User{302B712E-A298-45E5-A2C2-67885A3A59EB}D:\\pelit\\empire earth\\empire earth.exe"= TCP:D:\pelit\empire earth\empire earth.exe:Empire Earth
"TCP Query User{B90AE7F7-A528-47A0-AF9C-7927AC087A81}C:\\program files\\valve\\half-life\\hl.exe"= UDP:C:\program files\valve\half-life\hl.exe:Half-Life Launcher
"UDP Query User{A336AAE2-9E82-452D-B5AC-DC47E5B174BA}C:\\program files\\valve\\half-life\\hl.exe"= TCP:C:\program files\valve\half-life\hl.exe:Half-Life Launcher
"{55844D8F-9424-406B-A5B3-AF0DFD3D944D}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R0 O2MDRDR;O2MDRDR;C:\Windows\system32\DRIVERS\o2media.sys [2007-04-03 20:04]
R0 O2SDRDR;O2SDRDR;C:\Windows\system32\DRIVERS\o2sd.sys [2007-04-03 02:11]
R0 PSDFilter;PSDFilter;C:\Windows\system32\DRIVERS\psdfilter.sys [2007-04-12 18:43]
R0 PSDNServ;PSDNSERVER;C:\Windows\system32\drivers\PSDNServ.sys [2007-04-12 18:43]
R0 psdvdisk;psdvdisk;C:\Windows\system32\drivers\psdvdisk.sys [2007-04-12 18:43]
R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 20:31]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2006-11-02 17:51]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-03-29 20:35]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-03-29 20:32]
R2 BcmSqlStartupSvc;Business Contact Managerin SQL Server -käynnistyspalvelu;"C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe" [2008-01-16 12:16]
R2 eDataSecurity Service;eDSService.exe;"C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe" [2007-04-12 18:43]
R2 eNet Service;eNet Service;C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-04-17 20:36]
R2 eSettingsService;eSettings Service;C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-06-28 19:50]
R2 MobilityService;MobilityService;C:\Acer\Mobility Center\MobilityService.exe [2006-11-24 13:57]
R2 SQLWriter;SQL Server VSS Writer;"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 06:29]
R2 WMIService;ePower Service;C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-06-13 12:23]
R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-08-05 19:39]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-07-28 10:36]
R3 Cam5607;Acer Crystal Eye webcam;C:\Windows\system32\Drivers\BisonC07.sys [2007-06-12 03:59]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 10:51]
S3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2006-11-02 10:30]
S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver;C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-12-19 23:18]
S3 flash;flash;C:\Windows\system32\drivers\flash.sys [2005-11-17 16:36]
S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);"C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSMLBIZ []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{660eb9db-f8ef-11dc-85e0-000000000000}]
\shell\AutoRun\command - F:\AUTORUN.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76996462-f91b-11dc-a859-000000000000}]
\shell\AutoRun\command - F:\AUTORUN.EXE
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-24 20:10:41
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-24 20:12:08
ComboFix-quarantined-files.txt 2008-04-24 17:11:51
Pre-Run: 48,710,295,552 tavua vapaana
Post-Run: 48,469,082,112 tavua vapaana
292 --- E O F --- 2008-04-20 10:27:46
Malwarebytes loki;
Malwarebytes' Anti-Malware 1.11
Tietokantaversio: 677
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
Tarkistetut kohteet: 146467
Kulunut aika: 46 minute(s), 11 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 1
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
D:\Lataukset\Yamicsoft.Vista.Manager.v1.4.Incl.Keymaker-CORE\CORE10k.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
AMD FX-8320, AM3+, 3.5GHz, 8-core | Kingston HyperX 2x4GB, DDR3 1600MHz | Samsung F3 500GB | Asus M5A97 EVO R2.0, AM3+, AMD 970, DDR3, ATX | AMD Radeon HD 7750 | XFX 450W | Windows 7 Ultimate 64
Acer TM5520 Vista
Acer 7736ZG Windows 7
Samsung Note 4G
XBOX360 Elite 120Gb
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
25. huhtikuuta 2008 @ 08:52 |
Linkki tähän viestiin
|
|
ok...
Voiko tietsikka koskaan toimia?
|
|
